Attacking the Source: Surreptitious Software Features (and How to Become Extremely Paranoid)

2300, Friedman
Speaker(s): Joshua
Forget about network perimeters - an organization's real attack surface is made up of which codebases can be interacted with or altered. This talk explores the past history and the methods available for maliciously altering codebases and it even includes how an attacker can bring their code into your organization without even touching your perimeter. Topics covered include everything from conceptualizing an attack path to the execution of it; including obtaining relevant target information, exploiting the human element, writing plausibly deniable vulnerable source code, and backdooring binaries.

CAPTCHAs - Building and Breaking

2300, Noether
Speaker(s): dr_dave, r3dfish
CAPTCHAs are the most common form of web activity security and they play an important role in regulating online activity. CAPTCHAs keep bots and "blackhats" from abusing online resources by proving a user's humanity via solving a challenge that consists of a hard AI problem. CAPTCHA development is a constantly evolving arms race with new styles and designs being created by site administrators and broken by attackers every day. In order to keep the world wide web usable, site administrators must constantly work on developing new methods and improving CAPTCHAs to prevent automated abuse. This talk will cover the basics of what CAPTCHAs are, what type of security they provide, the major types of CAPTCHAs, and how to attack them. The speakers will also discuss criteria used when designing their CAPTCHA framework and cover some academic literature that is relevant to the field. They will look at popular tools and services currently used to attack CAPTCHAs and provide some insight into the current state of bot identification. A fresh new CAPTCHA design will be presented that uses human emotion recognition as the "hard AI" challenge. Speakers will demonstrate how they have achieved their desired usability, scalability, and robustness levels via a real world implementation. An overview of the tools and tool chain used (MS Emotion API, GIMP, Google APIs, Python, Django) to create the CAPTCHA challenges will be detailed. The session will conclude with a user study and provide an analysis of the results with a discussion about some of the limitations of the project.