Trustwave SpiderLabs to Unveil New Research, Lead Hands-On Demos at Upcoming Security Events

CHICAGO, IL--(Marketwire - Jul 18, 2012) - Experts from Trustwave, a leading provider of cloud-based compliance and information security solutions, will participate in fourteen sessions during Black Hat USA, DEF CON 20 and Security BSides Las Vegas -- July 25 through 29 in Las Vegas. The discussions will include topics such as: "ModSecurity as a Universal Web Protection Tool," "Shortcomings of Google's Bouncer," "Mobile Data Leakage," and a live demonstration of "Opposing Forces." These sessions will address today's most crucial cyber security challenges.

More details about some of the week's most exciting activities and a full schedule of Trustwave's involvement are below:

"ModSecurity as a Universal Cross-Platform Web Protection Tool" at Black Hat USA and DEF CON 20
Presented by Trustwave's Ryan Barnett with Microsoft on July 25, 2:15 pm (Black Hat Arsenal Demo at 3:30).
ModSecurity, the open-source software managed by Trustwave's security team, is already the most widely-used Web Application Firewall, protecting millions of websites. During this presentation, Trustwave will announce that ModSecurity has now become the first ever free cross-platform Web Application Firewall, as it will be available for Microsoft's IIS and Nginx platforms. A variety of security advancements and advantages provided by this breakthrough will be discussed, including detection of zero-day attacks on these online servers.

"Adventures in Bouncerland" at Black Hat USA
Presented by Trustwave's Nicholas J. Percoco and Sean Schulte on July 25, 5:00 pm.
To prevent malicious applications from entering its Android Market, Google introduced a security service called Bouncer. In this presentation, Percoco and Schulte will demonstrate how they discovered some key weaknesses in the system and created an app that beat Google's Bouncer. This talk will analyze the issues being faced by mobile application markets in their war against malware and offer new ideas on how to strengthen defenses.

"OPFOR 4Ever" at DEF CON 20
Presented by Trustwave's Tim Maletic and Christopher Pogue on July 29, 10:00 am.
Opposing Forces, or OPFOR, provides an exercise focused on improving detection and response through the principle of "train as you fight." Maletic and Pogue will demonstrate how they have applied OPFOR to build a continuous feedback loop between penetration testing and incident response. In OPFOR 4Ever, the defense and offense actually train each other. Attacks will be demonstrated from both a defensive and offensive point of view. Then, using the replay, they will develop the attacks to a form more suitable for real-world penetration testing. The key idea here is to better simulate what "black hat" hackers actually do in order to best understand how to defend against them.

"Mobile Snitch -- Devices Telling the World About You" at Security BSides Las Vegas
Presented by Trustwave's Luiz Eduardo Dos Santos and Rodrigo Montoro on July 26, 10:00 am.
In the past few years, we have not only seen a significant growth in use of mobile devices, but also the usage of multiple mobile devices at one time. The nature of mobile Wi-Fi device operations, combined with the lack of user awareness, could lead to someone not only knowing things about your life but even exactly who you are. This type of "unwanted sharing" can even occur within private corporate networks, as will be shown. Most importantly, this presentation will cover the proof-of-concept for "Mobile Snitch," which will automatically gather information about these devices once in the same network, with the end goal being to determine the identity of the person accompanying each device.

Trustwave's Full Schedule of Events

• "ModSecurity as a Universal Cross-Platform Web Protection Tool" at Black Hat USA
  Ryan Barnett with Microsoft on July 25, 2:15 pm (Black Hat Arsenal Demo at 3:30)
  
  
• "Adventures in Bouncerland" at Black Hat USA and DEF CON 20
  Nicholas J. Percoco and Sean Schulte on July 25, 5:00 pm and July 29^th at 12:00pm
  
  
• "Stamp Out Hash Corruption, Crack All The Things" at Black Hat USA and DEF CON 20
  Jonathan Claudius on July 26, 2:15 pm, and July 28th, 11:00 am
  
  
• "Blended Threats and Javascript: A Plan for Permanent Network Compromise" at Black Hat USA
  Joshua Brashars on July 26, 3:30 pm
  
  
• "Hookin' Ain't Easy: BeEF Injection with MITM" at Black Hat USA
  Steve Ocepek and Ryan Linn, July 26, 5:00 pm
  
  
• "Mobile Snitch -- Devices Telling the World About You" at Security BSides Las Vegas
  Luiz Eduardo Dos Santos and Rodrigo Montoro on July 26, 10:00 am
  
  
• "Router of Darkness, Techniques for Embedded System Hacking" at Security BSides Las Vegas
  David Bryan on July 26, 5:00 pm
  
  
• "The Patsy Proxy: Getting Others to do Your Dirty Work" at DEF CON 20 Skytalks
  Daniel Crowley on July 28, 10:00 am
  
  
• "Exploit Archaeology: Raiders of the Lost Payphones" at DEF CON 20
  Joshua Brashars on July 28, 11:00 am
  
  
• "Builders Vs. Breakers" at DEF CON 20 Skytalks
  Jonathan Claudius on July 28, 3:00 pm
  
  
• "OPFOR 4Ever" at DEF CON 20
  Tim Maletic and Christopher Pogue on July 29, 10:00 am
  
  

About Trustwave
Trustwave is a leading provider of compliance, Web, application, network and data security solutions delivered through the cloud, managed security services, software and appliances. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its TrustKeeper® portal and other proprietary security solutions. Trustwave has helped hundreds of thousands of organizations -- ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers -- manage compliance and secure their network infrastructures, data communications and critical information assets. Trustwave is headquartered in Chicago with offices worldwide. For more information, visit https://www.trustwave.com.

Follow Trustwave on Twitter at www.twitter.com/Trustwave and on Facebook at www.facebook.com/Trustwave.