{"id":31469,"date":"2016-01-15T19:44:51","date_gmt":"2016-01-15T14:14:51","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=31469"},"modified":"2016-12-19T15:37:39","modified_gmt":"2016-12-19T10:07:39","slug":"experience-at-sans-delhi-community-night-2016","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/experience-at-sans-delhi-community-night-2016\/","title":{"rendered":"Experience at SANS Delhi Community Night, 2016"},"content":{"rendered":"<p>TO THE NEW has been <a href=\"http:\/\/gr8conf.in\/\" target=\"_blank\">organizing conferences<\/a> and actively participating in various conferences as well. I was invited to attend a presentation at <strong>SANS Community Night in Delhi, India<\/strong> on 14th Jan 2016. The topic of the talk was <strong>\u201cDIY vulnerability discovery with DLL Side Loading\u201c<\/strong>, and it&#8217;s use as stealthy persistence technique for malware propagation. The critical impact of these vulnerabilities was explained and the presenter emphasized on the fact that most vulnerable DLLs go unnoticed.<\/p>\n<p>The venue was good and easy to locate. The event started with registration of the attendees and the talk started at 7:30 PM in the evening. The talk was presented in a well planned manner and the concepts were explained from the basics. The concepts were also very well demonstrated by a live demo by the presenter Jake Williams. The details of the event and training can be found at the official website of <a href=\"https:\/\/www.sans.org\/event\/cyber-defence-delhi-2016\" target=\"_blank\">SANS Cyber Defence Delhi 2016<\/a>.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-31501\" src=\"\/blog\/wp-ttn-blog\/uploads\/2016\/01\/f727a733-e5c8-4b92-b545-0c7bbbfd6e01.jpg\" alt=\"f727a733-e5c8-4b92-b545-0c7bbbfd6e01\" width=\"1600\" height=\"1200\" \/><\/p>\n<p>We at <a title=\"TO THE NEW\" href=\"http:\/\/www.tothenew.com\/\">TO THE NEW<\/a>\u00a0have a habit of attending conferences. We got to meet some prominent personalities in Information Security domain and it is good to share our experiences in the application security realm.<\/p>\n<p>It was a great experience attending the conference, some of the key take away were:<\/p>\n<ul>\n<li>Import tables &amp; abusing DLL search paths.<\/li>\n<li>Icacls.exe utility.<\/li>\n<li>Safe DLL Search Mode and loading of DLLs from working directory.<\/li>\n<li>Common threats and KnownDLLs.<\/li>\n<li>DLL Search Path (unsafe) and significance of path variables.<\/li>\n<li>Default DLL Search Path (SafeSearch).<\/li>\n<li>Ghost DLL injection and gflags.<\/li>\n<li>Tools to check DLL injection such as Procmon and SXSTrace.<\/li>\n<li>Practical defenses.<\/li>\n<\/ul>\n<p>Below are the details of the talk I attended. The presentation is present on mediafire and the same can be downloaded from the link below.<\/p>\n<p><strong>Talk:<\/strong> DIY vulnerability discovery with DLL Side Loading<br \/>\n<strong>Speaker:<\/strong> Jake Williams<br \/>\n<strong>Presentation:<\/strong>\u00a0<a href=\"http:\/\/www.mediafire.com\/view\/y52g9460w6iy38z\/sideloading.pdf\" target=\"_blank\">DLL Hijacking Like a Boss!<\/a><\/p>\n<p>We will keep sharing\u00a0our learning and experience in future Infosec events as well.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>TO THE NEW has been organizing conferences and actively participating in various conferences as well. I was invited to attend a presentation at SANS Community Night in Delhi, India on 14th Jan 2016. The topic of the talk was \u201cDIY vulnerability discovery with DLL Side Loading\u201c, and it&#8217;s use as stealthy persistence technique for malware [&hellip;]<\/p>\n","protected":false},"author":166,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":5},"categories":[2026,1],"tags":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/31469"}],"collection":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/users\/166"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/comments?post=31469"}],"version-history":[{"count":0,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/posts\/31469\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/media?parent=31469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/categories?post=31469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tothenew.com\/blog\/wp-json\/wp\/v2\/tags?post=31469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}