Claudio Merloni's guest appearances

Claudio Merloni

Black Hat Briefings, Las Vegas 2006 [Video] Presentations from the security conference

Black Hat Briefings, Las Vegas 2006 [Audio] Presentations from the security conference

Charles Edge

Alex Stamos

Andrew Cushman

Jamie Butler

Jeremiah Grossman

Brendan O'Connor

Kevin Mandia

Tom Gallagher

Chris Eng

Zane Lackey

Bruce Potter

Tod Beardsley

Pete Finnigan

Dan Kaminsky

Stefan Frei

OwlTail

How could an attacker steal the phone numbers stored on your mobile, eavesdrop your conversations, see what you're typing on the keyboard, take pictures of the room you're in, and monitor everything you're doing, without ever getting in the range of your Bluetooth mobile phone?		In this talk we present a set of projects that can be combined to exploit Bluetooth devices (and users...), weaknesses building a distributed network of agents spreading via Bluetooth which can seek given targets and exploit the devices to log keystrokes, steal data, record audio data, take pictures and then send the collected data back to the attacker, either through the agents network or directly to the attacker. We show the different elements that compose the whole project, giving an estimate, through real data and mathematical models, of the effectiveness of that kind of attack. We also show what our hidden, effective and cool worm-spreading trolley looks like: say hello to the BlueBag!	;-)		Claudio Merloni, M.S. in Computer Engineering, has graduated from the Politecnico of Milano School of Engineering. Since 2004, he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. His daily work is focused mainly on security policies and management, security assessment and computer forensics.		Luca Carettoni is a Computer Engineering student at the Politecnico of Milano University. His current research and master’s degree thesis deals with automatic detection of web application security flaws. Since 2005 he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. He is the author of several research papers, advisories and articles on computer security for Italian journals. His interests revolve around three attractors: web applications security, mobile computing and digital freedom."

How could an attacker steal the phone numbers stored on your mobile, eavesdrop your conversations, see what you're typing on the keyboard, take pictures of the room you're in, and monitor everything you're doing, without ever getting in the range of your Bluetooth mobile phone? 	 	In this talk we present a set of projects that can be combined to exploit Bluetooth devices (and users...), weaknesses building a distributed network of agents spreading via Bluetooth which can seek given targets and exploit the devices to log keystrokes, steal data, record audio data, take pictures and then send the collected data back to the attacker, either through the agents network or directly to the attacker. We show the different elements that compose the whole project, giving an estimate, through real data and mathematical models, of the effectiveness of that kind of attack. We also show what our hidden, effective and cool worm-spreading trolley looks like: say hello to the BlueBag! 	;-) 	 	Claudio Merloni, M.S. in Computer Engineering, has graduated from the Politecnico of Milano School of Engineering. Since 2004, he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. His daily work is focused mainly on security policies and management, security assessment and computer forensics. 	 	Luca Carettoni is a Computer Engineering student at the Politecnico of Milano University. His current research and master’s degree thesis deals with automatic detection of web application security flaws. Since 2005 he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. He is the author of several research papers, advisories and articles on computer security for Italian journals. His interests revolve around three attractors: web applications security, mobile computing and digital freedom."

Claudio Merloni: The BlueBag: a mobile, covert Bluetooth attack and infection device

"How could an attacker steal the phone numbers stored on your mobile, eavesdrop your conversations, see what you're typing on the keyboard, take pictures of the room you're in, and monitor everything you're doing, without ever getting in the range of your Bluetooth mobile phone?		In this talk we present a set of projects that can be combined to exploit Bluetooth devices (and users...), weaknesses building a distributed network of agents spreading via Bluetooth which can seek given targets and exploit the devices to log keystrokes, steal data, record audio data, take pictures and then send the collected data back to the attacker, either through the agents network or directly to the attacker. We show the different elements that compose the whole project, giving an estimate, through real data and mathematical models, of the effectiveness of that kind of attack. We also show what our hidden, effective and cool worm-spreading trolley looks like: say hello to the BlueBag!	;-)		Claudio Merloni, M.S. in Computer Engineering, has graduated from the Politecnico of Milano School of Engineering. Since 2004, he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. His daily work is focused mainly on security policies and management, security assessment and computer forensics.		Luca Carettoni is a Computer Engineering student at the Politecnico of Milano University. His current research and master’s degree thesis deals with automatic detection of web application security flaws. Since 2005 he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. He is the author of several research papers, advisories and articles on computer security for Italian journals. His interests revolve around three attractors: web applications security, mobile computing and digital freedom."

"How could an attacker steal the phone numbers stored on your mobile, eavesdrop your conversations, see what you're typing on the keyboard, take pictures of the room you're in, and monitor everything you're doing, without ever getting in the range of your Bluetooth mobile phone? 	 	In this talk we present a set of projects that can be combined to exploit Bluetooth devices (and users...), weaknesses building a distributed network of agents spreading via Bluetooth which can seek given targets and exploit the devices to log keystrokes, steal data, record audio data, take pictures and then send the collected data back to the attacker, either through the agents network or directly to the attacker. We show the different elements that compose the whole project, giving an estimate, through real data and mathematical models, of the effectiveness of that kind of attack. We also show what our hidden, effective and cool worm-spreading trolley looks like: say hello to the BlueBag! 	;-) 	 	Claudio Merloni, M.S. in Computer Engineering, has graduated from the Politecnico of Milano School of Engineering. Since 2004, he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. His daily work is focused mainly on security policies and management, security assessment and computer forensics. 	 	Luca Carettoni is a Computer Engineering student at the Politecnico of Milano University. His current research and master’s degree thesis deals with automatic detection of web application security flaws. Since 2005 he has worked as a security consultant for Secure Network, a firm specializing in information security consulting and training, based in Milan. He is the author of several research papers, advisories and articles on computer security for Italian journals. His interests revolve around three attractors: web applications security, mobile computing and digital freedom."