Laurent Butti's guest appearances

Laurent Butti

Black Hat Briefings, Europe 2007 [Audio] Presentations from the security conference.

Black Hat Briefings, Las Vegas 2006 [Video] Presentations from the security conference

Black Hat Briefings, Las Vegas 2006 [Audio] Presentations from the security conference

Alexander Sotirov

David Maynor

Emmanuele Zambon

Andrew Cushman

Jamie Butler

Jeremiah Grossman

Brendan O'Connor

Kevin Mandia

Tom Gallagher

Chris Eng

Zane Lackey

Bruce Potter

Tod Beardsley

Pete Finnigan

Dan Kaminsky

OwlTail

Franck Veysset

Wireless stealth was somewhat expensive some years ago as we were required to use proprietary radios and so on… Thanks to increasingly flexible low-cost 802.11 chipsets we are now able to encode any MAC layer proprietary protocol over 2.4 GHz/5 GHz bands! This could mean stealth to everybody at low-cost!		This presentation will focus on two techniques to achieve a good level of stealth:		    * a userland technique exploiting a covert channel over valid 802.11 frames;	    * a driverland technique exploiting some 802.11 protocol tweaks. 		These techniques are somewhat weird! That’s one reason they resist the action of scanners and wireless IDS!		The tools that will be released are proof-of-concepts and may be improved both in terms of features and code cleanups!"

Wireless stealth was somewhat expensive some years ago as we were required to use proprietary radios and so on… Thanks to increasingly flexible low-cost 802.11 chipsets we are now able to encode any MAC layer proprietary protocol over 2.4 GHz/5 GHz bands! This could mean stealth to everybody at low-cost! 	 	This presentation will focus on two techniques to achieve a good level of stealth: 	 	 * a userland technique exploiting a covert channel over valid 802.11 frames; 	 * a driverland technique exploiting some 802.11 protocol tweaks. 	 	These techniques are somewhat weird! That’s one reason they resist the action of scanners and wireless IDS! 	 	The tools that will be released are proof-of-concepts and may be improved both in terms of features and code cleanups!"

Franck Veysset and Laurent Butti: Wi-Fi Advanced Stealth

"Wireless stealth was somewhat expensive some years ago as we were required to use proprietary radios and so on… Thanks to increasingly flexible low-cost 802.11 chipsets we are now able to encode any MAC layer proprietary protocol over 2.4 GHz/5 GHz bands! This could mean stealth to everybody at low-cost!		This presentation will focus on two techniques to achieve a good level of stealth:		    * a userland technique exploiting a covert channel over valid 802.11 frames;	    * a driverland technique exploiting some 802.11 protocol tweaks. 		These techniques are somewhat weird! That’s one reason they resist the action of scanners and wireless IDS!		The tools that will be released are proof-of-concepts and may be improved both in terms of features and code cleanups!"

"Wireless stealth was somewhat expensive some years ago as we were required to use proprietary radios and so on… Thanks to increasingly flexible low-cost 802.11 chipsets we are now able to encode any MAC layer proprietary protocol over 2.4 GHz/5 GHz bands! This could mean stealth to everybody at low-cost! 	 	This presentation will focus on two techniques to achieve a good level of stealth: 	 	 * a userland technique exploiting a covert channel over valid 802.11 frames; 	 * a driverland technique exploiting some 802.11 protocol tweaks. 	 	These techniques are somewhat weird! That’s one reason they resist the action of scanners and wireless IDS! 	 	The tools that will be released are proof-of-concepts and may be improved both in terms of features and code cleanups!"

"Fuzzing is a software testing technique that consists in finding implementation bugs. Fuzzing Wi-Fi drivers is becoming more and more attractive as any exploitable security bug will enable the attacker trun arbitrary code with ring0 privileges (within victim's radicoverage). 	This presentation will describe all the processes involved in the design from scratch of a fully-featured Wi-Fi fuzzer. It will pinpoint all issues and constraints when fuzzing 802.11 stacks (scanning, bugs identification, replaying bugs, analyzing kernel crashes...). 	Then some features will be focused on, in order tunderstand which kind of implementation bugs may be discovered and which vulnerabilities we discovered thanks tthis tool (CVE-2006-6059, CVE-2006-6125). 	Finally, a real-world example will be fully explained: how we found the first (publicly known) madwifi stack-based overflow thanks tour Wi-Fi fuzzer (CVE-2006-6332)."	Laurent is a network security expert working for France Telecom RD labs, where he works on wireless security (IEEE 802.11, IEEE 802.16...), honeypots and malwares. He alsspoke at numerous security-focused conferences (EuroSec, SSTIC, FIRST, LSM, ToorCon, ShmooCon, BlackHat...).

"Fuzzing is a software testing technique that consists in finding implementation bugs. Fuzzing Wi-Fi drivers is becoming more and more attractive as any exploitable security bug will enable the attacker trun arbitrary code with ring0 privileges (within victim's radicoverage). 	This presentation will describe all the processes involved in the design from scratch of a fully-featured Wi-Fi fuzzer. It will pinpoint all issues and constraints when fuzzing 802.11 stacks (scanning, bugs identification, replaying bugs, analyzing kernel crashes...). 	Then some features will be focused on, in order tunderstand which kind of implementation bugs may be discovered and which vulnerabilities we discovered thanks tthis tool (CVE-2006-6059, CVE-2006-6125). 	Finally, a real-world example will be fully explained: how we found the first (publicly known) madwifi stack-based overflow thanks tour Wi-Fi fuzzer (CVE-2006-6332)."	 Laurent is a network security expert working for France Telecom RD labs, where he works on wireless security (IEEE 802.11, IEEE 802.16...), honeypots and malwares. He alsspoke at numerous security-focused conferences (EuroSec, SSTIC, FIRST, LSM, ToorCon, ShmooCon, BlackHat...).

Laurent Butti: Wi-Fi Advanced Fuzzing