As Recon 2011 in Montreal (July 8-10) is fast approaching we wanted to let ZDI researchers know there is a training being offered by two of the ZDI team members: Bug Hunting and Analysis 0x65.
Some of the case studies offered on day 2 of the training will be submissions that were patched and disclosed through the ZDI. Many researchers have been interested in our analysis of their submissions. Recon is a great place to discuss these cases. If you will be attending and want to request a case study of one of your *patched/disclosed* submissions, send a request via email. We probably have time to get one or two more done before the training, so get your request over ASAP if you're interested.
As always things are better with free stuff, so:
Any new or existing ZDI researchers who wish to attend this class will recieve a 5,000 pt reward bonus credited to their researcher account.
Bug Hunting and Analysis 0x65
This 3 day course is structured to impart upon the students the skills necessary to effectively utilize debuggers, disassemblers, and other tools to discover vulnerabilities in binary code. The curriculum will begin by introducing students to the tools and generic techniques that will enable them to actively participate in reversing applications during the rest of the course.
After gaining a basic understanding of the tools involved, the instructors will spend day 2 walking students through case studies from patched vulnerabilities. That is, we will be choosing specific vulnerabilities and walking the students through the methodology used to verify them (debugging) and how the discoverer likely found them (fuzzing, static reverse engineering, dynamic instrumentation, etc). As each flaw is dissected, we will focus on how the student's arsenal of techniques can be extended to more easily debug applications and eventually discover similar bugs going forward.
On day 3 we will begin focusing on automating our tools to build a checklist that we can use to more efficiently reverse engineer a binary code base. We will walk through a complete audit of a default installation (latest version) of a popular enterprise server application culminating in the discovery of a remote pre-authentication 0day vulnerability. Students will be required to sign a minimal NDA in order to participate in this portion of the training.
Instructors: Aaron Portnoy and Zef Cekaj
Dates: 5-7 July 2010
Availability: 18 Seats
Dates: 11-13 July 2010
Availability: 18 Seats
Price 2600$ CAD before May 15, 3200$ CAD after.
