16th episode of The Silver Bullet Security Podcast.
Interview with Greg Hoglund

At the beginning of my career I had I high hope, now I become a
non-believer

Breaking things is a lot of fun.

Code understanding procedure - static analysis.

You don't need to use static analysis to convert all the binary... but
there is a dynamic analysis to achieve similar end goal.

The most expensive part of reverse engineering is to do static analysis.

If you already know what you are doing, you can take a shorter path -
clearly the attacker has an advantage.

Disclosure is good, if you keep things secret it does not mean that
no-body is using it. Zero day exploit is the most dangerous...

Corp has 70% of their IP stored digitally.

A lot of people out of US are willing to work with less money to develop
cutting edge rootkit tech...

Absolutely easy to cut a cert to install rootkit in Vista...

If you using kernel level tech to help enterprise is fine... the
important thing is to keep the control.

EULA: "hi I'm a virus, click OK so I can spread to everybody..."
Does this make it malware?

there is HUUUGE market of online virtual property.

example: world of warcraft, there are many shops (ppl get paid ~4 dollar/hour, it's a lot of money for ppl who live in Asia).

There is a delta between virtual money and real money.

Ppl get paid 4 $/h running probably 10 different bots at the same time, generating 300-400 gold piece / hours, using level 60 or above account... the money income for any give shop can easily exceed 30k $/ month.... that's a whole sale rate...

whole sale rate: gold piece for 4 cent
retail sale rate: gold piece for 10 cent

The cheating is HUGE

world of warcraft try to band these shop (they can ban 1 thousand account), in one ban they loose the whole business...

these shops are entirely dependence upon the stealth of their bot, because the can loose all in single time...

actually even when there is these mass ban, they are people who are gaining, because the price of gold piece go up...

creating bot that make character go around and harvest gold is not the exploit.. it's just breaking the EULA, but exploiting the database syncronization between servers, causing a guy doubling the gold is the exploit...

The value of 1 duplication exploit is probably valued over 1000 dollar if is used properly... (dup bug)

the duplication is exponential.... you'll have probably hard time just to laundering the money.

there is guy who found a dup dub, made company like IDG (who said they dont sporsor loundering, they are lying, their business is based on this money loundering), creating houndreds of account for him.... he made millions... probably he live in Canada.

time 24:03

Labels: cissp, security