第三屆 台灣駭客年會 Hacks in Taiwan HIT 2007 開場演講 by 黃耀文 Wayne

1. 第三屆台灣駭客年會
Third Hacks in Taiwan
Conference
Wayne Huang
黃耀文
wayne@armorize.com

2. 台灣駭客年會
u 一個國家的資安產業成熟度指標—
underground hacking conferences
u Hacks in Taiwan, brought to you by
Tim Hsu and chro0t
u Welcome to HITCon 2007

3. HIT 2005
u 四百年來第一會—台灣終於有
自己的駭客年會！
u "地下網管20年" -- gasgas
u "Evil netpipe" -- timhsu
u "Windows Kernel
Shellcode Exploit" --
Nanika

4. HIT 2005
u "The Evolution of Windows Spyware Techniques"
-- Birdman
u "Anti-Forensic with Anti-Reversing" -- Kuon
u sscan, newbug, unohope, alan, Charmi

5. HIT 2006
u 場地爆滿，MS 總部電話留位！
u 來自世界各地的聽眾！

6. HIT 2006
u Tony Lee, Lead Anti-Virus Researcher, Microsoft
u Sarah Blankinship, Security Program Manager,
Microsoft

7. Y.M. Chen
u Director of Consulting, McAfee
u PACSEC.JP, HITB, HACK.LU, HIT, CSI,
MISTI

8. Wayne
u WWW, PHP, RSA, …
u OWASP 台灣分會會長
u 阿碼科技執行長
u 台大電機博士班候選人

9. Fyodor
u SNORT founder
u Usenix, BlackHat, Ruxcon, HITB, Syscan,
Bellua…
u 台大電機博士班

10. Birdman

11. Wargame!
u 第一名：劉昆豪 技服中心工程師。
u 第二名：吳光哲 任職訊連科技
u 第三名：翁浩正 輔大資工系。

12. HIT 2007
u TWISC@NTUST 協辦
u HIT 2005: 120人
u HIT 2006: 160人
u HIT 2007: 270人…爆！！

13. HIT 2007
u 講師橫跨產駭學界
u 參加者來自世界各地
u 更精彩的內容，給更厲害的聽眾
u 拭目以待！

14. Source: Google Online Security Blog
http://googleonlinesecurity.blogspot.com/
Hacked websites
Malware origin

15. HIT 2008
u 台灣資安之能量，有其背後之政治與歷史意義
u 台灣資安界，其實臥虎藏龍
u 龍虎只在每年 HIT 公開出現！
u Hacks in Taiwan 是台灣所有對資安有興趣
的朋友的會
• 交流技術
• 分享經驗
• 談論趨勢

16. Wall Street 看 Security
Security index had consistently outperformed NASDAQ
Source: Cowen and Company , RSA 2007

17. Security 3.0 in Web 2.0—
What’s Next?
Date Major Security Events within Past Two Months
2007.5.11
n Google published "The Ghost in the Browser" research in Hotbots ’07 (with Usenix)
which states that more than 10% of all on Google indexed wetbsites have been
hacked and contain malware, spyware, or malicious code
2007.5.15
n OWASP published the OWASP Top 10 2007 (the first time since 2004); Cross-site
Scripting vulnerability climbed to #1
2007.5.29
n Google announced acquistion of GreenBorder (a browser-based security solution)
to jumpstart into web application security space
2007.6.1. n Google starts flagging malicious website warning users not to enter
2007.6.6.
n IBM acquired penetration testing company Watchfire to step into Web security
space
2007.6.18.
n Penetration testing company Cenzic approved U.S. patent on fault-injection
technology, starting a new wave of hot debate in Web security
2007.6.19.
n HP acquired penetration testing company SPI Dynamics to enter into web security
space, competing with IBM
2007. 6.30. n PCI includes code review for PCI compliance v1.1, mandatory in 2008
2007.7.9.
n Google acquired online email security Postini for US$625 million in cash,
aggressively entering into online enterprise security space

18. HIT 2008
u 更新更黑的內容，更恐怖的講師陣容！
u 不必出國，不必去BlackHat / DefCon！
u 明年場地預定：台大醫院國際會議廳
（徵求贊助單位）
u 感謝各界的支持，我們明年見！