This document discusses Marion Marschalek's background in software engineering and information security. It covers topics like the need for innovation in technology, challenges in the field, and characteristics of advanced persistent threats. The document encourages the reader to pursue their dreams and learn new skills despite perceived limitations. It concludes by stating Marion's three wishes if she could have any, which are focused on freedom of choice, thought, and secure systems.

1. If you had three wishes, what would they be?
xn--80aqafcrtq.cc

3. http://hqwallbase.com/28103-lego-stormtroopers-wallpaper-2560x1600
Marion Marschalek
@pinkflawd
marion@cyphort.com

4. MINDSETTLINGTHOUGHTS
THE NEED FOR INNOVATION
SO WHAT(NOW)?

5. www.ilikewallpaper.net
Did Highschool for Software Engineering
Malware Analyst in Anti-Virus Industry
Studied Information Security
Thought Malware sounds cool ...
Female Reverse Engineering Challenge
BOOM.

6. TECHNOLOGY vs.
journalism
publishing
multimedia design
philosophy
economy

7. What do YOU think you‘re good at?

8. THE INNOVATIONGAP
challenges
interesting characters
more $
more freedom
fun
less personal competition
ridiculous appreciation
hdwallpapercorner.com

9. the Aand the Pof the T

10. ADVANCED[ədˈvɑ:n(t)st]
PERSISTENT[pəˈsɪstənt]
we don‘t understand it
we detected it too late

11. 7 Sins of Today‘s Threats
http://www.dvd-ppt-slideshow.com

12. NOT BEING UNIQUE
Runtime packer trigger heuristics!
Altered compiler settings don‘t ...
Dynamic API resolving
String obfuscation

13. ONE BINARY TO RULE FOREVER
Filehash-based detection
Updating of binaries in irregular intervals
Route traffic through local proxy

14. REPETITIVE ARTIFACTS
File names
Domain names
Registry key names / value names
Infiltration methods
Persistence methods

15. ENVIRONMENTALINSENSITIVITY
Might want to refuse executing in sandboxes, emulators & analyst‘s machines
Potentially targeted systems usually homogeneous

16. SINGULAR PERSISTENCE
Remember the P?
Registry & service list monitored
One process easy to kill
MBR regularly scanned
Why not do all?

17. SEPARATION OF LAYERS
In-memory scanning identifies equal payloads
Consistent evasion tricks multiply success

18. KNOWN SPHERES
Remember the A?
Find new battle fields
Virtual machine executionKernel land codeBootkits
BIOS

19. 1.Unique binaries
2.Irregular updates
3.No repetitive artifacts
4.Environmental sensitivity
5.Multiple persistence techniques
6.Consistent evasion
7.Unknown spheres

20. The Aand the Pof the T
1
2
3
4
5
6
7
BlackEnergy
Havex
BlackPOS
EvilBunny
estimated 56 Mio. credit cards compromised

21. THREAT DETECTION 101
The binary has to be known.
The binary has to be recognized.
The behavior of the binary has to be recognized.

22. BRIGHT MINDS
http://www.deviantart.com/morelikethis/109459418

23. MAD SKILLS
http://paulingblog.wordpress.com

24. DRIVEN CHARACTERS
hdwallpapers360.com

25. So what (now)?
‘Ihave to learn this.‘
‘I'm not sure about this.‘
‘Some day Iwill.‘
‘I am not good at X.'
or plainly 'I can't.'

26. KICK ASS.

27. Look at what you can do, not at what you can not do.
have to learn!

28. THE $-THING
CONFIDENCE.
CHOICES.
FREEDOM.

29. Choose Your Dreams Carefully
http://wallpaperswide.com

30. Choose Your Dreams Carefully

31. IF I HAD THREE WISHES ...
1.Everyone would have unbiased choices.
2.We would all be free to think whatever we want.
3.We would have secure systems which would assure integrated safety and privacy.

32. Thank you!
Marion Marschalek
@pinkflawd
http://karmadecay.com/