Abstract: Latest investigations uncovered two interesting series of malware based targeted attacks against high-profile targets, including governmental institutions. In February 2013, a new 0-day vulnerability was found to be used in the wild to infect computers with custom malware. About one week later, we found together with Kaspersky Labs new samples, where the same 0-day vulnerability was used, but the attackers used different malicious code to be installed on the targets. Investigations on the Miniduke campaign uncovered that many of the targets that could be identified are governmental institutions in more than 20 countries. Another attack campaign was revealed in March 2013, where investigations found that the attackers abused the legitimate software TeamViewer, hence, it is called TeamSpy. These attacks are also targeted and some victims are governmental institutions. In my presentation I will give details about these two recent investigations carried out by CrySyS Lab.

Abstract: With the wide proliferation of wireless devices, securing information sent over the wireless medium becomes vital. The wireless setting, however, introduces a number of challenges and limitations that cannot be fully resolved using traditional security solutions. In this talk, I will present investigations and solutions tailored to secure wireless communication scenarios. I focus on vulnerabilities to communication interference attacks in which attackers try to prevent the reception of the correct, timely information transmitted by the sender. In particular, my talk will address the following aspects: the vulnerability of wireless radio transmissions to signal-layer attacks, schemes for enabling communication under jamming attacks without shared secrets, and secure localization techniques (in particular resistance against spoofing attacks on GPS).