{"id":1449,"date":"2014-10-01T16:37:17","date_gmt":"2014-10-01T14:37:17","guid":{"rendered":"https:\/\/yt.christiaan008.com\/?post_type=project&p=1449"},"modified":"2015-06-08T09:43:59","modified_gmt":"2015-06-08T08:43:59","slug":"defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network","status":"publish","type":"project","link":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network","title":{"rendered":"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network"},"content":{"rendered":"

[et_pb_section fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#ffffff” inner_shadow=”off” parallax=”off” parallax_method=”off”][et_pb_fullwidth_slider admin_label=”Fullwidth Slider” show_arrows=”on” show_pagination=”on” auto=”off” parallax=”on” parallax_method=”off” module_id=”newtab”][et_pb_slide heading=”DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network” background_image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/defcon-20-Dan-Tentler_dark.jpeg” background_color=”#ffffff” alignment=”center” background_layout=”dark” video_url=”https:\/\/www.youtube.com\/watch?v=fRljfc4k0Ew” button_text=”Watch this video on YouTube” button_link=”https:\/\/www.youtube.com\/watch?v=fRljfc4k0Ew”]<\/p>\n

Speakers: Svetlana Gaivoronski | Dennis Gamayunov<\/p>\n

One of the most effective techniques used in CTF is the usage of various exploits, written with the help of well-known tools or even manually during the game.<\/p>\n

Experience in CTF participation shows that the mechanism for detecting such exploits is able to significantly increase the defense level of the team.<\/p>\n

In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.<\/p>\n

[\/et_pb_slide][\/et_pb_fullwidth_slider][\/et_pb_section][et_pb_section][et_pb_row][et_pb_column type=”1_4″][et_pb_number_counter admin_label=”Number Counter” title=”Views” number=”1025″ percent_sign=”off” counter_color=”#2EA3F2″ background_layout=”light” \/][\/et_pb_column][et_pb_column type=”1_4″][et_pb_number_counter admin_label=”Number Counter” title=”Likes” number=”5″ percent_sign=”off” counter_color=”#2EA3F2″ background_layout=”light” \/][\/et_pb_column][et_pb_column type=”1_4″][et_pb_blurb admin_label=”Blurb” title=”Source: DEF CON Conference” url=”https:\/\/www.youtube.com\/user\/DEFCONConference\/about” url_new_window=”on” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt3.ggpht.com\/-RuMBpkZnHMc\/AAAAAAAAAAI\/AAAAAAAAAAA\/JUWxGsLf4zY\/s100-c-k-no\/photo.jpg” alt=”DEF CON Conference” icon_placement=”top” animation=”left” background_layout=”light” text_orientation=”center” \/][\/et_pb_column][et_pb_column type=”1_4″][et_pb_blurb admin_label=”Blurb” title=”Source: Christiaan008″ url=”https:\/\/www.youtube.com\/user\/ChRiStIaAn008″ url_new_window=”on” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt3.ggpht.com\/-p4i1EttlG4A\/AAAAAAAAAAI\/AAAAAAAAAAA\/LgFFtlbO4-Q\/s100-c-k-no\/photo.jpg” alt=”Christiaan008″ icon_placement=”top” animation=”left” background_layout=”light” text_orientation=”center” \/][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fullwidth=”off” specialty=”off” transparent_background=”off” background_color=”#f2f2f2″ inner_shadow=”off” parallax=”off” parallax_method=”off”][et_pb_row][et_pb_column type=”1_3″][et_pb_blurb admin_label=”Main category – Hacking” title=”Main category” url_new_window=”off” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/main_hacking_96_96_black.svg” icon_placement=”top” animation=”top” background_layout=”light” text_orientation=”center” url=”https:\/\/yt.christiaan008.com\/technical-videos-by-category\/#Hacking”]<\/p>\n

Hacking<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″][et_pb_blurb admin_label=”Subcategory – Exploit” title=”Subcategory” url_new_window=”off” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/sub_exploit_128_96_black.svg” icon_placement=”top” animation=”top” background_layout=”light” text_orientation=”center” url=”https:\/\/yt.christiaan008.com\/technical-videos-by-category\/#Hacking”]<\/p>\n

Exploit<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″][et_pb_blurb admin_label=”Subcategory – Hacking” title=”Subcategory” url_new_window=”off” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/sub_hacking_96_96_black.svg” icon_placement=”top” animation=”top” background_layout=”light” text_orientation=”center” url=”https:\/\/yt.christiaan008.com\/technical-videos-by-category\/#Hacking”]<\/p>\n

Hacking<\/p>\n

[\/et_pb_blurb][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fullwidth=”off” specialty=”off” transparent_background=”on” background_color=”#2ea3f2″ inner_shadow=”on” parallax=”off” parallax_method=”off”][et_pb_row][et_pb_column type=”1_2″][et_pb_blurb admin_label=”Blurb” url_new_window=”off” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/01\/video_wall_96_96_black.svg” icon_placement=”top” animation=”left” background_layout=”light” text_orientation=”center” \/][et_pb_cta admin_label=”Call To Action” button_url=”https:\/\/yt.christiaan008.com\/technical-videos\/” button_text=”Video wall” use_background_color=”off” background_color=”#f2f2f2″ background_layout=”light” text_orientation=”center” title=”Be surprised” \/][\/et_pb_column][et_pb_column type=”1_2″][et_pb_blurb admin_label=”Blurb” url_new_window=”off” use_icon=”off” icon_color=”#2EA3F2″ use_circle=”off” circle_color=”#2EA3F2″ use_circle_border=”off” circle_border_color=”#2EA3F2″ image=”https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2015\/01\/videos_by_category_96_96_black.svg” icon_placement=”top” animation=”left” background_layout=”light” text_orientation=”center” \/][et_pb_cta admin_label=”Call To Action” button_url=”https:\/\/yt.christiaan008.com\/technical-videos-by-category\/” button_text=”Videos by category” use_background_color=”off” background_color=”#2EA3F2″ background_layout=”light” text_orientation=”center” title=”I know what I’m looking for” \/][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fullwidth=”on” specialty=”off” transparent_background=”off” background_color=”#f2f2f2″ inner_shadow=”off” parallax=”off” parallax_method=”off”][et_pb_fullwidth_header admin_label=”Fullwidth Header” title=”Related videos” background_layout=”light” text_orientation=”center” \/][\/et_pb_section][et_pb_section fullwidth=”off” specialty=”off” transparent_background=”on” background_color=”#f2f2f2″ inner_shadow=”off” parallax=”off” parallax_method=”off”][et_pb_row][et_pb_column type=”4_4″][et_pb_filterable_portfolio admin_label=”Filterable Portfolio” fullwidth=”off” posts_number=”4″ include_categories=”93,27,86″ show_title=”on” show_categories=”off” show_pagination=”on” background_layout=”light” \/][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.<\/p>\n","protected":false},"author":2,"featured_media":1451,"comment_status":"open","ping_status":"open","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"project_category":[163,217,93,222,154,86,198],"project_tag":[],"class_list":["post-1449","project","type-project","status-publish","has-post-thumbnail","hentry","project_category-def-con","project_category-def-con-20","project_category-exploit","project_category-hacking-general","project_category-hacking-main","project_category-technical_grid_slider2","project_category-rss-all"],"yoast_head":"\nDEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network | Christiaan's collection<\/title>\n<meta name=\"description\" content=\"In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network | Christiaan's collection\" \/>\n<meta property=\"og:description\" content=\"In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network\" \/>\n<meta property=\"og:site_name\" content=\"Christiaan's collection\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/christiaan008\" \/>\n<meta property=\"article:modified_time\" content=\"2015-06-08T08:43:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"480\" \/>\n\t<meta property=\"og:image:height\" content=\"360\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@christiaan008\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network\",\"url\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network\",\"name\":\"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network | Christiaan's collection\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/yt.christiaan008.com\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2014\\\/10\\\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg\",\"datePublished\":\"2014-10-01T14:37:17+00:00\",\"dateModified\":\"2015-06-08T08:43:59+00:00\",\"description\":\"In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#primaryimage\",\"url\":\"https:\\\/\\\/yt.christiaan008.com\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2014\\\/10\\\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg\",\"contentUrl\":\"https:\\\/\\\/yt.christiaan008.com\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2014\\\/10\\\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg\",\"width\":480,\"height\":360},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/yt.christiaan008.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Projects\",\"item\":\"https:\\\/\\\/yt.christiaan008.com\\\/?post_type=project\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/yt.christiaan008.com\\\/#website\",\"url\":\"https:\\\/\\\/yt.christiaan008.com\\\/\",\"name\":\"Christiaan's collection\",\"description\":\"A great collection of security related videos!\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/yt.christiaan008.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network | Christiaan's collection","description":"In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network","og_locale":"en_US","og_type":"article","og_title":"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network | Christiaan's collection","og_description":"In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.","og_url":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network","og_site_name":"Christiaan's collection","article_publisher":"https:\/\/www.facebook.com\/christiaan008","article_modified_time":"2015-06-08T08:43:59+00:00","og_image":[{"width":480,"height":360,"url":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@christiaan008","twitter_misc":{"Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network","url":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network","name":"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network | Christiaan's collection","isPartOf":{"@id":"https:\/\/yt.christiaan008.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#primaryimage"},"image":{"@id":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#primaryimage"},"thumbnailUrl":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg","datePublished":"2014-10-01T14:37:17+00:00","dateModified":"2015-06-08T08:43:59+00:00","description":"In this presentation we propose an approach and hybrid shellcode detection method, aimed at early detection and filtering of unknown 0-day exploits at the network level.","breadcrumb":{"@id":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#primaryimage","url":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg","contentUrl":"https:\/\/yt.christiaan008.com\/wp-content\/uploads\/sites\/3\/2014\/10\/defcon-20-Demorpheus-Getting-Rid-Of-Polymorphic-Shellcodes-In-Your-Network.jpg","width":480,"height":360},{"@type":"BreadcrumbList","@id":"https:\/\/yt.christiaan008.com\/?project=defcon-20-demorpheus-getting-rid-of-polymorphic-shellcodes-in-your-network#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/yt.christiaan008.com\/"},{"@type":"ListItem","position":2,"name":"Projects","item":"https:\/\/yt.christiaan008.com\/?post_type=project"},{"@type":"ListItem","position":3,"name":"DEF CON 20: Demorpheus: Getting rid of polymorphic shellcodes in your network"}]},{"@type":"WebSite","@id":"https:\/\/yt.christiaan008.com\/#website","url":"https:\/\/yt.christiaan008.com\/","name":"Christiaan's collection","description":"A great collection of security related videos!","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/yt.christiaan008.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project\/1449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project"}],"about":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/types\/project"}],"author":[{"embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1449"}],"version-history":[{"count":19,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project\/1449\/revisions"}],"predecessor-version":[{"id":7118,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/project\/1449\/revisions\/7118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=\/wp\/v2\/media\/1451"}],"wp:attachment":[{"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1449"}],"wp:term":[{"taxonomy":"project_category","embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fproject_category&post=1449"},{"taxonomy":"project_tag","embeddable":true,"href":"https:\/\/yt.christiaan008.com\/index.php?rest_route=%2Fwp%2Fv2%2Fproject_tag&post=1449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}