Joe Stewart

Director of Malware Research, Dell Secureworks

http://www.secureworks.com

Biography

Joe Stewart is the Director of Malware Research for Dell SecureWorks’ Counter Threat Unit. As a leading expert on malware and Internet threats, he is a frequent commentator on security issues for leading media outlets such as The New York Times, MSNBC, Washington Post, USA Today and others. Stewart has presented his security research at many conferences such as RSA, Black Hat, DEFCON, ShmooCon, RECON, Netsec, Hacker Halted USA, Air Force Cyber Space Symposium, AGORA, the Anti-Phishing Working Group, and many international ones, including CERT-EE Conference (Estonia), DeepSec 2008 (Austria), KAIST International Workshop on DDoS Attacks and Defenses (Korea), and AusCERT2010 (Australia).

Presentation: HTran and the Advanced Persistent Threat

While researching one of the malware families involved in the RSA breach disclosed in March 2011, Dell SecureWorks' Counter Threat Unit observed an interesting response from one of the malware's command-and-control hosts, which led to an interesting opportunity to derive attribution information for certain Advanced Persistent Threat (APT) activity as well as to detect attacks in progress. This presentation will detail this discovery and conclusions drawn from a months-long project to expose as much information about the infrastructure used by APT actors as possible.