ROOTCON Blog

The legendary crypto and IPV6 expert Lawrence Hughes is finally back for ROOTCON X and will deliver another awesome talk entitled "Certificate Based Strong Client Authentication as a Replacement for Username/Password".

A first time speaker at ROOTCON, Eskie Cirrus James D. Maquilang, C)PEH will be delivering his talk on "Exploiting Home Routers". For those of you who don't know Eskie, he is the guy responsible for the Vulnerability Note VU#525276 wherein he reported multiple vulnerabilities of SpeedSurf 504AN and Kasda KW58293 modems distributed by PLDT (Phillipine Long Distance Telephone).

Another first time speaker is a seasoned speaker at OWASP India, Nullcon, Blackhat Asia and many other conferences. Let us all welcome Sanoop Thomas who is the author of Xtreme Vulnerable Web Application (XVWA) and Halcyon. This year he will be presenting his very own Halcyon - "Halcyon – A Faster Way to Build Custom Scripts for Nmap Scans".

No need for an explanation here! We salute the guy behind the Metasploit Framework. Despite leaving Rapid 7, his legacy can never be forgotten. We really want you man!

Before the founding of Bluebox Security, Caleb Sima was EIR at Andreessen Horowitz. Prior to this Caleb was CEO of Armorize Technologies, an internationally acclaimed, SaaS-based malware monitoring and code security analysis firm headquartered in San Francisco. Before his tenure at Armorize, Caleb served as Chief Technology Officer for HP’s Application Security Center and was responsible for directing the lifecycle of the company’s web application security solutions. He joined HP following the acquisition in 2007 of SPI Dynamics, the company he co-founded and led as CTO, where he oversaw the development of WebInspect – a solution that set the bar in Web application security testing tools. Prior to co-founding SPI Dynamics in early 2000, Caleb worked for Internet Security Systems’ elite X-Force R&D team and as a Security Engineer for S1 Corporation.

Jason Haddix

Jason is an influential bug bounty hunter, the Director of Technical Operations at Bugcrowd Inc and a former Director of Penetration Testing at HP Fortify. He trains and works with internal application security engineers to triage and validate hardcore vulnerabilities in mobile, web, and IoT applications/devices. Together with Daniel Miessler, they head the OWASP IoT, OWASP SecLists and OWASP Mobile Top Ten projects. He is a great web and mobile hacker. He was our keynote last year and we hope that he will be back again for this year.

Vivek Ramachandran

"Hello all! This is Vivek..." - these are the famous lines and introduction in most of Vivek's videos in SecurityTube.net and Pentester Academy where he is the CEO of the two platforms. He is a known BlackHat Trainer for Wireless Penetration Testing. He also discovered the Caffe Latte attack, broke WEP Cloaking, and conceptualized enterprise Wi-Fi Backdoors. He is definitely a badass wireless security person and we want his expertise for ROOTCON X!

John Menerick

We want this Security Dragon at Netsuite back for this year! He has presented two topics at ROOTCON IX and he delivered it well. His slides are funny and exceptional. You doubt this guy? Watch the DEFCON videos!

Mariano Nunez

He is my inspiration to SAP Security Testing because for authoring Bizploit Framework which is an open source ERP Penetration Testing framework. He is the CEO and co-founder of Onapsis which is an authority in SAP cyber security field.  According to sources, he was the first to publicly present on cyber security risks affecting SAP platforms and how to mitigate them.

James Fitts

James works at HP Fortify where he breaks mobile applications (primarily Android). He is also an exploit developer and has contributed modules to the Metasploit Framework. He has delivered an awesome topic about Android Application Assessments during the Mobile Hacking Summit (MHS) at Blackhat USA 2014.

Blake Self

Blake is one of the crew members of SOLDIERX who has been an active speaker at DEFCON. He co-authored the first commercial encrypted instant messenger with Dr. Cyrus Peikari while at VirusMD. He has worked previously at SIPRNET Administrator, Department of Defense Red Team Analyst, and R&D at various corporations. I love his talk last DEFCON 22 entitled "Don't DDoS Me Bro: Practical DDoS Defense".

Rahul Sasi

He is the founder and CTO of Cloudsek. He is one of the most sought after Indian Information Security Researcher and one of the core members of Garage4hackers. He has also spoken at various hacker conferences every year.

Aseem Jakhar

He is the Founder at hardwear.io, Research Director at Payatu Labs and Founder/Organizer at NULLCON (India's Premier Hacking Conference). He is the author of open source Linux thread injection kit -Jugaad and Indroid which demonstrate a stealthy in-memory malware infection technique.

Micah Hoffman
He is also known as @WebBreacher in Twitter. He is an active member in the NoVAHackers community, writes Recon-ng modules, SANS Certified Instructor and enjoys tackling issues with the Python scripting language.

Alexander Polyakov
Alexander is another authority in SAP Cyber Security. He is the founder of ERPScan and President of the EAS-SEC.org project. Recognized as an R&D professional and Entrepreneur of the year, his expertise covers the security of enterprise business-critical software like ERP, CRM, SRM and industry specific solutions for Oil and Gas, Manufacturing, Retail and Banking; as well as other verticals developed by enterprise software companies such as SAP and Oracle.

Raymond Nunez
Mon has been a consultant to international organizations such as WHO and NEC, is the Co-Head Security Architect of DOST-ICTO for the Integrated Government Project (iGov), the Network Infrastructure and Security Consultant of the UP Computer Center, etc.

A member of Team Manila, Mon, with Paul Prantilla, has competed in the DEFCON 22 in Las Vegas this 2014. The team participated in multiple contests achieving 4th out of 264 teams for the Network Forensics Puzzle Contest (NFPC), and also 4th at the Capture the Packet Contest (CTP) championship round. They also competed in the 2014 Capture The Flag contest at Hack In The Box, Kuala Lumpur -- making them the first and only team from the Philippines to ever compete in an international CTF event.

Bruce Schneier
Bruce is one of the most influential security guru in the field of cryptography. He has been involved in the creation of many cryptographic algorithms: Skein, Solitaire, Phelix, Helix, Fortuna, Yarrow algorithm, Twofish, Blowfish, Threefish, and MacGuffin Pictures.

Christopher Elisan
Sir Tophs has spoken at ROOTCON for two conferences already and yes we want him back! He is the Principal Malware Scientist at RSA. He has a long history of digital threat and malware expertise, reversing, research and product development started at Trend Micro as one of the pioneers of TrendLabs where he honed his skills in malware reversing. He then built F-Secure’s Asia R&D where he spearheaded projects in vulnerability discovery, web security and mobile security. After F-Secure, he joined Damballa as their resident malware subject matter expert and reverse engineer. He speaks at conferences around the world and frequently provides expert opinion about malware, botnets and advance persistent threats for leading industry and mainstream publications. Elisan’s published works include "Advanced Malware Analysis."

Shawn Webb
Shawn a.k.a lattera is a Security Engineer and Co-founder of the HardenedBSD project. It would be nice if he can introduce his project during ROOTCON 10. He is also a long-time crew member of SOLDIERX.

NJ Ouchn
He is the organizer of the major event Blackhat Arsenal Tools (US and Europe) since 2011 and the founder and the main maintainer of toolswatch.org. He also maintains the projects; DPE (Default Password Enumeration), vFeed® the open source correlated & cross-linked vulnerability database, FireCAT the Firefox Catalog of Auditing exTensions, and KromCAT – Google Chrome Catalog of Auditing exTensions. Maybe he can organize an event like Arsenal Tools? Let's see!

Daniel Cid
He is the founder of the open source OSSEC HIDS and the Founder/CTO of Sucuri. He is also the co-writer of the Host-Based Intrusion Detection book and is an active writer at blog.sucuri.net.

Tavis Ormandy
Tavis has been seen nowadays in the mailing lists and exploit databases breaking antivirus software. This guy is legit since he is currently employed by Google as part of their Project Zero team. Tavis you are an inspiration!

Dan Duplito
Dan is one of the few elite hackers in the Philippines who is a chick magnet according to Tikbalang. He is the Vice-President of the Information Security Division in PSBank, one of goons of ROOTCON, and an Outstanding ASEAN CISO Awardee for 2013.

Craig Smith
Craig runs runs Theia Labs, a research firm that focuses on security auditing and building hardware and software prototypes. He has worked for several auto manufacturers and provided them with his public research. He is also a founder of the Hive13 hackerspace and OpenGarages.org. Craig is a frequent speaker on car hacking and has run workshops at RSA, DEF CON, and other major security conferences. He is the author of the book "Car Hacker's Handbook: A Guide for the Penetration Tester".

Douglas Berdeaux
He is the founder of WeakNet Laboratories, and the lead developer of known open-source security projects and tools like WEAKERTHAN Linux, WiFiCake-NG, WardriveSQL, GPS-Parser-ng, WPA Phishing Attack for EAP Phishing, SSWR (Scripted Security for Wireless Routers), Catchme-NG, Perlwd (Perl UNiX MD5 HASH Cracking application), and many more.

Oh wait, you are not on the list? Don't worry! If you think you can do better than these guys which I think you can then please submit your talk at cfp [at] rootcon [dot] org and follow the instructions here: https://www.rootcon.org/xml/rc10/cfp.

Now what about this year? Well, we need the crowd of researchers and 31337 hackers again to submit your talks since ROOTCON X's CFP (Call for Papers) has been opened for this year! 

It's time to show off those fresh and sizzling new hacks on September 22-24, 2016 at the Taal Vista Hotel, Tagaytay, Philippines. What are you waiting for? Email cfp [at] rootcon [dot] org and follow the instructions here: https://www.rootcon.org/xml/rc10/cfp

Topics of interest but not limited to:

This years' ROOTCON 9 has been dubbed as the ROOTCON All Star, we have different speakers and con-goers from around the globe. It wouldn't be possible without the RC Goons, Sponsors, Speakers and of course our awesome con-goers. 

Hats down to our ROOTCON Elite Sponsors:

Kaspersky Lab

HP Fortify on Demand

Netsuite Security

F5 Networks

Tenable Security

First DataCorp

Accenture

And to the rest of the sponsors big hugs to you guys.

MISNet Education

PaloAlto Networks

Rapid 7

Pandora Security Labs

Citi

Security Matters

Inquirer

and to Smiffnoff Mule for providing us drinks at our epic post-con party.

A quick note: What you get at ROOTCON is what you made ROOTCON for you.

Cheers everyone and see you all next year.

All The Best,

Dark (semprix) Meister

More than people turned up to listen to talks on a wide variety of subjects. Aside from Filipino participants, there were also geeks from Taiwan, Hong Kong, Australia, Spain, Malaysia, America, India, etc. who attended the event. Cheers to the attendees who flew to the Philippines just to attend ROOTCON.

This is one of the questions I asked to semprix (father of ROOTCON) before visualizing the ROOTCON Campus Tour which is an information security seminar and an inter-university Hacker Capture the Flag (CTF) for university students in the Philippines. I suggested it will be fun too.

We also want to give back something to the community because we want the event to be free, we want to promote security awareness, and that we want to introduce the essence of the hacker culture.

And so we pushed the event last September 4, 2015 at De La Salle University in cooperation with DLSU - College of Computer Studies, Mr. Isaac Sabas of Pandora Security Labs, and La Salle Computer Society. The event was also sponsored by Booster C Energy.

Participants came from De La Salle University, Mapua Institute of Technology, Ateneo de Manila University, University of Sto. Tomas, UP Diliman, PUP, etc.

Aside from the cool talks, games and challenges in ROOTCON that you all look forward to, there will be a post-con party as well. ROOTCON Post-con Party is the best time to socialize with your fellow G33ks and H4x0rs. This is the best part of the CON that you don't want to miss at all.

We ensure you a one stubbornly refreshing party.

Ahem! Yes, ROOTCON in partnership with with De La Salle University - College of Computer Studies officially launches ROOTCON Campus Tour and the great thing about this event is that it is 100% Free.

ROOTCON Campus Tour is the first ever inter-university Capture the Flag (CTF) and infosec gathering for university students that aims to bring the ambience of the premier hacking conference in the Philippines, ROOTCON. The event is 100% FREE and covers topics like Information Security 101, Information Security Career 101, Introduction to Hacking, Exploit Development, Malware Analysis, Debugging, etc. 

The Capture the Flag event is the main highlight of this event wherein the champion could secure a FREE pass to ROOTCON 9. 

ROOTCON Campus Tour's CTF is not your ordinary hackathon or codefest because it is really an inter-university hacker cup that has intermediate to advance challenges like reverse engineering, return oriented programming, packet sniffing, debugging, web exploits, and many more to mention. 

ROOTCON Campus Tour wouldn't be a reality without the help of Isaac Sabas of Pandora Security Labs and De La Salle University - College of Computer Studies. Thank you for the help and we totally salute you guys!

You don't wanna miss this event! Stay tuned for more updates @ http://campustour.rootcon.net/

Still doubtful that we are the premier hacking conference in the Philippines? Then check out our awesome lineup of speakers plus the 1337ness:

Carlos Tingson