Kudelski Security's Principal Engineer to Speak on Hunting for Signal Vulnerabilities at INFILTRATE 2017

What:

The presentation will focus on Signal, one of the most trusted secure messaging and secure voice applications. While the app employs strong cryptography and has solid system architecture, vulnerabilities have been discovered in its code base (later addressed by Open Whisper System, which maintains Signal).

Aumasson and Vervier will detail vulnerabilities discovered in the Signal Android client, the underlying Java libsignal library, as well as an example usage of the C libsignal library. Demos will illustrate how these can be used to crash Signal remotely, bypass the MAC authentication for certain attached files, as well as to trigger memory corruption bugs. Also to be discussed is the general architecture of Signal, its attack surface, tools for analysis, along with the general threat model for secure mobile communication apps.

More information about the session may be found here.

Who:

Aumasson is principal research engineer at Kudelski Security in Switzerland. He designed the popular cryptographic functions BLAKE2 and SipHash. Aumasson also initiated the Crypto Coding Standard and Password Hashing Competition that developed the Argon2 algorithm. He has been a speaker at Black Hat, DEFCON, RSA, CCC, SyScan and Troopers on topics such as applied cryptography, quantum computing and platform security. He is the author of "The Hash Function BLAKE" and is currently writing a second book on cryptography due out later this year.

Vervier is a highly regarded independent security researcher based in Germany. During the past 15 years he has gained professional experience in offensive IT security as a penetration tester and security consultant. He actively conducts security research and is responsible for the discovery of high profile vulnerabilities such as libotr heap overwrite.

When:

4:00 pm ET, Friday, April 7, 2017

Where:

Fontainebleau Hotel, Miami