AVAR 2011 Hong Kong Report

First published: 30^th November 2011

The fourteenth Anti-Virus Asia Researchers Annual Conference took place on the 9th - 11th November in the heart of Wan Chai, Hong Kong.

As usual, several significant industry meetings took place alongside the conference, with the Wild List Organisation and the Anti-Virus Product Developer Consortium both holding meetings on the 9th. AVAR itself held its Directors' meeting on the 9th, and the Members' Annual General Meeting at the end of the conference.

The conference itself was kicked off by Roy Ko, Centre Manager of Hong Kong CERT, giving the Keynote speech on Creating a Safe, Clean and Reliable Cyberspace. The conference then split into two streams, with Andrew Lee and Pierre-Marc Bureau examining the motivations of malware authors, revealed through case-studies, while Young Jun Chang discussed targeted attacks in Korea.

Igor Muttik looked at the potential for malware in the pre-boot environment of the Extensible Firmware Interface (EFI), concluding that pre-OS malware is easy to write and unpleasant to deal with, so we need better coverage and tools. Igor earned the Best Speaker Award at the end of the conference.

Several presentations looked at malware on mobile devices. V Dhanalakshmi covered the Android security model, the threats and ways to mitigate the risks. Itshak Carmona covered Symbian, Android and iPhone malware. Cao Yang and Zou Shihong showed how malware on Symbian and Android devices can attack the most popular mobile payment systems in China. On the defence side, Yu Guo Liu looked at providing a one-stop solution for both PC and mobile platforms.

Different countries provide different environments and opportunities for malware. Jim Wang explained how to reverse-engineer programs written in the Chinese programming language EPL (Easy Programming Language) and Kazumasa Itabashi discussed tricks used to target regional Japanese and Chinese software.

Three presenters, Lukas Hasik, Raymond Roberts and Xue Yang also described attack techniques: Google image poisoning, Obfuscation and Exploit Kits respectively.

Jianfeng Lu, Jeffrey Ma, Rajesh Nikam and Benny Czarny each took a different look at defensive techniques while Tony Lee and Richard Thomas covered cross-industry cooperation and testing methodologies.

Alfons Tanujaya, Randy Abrams, Darya Gudkova and Cameron Camp gave four presentations related to social engineering and user education.

The conference social programme included the Gala Dinner, held at the famous Jumbo Kingdom floating restaurant in Aberdeen Harbour and the islands tour on a traditional Chinese junk.

AVAR 2012 will be hosted by Tencent in Mainland China.