Our Favorite Presentations from Shmoo Con 2015
Summary: Unit 42 attended ShmooCon 2015 in Washington, DC, and highlighted three talks: Andrew Morris's use of open source indicators, malware artifacts, and honeypot data to track APT activity, including a GitHub tool that publishes reports on attacks, IPs, and SSH passwords; Scott Behrens and Andy Hoernecke's overview of application security pitfalls at Netflix and their automation tools Simian Army, Security Monkey, and Sketchy/Scumblr; and Omar Ahmed and Tyler Bohan's work embedding a Python interpreter in Intel Pin to build dynamic binary instrumentation tools that detect Use After Free and heap overflows. The post notes ShmooCon sells out each year with tickets from three rounds gone in under a minute and caps purchases at two per person.
Bottom line: The presenters' tooling - a honeypot-driven tracker for a Chinese-derived SSH password-spreading malware, Netflix's Simian Army that takes down entire AWS regions, and a Pin wrapper for detecting memory corruption - shows that the automation shifting threat intelligence and analysis work was already public and free on GitHub in 2015.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026