Meet [REDACTED]. He is a single function app that wanted to be much more. He always looked up those elite malware and botnet apps but now that the Google’s Bouncer moved into town his hopes and dreams appeared to be shattered. This was until he was handed a text file while strolling along a shady part of the Internet (AKA Pastebin). The title of this txt file was “Bypassing Google’s Bouncer in 7 steps for Fun and Profit”. Upon reading this, our little app began to glow with excitement. He routed himself all the way to the gates of Google Play and began his journey from a simple benign app that [REDACTED], to a full-fledged info stealing botnet warrior. In this presentation we will tell the story of how our little app beat the Bouncer and got the girl (well, at least all her personal information, and a few naughty pics).
Nicholas J. Percoco: With more than 15 years of information security experience, Percoco is the lead security advisor to many of Trustwave¹s premier clients and assists them in making strategic decisions around security compliance regimes. He leads the SpiderLabs team that has performed more than 1300 computer incident response and forensic investigations globally, run thousands of penetration and application security tests for clients, and conducted security research to improve Trustwave's products. Percoco and his research has been featured by many news organizations including: The Washington Post, eWeek, PC World, CNET, Wired, Hakin9, Network World, Dark Reading, Fox News, USA Today, Forbes, Computerworld, CSO Magazine, CNN, The Times of London, NPR, Gizmodo, Fast Company, Financial Times and The Wall Street Journal. Twitter: @c7five http://blog.spiderlabs.com
Sean Schulte: Sean is an engineer at Trustwave who works primarily with Java and Ruby. He is responsible for building external APIs such as the SSL reseller API, and internal APIs including a Google Safe Browsing blacklist along with the infrastructure to support various SSL services. In his spare time he maintains an unpopular, but feisty, baseball blog. Twitter: @sirsean