12-09, 14:40–14:55 (Europe/London), Rookie track
PE files have interesting properties that can be manipulated to achieve a variety of goals during an offensive security exercise. In particular, manipulating the 'S' bit of a section enables memory regions to be shared among processes dynamically - serving as an effective covert channel. This session aims to introduce a homegrown tool to illustrate this concept in action.
Alex is a Senior Incident Response Analyst supporting a multinational consulting firm in the UK. Along with extensive experience in SOC operations, Alex is a proficient coder and enjoys general coding & automation projects. When not engaged in securing organisations, Alex enjoys hanging out and sampling all varieties of food.