拉斯維加斯@美國_Blackhat USA 2018 & Defcon 26 & AI Village

對於1個30歲前都還沒辦護照更沒搭過飛機，然後壓根沒想過體驗所謂忙著出國開會，還有不太可能去讀博士班的人來說；從人生的第一次搭飛機出國就飛西班牙巴塞隆那開始去了歐洲，後來這幾年也陸續的去了巴塞隆那@西班牙、巴黎@法國、新加坡、曼徹斯特+倫敦@英國、首爾@南韓、舊金山+拉斯維加斯+奧蘭多+西雅圖@美國、墨爾本@澳洲、北京@中國等不少國家跟城市；陸續也寫了多篇文章，但都有點混亂，若不好好整理，實在對不起自己的人生啊。。。

TonTon H.-D. Huang, "Hunting the Ethereum Smart Contract: Color-inspired Inspection of Potential Attacks", AI Village, Defcon 26, Las Vegas, Nevada, 2018. (link / Blog)
TonTon H.-D. Huang, Chia-Mu Yu, and Hung-Yu Kao, "Look! Ransomware is there: Large Scale Ransomware Detection with Naked Eye", Ruxcon Security Conference, Melbourne, Australia, 2017. (link / Blog)
TonTon H.-D. Huang, Chia-Mu Yu, and Hung-Yu Kao, "R2-D2: Color-Inspired Convolutional Neural Network (CNN)-based Android Malware Detection", OWASP AppSec USA, Orlando, Florida, 2017. (link / Blog)
TonTon H.-D. Huang, "New Mindset for Malware Battlefield: Bytecode Analysis and Physical Machine-based for Android", Hacks in Taiwan Conference (HITCON) CMT, Taipei, Taiwan, 2015. (Keynote Speech, link / Blog)
TonTon H.-D. Huang, "Building Adaptive Heterogeneous Architecture for Malware Behavior Analysis: MAN in Taiwan", Hacks in Taiwan Conference (HITCON) PLG, Taipei, Taiwan, 2014. (link / Blog)
TonTon H.-D. Huang* and Hung-Yu Kao, "R2-D2: Color-inspired Convolutional Neural Network (CNN)-based Android Malware Detections", IEEE International Conference on Big Data 2018 (IEEE Big Data 2018), Seattle, WA, USA, Dec 10-13, 2018. (link / Blog)
TonTonH.-D. Huang, "Hunting the ethereum smart con-tract:Color-inspired inspection of potential attacks", arXiv preprint, arXiv:1807.01868, 2018. (link)
TonTon H.-D. Huang*, Chia-Mu Yu, and Hung-Yu Kao, "Data-Driven and Deep Learning Methodology for Deceptive Advertising and Phone Scams Detection", 2017 Conference on Technologies and Applications of Artificial Intelligence (TAAI 2017), Taipei, Taiwan, Dec. 1-3, 2017. (link)
TonTon H.-D. Huang*, Chia-Mu Yu, "Poster: Adaptive Data-Driven and Region-Aware Detection for Deceptive Advertising", IEEE Symposium on Security and Privacy 2016 (IEEE S&P 2016), San Jose, CA, USA, May 23-25, 2016. (link / Blog)
TonTon H.-D. Huang*, C.-S. Lee, M.-H. Wang, and Hung-Yu Kao, "IT2FLS-based Malware Analysis Mechanism: Malware Analysis Network in Taiwan (MiT)", in Proceeding of the 2013 IEEE International Conference on Systems, Man, and Cybernetics (IEEE SMC 2013), Manchester, United-Kingdom, Oct. 13-16, 2013. (link / Blog)
TonTon H.-D. Huang*, C.-S. Lee, H. Hagras, and Hung-Yu Kao, "TWMAN+：A Type-2 Fuzzy Ontology Model for Malware Behavior Analysis," in Proceeding of the 2012 IEEE International Conference on Systems, Man, and Cybernetics (IEEE SMC 2012), COEX, Seoul, Korea, Oct. 14-17, 2012. (link / Blog)
TonTon H.-D. Huang*, G. Acampora, V. Loia, C.-S. Lee, and Hung-Yu Kao, "Applying FML and Fuzzy Ontologies to Malware Behavioral Analysis," in Proceeding of the 2011 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE 2011), Taipei, Taiwan, June. 27-30, 2011. (link / Blog)
TonTon H.-D. Huang*, C.-S. Lee, Hung-Yu Kao, Y.-L. Tsai, and J.-G. Chang, "Malware Behavioral Analysis System: TWMAN," in Proceeding of the 2011 IEEE Symposium on Computational Intelligence for Intelligent Agent (IEEE SSCI 2011), Paris, France, Apr. 11-15, 2011. (link / Blog)
TonTon H.-D. Huang*, T.-Y. Chuang, Y.-L. Tsai, and C.-S. Lee, "Ontology-based intelligent system for malware behavioral analysis," in Proceeding of the 2010 IEEE World Congress on Computational Intelligence (WCCI 2010), Barcelona, Spain, Jul. 18-23, 2010. (link / Blog)

哦 ! 就這樣又好一陣子沒有飛美國了 ... 這次拜 AI Village, Defcon 26 的福 ! (PS: 文長慎入)

帶著 " Hunting the Ethereum Smart Contract: Color-inspired Inspection of Potential Attacks " 就這樣出發前往傳說中的賭城拉斯維加斯 (Las Vegas) 體驗一下傳說中的兩個駭客盛會 Black Hat USA 2018 跟 Defcon 26

這趟行程印像最深的我想就是氣溫高到有點嚇人

在路上簡直像被用吹風機對著吹的，當然還巧合的遇上了 Flash Flood ...

OK，回到長榮航空，去年那趟打開是別人吃完的航空餐還是造成了陰影

不過這趟最麻煩的就是去程飛到洛杉磯 (Los Angeles) 轉機，但中間只有近 2 小時

而且行李必須重新托運

然後發現這個機場還真不是普通的大

好不容易等到了行李，然後小步快跑的上了飛機後 ...

咻一下，不到一小時吧，就這樣來到了賭城拉斯維加斯 (Las Vegas)

我想最可惜的莫過於對於 " 賭 " 我還真的是一竅不通 ... 甚至麻將或者牌類遊戲都如此

不過，剛到這機場時倒覺得四處都是拉霸有點新鮮

直到踏出機場的一瞬間 ... 吹風機式的體感溫度就這樣迎面而來

這次住的飯店其實挑了很久，最後是 Platinum Hotel and Spa（鉑金Spa酒店）

https://www.booking.com/hotel/us/platinum.zh-tw.html

211 East Flamingo Road, 拉斯維加斯大道, 拉斯維加斯, NV 89169, 美國

然後飯店出來就有一家 7-11，搭配上飯店內的設備，對於食物完全非常好解決 !

豪華一臥室套房- 帶特大號床，什麼稀奇古怪的設備應有盡有；當然在這飯店還有之後那一段整個很意外，直到現在我自己都不太能解釋跟忘記的，到底是如何發生的故事 !

交通地點也離拉斯維加斯大道不遠，是個讓人非常滿意的飯店 ! 如果下次投上了 Black Hat USA 跟 Defcon 一定再住

接著就是傳說中 Blackhat USA 的場地

曼德勒海灣賭場度假村（英語：Mandalay Bay Resort and Casino）是位於美國內華達州拉斯維加斯大道上的一所賭場酒店，酒店由美高梅國際酒店集團所持有及管理。另外，酒店主大樓的第34至39層則用作四季酒店客房之用。酒店擁有3,309間客房以及面積達135,000平方公尺的賭場，附設有接近一百萬平方公尺的曼德勒海灣會議中心以及主辦拳賽、演唱會等節目的曼德勒海灣表演中心。(from 維基百科)

來到這邊一定要先拍下這經典的標的物啊 !

還有逛逛這贈品多到讓你拿到手痠的 Business Hall

https://www.blackhat.com/us-18/business-hall.html

巧合的是也在這遇到了過往的同事朋友 ... 左上方的圖就是用來證明手真的會痠的贈品哦 !

https://www.blackhat.com/us-18/briefings/schedule/index.html

當然，幾場關鍵的演講也是一定要去聽的 !

咱家的小豹更是一定要露個臉啊 !

更為驚人的就是這午餐時間席開 " 數百桌 " 的場面了

就這樣花了兩天的時間在會場四處逛 ... 得到的結果就是

除非你是 briefings 的 speaker 啦，不然真的可以不用浪費錢特地飛來參加

想聽演講 ? 嗯 ... 英文程度要不差，然後 ... 其實官方很快就把影片公佈了啦 ! XD

https://www.youtube.com/user/BlackHatOfficialYT

https://www.youtube.com/user/DEFCONConference

接著就是這趟的主要目的了

AI Village @ Defcon 26: https://aivillage.org

來說說兩者的個人體驗的差別好了

Blackhat 感覺上就是很商業化的產品介紹展示

至於 Defcon 就是感覺滿滿的會場都是駭客

任意連上現場的網路的話，可能不知覺中就馬上被駭走了什麼東西了呢

找到要發表的會場後，當然就是得要四處逛逛了

這個則是 CTF 的現場

捷報！臺灣HITCON戰隊獲DEF CON CTF第三名！韓國再度抱走冠軍
https://www.ithome.com.tw/news/125134

這次的題目其實就是從今年農曆年後，開始趕工做的

Blockchain and Cryptocurrencies are gaining unprecedented popularity and understanding. Meanwhile, Ethereum is gaining a significant popularity in the blockchain community, mainly due to the fact that it is designed in a way that enables developers to write decentralized applications (Dapps) and smart contract. This new paradigm of applications opens the door to many possibilities and opportunities. However, the security of Ethereum smart contracts has not received much attention; several Ethereum smart contracts malfunctioning have recently been reported. Unlike many previous works that have applied static and dynamic analyses to find bugs in smart contracts, we do not attempt to define and extract any features; instead we focus on reducing the expert’s labor costs. We first present a new in-depth analysis of potential attacks methodology and then translate the bytecode of solidity into RGB color code. After that, we transform them to a fixed-sized encoded imag e. Finally, the encoded image is fed to convolutional neural network (CNN) for automatic feature extraction and learning, detecting security flaw of Ethereum smart contract.