There are two things one can count on every year at ToorCon: the amazing San Diego weather and excellent presentations about new and emerging security research. This year’s ToorCon 11 did not disappoint, and delivered a lot of great content and new security research throughout the weekend.

The conference started with a non-traditional keynote address from Vernor Vinge, an award-winning science fiction author, who presented his thoughts, insight and concerns about the future of ubiquitous computing. As a nice follow-up to this theoretical presentation, Dan Kaminsky spoke next about his research into the flaws behind X.509 public key infrastructure, which he previously spoke about at Black Hat USA 2009 / DEFCON 17 this past summer. These presentations set the tone for this year’s ToorCon, showing that anything and everything is open for discussion.

Saturday’s session featured in-depth one-hour presentations which ran the gamut of security-related topics. Brandon Enright presented an excellent summary of various botnets and how they work and stay operational, which can be a very confusing topic to people who aren’t in the trenches with botnets on a regular basis. Julia Wolf provided a mountain of data about various viruses and other malware that have been in the news, and the kinds of things security geeks dream about at night. A Hollywood-style presentation by Jason Ostrom and Arjun Sambamoorthy demonstrated their freshly released UCSniff tool for IP video eavesdropping and injection by performing a “theft” on stage reminiscent of something out of “Sneakers.” Later in the day, Josh Wright released a framework for the ZigBee wireless protocol, which is appearing in more and more places such as home automation and hospital care.

Last on Saturday, but not least, the CTU’s own Ben Feinstein presented an in-depth analysis of the Koobface malware which has plagued social networking sites throughout 2009, exposing its capabilities, problems and other data that has been gathered over the past several months. Two other CTU members presented on Sunday at this year’s ToorCon. Kevin Stevens spoke about the “pay-per-install” industry, how it has changed over the years and recent “reforms” players in this industry have made. Dennis Brown presented on the underground economy of trading video game currencies for real money which is driving the popularity of game password stealers.

Sunday focused on quick, 20-minute presentations, consisting mostly of new or in-progress research, but there was no decline in the quality of these presentations. One of the presentations that stood out was by Ron Bowes, who released some great information about scanning with nmap over SMB/RPC to obtain detailed system information. Another presentation of note was by Joel R. Voss who presented a new method for static code analysis, and demonstrated its effectiveness in finding flaws in common software. There were many other presentations that contained a wealth of information, as well as a couple impromptu Q&A sessions with Dan Kaminsky and others which were as humorous as they were informative.

Year after year, ToorCon continues to deliver, while still feeling like a smaller conference. One of the great things about ToorCon is that the presenters, and everyone else for that matter, is very accessible and usually happy to talk about what they’ve been working on and share their insight into what’s going on in security. This is often hard to do at the larger conventions, and makes ToorCon special in that regard. It’s definitely worth the trip!