"Post Intrusion SSH Hijacking" by Metalstorm was a great talk about how to leverage one hack into several nearly untraceable intrusions. Instead of attacking a network on off hours, the idea is to exploit the admin's desktop and then piggy back on all their existing ssh sessions. Using the SSH RFC (something I have had the joy of memorizing) to its fullest Metalstorm was able to convince sshd that he needed another terminal session all while using the existing authenticated secure tunnel.

This talk was well paced and very funny in parts. The idea of an admin playing "Hunt the Wumpus" while pine exploded on his desktop was really funny. Even MS's much maligned Clippy made a cameo.

His parting thoughts on MSRDP and Citrix ICA are disturbing however. Protocols that support Multiplexed channels are in danger of being pwned by this technique. I really like Python and SSH so I thought it was awesome to see someone mash them together with such great results!