Last weekend, from 17 to 19 January, ShmooCon was held in Washington, DC. A number of different topics was covered in great talks and we want to give you a short overview of the conference. In the following our favorite talks are briefly summarized.
Privacy Online: What Now?
Ian Goldberg, one of the designers of the
OTR Protocol, gave the
keynote on the first day. His talk was quite interesting and he presented some
really nice approaches, one of those being an attack against PGP. He described
the attack as follows: an attacker could copy a key server by downloading all
the stored keys. If this is done it is possible to create new key pairs with
exactly the same settings as the keys downloaded. The third step is to create
all the signing links between the keys as they exist on the real key server.
Finally, the attacker uploads these new keys including the signing links to the
original key server.
Now, in case Alice wants to retrieve the public key of Bob, Alice would find two
keys with seemingly identical properties. If choosing the wrong key for
encryption the message will be decipherable by the attacker and in case of MitM
situation be accessed. Furthermore, if Alice then signs the “mirror key”, the
cloned keys and the original would merge, resulting in further problems.
This was just one consideration discussed in Goldberg’s talk. For the full
content, watch the recording, available soon on ShmooCon page.
You Don’t Have the Evidence
Scott Moulton gave an introduction into forensics and data recovery tools. The
most important fact, which he wanted to emphasize is that when encountering
damaged files, many of the forensic tools have no ability to deal with the
damage and quit, crash, or worse. This is where the data recovery tools got
their benefit. They can handle nearly any kind of error when reading data from a
hard drive. Data recovery imaging tools have some very advanced functions and
capabilities for imaging damaged hard drives and damaged sectors that forensic
tools are incapable of finishing. He also announced some alternative tools for
imaging a hard drive. These are for example
dcfldd or
ddrescue.
Large Scale Network and Application Scanning
This was a real really nice and entertaining talk. Robert David Graham has
written a cool tool called “masscan” which is able to scan the entire Internet
in a really short time.
While giving the talk Paul McMillan started a scan on TCP port 5900, widely used
for VNC. The scan took only twelve minutes! Furthermore he implemented a nifty
feature: if the tool is getting a response of a scanned IP, it is connecting to
the VNC server and checks for authentication. If there is none it takes a
screenshot and saves the information into a text file. The results were
published and are quite interesting. The scan resulted in, well, interesting
results, here for example is one of them:
Besides this, several “control screens” from various systems came up including
two screens with an NCR branding. The first round of VNC scanning last autumn
actually included some results related to public infrastructure and a pool
control with an “empty acid tank” button. Notifying the responsible admins led
to “diverse” responses, too.
If you like to test this tool as well, you can get it from
github.
In the second part of the talk Alejandro Caceres presented his distributed web application vulnerability search engine called PunkSPIDER which is based on PunkSCAN, a web app vulnerability scanner.
Despite the diversity of the talks and the different backgrounds of the speakers
some general consensus was present during ShmooCon:
Governmental surveillance cannot be completely prevented but it can be made as
hard as possible.
Protocols developed in the future with for the Internet should never transmit
data in plaintext. In addition all applications should always support security
features like encryption and perfect forward secrecy. In case a user has the
option to active or deactivate encryption, it should always be the default
setting. However, most of the time enforcing encryption is the better choice, as
users tend to make debatable decisions…
With this in mind, future programs and protocols will hopefully be more secure
and at the same time lead to more privacy on the Internet.
Overall ShmooCon 2014 was a really cool event. Besides these talks, there were a
lot of more nice activities offered like the ShmooCon Labs or the Wireless
CTF.
If some of you would like to view the recordings of the talks, they will be
published in 60 days on the ShmooCon website.
See you,
the ERNW ShmooCon Crew (Heinrich, Dominik, Brian, Hendrik)