As every year some of us used the holidays to visit the Chaos Communication
Congress to socialize with like-minded people and to hear interesting talks.
I mean what other reasons than learning about security might exist to leave
behind all your lovely in-laws you’ve been sharing some relative’s house with
the days before … 😉
Here is a short recap of some of the talks we found most interesting:
Mining for Bugs with Graph Database Queries by Fabian Yamaguchi
Video
One of my favorite talks at this years congress was about the open source tool
joern, a code analysis platform for C/C++
applications. Fabian, the main author of joern, presented his work on
vulnerability discovery in large code bases. One of the key points of his work
is robustness, meaning that the resulting tools should produce meaningful
results in large and noisy real world projects even if this results in a loss of
accuracy. The second important point is that tools should assist human auditors,
not replace them, which seems to be one of the more interesting current research
directions (see also
this paper).
At its core joern combines standard compiler technology with modern graph
databases to offer auditors a powerful way to search for certain code
constructs. To do this joern parses source code into an AST (Abstract Syntax
Tree) and creates the corresponding CFG (Control Flow Graph), as well as a Data
Dependency Graph (PDG) for all functions. This creates the Code Property Graph
which combines all three representation forms into a single unified layer.
The Code Property Graph is stored inside a graph database (joern uses
neo4j), which can be queried using a powerful graph
traversal language named gremlin
(https://github.com/tinkerpop/gremlin/wiki). The combination of gremlin with
some wrapper tools included in joern gives an auditor the possibility to
construct powerful search queries against the code base. Fabian presented
different queries he used to search for vulnerabilities in the VLC video player,
as well as the Linux kernel that resulted in really impressive results (and a
high number of discovered vulnerabilities). Joern is definitely a tool you
should check out and I’m looking forward to more impressive research by its
author.
– Felix
Mobile self-defense by Karsten Nohl
Video
This talk was highly covered by the media and therefore may have had some actual
impact on the general public. The main message was: Surveillance of your phone
is happening and it is easy – all thanks to the capabilities of SS7 and bad
configurations. Karsten started by referencing the previous talk by Thomas
Engel: “SS7: Locate. Track. Manipulate.” which had
explained some of the vulnerabilities in detail: Using a rogue network operator,
it is possible track any phone and intercept mobile communication, which allows
certain companies to offer tracking as a service.
Not all network operators have mitigations against those attacks in place (and
in most cases it is not as easy as blocking a “SendIdentification”-SS7 packet).
In some networks, SS7 is not even needed to intercept communication: For
example, countries like India, South Korea and Thailand have 3G encryption
disabled, making interception trivial.
Karsten presented gsmmap.org a collaborative project that
shows if your provider has mitigation against SS7 vulnerabilities and encryption
in place (contributions are welcome! 🙂 ). Karsten’s company SRLabs created an
app (SnoopSnitch) that can
be used to detect several types of attacks, using an Android device with
Qualcomm chip. For example, SnoopSnitch
is able to detect silent SMS which are commonly used by governments to track
phone users. The collected data can then be uploaded to the SRLabs servers to
allow further research on that subject, track developments and raise awareness.
For more details visit the
project homepage
– Benedikt
The Perl Jam: Exploiting a 20 Year-old Vulnerability by Netanel Rubin
Video
In this talk Netanel Rubin presented his research on surprising security issues
of the programming language Perl. After describing the basic Perl datatypes
(scalars, arrays and hashes), he introduced the concept of lists which have some
unexpected behavior when compared to other programming languages. An example is
that an implicit cast of a list into a scalar will result in the last element of
the list. Netanel explained this weird behavior with the fact that lists are no
actual data type but actually are only expressions. After that he described
potential vulnerabilities that can originate due to incorrect handling of lists.
He illustrated that the handling of GET variables within the perl CGI module
behaves in an interesting way when multiple parameters share the same name – in
this case perl converts the parameters to a list instead of just using the first
or last occurrence of a variable. Because this behavior is nearly undocumented,
it can lead to security critical bugs. Netanel used this misbehavior of Perl’s
CGI module to discover a critical security issue in
Bugzilla, a bug tracking
application which is used by many popular open-source projects. By manipulating
a benign HTTP request during the registration process, he can register with an
arbitrary email address bypassing the normal email validation step. Because many
open source projects restrict access to security critical bugs depending on the
email domain of an account, this could allow viewing of confidential bug
reports.
In the last part of his presentation Netanel spoke about the DBI module, a
common way to connect to databases using perl. The DBI->quote() method can be
used to escape parameters before inserting them into database queries. However,
if the variable passed into the quote method is a list (for example because it
was returned by the aforementioned CGI module), a second parameter can be passed
to the quote method, disabling the normal escaping. This opens the way to
classical SQL injection attacks.
During the whole talk Perl was bashed in a quite aggressive way which offended
some people in the audience, however Netanel defended his presentation stating
that Perl makes it too easy for a developer to write insecure code. From my
personal perspective Perl was not designed for large scale web applications and
even if CGI and other modules exist since decades, Perl should not be
recommended as a programming language for web applications. Nevertheless many
large projects are (still) written in Perl and hence suffer from some of the
described vulnerabilities, which in turn means understanding and patching these
problems is very important even though a less “offending” presentation style
might help to reach more developers.
– Kevin
Traue keinem Scan, den du nicht selbst gefälscht hast by **David Kriesel
**Video
David Kriesel, a researcher at the
University of Bonn, talked about his encounters with Xerox. The American company
makes 26 billion dollars yearly revenue by equipping businesses and government
agencies in the world with copiers and scanners. In the summer 2013 David found
out that the Xerox machines WorkCentre and ColorQube change documents after
scanning.
First he described the problem in detail: The scanner compresses (with JBIG2, an
image compression standard) the image. If it contains text, the device stores
each letter as an image file and remembers where it occurred in the document.
After scanning, the digital document does contain as many letters as its analog
template, but JBIG2 identifies (through pattern matching) pieces that are highly
similar, replacing them with a sort of clone stamped version that saves space.
In his tests David noted that often the number 6 would be turned into an 8.
The error is tricky, because the displayed character is not blurred, illegible
or defaced. It is simply wrong. The bug in the compression algorithm exists
since eight years and users could not do anything against it.
David recommended urgently that, if you use a Xerox machine, you should apply
the potential update which fixes the bug. Since Xerox devices are rarely sold in
a direct way to customers, but mostly office or IT service providers sell the
equipment, it’s more than likely that out there still thousands of Copiers from
Xerox can be found which constantly manipulate documents.
It was an interesting talk that showed if you use a scanner frequently for
processing documents, it might be a good idea to check the digital document
after scanning.
– Ayhan
Too Many Cooks – Exploiting the Internet-of-TR-069-Things by **Lior
Oppenheim and Shahar Tal
**Video
At first the two guys gave a quick
intro tour on TR-069 which is a protocol used by ISPs to configure customer
devices like your ADSL router.
Some findings were already presented earlier at DEFCON22. For that talk, through
portscanning they found out that 1.12% of devices had port 7547 open – which is
next to most open port 80 with 1.77%! As they scanned the port again in November
2014, they got a 1.18% response, which are more than 46m devices in the Internet
of Things. About 2.2m more than the last time.
They identified that in 52% of cases a software called ‘RomPager’ from
AllegroSoft is behind the open port. ‘RomPager’ is an embedded HTTP server. In
98% of the devices version 4.07 is used, which is from 2002 (the current version
provided by AS is 5.4), so there are 11.3m devices out there listening on port
7547 with the old version 4.07.
After some firmware analysis Lior discovered that there is a ZynOS-header in
every firmware, which is a RTOS and also known to be vulnerable for “rom-0”
(CVE-2014-4019).
So they did some manual testing, like fuzzing over HTTP headers and got crashes
on the username sub-header of digest authentication. After following up the code
to find the ‘why?’, they got their exploit #1. Problem is, that you have to
know the exact memory layout – because each device and firmware version has a
different address space layout.
The second vulnerability they found is related to HTTP requests,where the HTTP
handlers structurces could get overwritten.
Finally they presented their current finding: the, as they call it, Misfortune
Cookie. However those magic cookies weren’t shown at all ;).
But, at least, they described how they got there. As the ‘RomPager’ has no
dynamic memory allocation, there might be a pre-allocated cookies array
which can be abused.
They stated that this technique worked on any model of any brand which they had
access to. With a few magic cookies it’s possible to bypass any authentication
and browse with admin privileges on the webinterface.
Countermeasures were discussed as well. Alas, there’s no easy way to get safe.
You could cancel your Internet subscription, use an alternative firmware (if
supported) and, of course, you should pay attention
when buying a new router. Disabling
TR-069 auto-configuration in your router’s settings won’t help either; port 7547
always stays open and the router remains being vulnerable.
The guys contacted the vendors and AllegroSoft. Some patched firmware is already
out and AllegroSoft stated that they can’t force vendors to upgrade to the
latest version of ‘RomPager’.
IMHO this was a very interesting and funny talk, with lots of easy-to-understand
info showing an overall huge security risk.
– Stefan