Happy new year and all the best for 2015 to everybody!
Here’s the next round of Troopers15 talks (all the others can be found here):
===
Marion Marschalek & Moti Joseph: The Wallstreet of Windows Binaries FIRST TIME MATERIAL
Synopsis: Nowadays common ways to find exploitable vulnerabilities include but are not limited to fuzzing, static and dynamic analysis and patch reversing. All common approaches have advantages and limits. Fuzzers tend to only find a limited number of bugs, depending on the sophistication of the fuzzer which is indirectly dependent on the development time invested. Reverse engineering a binary for finding bugs, regardless whether statically or with a debugger, is tedious and requires a lot of time and expertise.
As we are lazy bastards, we refuse to do all the work by hand and brain. And, as we are greedy bastards, we want a maximum scope of vulnerabilities we can cover and not be limited to what we see from a fuzzers perspective.
So as you know – in general the lazy greedy bastards have the better ideas. We present you with our idea, which is built after the model of the Wallstreet. We built a tool which weighs the value of a function in a Windows binary as the Wallstreet values a stock; the value telling us the likability of a function to be exploitable.
The Wallstreet technique works with two different evaluation methods, for once the likability that a function is vulnerable and also the likability that it is exploitable.
We collect indicators, which help us evaluate that a specific function is potentially vulnerable. Such could be a present memory allocation or conversion function, a lacking sanitization check or a suspicious pattern in the functionname such as ‘create’, ‘convert’ or ‘set’. A combination of these and a handful more indicators lets us calculate what we call the speculation value.
For the validation of the exploitability we traverse the call tree of a suspicious candidate, to verify its accessibility in an automated way. Only functions which we can influence as an attacker are interesting for us; thus we rate these accessible functions with a price-to-earnings value. Finally putting speculation value and price-to-earnings value in context, we evaluate a function with either ‘buy’ if we believe it comes with an exploitable vulnerability, or with ‘sell’ when we are certain it is not interesting to us. No worries, the presentation will not contain advanced mathematical equations.
Our tool parses binaries and persists all the gathered information to a database, from where we can retrieve highly suspicious functions in an automated way. Without getting our hands dirty, that is. And because we are lazy bastards who like colors, a lot, we use visuals to make evaluation even easier. The tool is dubbed Wallstreet, free after the most famous stock market on the planet. It is based on Python, C and SQLite and will be released under the WTFPL license (http://www.wtfpl.net/). Also, there will be demos 😀
Wrapping it up, this presentation shows an easy to use approach which makes the complicated topic of binary exploitation more accessible. Wallstreet of Windows Binaries provides beginners with better understanding of the challenges and practitioners with a hands-on tool.
Bios
Marion is malware reverse engineer. Some say she also does marketing, but at the time of writing she could not be reached to further comment on that. At daytime she hunts malware for Cyphort Inc., at nighttime she hunts rabbits. Two years ago Marion won Halvar Flake’s reverse engineering challenge for females, since then she set out to rock and roll the industry. She practices martial arts and has a vivid passion to take things apart. Preferably, other people’s things.
Marion’s recent publications include:
EvilBunny: Suspect #4 [November 2014]
Not old enough to be forgotten: the new chic of Visual Basic 6 [Virus Bulletin, July 2014]
Analysis Report Trojan-Downloader.Win32.Upatre [February 2014]
Moti Joseph has been involved in computer security. In the last few years he has been working on reverse engineering exploit code and developing security products. Moti has been speaking at Black Hat Las Vegas 2007, CONF2009 & CONF2010 in Poland, POC 2009 & 2010 in South Korea, ShakaCon 2009 in USA, CHINA 2011 at Shanghai Jiao Tong University, NopCON 2012 in Istanbul and SysCan2010 Taiwan, Taipe.
Also, Moti’s work is so secret, he never publishes anything.
At Troopers14 they presented “What Happens In Windows 7 Stays In Windows 7“.
Innovation Aspects
Automation is crucial in security research, as much as data analysis is crucial for process automation. The Wallstreet Of Windows Binaries is a follow-up project to a tool named DiffRay, which we started in 2013. DiffRay was successful, but required a lot of work to be done manually and also a lot of expertise and dedicated time for evaluation of results. The Wallstreet tool aims to cover a much broader scope of vulnerabilities with less manual effort. We believe, by providing tools for the community and our findings and insights we empower a greater collective understanding of the subject.
===
Martijn Grooten: The State of Email in 2015 FIRST TIME MATERIAL
Synopsis: Back in the early 1980s, when email was invented, the Internet population was many orders of magnitude smaller than four million. The small group of people that used the Internet knew each other and they adhered to this thing called ‘netiquette’, so they wouldn’t send each other unwanted emails. They definitely wouldn’t read each other’s emails, even if they could.
That 1980s Internet has changed beyond recognition in the three decades since. But email is still more or less the same. In this presentation we will look at the state of email in 2015. Does spam show that email is broken? Do the Snowden revelations show that it is? Or will the migration towards IPv6 break it? And what is being done to fix these issues?
Bio: Martijn Grooten is Editor of Virus Bulletin. A mathematician turned security researcher, he has been running comparative tests on spam filters for six years. He has a broad interest in security and has spoken on various topics at a number of conferences. He holds a number of regularly changing opinions.
===
Antonios Atlasis, Enno Rey & Jayson Salazar: MLD Considered Harmful – Breaking Another IPv6 Subprotocol IPv6 Security Summit
Synopsis: Multicast Listener Discovery (MLD) and its successor, MLDv2, is a protocol of the IPv6 suite used by IPv6 routers for discovering multicast listeners on a directly attached link,
much like IGMP is used in IPv4. Most of the modern Operating Systems (OS), like Windows, Linux and FreeBSD, not only come pre-configured with IPv6 enabled, but they also start-up by
sending MLDv2 traffic, which is repeated periodically. Despite of the out-of-the-box usage of MLDv2, it is one of the IPv6 protocols that have not be studied yet to a suitable extent,
especially as far as its potential security implications are concerned. These ones can vary from OS fingerprinting on the local-link by sniffing the wire passively, to amplified DoS
attacks. In this presentation, we will first study and analyse the default behaviour of some of the most popular OS. During this study, we will examine whether the specific OS
implementations conform to the security measures defined by the corresponding RFCs, and if not, what are the potential security implications. Then, by diving into the specifications of the
protocol, we will discuss potential security issues related with the design of MLD and how they can be exploited by attackers. Finally, specific security mitigation techniques will be
proposed to defend against them, which will allow us to to secure IPv6 networks to the best possible extent in the emerging IPv6 era. There will be demos and a tool release. 😉
This is an updated version of our DeepSec talk.
Bios
Antonios Atlasis (MPhil, PhD) has been an IT engineer for more than 20 years, developer and instructor in several Computer Science and Computer Security related fields. The last decade he
has specialised in IT Security, working mainly as a penetration tester, incident handler and intrusion analyst. His latest security researches focuses on IPv6 and some of his work has been
presented at BlackHat Europe 2012, BlackHat Abu Dhabi 2012, at the IPv6 Security Summit of Troopers13 and at Troopers14. He is the author of Chiron and regularly contributes to the Insinuator IPv6 Blog.
Enno Rey is a long-term network security geek who loves to explore devices & protocols, and to break flawed ones. He has been involved with IPv6 since 1999.
Jayson Salazar currently works as a penetration tester at ERNW GmbH. The focus of his work lies mostly in the areas of application and network security, at the moment especially IPv6. In
addition to security trainings, he actively takes part in security assesments of network infrastructures and web applications in enterprise environments.
===
Paul Coggin: Defending the Enterprise Against Network Infrastructure Threats
Synopsis: Learn about network attack vectors that an adversary can use to control, and influence network traffic flows and exfiltrate data by exploiting network devices and protocols in enterprise or service provider networks. Defensive methods and techniques for monitoring and protecting against the outlined attack vectors will be discussed. This presentation explores advanced methods and techniques that the CISO, network and security architects and security auditors need to understand about network infrastructure and protocols. Understand how routing infrastructure can be compromised to enable sophisticated pivoting and exfiltration of data. Know how to analyze often over looked network trust relationships, integration, dependencies and interdependencies in the enterprise and service provider network architecture. Review the architecture and operations for border gateway protocol (BGP) services with references to the recent BGP prefix hijacking attacks. The discussion will cover how Multi-protocol Label Switch (MPLS) networks may be attacked without the Enterprise being aware of the event. Strategies for monitoring and securing enterprise networks including BGP and MPLS against the threats vectors presented will be discussed.
Bio: Paul Coggin is a Senior Principal Cyber Security Analyst with Dynetics, Inc in Huntsville, Alabama. Paul is responsible for architecting and securing large complex tactical, critical infrastructure and service provider networks as well as teaching networking and security courses. Paul is a Cisco Systems Certified Instructor # 32230, Certified EC-Council Instructor and a certified SCADA security architect. He has a BS in Mathematics, an MS in Computer Information Systems, an MS in Information Assurance and Security and he is currently pursuing an MS in Systems Management.
===
Ertunga Arsal: SAP, Credit Cards and the Bird that Talks Too Much SAP Security Track
Synopsis: SAP applications build the business backbone of the largest organizations in the world. In this presentation, exploits will be shown manipulating a business process to extract money, critical payment information, and credit card data out of the business backbone. Follow the bird and enjoy tweets of data that will interest you.
Bio: Ertunga Arsal is the founder of ESNC, a company specialized in SAP security products. ESNC developed the first product to automate the complete security and patching process for SAP. Previously, he worked with Tech Data (Nasdaq:TECD) for many years as a security consultant and was responsible for SAP and applications security of the EMEA region. Being part of the incident response team, he commonly took the lead on numerous investigations. Ertunga is an active security researcher and alone in 2013, SAP has released more than 75 security patches for the vulnerabilities he reported. Ertunga also lectures on Systems and Network Security at Sabanci University for postgraduates.
===
Patrick Thomas: Multipath TCP Breaking Today’s Networks with Tomorrow’s Protocols
Synopsis: MultiPath TCP (MPTCP) is an extension to TCP that enables sessions to use multiple network endpoints and multiple network paths at the same time, and to change addresses in the middle of a connection. MPTCP works transparently over most existing network infrastructure, yet very few security and network management tools can correctly interpret MPTCP streams. With MPTCP network security is changed: how do you secure traffic when you can’t see it all and when the endpoint addresses change in the middle of a connection?
This session shows you how MPTCP breaks assumptions about how TCP works, and how it can be used to evade security controls. We will also show tools and strategies for understanding and mitigating the risk of MPTCP-capable devices on a network.
Bio: Patrick Thomas is a recovering software developer turned penetration tester with Neohapsis (now Cisco). He works on offensive and defensive security tools, with an emphasis on web application security, web malware, and social engineering. He has previously spoken at Black Hat, DEFCON, SecTor, AppSec Cali, and others.
===
More talks to follow soon, so stay tuned 
.
See you @Troopers & have a great weekend
Enno