Some of the ERNW Crew hit up Black Hat USA and DEFCON. Our own Omar Eissa even gave his first BH and DEFCON talks! See which talk we liked and what inspiration we took home.
BlackHat US 20:
ERNW´s Omar Eissa presented on Cisco Autonomic networks showing how
slides: https://www.blackhat.com/docs/us-17/wednesday/us-17-Eissa-Network-Automation-Isn’t-Your-Safe-Haven-Protocol-Analysis-And-Vulnerabilities-Of-Autonomic-Network.pdf
insinuator blogposts:
https://insinuator.net/2017/03/autonomic-network-overview/
https://insinuator.net/2017/03/autonomic-network-analysis/
https://insinuator.net/2017/04/autonomic-network-vulnerabilities/
BoradPWN
– Speaker: Nitay Artenstein
– Slides:
https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets.pdf
–
Paper:
https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets-wp.pdf
–
Broadly covered in main stream Media –> Wired article, tons of write-ups…link:
https://www.wired.com/story/broadpwn-wi-fi-vulnerability-ios-android/
– Initial Blog Post: https://blog.exodusintel.com/2017/07/26/broadpwn/
– He took a deep dive into the internals of the BCM4354, 4358 and 4359 Wi-Fi
chipsets and found an issue that he exploited to an extent where he created the
world´s first wifi worm.
– This hits most of the mobiles users pretty hard. Affected devices are for
example: Samsung Galaxy from S3 through S8, inclusive All Samsung Notes3. Nexus
5, 6, 6X and 6P, All iPhones after iPhone 5
– An infected device can be used to infect other mobile devices.
– Luckily currently there is no malware that is actively exploiting this issue.
CRACKING THE LENS: TARGETING HTTP’S HIDDEN ATTACK-SURFACE
– Speaker: James Kettle from PortSwigger, @albinowax
– Slides:
https://www.blackhat.com/docs/us-17/wednesday/us-17-Kettle-Cracking-The-Lens-Exploiting-HTTPs-Hidden-Attack-Surface.pdf
–
After looking into an unexpected Pingback the researcher started to dig deeper
into misrouting attacks and thus target auxiliary systems by manipulating the
HTTP Host header and other parts of the HTTP request.
– It is possible to attack internal applications by misrouting requests and thus
access applications behind load balancers and proxies.
– He did so by using burps collaborator feature
– PortSwigger
– Blog:
http://blog.portswigger.net/2017/07/cracking-lens-targeting-https hidden.html
has detailed information.
– Key takeaways: It was shown that minor flaws in reverse proxies can result in
critical vulnerabilities.To achieve defense in depth, reverse proxies should be
firewalled into a hardened DMZ, isolated from anything that isn’t publicly
accessible. Additionally, two tools to identify such vulnerabilities have been
released:
https://github.com/PortSwigger/collaborator-everywhere and
https://github.com/PortSwigger/hackability
Orange Is The New Purple
– Speaker: April C. Wright
– Paper:
https://www.blackhat.com/docs/us-17/wednesday/us-17-Wright-Orange-Is-The-New-Purple-wp.pdf
–
Tackles the challenge of the gap between software builders and security teams.
The “us” vs. “them” mentality when we’re all on the same team.
– Purple Team: A combo of Red and Blue Teams with the primary goal of maximizing
the results of Red Team activities and improve Blue Team capability.
– Orange Team: Structured interactions between Red and Yellow Team members with
the primary goal of providing education/benefits to the Yellow team.
– Investing time now in properly developing Purple and Orange teams lessen risks
in the future.
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi
Cryptographic Handshake
– Speaker: Mathy Vanhoef
– Slides: http://papers.mathyvanhoef.com/blackhat2017-slides.pdf
– Demo: https://youtu.be/XLvXL7HabYM
– It is is a model-based testing for the Wi-Fi handshake. i.e: check whether the
implementation behaves according to documentation.
– They tested different access points, e.g.: OpenBSD, Broadcom, MediaTek (home
routers), Windows, Aironet Windows Hotspots suffers from Denial-of-Service
attacks OpenBSD suffers from unauthenticated permanent DoS
– Broadcom: cipher downgrade attack
DEF CON 25:
———–
A New Era of SSRF – Exploiting URL Parser inTrending Programming
Languages! – Orange Tsai
-slides:
https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Orange-Tsai-A-New-Era-of-SSRF-Exploiting-URL-Parser-in-Trending-Programming-Languages.pdf
– Impressive research and talk.
– Initial Blog post:
http://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html
– Showing how libraries and programming languages handle URLs differently.
– He showed a case study where he chained four vulnerabilities to get code
execution in GitHub enterprise instances.
– By showing his research he introduced a new Attack Surface on SSRF-Bypasses
and New Attack Vectors on Protocol Smuggling.
– Fun with cats n´stuff (There are quite a few adorable cats in the slides!).
Friday the 13th: JSON attacks:
– Speakers Alvaro Muñoz and Oleksandr Mirosh from Hewlett Packard
Enterprise (HPE)
– Slides:
https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Alvaro-Munoz-JSON-attacks.pdf
–
Showing how to attack .NET serializers and JSON serializers and in the end find
a general approach to this attack.
– They compared commonly used libraries used in applications and how they behave
by default and under what circumstances they can be exploited.
– One should never use user-controlled data to define the deserializer expected
Type.
– A key takeaway as so often is not to deserialize untrusted data.
Sources for “Inspiration”:
https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/
http://www.eweek.com/security/black-hat-defcon-2017-security-conferences-to-reveal-new-threats
https://www.blackhat.com/us-17/briefings.html
http://hackaday.com/2017/07/29/broadpwn-all-your-mobiles-are-belong-to-us/http://links.covertchannel.blackhat.com/ctt?kn=11&ms=NTQ1NjA2MzkS1&r=Mjg0MjI4MTM4ODc1S0&b=2&j=MTIwMzkwNzI0MAS2&mt=1&rt=0
Thanks for reading!