Hi there,
Like in recent years the popular
Hacking 101 workshop
will take place on TROOPERS17, too! The workshop will give attendees an insight
into the hacking techniques required for penetration testing. These
techniques will cover various topics:
information gathering
network scanning
web application hacking
low-level exploitation
…and more!
During this workshop you will learn, step by step, a testing methodology
that is applicable to the majority of scenarios. So imagine you have to
assess the security of a system running on the Internet. How would you
start? First, you need a good understanding about the target, including running
services or related systems. Just scanning an IP will most likely not reveal
a lot of information about the system. The gathered information may help you to
identify communication relations of services that could include vulnerabilities.
A brief understanding of the target and it’s related
systems/services/applications will make scanning and identifying
vulnerabilities a lot easier and more effective. Then, the last step will be
the exploitation of the identified vulnerabilities, with the ultimate aim to
get access to the target system and pivot to other, probably internal,
systems and resources.
Jenkins is a continuous integration server, widely
used in Java environments for building automation and deployment. The project
recently disclosed an unauthenticated remote code execution vulnerability
discovered by Moritz Bechler. Depending on the development environment, a
Jenkins server can be a critical part of the infrastructure: It often creates
the application packages that later will be deployed on production application
servers. If an attacker can execute arbitrary code, s/he can easily manipulate
those packages and inject additional code. Another scenario would be that the
attacker stealing credentials, like passwords, private keys that are used for
authentication in the deployment process or similar.
The HITBSecConf or “Hack In The Box” in Amsterdam is a well known security
conference in Europe. We also attended this year too, and there were quite some
interesting talks at the HITBSecConf16 conference. One of the talks was about
“New Methods for Exploiting ORM Injections in Java Applications” by the security
researchers Mikhail Egorov and Sergey Soldatov.
I. What is Object-Relational Mapping (ORM)?
ORM stands for Object-Relational Mapping, which is a technique that
automatically converts data from a relational database management system (RDBMS)
into objects. This is often used in business applications of today.
At the Troopers 16 Casey Smith has given a talk about the gap in Application
Whitelisting.
Application Whitelisting is a technique that should prevent malware and
unauthorized applications from running. Broadly speaking this is implemented by
deciding if an application is trusted or not before executing it. Casey’s talk
gave an understanding where this whitelisiting fails down.
In his introduction about the architecture he reminded us: There is no perfect
defense. It is important to understand how the defenses work and where they
fail. In the difference to exploits, which can be patched, there is no
possibility to patch architecture flaws.
At the TROOPERS’15 Jacob l. Torrey held a track about LangSec-Aware Software
Development Lifecycle. He talked about programming conventions and what tools
can be used for enforcing the compliance. There is a lack of metrics to
understand what make software more secure or less secure. His main goals was to
show that LangSec has far-reaching impacts into software security and to give
the audience a framework to transform the theory into practice. A SLDC should
help to find bugs sooner in the development process and reduce defect rate in
production thereby. A lower defect rate in production does not only improve
security it also reduces costs.
