We’ve finalized the agenda for this year’s IPv6 Security Summit. Here’s an overview of the event:
The “IPv6 Security Summit” is a special two-day convention in the context of the Troopers security conference. It will be run in two tracks of both half-day workshops and 90 minute presentations on specific topics. The goal is to foster the discussion of IPv6 security aspects & issues and to provide practical advice for security officers, network planners and practitioners in the IPv6 security field.
As every year some of us used the holidays to visit the Chaos Communication Congress to socialize with like-minded people and to hear interesting talks.
I mean what other reasons than learning about security might exist to leave behind all your lovely in-laws you’ve been sharing some relative’s house with the days before … 😉
Here is a short recap of some of the talks we found most interesting:
Mining for Bugs with Graph Database Queries by Fabian Yamaguchi Video
One of my favorite talks at this years congress was about the open source tool joern, a code analysis platform for C/C++ applications. Fabian, the main author of joern, presented his work on vulnerability discovery in large code bases. One of the key points of his work is robustness, meaning that the resulting tools should produce meaningful results in large and noisy real world projects even if this results in a loss of accuracy. The second important point is that tools should assist human auditors, not replace them, which seems to be one of the more interesting current research directions (see also this paper). At its core joern combines standard compiler technology with modern graph databases to offer auditors a powerful way to search for certain code constructs. To do this joern parses source code into an AST (Abstract Syntax Tree) and creates the corresponding CFG (Control Flow Graph), as well as a Data Dependency Graph (PDG) for all functions. This creates the Code Property Graph which combines all three representation forms into a single unified layer.
The Code Property Graph is stored inside a graph database (joern uses neo4j), which can be queried using a powerful graph traversal language named gremlin (https://github.com/tinkerpop/gremlin/wiki). The combination of gremlin with some wrapper tools included in joern gives an auditor the possibility to construct powerful search queries against the code base. Fabian presented different queries he used to search for vulnerabilities in the VLC video player, as well as the Linux kernel that resulted in really impressive results (and a high number of discovered vulnerabilities). Joern is definitely a tool you should check out and I’m looking forward to more impressive research by its author.
– Felix
Happy new year and all the best for 2015 to everybody!
Here’s the next round of Troopers15 talks (all the others can be found here):
===
Marion Marschalek & Moti Joseph: The Wallstreet of Windows Binaries FIRST TIME MATERIAL
Synopsis: Nowadays common ways to find exploitable vulnerabilities include but are not limited to fuzzing, static and dynamic analysis and patch reversing. All common approaches have advantages and limits. Fuzzers tend to only find a limited number of bugs, depending on the sophistication of the fuzzer which is indirectly dependent on the development time invested. Reverse engineering a binary for finding bugs, regardless whether statically or with a debugger, is tedious and requires a lot of time and expertise.
As we are lazy bastards, we refuse to do all the work by hand and brain. And, as we are greedy bastards, we want a maximum scope of vulnerabilities we can cover and not be limited to what we see from a fuzzers perspective.
So as you know – in general the lazy greedy bastards have the better ideas. We present you with our idea, which is built after the model of the Wallstreet. We built a tool which weighs the value of a function in a Windows binary as the Wallstreet values a stock; the value telling us the likability of a function to be exploitable.
The Wallstreet technique works with two different evaluation methods, for once the likability that a function is vulnerable and also the likability that it is exploitable.
We collect indicators, which help us evaluate that a specific function is potentially vulnerable. Such could be a present memory allocation or conversion function, a lacking sanitization check or a suspicious pattern in the functionname such as ‘create’, ‘convert’ or ‘set’. A combination of these and a handful more indicators lets us calculate what we call the speculation value.
For the validation of the exploitability we traverse the call tree of a suspicious candidate, to verify its accessibility in an automated way. Only functions which we can influence as an attacker are interesting for us; thus we rate these accessible functions with a price-to-earnings value. Finally putting speculation value and price-to-earnings value in context, we evaluate a function with either ‘buy’ if we believe it comes with an exploitable vulnerability, or with ‘sell’ when we are certain it is not interesting to us. No worries, the presentation will not contain advanced mathematical equations.
Our tool parses binaries and persists all the gathered information to a database, from where we can retrieve highly suspicious functions in an automated way. Without getting our hands dirty, that is. And because we are lazy bastards who like colors, a lot, we use visuals to make evaluation even easier. The tool is dubbed Wallstreet, free after the most famous stock market on the planet. It is based on Python, C and SQLite and will be released under the WTFPL license (http://www.wtfpl.net/). Also, there will be demos 😀
Wrapping it up, this presentation shows an easy to use approach which makes the complicated topic of binary exploitation more accessible. Wallstreet of Windows Binaries provides beginners with better understanding of the challenges and practitioners with a hands-on tool.
As we promised some days ago here’s the fourth round of Troopers15 talks (the first three can be found here). We really can’t wait for the con ourselves 😉 !
Arrigo Triulzi: Pneumonia, Shardan, Antibiotics and Nasty MOV: a Dead Hand’s Tale FIRST TIME MATERIAL
Synopsis: Starting in the 80’s we will discuss the influence of nuclear weapons on the design of an ITsec “Dead Hand” system for a security practitioner, how it merged with research into firmware backdoors and microcode modification and finally triggered when instead of enjoying Summer pneumonia struck unannounced, or rather, announced by the Dead Hand via Twitter.
As we promised some days ago here’s the third round of Troopers15 speakers (first one here, second here). It’s going to be awesome!
Andreas Lindh: Defender Economics FIRST TIME MATERIAL
Synopsis: There are a lot of preconceptions about defense, the most prevalent one probably the “defenders dilemma” in which it is stated that an attacker only needs to find one weakness to compromise a network while a defender needs to defend all of them. While this may be true in a technical sense, things become a lot more complicated once you apply real world considerations. Preconceptions like this are often the foundation on which risk management and ultimately defense strategies are based, something that has led to a number of false but generally accepted assumptions about attackers and their capabilities, and how to defend against them.
This talk will discuss the capabilities, and more importantly the limitations, of different types of attackers. Using the ancient wisdom of the Teenage Mutant Ninja Turtles, the speaker will explain how knowledge of an attacker’s limitations can be leveraged to raise the cost of attack, something that will tip the scale in the defenders favor. The speaker will also explain how different defensive measures will affect different types of attackers, how they are likely to react to them, and in the end how to get them to hopefully move on to another target.
Mike Ossmann: RF Retroreflectors, Emission Security and SDR
Synopsis: The leaked pages from the NSA ANT catalog provided a glimpse into the modern world of emission security. Extending beyond passive monitoring of unintentional emissions, today’s spooks employ active attacks with tools such as RF retroreflectors. I’ll report on my experiments to reproduce such techniques with open source hardware and software, primarily using SDR.
We’re delighted to provide the first announcement of talks of next year’s Troopers edition. Looks like it’s going to be a great event again .
Here we go:
Jacob Torrey – The foundation is rotting and the basement is flooding: A deeper look at the implicit trust relationships in your organization FIRST TIME MATERIAL
Synopsis: In this session, a new hardware-level attack on PCIe is presented as an example for the implicit trust your organization places in 3rd parties. These implicit trust relationships that are typically overlooked will be closely examined under the lens of “InfoSec debt” and providing guidance to InfoSec decision makers on the ROI or risks of adding additional IT services/appliances to an organization’s network.
The “InfoSec debt” metric can then be tracked over time and provides an intuitive way to explain the cost/benefits of IT security to other organizational stakeholders.
I had the pleasure to participate in this year’s Power of Community and was invited to talk about the insecurity of medical devices. The conference is based in Seoul, Korea and started in 2006. It has a strong technical focus and it is a community driven event. For me it was great to participate as mostly hackers from Asia were there and I got the chance to talk to a lot of nice folks that I wouldn’t be able to meet otherwise. This is especially true for the host, vangelis.
We’re currently enjoying the Brazilian sunshine, waiting for H2H2 11’s closing remarks and decided to give you a few details on the past three days. The conference was opened by a short welcome by our fellow Trooper Rodrigo Rubira Branco and stuffed with loads of great talks. This year’s keynotes came from Daniel J. Bernstein and Halvar Flake and gave yet another insight into the ever changing world of InfoSec. The international lineup also included Travis Goodspeed, Sergej Bratus and Fernando Gont. H2HC was a great chance for us to talk to various Hackers from around the world and share our opinions and knowledge.We can only warmly recommend a visit to next year’s H2HC in Sao Paulo.
Many many thanks to Rodrigo, Laila and the rest of the team for an awesome weekend. And a quick hello to all new followers on Insinuator.net, we’re looking forward to meeting you all again, soon.
I know I am a bit late with this post, but I was speaking on the North American IPv6 Summit in Denver three weeks ago. The focus of my talk was on Why IPv6 Security is hard – Structural Deficits of IPv6 & Their Implications (slightly modified/updated from the Troopers IPv6 Security Summit). We consider the NA IPv6 Summit as one of the most important IPv6 events at all and we were happy to contribute to the overall success. The conference was organized for the 7^(th) time by the Rocky Mountain IPv6 Task Force and took place in the Grand Hyatt Denver (37th floor ;-)). Luckily the weather was perfect, and the view of the landscape from the conference rooms was just amazing. I really enjoyed the time in Denver, as the organizer sdid all they could to treat the speaker well J. The talks were of mix of regular research or case-study type talks and some sponsored talks ranging from deployment experience, security and statistics to SDN (Yes, I said it ;)) and the Internet of Things (I said it again ;)). The line-up was nicely put together.
.