We’ve finalized the agenda for this year’s IPv6 Security Summit. Here’s an
overview of the event:
The “IPv6 Security Summit” is a special two-day convention in the context of the
Troopers security conference. It will be
run in two tracks of both half-day workshops and 90 minute presentations on
specific topics. The goal is to foster the discussion of IPv6 security aspects &
issues and to provide practical advice for security officers, network planners
and practitioners in the IPv6 security field.
As every year some of us used the holidays to visit the Chaos Communication
Congress to socialize with like-minded people and to hear interesting talks.
I mean what other reasons than learning about security might exist to leave
behind all your lovely in-laws you’ve been sharing some relative’s house with
the days before … 😉
Here is a short recap of some of the talks we found most interesting:
Mining for Bugs with Graph Database Queries by Fabian Yamaguchi Video
One of my favorite talks at this years congress was about the open source tool
joern, a code analysis platform for C/C++
applications. Fabian, the main author of joern, presented his work on
vulnerability discovery in large code bases. One of the key points of his work
is robustness, meaning that the resulting tools should produce meaningful
results in large and noisy real world projects even if this results in a loss of
accuracy. The second important point is that tools should assist human auditors,
not replace them, which seems to be one of the more interesting current research
directions (see also
this paper).
At its core joern combines standard compiler technology with modern graph
databases to offer auditors a powerful way to search for certain code
constructs. To do this joern parses source code into an AST (Abstract Syntax
Tree) and creates the corresponding CFG (Control Flow Graph), as well as a Data
Dependency Graph (PDG) for all functions. This creates the Code Property Graph
which combines all three representation forms into a single unified layer.
The Code Property Graph is stored inside a graph database (joern uses
neo4j), which can be queried using a powerful graph
traversal language named gremlin
(https://github.com/tinkerpop/gremlin/wiki). The combination of gremlin with
some wrapper tools included in joern gives an auditor the possibility to
construct powerful search queries against the code base. Fabian presented
different queries he used to search for vulnerabilities in the VLC video player,
as well as the Linux kernel that resulted in really impressive results (and a
high number of discovered vulnerabilities). Joern is definitely a tool you
should check out and I’m looking forward to more impressive research by its
author.
– Felix
Happy new year and all the best for 2015 to everybody!
Here’s the next round of Troopers15 talks (all the others can be found
here):
===
Marion Marschalek & Moti Joseph: The Wallstreet of Windows Binaries
FIRST TIME MATERIAL
Synopsis: Nowadays common ways to find exploitable vulnerabilities include
but are not limited to fuzzing, static and dynamic analysis and patch reversing.
All common approaches have advantages and limits. Fuzzers tend to only find a
limited number of bugs, depending on the sophistication of the fuzzer which is
indirectly dependent on the development time invested. Reverse engineering a
binary for finding bugs, regardless whether statically or with a debugger, is
tedious and requires a lot of time and expertise.
As we are lazy bastards, we refuse to do all the work by hand and brain. And, as
we are greedy bastards, we want a maximum scope of vulnerabilities we can cover
and not be limited to what we see from a fuzzers perspective.
So as you know – in general the lazy greedy bastards have the better ideas. We
present you with our idea, which is built after the model of the Wallstreet. We
built a tool which weighs the value of a function in a Windows binary as the
Wallstreet values a stock; the value telling us the likability of a function to
be exploitable.
The Wallstreet technique works with two different evaluation methods, for once
the likability that a function is vulnerable and also the likability that it is
exploitable.
We collect indicators, which help us evaluate that a specific function is
potentially vulnerable. Such could be a present memory allocation or conversion
function, a lacking sanitization check or a suspicious pattern in the
functionname such as ‘create’, ‘convert’ or ‘set’. A combination of these and a
handful more indicators lets us calculate what we call the speculation value.
For the validation of the exploitability we traverse the call tree of a
suspicious candidate, to verify its accessibility in an automated way. Only
functions which we can influence as an attacker are interesting for us; thus we
rate these accessible functions with a price-to-earnings value. Finally putting
speculation value and price-to-earnings value in context, we evaluate a function
with either ‘buy’ if we believe it comes with an exploitable vulnerability, or
with ‘sell’ when we are certain it is not interesting to us. No worries, the
presentation will not contain advanced mathematical equations.
Our tool parses binaries and persists all the gathered information to a
database, from where we can retrieve highly suspicious functions in an automated
way. Without getting our hands dirty, that is. And because we are lazy bastards
who like colors, a lot, we use visuals to make evaluation even easier. The tool
is dubbed Wallstreet, free after the most famous stock market on the planet. It
is based on Python, C and SQLite and will be released under the WTFPL license
(http://www.wtfpl.net/). Also, there will be demos 😀
Wrapping it up, this presentation shows an easy to use approach which makes the
complicated topic of binary exploitation more accessible. Wallstreet of Windows
Binaries provides beginners with better understanding of the challenges and
practitioners with a hands-on tool.
As we promised some days ago here’s the fourth round of Troopers15 talks (the
first three can be found here). We really
can’t wait for the con ourselves 😉 !
Arrigo Triulzi: Pneumonia, Shardan, Antibiotics and Nasty MOV: a Dead Hand’s
Tale FIRST TIME MATERIAL
Synopsis: Starting in the 80’s we will discuss the influence of nuclear weapons
on the design of an ITsec “Dead Hand” system for a security practitioner, how it
merged with research into firmware backdoors and microcode modification and
finally triggered when instead of enjoying Summer pneumonia struck unannounced,
or rather, announced by the Dead Hand via Twitter.
As we promised some days ago here’s the third round of Troopers15 speakers
(first
one here,
second
here).
It’s going to be awesome!
Andreas Lindh: Defender Economics FIRST
TIME MATERIAL
Synopsis: There are a lot of preconceptions about defense, the most prevalent
one probably the “defenders dilemma” in which it is stated that an attacker only
needs to find one weakness to compromise a network while a defender needs to
defend all of them. While this may be true in a technical sense, things become a
lot more complicated once you apply real world considerations. Preconceptions
like this are often the foundation on which risk management and ultimately
defense strategies are based, something that has led to a number of false but
generally accepted assumptions about attackers and their capabilities, and how
to defend against them.
This talk will discuss the capabilities, and more importantly the limitations,
of different types of attackers. Using the ancient wisdom of the Teenage Mutant
Ninja Turtles, the speaker will explain how knowledge of an attacker’s
limitations can be leveraged to raise the cost of attack, something that will
tip the scale in the defenders favor. The speaker will also explain how
different defensive measures will affect different types of attackers, how they
are likely to react to them, and in the end how to get them to hopefully move on
to another target.
Mike Ossmann: RF Retroreflectors, Emission
Security and SDR
Synopsis: The leaked pages from the NSA ANT catalog provided a glimpse into the
modern world of emission security. Extending beyond passive monitoring of
unintentional emissions, today’s spooks employ active attacks with tools such as
RF retroreflectors. I’ll report on my experiments to reproduce such techniques
with open source hardware and software, primarily using SDR.
We’re delighted to provide the first announcement of talks of next year’s
Troopers edition. Looks like it’s going to be a
great event again
.
Here we go:
Jacob Torrey – The foundation is rotting and the basement is flooding: A deeper
look at the implicit trust relationships in your organization FIRST
TIME MATERIAL
Synopsis: In this session, a new hardware-level attack on PCIe is presented as
an example for the implicit trust your organization places in 3rd parties. These
implicit trust relationships that are typically overlooked will be closely
examined under the lens of “InfoSec debt” and providing guidance to InfoSec
decision makers on the ROI or risks of adding additional IT services/appliances
to an organization’s network.
The “InfoSec debt” metric can then be tracked over time and provides an
intuitive way to explain the cost/benefits of IT security to other
organizational stakeholders.
I had the pleasure to participate in this year’s
Power of Community
and was invited to talk about the insecurity of medical devices. The conference
is based in Seoul, Korea and started in 2006. It has a strong technical focus
and it is a community driven event. For me it was great to participate as mostly
hackers from Asia were there and I got the chance to talk to a lot of nice folks
that I wouldn’t be able to meet otherwise. This is especially true for the host,
vangelis.
We’re currently enjoying the Brazilian sunshine, waiting for H2H2 11’s closing
remarks and decided to give you a few details on the past three days. The
conference was opened by a short welcome by our fellow Trooper Rodrigo Rubira
Branco and stuffed with loads of great talks. This year’s keynotes came from
Daniel J. Bernstein and Halvar Flake and gave yet another insight into the ever
changing world of InfoSec. The international lineup also included Travis
Goodspeed, Sergej Bratus and Fernando Gont. H2HC was a great chance for us to
talk to various Hackers from around the world and share our opinions and
knowledge.We can only warmly recommend a visit to next year’s H2HC in Sao
Paulo.
Many many thanks to Rodrigo, Laila and the rest of the team for an awesome
weekend. And a quick hello to all new followers on Insinuator.net, we’re looking
forward to meeting you all again, soon.
I know I am a bit late with this post, but I was speaking on the
North American IPv6 Summit
in Denver three weeks ago. The focus of my talk was on
Why IPv6 Security is hard – Structural Deficits of IPv6 & Their Implications
(slightly modified/updated from the
Troopers IPv6 Security Summit).
We consider the NA IPv6 Summit as one of the most important IPv6 events at all
and we were happy to contribute to the overall success. The conference was
organized for the 7^(th) time by the
Rocky Mountain IPv6 Task Force and took place in the
Grand Hyatt Denver (37th floor ;-)). Luckily the weather was perfect, and the
view of the landscape from the conference rooms was just amazing. I really
enjoyed the time in Denver, as the organizer sdid all they could to treat the
speaker well J. The talks were of mix of regular research or case-study type
talks and some sponsored talks ranging from deployment experience, security and
statistics to SDN (Yes, I said it ;)) and the Internet of Things (I said it
again ;)). The line-up was nicely put together.
.