We’re sometimes approached with the question “Which IPv6 mailing lists do you
guys read/subscribe to?” – here’s a quick overview of the main ones guys like
Christopher, Patrick, Rafael, Antonios and myself are periodically lurking at,
to discuss IPv6 (network|security) related stuff with other practitioners and
to learn from them:
During our first year of testing Windows Phone 8 applications we had yet
another, let’s say: “surprising” finding. It all started with the first
approaches on pentesting mobile applications on that new and rather closed
platform. Lacking jailbreak, root, and similar approaches we had a closer look
at alternate approaches to have a look at an apps interior. We quickly hooked
onto using modified firmwares (with deeper system access) and found a perfect
solution in a little flaw concerning the handling of SD cards in WP8.1. A flaw
that was, sadly for us, fixed silently….
Just recently, Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers
published details (see
http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/
) on a especially nasty piece of malware that bypasses authentication on Active
Directory (AD) systems which implement single-factor (password only)
authentication. Once deployed the malware stays quite noiseless in the Domain
Controller´s (DC) RAM, and the DC´s replication issues caused by it weren´t
interpreted – in this case – during months as a hint for system compromise.
Probably the malware´s modification on the LSASS process reduced the DC´s
ability to perform DC-to-DC authentication, but this is only speculation and not
where we would like to go today.
during our BlackHat US 2014 talk titled
“Evasion of High-End IPS Devices in the Age of IPv6”,
among others we discussed a Snort preprocessor rule (116:456) which, when
enabled (not the case by default), triggers an alert when an IPv6 datagram with
nine (9) or more IPv6 Extension Headers is used (such a header was used by us to
evade Snort). However, we mentioned that:
As every year some of us used the holidays to visit the Chaos Communication
Congress to socialize with like-minded people and to hear interesting talks.
I mean what other reasons than learning about security might exist to leave
behind all your lovely in-laws you’ve been sharing some relative’s house with
the days before … 😉
Here is a short recap of some of the talks we found most interesting:
Mining for Bugs with Graph Database Queries by Fabian Yamaguchi Video
One of my favorite talks at this years congress was about the open source tool
joern, a code analysis platform for C/C++
applications. Fabian, the main author of joern, presented his work on
vulnerability discovery in large code bases. One of the key points of his work
is robustness, meaning that the resulting tools should produce meaningful
results in large and noisy real world projects even if this results in a loss of
accuracy. The second important point is that tools should assist human auditors,
not replace them, which seems to be one of the more interesting current research
directions (see also
this paper).
At its core joern combines standard compiler technology with modern graph
databases to offer auditors a powerful way to search for certain code
constructs. To do this joern parses source code into an AST (Abstract Syntax
Tree) and creates the corresponding CFG (Control Flow Graph), as well as a Data
Dependency Graph (PDG) for all functions. This creates the Code Property Graph
which combines all three representation forms into a single unified layer.
The Code Property Graph is stored inside a graph database (joern uses
neo4j), which can be queried using a powerful graph
traversal language named gremlin
(https://github.com/tinkerpop/gremlin/wiki). The combination of gremlin with
some wrapper tools included in joern gives an auditor the possibility to
construct powerful search queries against the code base. Fabian presented
different queries he used to search for vulnerabilities in the VLC video player,
as well as the Linux kernel that resulted in really impressive results (and a
high number of discovered vulnerabilities). Joern is definitely a tool you
should check out and I’m looking forward to more impressive research by its
author.
– Felix
RA Guard Evasion is well-known in the IPv6 “circles”; there is
RFC 7113 Advice for IPv6 Router
Advertisement Guard (RA-Guard) and many interesting blog-posts like this
one here,
here,
and this excellent write-up
here that discuss
this issue.
Moreover, as Jim Smalls states in his comprehensive
“IPv6 Attacks and Countermeasures”
presentation given at the
North American IPv6 Summit 2013,
DHCPv6 Guard or a corresponding IPv6 ACL can stop a DHCPv6 Rogue Servers, but
(only?) for non-malicious/non-fragmented DHCPv6 packets (slide 35). However, at
that time there wasn’t any known attack tool in the wild that had the
fragmentation evasion built in.
Most of you are probably aware of the recently discovered/-closed severe ntpd
vulnerabilities (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296, see
also
the initial ntp.org security notice).
Some days ago the Project Zero team at Google published a blog post
“Finding and exploiting ntpd vulnerabilities”
with additional details. In this one they mentioned a seemingly minor but quite
important detail: on a default OS X installation one of the built-in protection
mechanisms of ntpd (that is the restriction to process certain packets only if
they are sourced on the local machine) can easily be circumvented by sending
IPv6 packets with a spoofed source address of ::1 (the equivalent to 127.0.0.1
in IPv4 which would be discarded by the kernel once received from an external
source).
We’re currently starting the preparation for the
Troopers15PacketWars Challenge, and since I’ve participated in
quite some CTF games and have been involved in the preparation of a number of
PacketWars Battles, I thought I’d write down some thoughts on the design of
hacking challenges.
First of all, my experience is limited almost exclusively to attack-defend-CTFs
or interactive war games (such as PacketWars or
CCDC).
While thinking about this blogpost, I also came across several terms which are
used, so I decided to give a short summary:
Happy new year and all the best for 2015 to everybody!
Here’s the next round of Troopers15 talks (all the others can be found
here):
===
Marion Marschalek & Moti Joseph: The Wallstreet of Windows Binaries
FIRST TIME MATERIAL
Synopsis: Nowadays common ways to find exploitable vulnerabilities include
but are not limited to fuzzing, static and dynamic analysis and patch reversing.
All common approaches have advantages and limits. Fuzzers tend to only find a
limited number of bugs, depending on the sophistication of the fuzzer which is
indirectly dependent on the development time invested. Reverse engineering a
binary for finding bugs, regardless whether statically or with a debugger, is
tedious and requires a lot of time and expertise.
As we are lazy bastards, we refuse to do all the work by hand and brain. And, as
we are greedy bastards, we want a maximum scope of vulnerabilities we can cover
and not be limited to what we see from a fuzzers perspective.
So as you know – in general the lazy greedy bastards have the better ideas. We
present you with our idea, which is built after the model of the Wallstreet. We
built a tool which weighs the value of a function in a Windows binary as the
Wallstreet values a stock; the value telling us the likability of a function to
be exploitable.
The Wallstreet technique works with two different evaluation methods, for once
the likability that a function is vulnerable and also the likability that it is
exploitable.
We collect indicators, which help us evaluate that a specific function is
potentially vulnerable. Such could be a present memory allocation or conversion
function, a lacking sanitization check or a suspicious pattern in the
functionname such as ‘create’, ‘convert’ or ‘set’. A combination of these and a
handful more indicators lets us calculate what we call the speculation value.
For the validation of the exploitability we traverse the call tree of a
suspicious candidate, to verify its accessibility in an automated way. Only
functions which we can influence as an attacker are interesting for us; thus we
rate these accessible functions with a price-to-earnings value. Finally putting
speculation value and price-to-earnings value in context, we evaluate a function
with either ‘buy’ if we believe it comes with an exploitable vulnerability, or
with ‘sell’ when we are certain it is not interesting to us. No worries, the
presentation will not contain advanced mathematical equations.
Our tool parses binaries and persists all the gathered information to a
database, from where we can retrieve highly suspicious functions in an automated
way. Without getting our hands dirty, that is. And because we are lazy bastards
who like colors, a lot, we use visuals to make evaluation even easier. The tool
is dubbed Wallstreet, free after the most famous stock market on the planet. It
is based on Python, C and SQLite and will be released under the WTFPL license
(http://www.wtfpl.net/). Also, there will be demos 😀
Wrapping it up, this presentation shows an easy to use approach which makes the
complicated topic of binary exploitation more accessible. Wallstreet of Windows
Binaries provides beginners with better understanding of the challenges and
practitioners with a hands-on tool.
As follow up of our 2014 talk
“LTE vs. Darwin”
I want to inform you about our telco research in 2015. We are currently dealing
with the so called IP Multimedia Subsystem (IMS), which handles the call and
media logic of 4G telecommunication networks. This network part provides
functions like VoIP (or VoLTE) and takes care of the interconnection to other
call or media related networks.