This is a guest post from Vladimir Wolstencroft, to provide some details of his
upcoming
#TR15 talk.
What do you get when you combine a security appliance vendor, a bug bounty
program, readily available virtualised machines, a lack of understanding of best
security practices and broken crypto?
Ownage, a good story and maybe even that bounty…
Focusing on Barracuda’s numerous security appliances, this talk will detail bug
hunting methods and the principles used to examine these machines:
Starting with a black box test and the challenges that this approach poses, to
decrypting the firmware, getting system root, bricking the box, fighting the
(de)activation methods, getting system root again, DOS’ing the VM host and
finally using Barracuda’s own source code to find those vulnerabilities that
otherwise would be invisible or impossible to find! There were also some
unexpected outcomes that followed…
We have pretty much finalized the agenda for the
Troopers TelcoSecDay and here’s another
cool talk (the others can be found
here,
here and
here):
Rob Kuiters: On her majesty’s secret service – GRX and a Spy Agency
Synopsis: In 2013 the GPRS Roaming eXchange (GRX) was in mainstream media as
part of the high profile Edward Snowden revelations. The leaked documents
indicated that the UK government’s intelligence organisation, Government
Communications Headquarters’ (GCHQ) hacked the Belgian GRX provider, Belgacom
International Carrier Services (BICS). They did this by targeting the GRX
provider’s employees with the ultimate aim of gaining access to Belgacom’s Core
GRX routers. Allegedly, GCHQ hacked the GRX routers in order to carry out
man-in-the middle “traffic sniffing” attacks against mobile users who are
roaming with smartphones or other devices capable of handling data.
in addition to those
recently announced and
these,
we’ve identified three more suitable talks for the TelcoSecDay
.
These are:
Hendrik Schmidt: Security Aspects of VoLTE
Synopsis: VoLTE is on its rise in mobile telecommunications. The service is
provided by the IP Multimedia Subsystem (IMS) which consists of a couple of
components. All those components offer new and, from an attacker’s perspective,
interesting interfaces. This talk evaluates the most interesting interfaces and
demonstrates attack vectors an attacker could abuse. This covers attacks from
customer access, Internet VoIP services and roaming exchange.
in addition to those
recently announced
we’ve identified two more suitable talks for the TelcoSecDay 😉
These are
Ravishankar Borgaonkar – TelcoSecurity Mirage: 1G to 5G
Synopsis: The evolution of the mobile networking technology from 1G to 5G is
driving the needs of our modern Digital Society. In this talk, we visit the
security pillars of these technologies and discuss if 5G can strengthen them or
not from an end-users perspective. In particular, we try to fill up security
requirements for 5G networks based on the ongoing design direction.
At Troopers15 there will be another
TelcoSecDay, like in the years before
(2014,
2013,
2012). Here’s the
first three talks (of overall 5-6):
Luca Bruno: Through the Looking-Glass, and What Eve Found There
Synopsis: Traditionally, network operators have provided some kind of public
read-only access to their current view of the BGP routing table, by the means of
a “looking glass”.
In this talk we inspect looking glass instances from a security point of view,
showing many shortcomings and flaws which could let a malicious entity take
control of critical devices connected to them. In particular, we will highlight
how easy it is for a low-skilled attacker to gain access to core routers within
multiple ISP infrastructures.
We’ve finalized the agenda for this year’s IPv6 Security Summit. Here’s an
overview of the event:
The “IPv6 Security Summit” is a special two-day convention in the context of the
Troopers security conference. It will be
run in two tracks of both half-day workshops and 90 minute presentations on
specific topics. The goal is to foster the discussion of IPv6 security aspects &
issues and to provide practical advice for security officers, network planners
and practitioners in the IPv6 security field.
Happy new year and all the best for 2015 to everybody!
Here’s the next round of Troopers15 talks (all the others can be found
here):
===
Marion Marschalek & Moti Joseph: The Wallstreet of Windows Binaries
FIRST TIME MATERIAL
Synopsis: Nowadays common ways to find exploitable vulnerabilities include
but are not limited to fuzzing, static and dynamic analysis and patch reversing.
All common approaches have advantages and limits. Fuzzers tend to only find a
limited number of bugs, depending on the sophistication of the fuzzer which is
indirectly dependent on the development time invested. Reverse engineering a
binary for finding bugs, regardless whether statically or with a debugger, is
tedious and requires a lot of time and expertise.
As we are lazy bastards, we refuse to do all the work by hand and brain. And, as
we are greedy bastards, we want a maximum scope of vulnerabilities we can cover
and not be limited to what we see from a fuzzers perspective.
So as you know – in general the lazy greedy bastards have the better ideas. We
present you with our idea, which is built after the model of the Wallstreet. We
built a tool which weighs the value of a function in a Windows binary as the
Wallstreet values a stock; the value telling us the likability of a function to
be exploitable.
The Wallstreet technique works with two different evaluation methods, for once
the likability that a function is vulnerable and also the likability that it is
exploitable.
We collect indicators, which help us evaluate that a specific function is
potentially vulnerable. Such could be a present memory allocation or conversion
function, a lacking sanitization check or a suspicious pattern in the
functionname such as ‘create’, ‘convert’ or ‘set’. A combination of these and a
handful more indicators lets us calculate what we call the speculation value.
For the validation of the exploitability we traverse the call tree of a
suspicious candidate, to verify its accessibility in an automated way. Only
functions which we can influence as an attacker are interesting for us; thus we
rate these accessible functions with a price-to-earnings value. Finally putting
speculation value and price-to-earnings value in context, we evaluate a function
with either ‘buy’ if we believe it comes with an exploitable vulnerability, or
with ‘sell’ when we are certain it is not interesting to us. No worries, the
presentation will not contain advanced mathematical equations.
Our tool parses binaries and persists all the gathered information to a
database, from where we can retrieve highly suspicious functions in an automated
way. Without getting our hands dirty, that is. And because we are lazy bastards
who like colors, a lot, we use visuals to make evaluation even easier. The tool
is dubbed Wallstreet, free after the most famous stock market on the planet. It
is based on Python, C and SQLite and will be released under the WTFPL license
(http://www.wtfpl.net/). Also, there will be demos 😀
Wrapping it up, this presentation shows an easy to use approach which makes the
complicated topic of binary exploitation more accessible. Wallstreet of Windows
Binaries provides beginners with better understanding of the challenges and
practitioners with a hands-on tool.
As we promised some days ago here’s the fourth round of Troopers15 talks (the
first three can be found here). We really
can’t wait for the con ourselves 😉 !
Arrigo Triulzi: Pneumonia, Shardan, Antibiotics and Nasty MOV: a Dead Hand’s
Tale FIRST TIME MATERIAL
Synopsis: Starting in the 80’s we will discuss the influence of nuclear weapons
on the design of an ITsec “Dead Hand” system for a security practitioner, how it
merged with research into firmware backdoors and microcode modification and
finally triggered when instead of enjoying Summer pneumonia struck unannounced,
or rather, announced by the Dead Hand via Twitter.
As we promised some days ago here’s the third round of Troopers15 speakers
(first
one here,
second
here).
It’s going to be awesome!
Andreas Lindh: Defender Economics FIRST
TIME MATERIAL
Synopsis: There are a lot of preconceptions about defense, the most prevalent
one probably the “defenders dilemma” in which it is stated that an attacker only
needs to find one weakness to compromise a network while a defender needs to
defend all of them. While this may be true in a technical sense, things become a
lot more complicated once you apply real world considerations. Preconceptions
like this are often the foundation on which risk management and ultimately
defense strategies are based, something that has led to a number of false but
generally accepted assumptions about attackers and their capabilities, and how
to defend against them.
This talk will discuss the capabilities, and more importantly the limitations,
of different types of attackers. Using the ancient wisdom of the Teenage Mutant
Ninja Turtles, the speaker will explain how knowledge of an attacker’s
limitations can be leveraged to raise the cost of attack, something that will
tip the scale in the defenders favor. The speaker will also explain how
different defensive measures will affect different types of attackers, how they
are likely to react to them, and in the end how to get them to hopefully move on
to another target.
Mike Ossmann: RF Retroreflectors, Emission
Security and SDR
Synopsis: The leaked pages from the NSA ANT catalog provided a glimpse into the
modern world of emission security. Extending beyond passive monitoring of
unintentional emissions, today’s spooks employ active attacks with tools such as
RF retroreflectors. I’ll report on my experiments to reproduce such techniques
with open source hardware and software, primarily using SDR.
.