Tag Archives: Hitb

After a cool dinner with other Belgian infosec people, the second day started with a discussion panel about the “Economics of vulnerabilities“. The panelists were: Lucas Adamski (Mozilla), Steve Adegbite (Adobe), Aaron Portnoy (Tipping Point),Adrian Stone (Blackberry / RIM), Chris Evans (Google),Katie Moussouris (Microsoft), Dhillon Kannabhiran (HITB – moderator). Almost all vendors are concerned by vulnerabilities in their softwares. Some decided to develop research programs to involve users in bug hunting (Mozilla & Google are well-known examples). Google estimates the cost of its “bug bounty program” only 10% of the price required by consultants to do the same job! The main topic was the “black market“. Yes, it exists and vendors cannot compete against the prices proposed there. If you want to make some business, this is the place to be! But, people buying on the black market are also expecting results: working exploits and not only a “vulnerability”. They are ready to pay but for a good ROI.  Another topic was how vendors accept vulnerabilities in their products. Some of them are still old-school and sue security researchers (check out the recent magic_de story) or ignore them. Some vendors establish good communication with the community of security researchers. About the vulnerability research programs, Microsoft told that they don’t have one: most vulnerabilities are sent to them privately. Question: isn’t a risk of “iceberg” effect? Most bugs being silently fixed? Note that even if 0-days are critical, they can be reduced by implementing security at all levels! (network access, permissions, etc). Victims of a 0-day introduced the malicious code via a specific channel or an action. Microsoft also mentioned “developers education“. Another good point! Last question: Will the researchers focus on bugs with bounties? All participants agreed on the fact that money is not the main incentive. Reconnaissance remains important!

The second talk was presented by Ivan Ristic about “SSL“. What’s the status of SSL implementations today? Is SSL properly configured? First, according to Ivan, SSL must be seen as an “add-on” designed for HTTP, as well as other protocols. SSL is not only a piece of code. It’s a full ecosystem: This is a good example of why security is difficult. The main issue remains weak configuration! SSL suffers of three principal attacks:

• Passive MitM (Example: firesheep)
• Active MitM (Example: sslstrip)
• 3rd party compromise (outsourcing)

Then, Ivan introduction of the research he performed via SSL Labs. They wrote a SSL rating guide and provide interesting online tools like the SSL assessment review. What’s the status of SSL implementations on the Internet? SSL Labs performed a big study: in 2010, they scanned web sites to grab SSL configuration. What do they discover?

• 119M domains checked, 900K servers to assess
• 600K were valid

In 2011, the performed the same exercise but using the EFF’s SSL observatory DB and scanned 1.2M of sites. They build a specific crawler (robot) to visit top list of sites.  What’s the current usage?

• Must combination is SHA1/RSA. most servers support strong ciphers.
• 20% redirect HTTP to HTTPS and from the other, some even do not redirect the login pages to HTTPS!
• HSTS is almost unused  (HTTP Strict Transport Security): 80 sites from 250K
• Cookies remain common in authentication
• Cookies secure flag must be more used
• Mixed content can also be a problem
• Distribution of trust (Google Ads, Analytivs, Twitter, Facebook, etc)

What were Ivan’s conclusions? First, the press and community give bad messages regarding SSL. In most cases, the deployment and implementation breaks SSL and finally, it’s possible to achieve reasonable security but most sites choose to not do it! Finally, a mention for the Google project “SPDY” which offers encryption by default.

“Let me Stuxnet  you” was presented before the lunch. I was a bit septic by reading the title of  Itzik Kotler. Everything has already been said about Stuxnet! But, good surprise, after a very short introduction about this attack, Itzik explained that software controls hardware but that malicious sofware can also control software!  And software can damage hardware! This is called a “PDoS” or “Permanent Denial of Service“. A PDoS is an attack which causes a piece of hardware to be replaced or reinstalled (Examples a bricked device). The reasons to perform a PDoS attacks remain the same as attacking a power plant: Rival companies, Foreign countries, terrorism, etc. They are different types of attacks:

• Phlashing: overwriting the firmware and make it useless or “bricked“
• Overclocking (burn it)
• Overvolting (burn it)
• Overusing (reusing a mechanical device and force it to die – like a CDROM tray)
• Power cycling

In a computer, what are the potential targets of such attacks?

• Fans (reduce speed to increase temperature)
• CPU Infinite loop using sample code: “jmp short 0×0″, bricking CPU by flashing a new  microcode)
• RAM (overclocking or overvolting)
• GPU
• Hard drives (excess of I/O)
• SSD drives (excess of write operations)
• BIOS
• NIC

Some funny simple example of “killer” commands:

  # while true; do dd if=/dev/xxx of=/dev/xxx conv=notrunc; done
  # hdparm -S 1 /dev/xxx; \
  while true; do sleep 60; dd if=/dev/random of=foobar count=1; done
  # while true; do eject /dev/cdrom; eject -t /dev/cdrom; done

Which countermeasures can be used against those attacks? For firmware upgrade, use digitally signed images and, as usual, apply common basic security! The talk was interesting but presented too slowly! Half an hour should be enough. No need to spend ten minutes on overclocking!

I attended “Attacking critical infrastructure” by Maarten Oosterink. A nice talk just after the lunch. Everything has been said in Stuxnet. Some interesting facts mentioned during the presentation:

• A common issue with systems used in industrial environment: When to patch? (During install, during maintenance cycles: 1-2-4 years,e very Tuesday, never)
• Who maintains? (The IT department, local engineers, vendors)
• Critical infrastructure are based on multiple (un)common protocols and applications. This increases drastically the surface of attack!

Regarding those attack vectors:

• The human factor (night shifts, remote locations), computer look “like home“, noisy rooms, poor IT skilled people, contractors/vendor maintenance.
• Procedural: low patch frequency, manual patching, backups on removable devices,irrelevant policies
• Used technologies: 90′s networking, bad configurations, no monitoring, ha protocols not robust and OSI layers > 5

One of the most expected talk with the one of Adam Laurie & Daniele Bianco. Indeed, the room was full. They presented their research about the security of the “EMV” (“Europay Mastercard Visa“) system used by modern readers/credit cards. The system has already been reported as broken by the Cambridge University. They explained deeply why the system is vulnerable. They showed an EVM skimmer. Compared to magnetic stripe models, they cannot be detected and require little installation effort.

EVM Skimmers

The EVM domain makes usage of a lot of abbreviations like CVM, PIN, SDA, DDA, CVMR, TVR which made some slides not easy to follow but, most imporant, they performed a nice demo and cloned a credit card.

The last talk was about OpenDLP: “Gone in 60 seconds” presented by Andrew Gavin, the creator of OpenDLP. According to the presentation title, I expected a more aggressive approach of OpenDLP. How to use it to really steal information. Andrew presented his tool in the first part. OpenDLP is free and based on two components: a central server (LAMP) . It can address:

• Compliance requirements
• Network & system administration tasks
• Pentests

Why it was developed? DLP solutions are expensive and not based on agents. Most important they are not working in the background! OpenDLP is based on policies that can be expended and reused across multiple agents. Policies have the following features:

• PCRE regex
• White/black lists
• Concurrent agent deployment
• Memory requirements
• How often agents phone home with results
• Obfuscation of data (ex: xxxxxx-3010)

How is the scan performed? Agents are deployed via SMB and started with Samba’s winexe (to run remote commands over SMB). Once running, it’s non intrusive by limiting the used CPU and memory resources. And once scan done, it asks itself to the server to be removed (winexe again). All the results are available from the server using a browser.

The second part was a review of the web interface (server side) with all the available features and a scan demo. Some benchmarks were collected to compare agent-based vs agent-less implementations. The list of coming features looks cool.

In the main room, it was also the end of the robot contest organized by the hackerspaces. I need such toys too!

Hackerspaces Robots Contest

The closing keynote was presented by Richard Thieme. It’s now almost time to drive back to Belgium. Thanks to the HITB team for the organization (and the press pass). See you next year for another coverage!

Welcome back in Amsterdam! This is the second edition of the Hack In The Box (HITB) security conference in Europe. Let’s go for a quick wrap-up! I woke up too early (04:00AM) to drive to Amsterdam and arrived without any traffic jams (rare in Amsterdam)! Enough time to perform the registration tasks and grab some 0xC0FFEE! The event started with a keynote presented by Joe Sullivan, the CSO of Facebook. “Facebook” and “Security” are two terms that are often present at the same time in information security news. Joe explained how Facebook implemented new security controls to raise the security of the social network users. Interesting statistic: the average Facebook user created ninety pieces of information each month! The main security innovation is the implementation of the “real name” culture. It is proven that, in public online places like forums, people are less aggressive if real names are used. Facebook also implemented tools to protect users from rogue profiles and to authenticate them in a better way. Some of those features are:

• Social reporting: You can report abuses of private data using by non authorized people.
• Social verification: Facebook might ask you to authenticate people shown on pictures.
• Account management: HTTPS support, login notifications and approvals, recognized devices and recent activity log.

It’s also more easy to report false information using the “Report” links available on almost all pages. The security policy of Facebook is clear: “Sometimes the best defense is good offense“. Facebook don’t hesitate:

• To escalate security issues to law enforcement.
• To coordinate with industry on technical take-downs
• To work with legal on lawsuits
• To perform investigations using a “formal escalation program” with authorities like the FBI, Interpol, DOJ, ICE, Secret Services.

The message passed by Facebook was clear: they take security into account. As said Joe:

“Innovation is essential on the internet. Security teams cannot say no to opportunities, must show how to do it safely and constantly adapt“.

I totally agree but, hélas, Facebook has to deal with the most difficult stuff to protect: people! Even by deploying new security features, they won’t prevent people to share and disclose sensitive stuff publicly. Then the real presentation started. HITB is based on two main tracks at the same time, some workshops (track #3) and lighting talks during coffee breaks. As usual, you’ve to make choice between concurrent talks.

My first choice went to Laurent Oudot, a French security researcher about the extraction of sensitive data from iPhone devices. The talks was talked “iNception” because could extract lot of information from the devices memory and they liked the movie The goal was to review some offensive concepts around iOS devices and to share the findings. Laurent already presented some security stuff around iOS devices last year. He first came back to the previous issues and reviewed what changed. Some actors reacted properly and fixed the security holes (Thalys), others did not ever respond (HTC).  First topic, how to find vulnerabilities in the smartphone world? There are multiple ways:

• Reverse engineering
• Behavior analysis (log, sniffer, memory, file system)
• Fuzzing
• Audit
• Pentest

To fuzz the device, some URL schemes can be used like: “<a href=’sms:” or “<a href=’tel:“. Audits may reveal interesting stuffs like the one present in the iOS 4.3. This versions proposes a new feature called “personal hotspot“. Nice but the WPA key is displayed in clear text on the console… Pentests may use “regular” applications available on the AppStore (read: “approved by Apple“). Those applications could be dangerous if not properly used (Example: AirContact). Then Laurent came back on the “location issue” disclosed soon and fixed in the iOS 4.3.3. He explained how to get rid of the data stored in the “consolidated.db” file:

• Using a jailbroken device, there is a Cydia application available. But it requires a running daemon on the device consuming some CPU cycles & battery.
• For an official device: backup, change the file and restore. Be the file will constantly be fed with new data, the operation mist be performed on a recurrent way.
• Upgrade to iOS 4.3.3

But there is another way (if you can’t or don’t wan to upgrade). The consolidated.db is a regular SQlite file and triggers can be added to SQL commands like “INSERT“. An “auto-delete” trigger can be implemented. More amazing, the iOS has many SQlite files to store sms, contacts, calls. By adding more triggers, it’s possible to implement an anti-forensic protection (auto-deleted, injection of fake information) or to backdoor to data by copying then to hidden tables! The next demo was a phishing attack against an iPhone by hijacking a local application (no exploit!). Just prepare a fake loging page and access your victim device physically. Very easy! Who’ll refuse to help a nice lady asking “May I use your mobile 30 seconds to call my boss?“. She could replace your regular Facebook application icon (moved to another screen) but a webapp linked to your rogue access page. More funny, the iOs has many URL schemes even not documented like:

• fb://profile/
• twitter://
• ppclient://
• portscan://
• ssh://mobile@alpine@127.0.0.1

Finally, Laurent gave a tip to detect jailbroken remotely. A very interesting talk. The conclusion is that mobile users require more security awareness. A modern mobile is a very nice target and is as vulnerable as a regular computer. The next talk focussed on XSS vulnerabilities. Well know and easy to reproduce by displayed nice “Pwn3d” alerts, Claudio Criscione explained how to go deeper and really use them during pentests. First Claudio explained that XSS are easy to find but using “alert” alone is irrelevant! Why not use the XSS for more malicious purposes? How to bridge the gap between MetaSploit & XSS attacks? Don’t forget that XSS are still relevant vulnerabilities! According to Claudio: “Using an alert today vs actively exploiting the XSS is closer to running Nessus than using Metasploit“. Then he explained the idea he had and how he build a new MetaSploit module to really take advantages of XSS holes in web applications.

After the lunch break, I attended another talk related to pentesting. Elena Kropochkina and Joffrey Czarny explained how to use “webshells“. What’s a webshell? It’s a piece of malicious code running on a victim host and which help the pentester to perform lot of interesting tasks like:

• File management, upload, download
• Execute system commands
• List ports, process
• Send e-mail,
• En(de)code
• etc.

They are webshells available on all common web platform (PHP, ASP, Java). Well known names are C99, FaTaLisTicq, NFM, R57, PHPJackal, Zehir, JspSpy. But most of them are detected by antivirus. To bypass them, obfuscation techniques are mandatory. Elena & Joffrey reviewed common techniques to obfuscate code. Example on PHP, hash the function and variable names, remove spaces, newlines etc. The problem with webshells: they have been developed for malicious activities and are not oriented to pentesting. That’s why Elena wrote a new webshell with more features:

• A unique framework (PHP ASP JSP)
• Protection (encryption of executable code)
• Client-agent architecture
• Integrity verification
• Key encryption locking on the pentester IP address
• Bypass ID(P)S and WAF’s
• Source code encryption
• Encrypted commands between the agent and server
• Protection against malicious re-use (unique password for each agent)
• Modular structure (based on modules)

Some demos were performed. Nice project still under development. There is  no plan to distribute the tool but it could be really a “plus”. Nice job! After webshells, we focused on SAP with Mariano Nunez Di Croce. Why is SAP? Here are some facts:

• 140K implementations worldwide
• 90K customer, 120 countries
• Fortune-500
• Business critical (govern, military, etc…)

Enough to make SAP a nice target! Last year, Mariano already presented some cool stuff about SAP. He was back with more funny demos! His topic focused on the security of standard SAP web applications (not custom). SAP traditional security is based on “separation of duties” but it’s not enough. The forgotten layer is the business runtime which involves much higher risks! Did you know that the number of “security bulletin” published by SAP exploded? 900 by end of 2010! SAP also implemented a “security day” like Microsoft. They also released some white papers related to security. The biggest issue remains the visibility of SAP on untrusted networks or directly on the Internet. SAP instances are easily detectable via Shodan or Google. SAP can be reached via different architectures:

• SAP ITS (Internet Transaction Server)
• SAP ICM (Internet Communication Manager)
• SAP EP (Enterprise Portal)

SAP instances can be easily identified via server banners, error messages, some components versions are even available in the HTTP source code. A typical SAP ECC install contains 1500 standard ICF services! Some are public and reveal interesting information (Example: /sab/public/info). Many SAP system are shipped with default password: SAP*, DDIC, EARLYWATCH, SAPCPIC and TMSADM. Mariano made several demos using SOAP RFC service. He also bypassed the authentication process using BurpSuite. Nice! What to conclude? SAP systems are connected to the Internet, SAP has different web technologies: understand them and how to secure them. Hopefully, SAP is working on security: The demo works only if not following SAP security recommend.

To close the first day, I planed to follow the track about the reverse engineering technique of the ticketing system of public transport systems. But for legal reasons, it was canceled (more details here). My alternative choice was to follow a presentation about ASLR in iOS or Silverlight/.Net issues. Definitively not my cup of tea. I skipped them. Second talk cancelled today: the one about OpenLeaks by Daniel Domscheit (absent due to illness).

In parallel to the talks, the CTF contest is ongoing as well as the Lego robot challenge day for HackerSpaces. The HITB team releases material after each presentation, keep an eye here! Stay tuned for the second day!