Workshop: SamuraiWTF

Come take the official Samurai-WTF workshop given by one of the founders and lead developers of the project, and get special pre-release copy of the next version of Samurai-WTF. You will learn the latest Samurai-WTF open source tools and be shown the latest techniques to perform web application assessments. Practice these skills on one of four vulnerable web applications installed and pre-configured on your Samurai-WTF live DVD. This experience will increase your hacking toolkit and take your web hacking skills to the next level.

 

Workshop: Teensy Programming for Everyone

Breaking into systems is getting harder by day using traditional methods. As a penetration tester or a security administrator you should know what methods an attacker may use to compromise a system. The emphasis of this training will be on using Teensy which is a Human Interface Device. It is an Arduino board based device which can be programmed and used as a keyboard/mouse/disk.

Details about Kautilya will be discussed which is a toolkit developed by the trainer which eases the use of Teensy in Penetration Tests. The participants will learn about programming Teensy as per their need using Arduino Development Environment (ADE) and also to customize Kautilya.

There will be lots of attack vectors, discussions, hands on and fun. Participants should be able to program their own devices after the training.

Workshop: Mobile Network Forensics

Intentionally or not, your phone leaks data to the world. What can you-- or your enemies-- uncover from mobile network traffic? Dig through real-life Android packet captures to uncover GPS coordinates, usernames and accounts, social networking data, and more. Dissect a traffic dump of Android malware and analyze phone data as it is exfiltrated to third-party servers. The second half of this workshop is a mobile network forensics contest. Each attendee will be given a mysterious USB drive and a note with a challenge. Students must use the skills they've gained in class to unravel the mystery. You are the forensics investigator. Can you solve the puzzle in time?

Workshop: Understanding Botnets By Building One

Financial botnets are a major threat to the global Financial Infrastructure. Other botnets threaten our infrastucture. However, most security professionals have no hands-on botnet experience, which weakens their ability to combat them.

Gain hands-on experience of building and managing your own botnet from scratch in this workshop.

You will build your own Zeus botnet, configure and optimize it, infect and control bots.

The Kelihos Botnet

Kelihos is still alive, building its p2p infrastructure and sending spam. It quickly evolves after b79 take down operation. This raises numerous questions:

Did it survive in the b79 operation or just re-build a new one? How did it evolve? Is there any changes in its infrastructure? Does it change the p2p protocol or communication encryption algorithms? What are the new functionality added in it? In this presentation, I will attempt to shed light on those interrogations after examining 3 main Kelihos generations, from its p2p protocol and encryption schemes to the working mechanisms.

Data Mining a Mountain of Zero Day Vulnerabilities

Every day, software developers around the world, from Bangalore to Silicon Valley, churn out millions of lines of insecure code. We used static binary analysis on thousands of applications submitted to us by large enterprises, commercial software vendors, open source projects, and software outsourcers, to create an anonymized vulnerability data set. By mining this data we can answer some interesting questions.

Which industries have the most secure and least secure code? What types of mistakes do developers make most often? Which languages and platforms have the apps with the most vulnerabilities? Should you be most worried of internally built apps, open source, commercial software, or outsourcers? These questions and many more will be answered as we tunnel through zero day mountain.

  

They Ought to Know Better: Exploiting Security Gateways via Their Web Interfaces

After a thorough examination of a number of common Security Gateway products over the past few months I have determined that Security Gateway Web User Interfaces are often vulnerable to security flaws, which could enable an attacker to gain control of the UI, bypass controls within the application, and in many cases control the underlying operating system.

Based on this research I have reported over 30 vulnerabilities, complete with proof-of-concept exploits to the vendors of these products.

This presentation will discuss vulnerabilities common across these products, weaknesses in product design, and some interesting attack vectors where external attackers can exploit Security Gateways via the UI, even where the attacker has no direct access to the UI.

  

Malicious PDF Analysis

This workshop will teach you the fundamentals you need to know to analyze (malicious) PDF documents. Didier Stevens will familiarize you with PDFiD and pdf-parser, two essential tools for PDF analysis he authored.

Each attendee will receive a copy of a 20+ page PDF analysis document Didier Stevens authored. And yes, this document will be provided in the Portable Document Format, but hey, when you successfully complete this workshop, you will know how to identify malicious PDF files

  

Lotus Domino: Penetration Through the Controller

In the talk an overview of some ways to break Lotus through the Domino Controller (includes 0day bug) will be presented.

  

Hacking XPATH 2.0

The presentation will discuss the vulnerability XPATH Injection in depth and we will cover advanced exploitation techniques. We will talk about xpath 2.0 and how an attacker can not just obtain the XML document but also obtain files outside the current document. We will discuss how to exploit vulnerabilities blindly and the case when the application does not reveal anything (ie. compare this to a time based sql injection). Exfiltrating data over out of bound channel such as HTTP, DNS will also be discussed followed by some real life examples of the vulnerability found in the wild. Finally we will release an open-source tool to automate exploiting this vulnerability with all advanced exploitation features built in.

  

HTML5 Top 10 Threats: Stealth Attacks and Silent Exploits

HTML5 is an emerging stack for next generation applications. HTML5 is enhancing browser capabilities and able to execute Rich Internet Applications in the context of modern browser architecture. Interestingly HTML5 can run on mobile devices as well and it makes even more complicated. HTML5 is not a single technology stack but combination of various components like XMLHttpRequest (XHR), Document Object model (DOM), Cross Origin Resource Sharing (CORS) and enhanced HTML/Browser rendering. It brings several new technologies to the browser which were not seen before like localstorage, webSQL, websocket, webworkers, enhanced XHR, DOM based XPATH to name a few. It has enhanced attack surface and point of exploitations for attacker and malicious agents. By leveraging these vectors one can craft stealth attacks and silent exploits, it is hard to detect and easy to compromise.

In this paper and talk we are going to walk through these new architectures, attack surface and possible threats. Here are the top 10 threats which we are going to cover in detail with real life examples and demos.

• ClickJacking & Phishing by mixing layers and iframe
• CSRF and leveraging CORS to bypass SOP
• Attacking WebSQL and client side SQL injection
• Stealing information from Storage and Global variables
• HTML 5 tag abuse and XSS
• HTML 5/DOM based XSS and redirects
• DOM injections and Hijacking with HTML 5
• Abusing thick client features
• Using WebSockets for stealth attacks
• Abusing WebWorker functionality

Above attack vectors and understanding will give more idea about HTML5 security concerns and required defense. It is imperative to focus on these new attack vectors and start addressing in today's environment before attackers start leveraging these features to their advantage. We are going to see new tricks for HTML5 vulnerabilities scanning and tools.

  

Dissecting Smart Meters

The Smart Grid brings greater benefits for electric utilities and customer alike, however these benefits come at a cost from a security perspective. This presentation will explore the architecture of most Smart Meters, the protocols they use, a breakdown of their embedded components, and the functionality their headend servers contain. We'll explain the methodologies we've developed to perform penetration testing these AMI systems, enumerate the types of vulnerabilities we commonly find, and discuss the solutions we recommend to Smart Meter vendors. We will even demonstrate at least one of the attacks we commonly perform in our penetration tests. This will be done without the FUD and over-hyped framing that we usually find in the media and other Smart Grid presentations.

  

IVR Security- Internal Network Attack via Phone Lines

The following research is on IVR (Interactive Voice Response) systems which are currently used in Phone Banking, Call centers, Hospitals and corporate mainly for information retrieval and Remote Management via Telephone lines. The paper explains a serious of security issues concerning these systems (IVR) and exploitation techniques and ways of carrying out attacks on internal network via Telephone lines. A demonstration of few exploits on IVR systems and a real incident about a critical responsibly disclosed banking flow in its Phone Banking System would be done.

  

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis

The detection of malware analysis environments has become popular and commoditized. Detection techniques previously reserved for more sophisticated forms of malware are now available to any novice cyber criminal. The use of next-generation virtualization-based malware analysis technologies considerably reduces the number of possible transparency shortcomings, but still fails to handle pathologically resistant malware instances that will only run on physical hardware.

Thus far, the execution of malware on physical (or baremetal) hardware has been useful for one or a handful of malware samples of interest. However, this activity was manually driven and time intensive (e.g., infect, study, format, reinstall). This presentation will resolve these long-outstanding shortcomings by describing the design and implementation of a scalable, automated baremetal malware analysis system, which can be constructed using inexpensive commodity hardware and freely available technologies. To motivate the approach's need, previously unpublished detection attacks for popular environments used to automate malware analysis (i.e., VMWare, QEMU) will be shown.

   

Smartphone's Apps Are Not That Smart: Insecure Development Practices

Mobile Apps is a growing business with thousands of applications to choose from across the dominants mobile platforms and new Apps released every week. Users install in their smartphones all kind of free Apps and many users are willing to pay for commercial ones usually due to low prices. Apps have become the new Web.

The Apps fever has provoked that thousands of developers, experienced and inexperienced, worldwide constantly release new and updated Apps to attract users so they become popular and in most cases make a profit. Unfortunately this development madness tends to sacrifice security and privacy.

This presentation unveils the ugly truth that too many Apps are highly insecure. The results are based on the security analysis performed on dozens of Apps on different smartphones by identifying flaws that can be avoided with safe development practices.

  

The IETF & The Future of Security Protocols: All The Signal, None of the Noise

The IETF meets in person three times a year and publishes dozens of standards - most of which take years to be implemented if they ever are. The drafts are rarely talked about at conferences, on twitter, or heard about in the development or security industry until long after they're finalized. But the Working Groups are surprisingly accessible and the things being discussed now will provide long-term fixes for the attacks we've been hacking around today.

We'll talk about the things going on in the Web Security, Public Key Infrastructure, TLS, and DNS Working Groups and improvements being made to Browsers, HTTP, and Javascript - and draw conclusions about what will and won't work. Early successes include the experimental technology that first detected the Diginotar Certificate Authority breach and TLS improvements that provide replacements for the parts that make cryptographers uneasy. And we'll talk about the things we're not as optimistic about; like Content Security Policy and why it hopes to end Cross Site Scripting but won't. We'll also do a short survey of the superficial and radical proposals to augment, replace, or bypass the Certificate Authority system.

All Your Calls Are Still Belong to Us: How We Compromised the Cisco VoIP Crypto Ecosystem

Modern "Enterprise" VoIP solutions are complex beasts. They usually encompass application servers (e.g. for mailboxes and to provide CTI functions), "infrastructure systems" for authentication or crypto stuff and "intelligent" phones.

In the end of the days the inherent complexity means that - while "traditional" VoIP attacks (like re-directing, sniffing and reconstructing calls) might no longer work - we've been able to severely compromise any enterprise VoIP environment we've pentested in the last twelve months. Based on a number of warstories, in this talk we'll first lay out the relevant attack vectors and the protocol or device level vulnerabilities enabling those.

We will then focus on Cisco's Unified Communications solution that seemingly disposes of a mature, certificate based crypto framework protecting both the signaling and the media transport. Well, seemingly. When closely inspecting the relevant parts and messages, it turns out that at some point all the key material can be replaced by attacker chosen keys. Which effectively means that we're down to cleartext-like attacks again...

For the first time we'll publicly provide a detailed technical explanation of the underlying vulnerabilities, show a live demo sniffing calls in a presumably fully encrypted environment and - of course ;-) - release a tool automating a number of steps of the complex overall attack. A discussion of potential mitigating controls, both on a technical and on the provisioning process level, completes the talk.

  

36 Views of Cyberspace

The word "cyberspace" is today used in many contexts but it is not always clear what exactly that term describes and what it means. In this paper we will compare definitions of cyberspace from several sources. Sources are relevant entities like national or regional government, standardization bodies and a dictionary. The purpose of this comparison is to establish the range of notions what the cyberspace is and to derive an ontology of cyberspace.

We will analyse which categories (identified from the existing definitions of cyberspace) are required for the cyberspace to exist. Finally, we will offer suggestions what elements a definition of cyberspace should have.

Issues with Embedded Device Disclosures: Helping the Vendors and Recognizing the End-Users

Computer security research often focuses on the disclosure of vulnerabilities in traditional computing devices, such as DNS or Mail Systems. Recently, however, there has been a growth of vulnerabilities being discovered in embedded devices such as automobiles, SCADA hardware, and medical devices. These non-traditional computer devices have additional complexities and impacts that are, as of yet, unexamined.

First, although much is made of the process of disclosure of the vulnerability itself, the response by the market place and manufacture are rarely discussed. Companies that produce many of these devices are generally under prepared to handle new found vulnerabilities.

Second, many of the disclosures with these non-traditional devices impact more than just a vendor, a computer administrator, or a company. The end user, the individual with the most at risk from some vulnerabilities, are often unaware of a vulnerability unless the mainstream media finds an interest in the story.

At Black Hat 2011, for example, there was a presentation about vulnerabilities in insulin pumps, which struck a chord with the media and resulted in the diabetic community, eventually prompting quite a few diabetics to voice their opinions through blog posts and tweets.

A prominent diabetic blogger, Kerri Sparling from SixUntilMe, will talk about how a vulnerability disclosure can impact end users in ways that researchers usually are not aware of.

  

Cyber-Attacks & SAP systems: Is Our Business-Critical Infrastructure Exposed?

Global Fortune 1000 companies, large governmental organizations and defense entities have something in common: they rely on SAP platforms to run their business-critical processes and information. In this scenario, cyber-criminals looking to perform espionage, sabotage or financial fraud attacks know that these systems are keeping the business crown jewels.

But, how difficult is for them to break into an SAP system today? Are we properly protecting the business information or are we exposed?

Five years ago, we were invited to hold the first public presentation on real-world cyber-threats to SAP systems at BlackHat Europe 2007. Since then, we have performed specialized Penetration Tests against the SAP platforms of several of the largest organizations of the world, enabling us to get an educated answer to those questions.

Join us in this new presentation to learn:

• How a cyber-attacker may break into an SAP system, completely anonymously.
• Which are the Top-10 technical vulnerabilities found in real-world SAP implementations.
• How protected are SAP systems from attacks over the Internet and internal networks.
• How feasible it is to detect attacks in real-time and/or forensic investigations.
• Which are the most effective measures to secure this business-critical platform.

This presentation will feature live demonstrations of attacks, war stories and statistics from real-world assessments.