HES 2012 the end !

Really, HES was just awesome, very technical with hot topics ...thanks a lot to the crew :) 

For those who want to see the video stream you can get it from here

http://www.ustream.tv/recorded/21835515

Just get a glance time to time on HES web site to download the slides.

http://2012.hackitoergosum.org/blog/schedule/talks

A french summary has been submitted by my team at this address:

http://www.devoteamblog.com/

HES 2012 day 3

Sorry, but I missed the keynote of the 3rd day. You can get the slides directly from HES web site.

Easy local Windows Kernel exploitation  by Cesar Cerrudo.

The goal of this presentation as expressed by Cerrudo is to show some simple tricks for windows exploitation vulnerability.

     

Before that, Cerrudo underlines that Windows exploitation still a dark art and there still few and good reliable kernel exploitation techniques.

Generally, for a specific vulnerability it can be possible to choose a specific value to write at a specific controlled kernel address.However, few techniques are generic and work across Windows Versions. 

Cerrudo pointed out that running code on kernel mode looking for and elevation of privilege could generates errors that cannot be caught for further analysis.

The current work of Cerrudo was inspired form  J00ru's paper "GDT and LDT In Windows Kernel".  This paper sheds lights on the following Windows API:

NtQuerySystemInformation (used by explorer to get information about process) allows to get the Kernel address of KPROCESS and returns  the 

struct_SYSTEM_HANDLE_TABLE_ENTRY_INFO {

   USHORT ProcessId

   ....

   PVOID Object // Kernel address

   } 

In Some wayss this structure helps to get Kernel information on any Windows in order to to execute an exploit. So what could be done then:

What if we can remove ACLs of almost Windows Object ?

What if we can set any privilges on a process token ? 

What if we can replace a process token ?

In all these cases, it is possible to do any of te above action with just one write. Indeed, Cerrudo stress on the fact that attackers are always looking for a system shell.

However, we don't need system shell for privilege escalation exploitation and that makes the exploitation easier.

The different techniques presented by Cerrudo could be summarized as below:

#1: Windows Object ACL 

kd> dt nt!_Object_HEADER

    0x000 PoinbterCount : INT 4B

     .....

    0x014 SecurityDescriptor : Prt32 information about the ACL (if you null out the field the object has no ACL any more )

    0x018 Body 

For that:

Get the target object (process....) kernel address using NtQuerySystemInformation 

Write NULL to [Object adr -0x14]

Manipulate the target object    

#2:Token privileges (Windows >Vista)

Typdef struct_TOKEN

 {

    typedef strruct_SEP_TOKEN_PRIVILEGES

  {

     UINT64 Present  

     UINT64 ENABLED; // all ones -- all privileges enabled 

...

#3:Token privileges (Windows XP et WINodws 2003) 

k>dt_TOKEN

+0x000 TokenSource      : _TOKEN_SOURCE

   +0x010 TokenId          : _LUID

   ...

If we can modify the Token it is possible to get powerful privileges as:

• Debug programs
• Take onwbership
• Restore files and dir
• Impersonate a client after auth
• Load ad drivers
• Create a token object
• Act as part of the OS

    

So for Enabling privileges:

• Get process primary token and then search its kernel address using NTquerySystemInormation
• Write 0xFFFFFFFF (or the wanted value for the corresponding privileges) to TOKEN at +0x48 (0x14 Win XP)

to illustrate this technique, Cerrudo uses the exploit for Tarjei Mandt Kernel vulnerability(use after free) as below: 

dec dword ptr [eax +4]

    

if we can control only eax then is to hard to exploit , However in:

Windows XP  the default value is : TOKEN +0x48 == 0x80000000  

Win7 ==> 1000000000000 only one privilges i enabled by def SeChangeNotifyPrivileges

0x8000000-0x1 == 0x7FFFFFF ==> 1111111111111b lots of privileges 

#4:Process primary token

Typdef struct_EPROCESS (Win 7)

      { 

             Struct_EX_FAST_REF Token;

 kd>dt nt!_Object_HEADER

+x000 PointerCont   : Int4B

The goal here is to Replace  the process token by the system identity token by hooking NtOpenThreadToken and calling MsiInstallProduct then get the object kernel address using NtQuerySystemInfdo.

If multiple writes 

Increase reference count with first write to PinterCount [_TOKEN -0X18] (on 32) and the second write to replace Token on _EPROCESS with system token.

If one write

replace TOKEN on _EPROCESS, and after elevation and before exploit finishes duplicate the system token.

Conclusions

Exploiting some kernel vulnerabilities are made more easier using NTquerySystemInformation 

this API helps to build more reliable exploits

You don't need system shells to elevate our privileges

Just awesome ! thanks Cerrudo for this presentation ... 

Follow Cerrudo at @cesarcer

Yo Dawg I heard you like reversing by Aaron Portnoy & Brandon Edwards

All I could say concerning this talk is : ZDI team are just amazing. Indeed, in this talk they presented to us their IDA Toolbag.
So I won't give technical details about the tools for the simple reason that this latter contains a lot of features...


The speakers pointed out that during their job at ZDI they face a lot of problems due to some limitations in IDA Pro.
In consequence they decides to develop a  tool to mitigate these problems. For that, their tool include features into the following IDA modules: 


Data storage
Querying 
Navigation
Collaboration
...  




A demo of the ToolBag has been introduced by the speakers.


I suggest you to go and get a glance on the project : http://thunkers.net/~deft/code/toolbag/

HES 2012 day 2

Keynote by Fyodor Yarochkin : How evolution shapes the infosec

Fyodor Y. presentation covers his past experience and mainly focus on computer crime research. Actually, Fyodor Y. experience covers : Snort/IDS ,Honeypot and Intrusion detection. 

Fyodor Y. starts by underlining that malicious activities are linked to financial gain on Internet (China and Russia), that joins Raul Chieasa's Keynote on HES 2011. 

Fyodor Y. pointed various observations:

The fact is most security researchers focus on finding vulnerability and computers crime focus on how to gain money by exploting human vulnerabilities (SE) than deep and complex vulnerability

  

double-click mailing --> companies discussing malicious behaviour on the Net.

  

An example was given by F. of a malicious company that fakes a real advertisement company, making a flash file ad.

The crime engineer are developing attacks depending on the location of the victim kind a of customization. 

  

Glottalization of the crime scene (localisation does not matter)

  

Volumes of micro-transactions --> Stealing a 1 $USD from 1,000,000 still makes a $1, 000, 000 

There are other means of taking control over wealth than cash

  

F. points the new payment technologies as those based on phone to pay duties. Mobile payments are not supervised by the government in consequence a  parallel market is growing up (Android mobile are more and more targeted by attacks that makes mobile payment). Indeed an Android application seems to be clean at the first verification, bypassing the control of google market. But once the application is installed it triggers an update that get the malicious payload.

  

To conclude Fyodor stress the fact  Human vulnerability could not be fixed 

  

Fyodor Y. end his keynote by presenting his "Honeypot project"

Motivation: What is the risk of Taiwan networks being owned now"

• Identify regional threats 
• Cooperation with CERT
•    Real-time exposure ....         . 

Hacking the NFC credit card for fun and debit . by Renaud Lifchitz

Firstly, I want to thank Renaud L. for the quality of its presentation because he was able to demonstrate a serious 

vulnerabilities regarding NFC systems basing on simple techniques and tools.

Renaud L. starts his presentation by introducing the following terms:

Contactless payment : daily payment with no need for card insertion and pin. Two main systems are present in the market: Visa Paywave and MatserCard Paypass 

     

NFC card could be recognized by a specific logo printed on them.

These card are developed using EMV standards (specification for data storage and security protocol .ISO 7816 standards) 

The card memory is a real filesystem with a root directory (MF)and folders (DF). BER TLV (very near to ASN.1) is used for 

data encoding (emvlab.org/tlvutils  for decoding tools).

                    

Card Commands requests are structured as : Class (targeted application), Instruction (read/write...), parameter, data length, data and the length of expected response.

The response contains mainly data and SWA/SW errors. 

After this refresher,  Renaud L. introduce the goal of his research. Indeed, his idea is to compare the security of NFC card with other security models as those of Passports or NAVIGO cards(used in France for public transportation).

Actually, Navigo card presents a good security level as no personal data are stored in them, use of good encryption and authentication mechanisms.

Regarding NFC cards, the first observation pointed out by Renaud L. is the lack of authentication and encryption                 

As a proof of concept, Renaud L. presented the necessary information and ingredients:

NFC frequencies: HF (13,56 Mhz) and LF (125-134 Khz) usages )

NFC readers: USB readers SCM SCLL3711 (40 euros) ACS ACR120U/ACR

Tools : scriptor (ISO 7816), Libnfc ,pn53x-tamashell          

The POC allows   Renaud L. to demonstrate that is possible to get remotely the following  data :

Confirmed : Cardholder (gender, first name and last name), PAN, Expiration data ,Magnetic strip data (for cloning card), transaction history 

Probably :no CVV (just one time-CVV possibly can be used for online payment

                   

To conclude  Renaud L. listed some possible attacks :

1. Read victm data and us it in commerce web site CVV is not alwas asked
2. Remote DOS attack
3. Create a magnetic strip dump
4. User tracking

For his demo  Renaud L. follows these steps:            

1. Wake up the card : list passive target
2. select banking application (AID) --> look at receipt 
3. Read specific EMV record

However  Renaud L. notices the the distance still a limitation to the attack. That could be mitigated using an USRP and telescoping antenna.

Secure Password Managers" and "Military-Grade Encryption" on Smartphones: Oh Really by Andrey Belenko & Dmitry Sklyarov

This presentation aims to give an overview on security mechanisms used (or not) by password managers on Smartphones.

For that, the speakers firstly tried  to underline the difference between 

the capabilities (TPM, biometrics...) offered by a PC password manager and those (passwords and passcode) that exists on smartphones 

Moreover, on smartphones password managers have various handicap:

Pasword typing : it is hard to type long and complex password

Relatively slow CPU : Complex password-token transforms will impact the usability so handling passwords is more complex than PC

Before going deeper into the study results, speakers made as threat model based on the following assumptions:

The Attacker has physical access to the device, backup of the device and to the paswords manager database file. the attacker tries then to recover the master passwords.

Generally, the physical access is quite easy  (think of fake charging station) 

The device backup on : 

Apple IOS 

• Needs device passwode or iTunes pairing (optional encryption PBKDF-2 SHA 1 with  10 0000 iterations).

Balckberry 

• Needs device password (Optional encryption -not enforced-).

          

The database files could be retreieved  

Appple iOS

• via afc  (need passcode) 
• via ssh   (jailbroken device)
• via (physical imaging)      

Blackberry 

• Needs device password 

       

The analysis presented by the speakers was based on a top 10 of Apple and blackberry applications (free and paid applications)        

(Sorry but I wont give the analysis of all applications but you can refer to speakers's slides ).

As examples : 

BlackBerry Wallet  1.0

• Stores sha-256 password
• Password verification requires 2x sha256
• No salt --> rainbow tables       

iOS password managers 

Free Tools : 

• Store passwords is Doucments/Password_keeper.sqlite
• Master password is always 4 digits
• No data encryption 
• Master password is stored in clear : SELECT ZPASSWORD from ....  

Paid tools 

• Master key is encrypted with master password 
• Use of iOS keychain 

                    

To conclude, speakers stated that Paid apps are not necessarily more secure than free ones.

              

All Your Calls Are Still Belong to Us - How We Compromised the Cisco VoIP Crypto Ecosystem by Daniel Mende and Enno Rey 

The speaker starts his presentation , before detailing the technical side, by a little refresher of what he calls the "7 sisters".

• Access control   
• Isolation 
• Restriction
• Encryption
• Entity protection
• Secure management 
• Visibility

These 7 principals are the basics for securing infrastructure regardless the technology used. These principals can be broken down to a checklist. 

The speaker listed then different case studies to demonstrate that globally the above principal es. for example:   

Case study scope: Call center 1500 Voip 

Presence of MS08-67 , Weak password , use of the same passwords on different components

No access Layer protection in place (abusing STP/DTP/OSPF/...)

Globally, the speaker feels according to his experience that regarding Voip equipment no body feels responsible to patch this boxes which implies security vulnerabilities .

                  

The second part of the presentation aimed to explain Cisco mechanism for Voip encryption. Hence, a refresher of the use of certificates and their implications has been presented. 

Indeed in Cisco World lots of certificate are used in a complex manner:

CUCM : needs a certificate itself of tftp signing firmware 

CAPF:(CA) needs a certificate 

Phone: use a certificate generated by the CAPF used for the communication between the phone and the call manager

CTL: The Certificate Trust List (CTL) is the root of the whole trust chain used in the crypto system of the CUCM. The CTL contains a server certificate, public key, serial number, signature, issuer name, subject name, server function, DNS name and the IP address for each server in the Unified Communication environment.

  

The CTL file must be created by an administrator in order to activate the “Mixed Mode” of the CUCM. The CTL file itself is signed by the private key stored on the security token (aladin etoken)        

Cisco IP Phones are using two different certificate types :

Manufacture-installed certificate (MIC):

Locally significant certificate (LSC):     

        

Actually, the weak point of the whole CUCM Security Model is the Certificate Trust List, which can potentially be subverted.        

         

To understand how communications are encrypted between and Iphone and a call managern, it is necessary to understand How a phone gets its certificate: 

1. Phone boots get the context CUCM
2. CUCM sends an initial CTL file
3. Phone checks if LSC is installed (local)
4. If not contact CUCM to get a partial config file 
5. CUCM sends a partial onfig 
6. The Phone generate public/private key
7. Send the public key to CUCM
8. Signed 
9. get it back 
10. installed as certificate    

The speaker pointed out also some the following behaviour when playing with CTL :

1. if validation fails reject CTL but old one get lost and we re back to initial provisioning state
2. just accept the new one 

In other way, If this process is intercepted, by a Man-in-the-Middle attack, it is possible to replace the original

Certificate Trust List with a modified one.

                      

The attack scenario consists in:

1. Traffic redirection between CUMC and phone
2. Provide TFTP server
3. Phone has to reboot  (SYN flood 30-50 sec ), any port can be used 
4. Use this FTP server to provide CTL file
5. Fake CTL main properties 
6. Replace public key of CTLs own Signing Certificate 
7. Replace public keys of matching CUCM certificate 

                  

Once the phone disposes of modified certs of its main communication partners, the attacker can: 

1. Access the phone private key associated with LSC
2. Read the encrypted config
3. MITM SIP-TLS traffic
4. Get user credentials
5. Replace key materials
6. Plus all the nice things that can be done with SIP protocol

                          

The demo is based on a Python script: ctl_proxy.py 

This small python script implements an TFTP server to serve modified CTL files and signed files to cisco

VoIP Hard- and Softphones. The tool is transparent from an TFTP view, so if a phone requests a special

file, this file is fetched from the CUCM TFTP server and served to the phone afterwards.

The tool is planned to be released on ERNW blog.

                       

     

HES 2012 ...

Revisiting Baseband attacks  by Weinmann Ralf Philipp (Luxembourg University)

  

The speaker states that his current works are based on previous research achieved in 2010. He carries on by giving a quick review  of known basebands attacks and the state of the art concerning this subject.

The speaker explains then different attack scenario as the one that consists in putting in place a rogue BTS operated by the attacker.

He underlines the fact that globally operator still think that is impossible for researcher to implement their own cell phone network.

    

A video demonstration was then shown illustrating a rogue BTS (physically based on an USRP) and linked to openBTS software. A call was issued from one phone to the other through the rogue BTS.   

     The main frame of the rest of the presentation goes as what follows:

•  How defensive side is organized 
•  How attacker capabilities are continuously increasing 
•  New  hardware platform
•  Silver bullet 
•   How it is possible to attack cell network infrastructure (turning the tables)          

      Defensive sides 

      The speaker mentions that internal audits are happening, vendors taking reports seriously. But, real problems are related the end of chain: OEMs (slow to fix security bugs, and don't see benefits of an update)

                 

      Globally the most Countermeasures seen are : 

• Not a single image with stack cookies seen
• Qualcomm's modem heap : safe unlinking 
•  X-gold 61x  DEP is useless du to ITCM
•  No ASLR (not giong to happen beacause it needs some complicated works)                         

     Attackers capabilities 

•  qcombbdbg helps a lot to understand the QCOM stack
•  unlike calimed in 2010: JTAG possible for a number production with QCOM chipset 
•  Pratical JTAG: RIFF box usually used by unlockers and helps for JTAG tracing 
•   For 3G: Anritsu  MD84OB a 3G protocol tester and allows also handover simulation 
• BB Heaps are better understood  

       

       Really that was a good presentation that I appreciate and I hope that I'll get the chance to work one day on this kind of subject...

Strange and Radiant Machines in the PHY Layer by Travis Goodspeed & Sergey Bratus

    
   The content of this conference was really interesting in the way that the speaker tries to shed light on  attacks that targets digital radio at the physical layer.
   
  And before that he tries to give an idea on how hardware bugs are identified Insisting that globally, before trying to attack a hardware, the speaker explains to us that is important to firstly get the software that resides in it.
   
   So the idea of Travis goodspeed as he well explain it in his blog is :
   
   "Layer 1 radio protocols are vulnerable injections similar to those that plague naively implemented SQL websites. You can place one packet inside of another packet and have the inner packet drop out to become a frame of its own. We call the technique Packet-in-Packet, or PIP for short"[goodspeed blog].
    
   So the key word of this conference was Packet injection and PIP (Packet in Packet). Indeed, PIP technique consists "in placing a complete radio frame within the body of a larger frame, then leveraging noise or protocol differences to cause the start of the outer frame to be missed"[GOODSPEED].


for those who wants to play with this type of attack, Goodspeed presented also a vulnerability that concerns Wireless Microsoft Keyboard. Actually, he developed a tool that allows to sniff traffic between a keyboard and a station. Nice Work...

Hardware backdooring is practical by Jonathan Brossard & Florentin    

   
Jonathan B. and Florentin presented a state of the art of Hardware backdooring.
As an introduction, the speakers gave an overview of the main components that have been used to develop the proof of concept: Rakshasa
Globally, the agenda of the presentation was  as the following:
A brief overview of an X86 architecture: here Florentin pointed out the fact that th TPM component is positioned between the "Southboard"  and the superIO component. that makes the TPM far from the CPU
 An overview of Coreboot project 
 A presentation of the design of Rakshasa: in fact, the POC is based on :

• Konboot 
• Coreboot
• SeaBios
• iPXE
• some payloads 

 Globally, the presentation was technically interesting ...

Cryptographic Function Identification in Obfuscated Binary Programs by Joan Calvet

One of the most recurrent challenge that are facing security researchers, reversers or pentesters is the way to identify Cryptographic function 
 in a Binary  program. Especially, malware analyzers have to deal with malwares that are in most cases obfuscation using cryptographic functions. 

 Joan C. as malware analyst presented to us his methodology to identify Crypto functions in obfuscated program. the methodology might divided into the following steps:

•  Step 1: Collect program trace execution (refer to Binary instrumentation tools as PIN)
•  Step 2: Extract Crypto Algorithm. The speaker underlines here that IDA features are plugins are not efficient in case of obfuscated binaries. Hence, he decided to introduce to us his own methodology based on the principal of identifying the relationship between inputs and outputs of a program. For that he assumes that loops are code features for crypto algorithm. So, he defines Loops and nested loops in case of binary analysis. 
•  Step 3: analyze the results. this steps is mainly based on comparing the behavior deduced from the previous steps with a real implementation of  a crytpo algorithm to validate the results. 

Finally, the speaker presented a demo based on real life cases and the enhancements that he has to do for his POC.

The talk was very clear and well explained. 

Hackito Ergo Sum day 1

Keynote by Cedric Blancher (French security researcher)

Attending HES 2012, that's really awesome! Cedric Blancher is opening the conference by a keynote.

Indeed, during this keynote he is trying to present and explain his feeling about HES and especially Hacking.

According to Cedric B., hacking is much wider than IT security, in fact security is a tiny part of Hacking.

Hacking is the ability to understand how things work, and to be able then to modify them in order to produce new stuffs or resolve problems.

To better illustrate this definition, Cedric B. makes an image with photography, knowing how to play with photographic equipements is a kind of hacking

In other words, Hacking makes you bends reality to you needs and have fun !

Of course, hacking is related to computers simply because theses "engines" are used evry days for various tasks.

Moreover, there is nothing so flexible to study, analyze and modify as computers...

And Being at HES, hacking deals also with IT security. Computer security is very hot topic, moreover Cybersecurity is becoming also a hot topic

For that just get a glance on :APTs (Google, RSA, Bercy....), anonymous (Lulzec..), cybercrime and cyberwar subjetcs.

Security gets coverage and then hacking gets coverge

Talking about Hacking implies the contrevesy between : Good and Bad. In fact, poeple are always linking Hakinhg to Evil World !

Cedric B. points out the fact that security conferences are booming in this world till the point that we are now able to spend all his life in confenreces

Except in France, Indeed in France there still few conferences as SSTIC, Hack In Paris, HES...

Cedric B. also points out that the technical level is decreasing concenring the subjects that are presented in these conferences.

Hopefully, HES still very technical.

Speaking about conferences, Cedric B. mentioned about Ekoprty (the same spirit as Hackito Sep at argentina). The idea of this confernce is that Hacking is becoming a public interest for that it is important to protect this knowledge

According to Cederic B. Protecting hacking is motived by:

• Need to learn
• Need to innnovate
• Need independance (reference to Hadopi in France)
• Need conter-powers
• Need Empowrement

Finally, Cedric B. underlines that he's a blogger and took the decision to never talk about political stuffs.

However, during the last 10 years --> laws such as : Hadopi, LCN and Lopsi2 makes Hacking more difficult.

To conclude if we want to change that we need to vote ....