Emmanuel Bouillon

Taming the Beast : Assess Kerberos-Protected Networks

Due to its universal support, to the fact that it is Microsoft's default and that it provides for a real SSO solution, Kerberos is a pervasive authentication protocol with a strong reputation of security. This talk will cover some of the issues involved with attacking a Kerberized network both under Unix and Microsoft Windows environment. It will review known yet underestimated implementation limitations and study under which circumstances they still lead to exploitable vulnerabilities. It will also present new ones that enable to step in the targeted systems. We will show how simple python codes implement those attacks. Finally, we will discuss some of the protocol evolutions and study their potential consequences in terms of security.

Benjamin Caillat

WiShMaster - WIndows SHellcode MASTERy

Malicious codes have to be able to manipulate their own code in order to implement some viral techniques, like executable infections, memory-only execution or polymorphism.

Such manipulations are considerably simplified if the program comes in the form of a shellcode. There are few solutions to obtain a shellcode: one is to write source code in assembly, but it quickly becomes a boring work. Another is to write source code in C language in a specific way, so that compiled code doesn't contain any hardcoded address. However, writing C code like this is very boring too, and it quickly appears that using an automatic tool that generates "specific" code from "normal" code is indispensable.

WiShMaster is a tool that converts a set of C source files written "normally" (the compilation of those source files produce an executable) and generates a shellcode, that is a block of code without any hardcoded or external reference and that can run in any process at any address. If execution is redirected to its first byte, the shellcode will accomplish exactly the same operation than the executable generated through normal sources compilation.

This transformation - called "shellcodisation" - opens lots of facilities: quick implementation of advanced viral techniques, shellcodes' redistribution etc.

WiShMaster first release is available on my web site (http://benjamin.caillat.free.fr/wishmaster.php)

Lord Erroll

Keynote: Privacy Protecting People or People Protecting Privacy

Bernardo Damele Assumpcao Guimaraes

Advanced SQL Injection Exploitation to Operating System Full Control

Over ten years have passed since a famous hacker coined the term "SQL injection" and it is still considered one of the major web application threats, affecting over 70% of web application on the Net. A lot has been said on this specific vulnerability, but not all of the aspects and implications have been uncovered, yet.

It's time to explore new ways to get complete control over the database management system's underlying operating system through a SQL injection vulnerability in those over-looked and theoretically not exploitable scenarios: From the command execution on MySQL and PostgreSQL to a stored procedure's buffer overflow exploitation on Microsoft SQL Server. These and much more will be unveiled and demonstrated with my own tool's new version that I will release at the Conference.

Eric Filiol

OpenOffice Security Design Weaknesses

Document malware exists for Microsoft Office: the sadly known macro-viruses which still represent a numeric nuisance nowadays. The recent evolution of office suite towards free software - providing a high compatibility with existing office software – makes it very necessary to determine and evaluate the exact level of risk of the OpenOffice suite with respect to document malware, This paper presents an up to date in-depth evaluation of its security (release 3.0.x) based on the results established since 2006 and 2007. All those results as well as the different sources codes of our attacks have been communicated to the OpenOffice developers group in order to help them to correct the identified security weaknesses and thus enhance the overall security of the OpenOffice suite around the concept of Trusted OpenOffice suite.

While this suite has been developed towards more and more easy-to-useness, the overall security has not been modified at all since. Worrying security weaknesses that have been identified since can still be exploited. They still may be used by malware to spread through innocuous-looking documents by exploiting the feeling of trust based on encryption and digital signature. At the present time, it seems far easier to develop sophisticated document malware for OpenOffice than for Microsoft Office. It is worth mentionning that the attacks we present are NOT based on software (implementation) flaws but on conceptual weaknesses that urge a redesign of the whole software concept.

Finally this paper will discuss the pros and cons of both open and proprietary solutions, on a purely technical basis, as far as security is concerned. There is no such thing as a perfect solution. Therein lies all the complexity of doing computer security.

Hagen Fritsch

Stack Smashing as of Today: A State-of-the-Art Overview on Buffer Overflow Protections on linux_x86_64

This presentation is for everyone familiar with buffer overflows, but who lost track on the developments of the field during the last years. We look into mitigation techniques deployed in current linux boxes and how to get around them while light is shed with an additional focus on 64bit platforms as those are increasing in popularity. Known (and not yet known) techniques to bypass NX, ASLR or stack-cookies will be presented giving an overview of the field and the ability to assess the threat that buffer overflows still pose today.

Roberto Gassira' and Roberto Piccirillo

Hijacking Mobile Data Connections

The increasing diffusion of smartphones and, generally, Internet capable mobile phones, is making web access from phones a 'normal' activity for mobile users. Mobile Operators are also leveraging new services for increasing their revenues connected to mobile data connections. In this fast changing scenario, some 'small' details may lag behind and have not been yet addressed in the Mobile environment. Our work shows how the combination of several common factors, Mobile Operator Networks, handsets and systemic 'issues' allow an attacker to take complete control of user data connections. By exploiting these issues, an attacker will be able to intercept data connections and possibly inject content by using easily available tools and standard protocols.

The described methodology allows 'data extrusion' scenarios, applying also to sessions that are typically confined into the Mobile Operator Network.The presentation analyzes the protocols needed for such attack, outline the issues, propose an attack scenario and provide means for its exploitation.A remote web browsing session hijacking will be demonstrated. We believe that new attacks exploiting the described issues may surge in the next future.

Rob Havelt

Yes It Is Too WiFi, and No Its Not Inherently Secure

Legacy 802.11 FHSS networks are alive and well. You see them in countless numbers of warehouses, retail environments, sometimes even in corporate networks. Unlike more modern 802.11 b/a/g/n these 802.11 FHSS networks are not treated as untrusted, oftentimes there will be no controls between these networks and corporate LAN environments. Sometimes vendors, and sometimes even credulous security consultants perpetuate the myth that this architecture is acceptable because unlike 802.11 off the shelf hardware to monitor these networks at the physical layer is not readily available.

Many times I've heard the argument that with these networks the SSID value is a security control as the attacker would need to know it to join the network, and that it would take "an expert attacker with thousands of dollars worth of highly sophisticated equipment to effectively sniff this over the air".

This talk will discuss the physical characteristics of 802.11 FHSS (PHY and MAC layer) and demonstrate practical methods of finding, eavesdropping, and attacking these networks, using basic, easily obtainable tools such as GNURadio and the USRP.

After demonstrating practical attack methodology, using actual real-life scenarios, I will discuss the security issues surrounding these legacy networks in production environments and the importance for security controls beyond obscurity.

Anthony Lineberry

Alice in User-Land: Hijacking the Linux Kernel via /dev/mem

Rootkits are commonplace in today’s threat landscape and increasingly difficult to deal with for those responsible for keeping systems safe. Kernel rootkits are especially difficult to detect and remove due to the fact that they operate on the same level as the operating system itself, and are thus able to intercept or subvert any operation made by the operating system. With new techniques demonstrated in this talk, it is possible to subvert the Linux kernel via direct code injection through /dev/mem, the driver interface to physically addressable memory, instead of using kernel modules to insert malicious code. This presentation will provide understanding of emerging rootkit methodologies in the 2.6 linux kernel such as locating important structures in the kernel, manipulating the memory inside, and hijacking the system, all via /dev/mem along with practical defensive countermeasures. Additionally, there will be a demonstration of a proof of concept implementation of rootkit code that enables manipulation of virtually anything your heart desires utilizing /dev/mem.

Bruno Luiz

Shuntaint: Emulation-based Security Testing for Formal Verification

This presentation will demonstrates an approach to security testing, which allows proofs of erros from specification to a simulated computer program. The focus is on low-level tracking for observing of logical properties satisfy a formal specification of programming error based on Common Weakness Enumeration (CWE). It will include techniques for alter execution flow though instrumentation code, triggering occurence of error during simulated execution of the computer program. As a result, new Valgrind tool, software-based dynamic information flow tracking system to attack a wide range of programming errors.

Moxie Marlinspike

Stripping SSL To Defeat HTTPS In Practice

This presentation will detail Moxie's SSL stripping technique, designed to side-step SSL as it is deployed in common web applications such as online banking and secure web logins. Additionally, there will be some discussion into possible mitigating patterns and solutions that have been proposed, as well as a look into what effect this technique might be having in the wild.

Erez Metula

.NET Framework Rootkits: Backdoors Inside Your Framework

This presentation introduces application level rootkit attacks on managed code environments, enabling an attacker to change the language runtime implementation, and to hide malicious code inside its core. This presentation focuses on the .NET Framework, while covering various ways to develop malware (rootkits,backdoors,logic manipulation, etc.) for the .NET framework, by changing its behavior. It includes demos of information logging, reverse shells, backdoors, encryption keys fixation, and other nasty things.

This presentation also introduces ".Net-Sploit" - a new tool for building MSIL malware that will enable the user to inject preloaded/custom payload to the Framework core DLL.

The Whitepaper, .NET-Sploit, and source code can be found here

Charlie Miller and Vincenzo Iozzo

Fun and Games with Mac OS X and iPhone Payloads

Mac OS X continues to spread among users, and with this increased market share comes more scrutinization of the security of the operating system. The topics of vulnerability analysis and exploit techniques have been discussed at length. However, most of these findings stop once a shell has been achieved. This paper introduces advanced payloads which help to avoid detection, avoid forensics, and avoid countermeasures used by the operating system for both Mac OS X and iPhone. These payloads include Meterpreter and userland-exec for forensics evasion and two iPhone payloads which work against factory iPhones, despite the deviceʼs memory protections and code signing mechanisms.

Jon Miller, Alex Wheeler, David Bonvillian, and Neel Mehta

Cutting Through the Hype: An Analysis of Application Testing Methodologies

In this presentation we will discuss the different testing methodologies used when assessing the security of both binary applications as well as web-based applications. We will focus on the differences and advantages as they relate to blackbox testing, whitebox testing, graybox testing, reverse engineering, and fuzzing. Unfortunately there is no one testing methodology that provides the best balance of time and accuracy for every application, in this talk we will provide metrics for helping decide what methodology should be used for what types of applications.

Mariano Nunez Di Croce

SAP Penetration Testing

While there is plenty of publicly available information on how to assess and secure operating systems, databases, wireless devices and Web applications, the security of Enterprise applications is still taking baby steps . If you are a professional pentester and are required to run an SAP security assessment, where would you start? nmap? nessus? And after that? SAP systems are complex, running many applications and interfaces. Therefore, the assessment of these systems requires specific techniques and tools.

In this talk you will learn how to start an SAP pentest, what and where to look for. You will look into the whole process, from the information discovery stage to the exploitation phase, with a LOT of LIVE DEMOS! Moreover, you will learn how to use sapyto, the first opensource SAP Penetration Testing Framework, which will help you with your SAP security assessments. Moreover, during this talk, a new sapyto version will be released!

On the other hand, if you are a security administrator you *must* know how to protect the systems storing and processing your critical business information, being aware of unsecure default configurations that will render your systems vulnerable, as well as the current and future attacks that will try to exploit them. This talk will also detail the ways in which you can protect yourself against potential attackers, helping you to increase the security level of your SAP installation and protecting your business.

Mariano Nunez Di Croce

Alternate: Testing Internet-facing SAP Services: The SAProuter

The SAProuter is an SAP application-level gateway developed to "protect your SAP network against unauthorized access". Therefore, by analyzing incoming connection attempts, the SAProuter will authorize or reject remote access to internal SAP systems. Every SAP implementation has at least one SAProuter, which many times is completely exposed to the Internet.

This talk will demonstrate different techniques and tools to assess the security of one of the most critical SAP components. You will see how wrong configuration can lead to complete exposure of the internal SAP network to Internet, as well as the whole company network.

Furthermore, we will present you the saprouterAgent, a sapytoAgent that will allow you to escalate privileges into the internal network in security pentests. All the presented tools will be available in the next public sapyto version, released at the presentation!

Finally, we will show how to protect your network from external attackers by secure configuration and implementation of your SAProuter systems.

Enno Rey and Daniel Mende

All Your Packets Are Belong to Us - Attacking Backbone Technologies

The year 2008 has seen some severe attacks on infrastructure protocols (SNMP, DNS, BGP). We will continue down that road and discuss potential and real vulnerabilities in backbone technologies used in today's carrier space (e.g. MPLS, Carrier Ethernet, QinQ and the like). The talk includes a number of demos (like cracking BGP MD5 keys, redirecting MPLS traffic on a site level and some Carrier Ethernet stuff) all of which will be performed with a new tool kit made available at the con. It's about making the theoretical practical, once more!

Rich Smith

VAASeline: VNC Attack Automation Suite

During network enumerations and pentests VNC servers are commonly found on otherwise-secured systems. VNC servers can often be the subjects of weak or blank passwords due to their presence as part of an organisation's 'Shadow IT' infrastructure, thus not conforming to password or authentication policies.

For these reasons, it was deemed preferable to have a generic method by which VNC systems could have arbitrary command execution scripted against them in an automated manner as part of a penetration test or vulnerability scan using only the Remote Frame Buffer (RFB) protocol on which VNC is built. While a seemingly simple task, due to the design of the RFB protocol, it quickly becomes complex and you are left thinking 'it shouldn't be this hard …. should it?' The reason for this from a programmatic perspective is the blind nature of the protocol: mouse and keyboard events input, framebuffer updates output. This makes input vectors very limited and outcome of supplied input essentially invisible to scripts as it is manifested as visual screen updates only.

The presentation discusses a generic method by which arbitrary commands can be executed on a VNC server only through the use of standard RFB protocol packet types, albeit through the inventive misuse of them.

In brief, a multi-step technique to use the clipboard of the target VNC server along with an uploaded VBScript clipboard monitor and the Client/ServerCutText RFB packet types as a crude RPC interface over which a custom but extensible ASCII protocol has been implemented to allow arbitrary, stateful actions to be taken on Win32 VNC servers using only the RFB protocol.

A library written in python to allow the technique to be easily used has be written and will be released under the LGPL license, along with the presentation. In addition a number of other VNC attack tools based on the same library will also be released, including:

• Passive Clipboard Sniff: This allows the contents of the clipboards from both a VNC client and server to be grabbed off the wire by an attacker.
• Active Clipboard Sniff: This allows the clipboard of a targeted VNC system to be monitored by a n attacker who is able to authenticate to a VNC server.
• VNC Auto Auth: This allows a VNC server utilising password authentication to have its password enumerated by either dictionary or brute force attacks.

These tools help an attacker to get into a position whereby he is able to use the VNC RPC technique to take arbitrary scriptable actions on a target.

These tools can be easily scripted together to provide an entirely automated VNC server enumeration, password discovery and attacker action across an entire network as part of a penetration test.

Demonstrations of the tools, libraries and techniques will be shown in the presentation.

Finally the techniques should be generally applicable to the Remote Desktop Protocol also, although a library to support this is not ready for release at this time.

Roelof Temmingh and Chris Bohme

Integrating Maltego with Offensive and Defensive Open Source Tools

Last year we have shown how Maltego can discover and visually correlate all sort of interesting information. Since version 2.0.2 of the tool it is possible to extend the functionality with local transforms. This means that anyone with a little creative energy can write their own transforms (in any language) while using the power and flexibility of the framework. This year we will show how we can integrate offensive and defensive tools into Maltego, how little effort it takes, and the awesome power this combination of tools hold. We will show how log file analyzers, vulnerability scanners, port scanner, IDS logs and local databases all work in harmony together - without re-inventing the wheel! These local transforms will be released to attendees at the conference. We will also be revealing the long awaited v2.1 as well updated community editions.

Jeroen van Beek

Passports Reloaded Goes Mobile

In 2006, BlackHat Las Vegas presented a cloned ePassport. In 2008 Elvis' ePassport was found. This presentation will examine the different mechanisms used in ePassport to prevent cloning and creation of electronic travel documents with non-original content and ways to attack these mechanisms. Additionally we dive into the process of integrating emulator chips in existing travel documents. Also a new ePassport attack suite will be presented, allowing you to backup your passport chip with a mobile phone.

Chris Wysopal

Detecting "Certified Pre-owned" Software and Devices

Is there lead in the paint of that Chinese toy or melamine in that baby formula? These are appropriate questions for the risks of today. But what about that codec or toolbar you just installed, or the digital picture frame you just purchased? Legitimate software and devices today are coming "certified pre-owned". It would be nice if AV companies could keep up with their blacklisting efforts but they have fallen behind. And when was the last time you scanned a web app or a digital picture frame for malicious code? AV just isn't up to the task. Static analysis with a ruleset that inspects for the telltale signs of malicious code can flag the badware. This presentation will outline how to inspect statically for rootkit behavior, anti-debugging code, timebombs, backdoor credentials, and network information leakage.

Stefano Zanero & Claudio Criscione

Masibty: a Web Application Firewall Based on Anomaly Detection

During this talk we will focus on why current web application firewalls and IPSs are basically useless, since they are misuse based (e.g. rely on rules). Since misuse detectors are unable to keep up with evolving attack schemes, evasion techniques, and custom applications, better anomaly detectors are badly needed.

Masibty is an anomaly detection reverse proxy, aimed at detecting web application attacks. It is able to detect zero-day attacks (the real thing, not a marketing-tainted redefinition) after an initial live training which does not require attack-free data.

Modularized for easy extension, in its current implementation it is able to detect and block anomalies in the DOM tree - therefore blocking XSS attacks - and in application parameters.

It is resilient to URL rewriting, and it was tested against in-the-wild exploits collected from the usual sources over a number of months, with the use of various forms of evasion.