We once again approach the Blackhat / DEF CON / B-Sides week in Vegas. This year’s DEF CON talks are announced and look pretty interesting … not to mention all of the workshops and other shenanigans that will be out there. Plus the change of venue to Caesars Palace should be really cool.
The hardest decision at DEF CON is choosing which talks to attend. ITSP magazine focused on talks about Privacy related found in a post HERE. Here are the talks I’m interested in seeing. This list may change once I get out there. See the complete list HERE. Feel free to comment on talks you think will be interesting.
Jailbreaking Apple Watch
On April 24, 2015, Apple launched themselves into the wearables category with the introduction of Apple Watch. This June, at Apple’s Worldwide Developer Conference, Apple announced that their watch is not only the #1 selling smartwatch worldwide by far, but also announced the introduction of new capabilities that will come with the release of watchOS 4. Like other devices, Apple Watch contains highly sensitive user data such as email and text messages, contacts, GPS and more, and like other devices and operating systems, has become a target for malicious activity.
This talk will provide an overview of Apple Watch and watchOS security mechanisms including codesign enforcement, sandboxing, memory protections and more. We will cover vulnerabilities and exploitation details and dive into the techniques used in creating an Apple Watch jailbreak. This will ultimately lead to a demonstration and explanation of jailbreaking an Apple Watch, showcasing how it can access important user data and applications.
How we created the first SHA-1 collision and what it means for hash security
In February 2017, we announced the first SHA-1 collision. This collision combined with a clever use of the PDF format allows attackers to forge PDF pairs that have identical SHA-1 hashes and yet display different content. This attack is the result of over two years of intense research. It took 6500 CPU years and 110 GPU years of computations which is still 100,000 times faster than a brute-force attack.
In this talk, we recount how we found the first SHA-1 collision. We delve into the challenges we faced from developing a meaningful payload, to scaling the computation to that massive scale, to solving unexpected cryptanalytic challenges that occurred during this endeavor.
We discuss the aftermath of the release including the positive changes it brought and its unforeseen consequences. For example it was discovered that SVN is vulnerable to SHA-1 collision attacks only after the WebKit SVN repository was brought down by the commit of a unit-test aimed at verifying that Webkit is immune to collision attacks.
Building on the Github and Gmail examples we explain how to use counter-cryptanalysis to mitigate the risk of a collision attacks against software that has yet to move away from SHA-1. Finally we look at the next generation of hash functions and what the future of hash security holds
Abusing Certificate Transparency Logs
The Certificate Transparency system provides public logs of TLS certificates. While Certificate Transparency is primarily used to uncover security issues in certificates, its data is also valuable for other use cases. The talk will present a novel way of exploiting common web applications like WordPress, Joomla or Typo3 with the help of Certificate Transparency.
Certificate Transparency has helped uncover various incidents in the past where certificate authorities have violated rules. It is probably one of the most important security improvements that has ever happened in the certificate authority ecosystem. In September 2017 Google will make Certificate Transparency mandatory for all new certificates. So it’s a good time to see how it could be abused by the bad guys.
Next-Generation Tor Onion Services
Millions of people around the world use Tor every day to protect themselves from surveillance and censorship. While most people use Tor to reach ordinary websites more safely, a tiny fraction of Tor traffic makes up what overhyped journalists like to call the “dark web”. Tor onion services (formerly known as Tor hidden services) let people run Internet services such as websites in a way where both the service and the people reaching it can get stronger security and privacy.
I wrote the original onion service code as a toy example in 2004, and it sure is showing its age. In particular, mistakes in the original protocol are now being actively exploited by fear-mongering “threat intelligence” companies to build lists of onion services even when the service operators thought they would stay under the radar.
These design flaws are a problem because people rely on onion services for many cool use cases, like metadata-free chat and file sharing, safe interaction between journalists and their sources, safe software updates, and more secure ways to reach popular websites like Facebook.
In this talk I’ll present our new and improved onion service design, which provides stronger security and better scalability. I’ll also publish a new release of the Tor software that lets people use the new design.
Backdooring the Lottery and Other Security Tales in Gaming over the Past 25 Years
In this talk Gus and Evan will discuss the recent Hot Lotto fraud scandal and how one MUSL employee, Eddie Tipton, was able to rig several state lotteries and win $17 million (or perhaps more). Gus’ firm is actively supporting the prosecution in this case. Evan was responsible for identifying and analyzing how Eddie was able to rig the RNG.
Details on the rigged RNG and other details from the case will be presented publicly for the first time during this talk.
For historical context other related attacks including the Ron Harris and hacking keno in the 1990’s and a recent incident involving a Russian hacking syndicate’s exploitation of slot machines will also be discussed.
Untrustworthy Hardware and How to Fix It
Modern computing platforms offer more freedom than ever before. The rise of Free and Open Source Software has led to more secure and heavily scrutinized cryptographic solutions. However, below the surface of open source operating systems, strictly closed source firmware along with device driver blobs and closed system architecture prevent users from examining, understanding, and trusting the systems where they run their private computations. Embedded technologies like Intel Management Engine pose significant threats when, not if, they get exploited. Advanced attackers in possession of firmware signing keys, and even potential access to chip fabrication, could wreak untold havoc on cryptographic devices we rely on.
After surveying all-too-possible low level attacks on critical systems, we will introduce an alternative open source solution to peace-of-mind cryptography and private computing. By using programmable logic chips, called Field Programmable Gate Arrays, this device is more open source than any common personal computing system to date. No blobs, no hidden firmware features, and no secret closed source processors. This concept isn’t “unhacakable”, rather we believe it to be the most fixable; this is what users and hackers should ultimately be fighting for.
Uncovering useful and embarrassing info with Maltego
The talk has two sections – useful and embarrassing.
In the ‘useful’ section of this fun filled talk we show how we combine the power of Maltego and Shodan to hunt for ICS devices on the Internet. We tackle the difficult problem of finding the function, owners and locations of these devices using OSINT and Maltego. The result is a one click sequence of transforms that makes finding interesting ICS devices child’s play. In the ’embarrassing’ section we look at how network footprinting (which we’ve refined to an art in Maltego) becomes useful for identifying and profiling people who’s job description involves lots of lies and who probably does not want to be associated with the data that’s out there on them.
CableTap: Wirelessly Tapping Your Home Network
Absract will be released prior to DEF CON.
Driving down the rabbit hole
Over the past few years, cars and automotive systems have gained increasing attention as cyber-attack targets. Cars are expensive. Breaking cars can cost a lot. So how can we find vulnerabilities in a car with no budget? We’ll take you with us on a journey from zero car security validation experience through the discovery and disclosure of multiple remotely-exploitable automotive vulnerabilities. Along the way, we’ll visit a wrecking yard, reassemble (most) of a 2015 Nissan Leaf in our lab, discuss how we picked our battles, fought them, and won. During our talk, we’ll examine the details of three different classes of vulnerabilities we found in this vehicle, how they can be exploited, and the potential ramifications to the owner of their real-world exploitation. We’ll also discuss the broader scope of the vulnerabilities discovered, how they extend beyond just this specific vehicle, and what the industry can do better to prevent these types of problems in the future.
Hacking the Cloud
You know the ins and outs of pivoting through your target’s domains. You’ve had the KRBTGT hash for months and laid everything bare. Or have you?
More targets today have some or all of their infrastructure in the cloud. Do you know how to follow once the path leads there? Red teams and penetration testers need to think beyond the traditional network boundaries and follow the data and services they are after. This talk will focus on how to take domain access and leverage internal access as a ticket to your target’s cloud deployments.
We will also discuss round trip flights from cloud to on-premises targets and what authorizations are required to access your target’s cloud deployments. While this talk is largely focused on Microsoft Azure implementations, the concepts can be applied to most cloud providers.
All Your Things Are Belong To Us
Get out your rollerblades, plug in your camo keyboard, and fire up your BLT drive. It’s 25 years later and we’re still hacking the planet. The Exploitee.rs are back with new 0day, new exploits and more fun. Celebrating a quarter century of DEF CON the best way we know how: hacking everything!
Our presentation will showcase vulnerabilities discovered during our research into thousands of dollars of IoT gear performed exclusively for DEF CON. We will be releasing all the vulnerabilities during the presentation as 0days to give attendees the ability to go home and unlock their hardware prior to patches being released. As always, to give back to the community that has given us so much, we will be handing out free hardware during the presentation so you can hack all the things too!Come party with us while we make “All Your Things Are Belong To Us.”
