DEF CON 23 [Audio] Speeches from the Hacker Convention

Materials Available Here:https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Chris-Rock-I-Will-Kill-You-How-to-Get-Away-with-Murder.pdf

I Will Kill You

Chris Rock Custodian Pty Ltd

Have you ever wanted to kill someone? Do you want to get rid of your partner, your boss or your arch nemesis? Perhaps you want to enjoy your life insurance payout whilst you’re still alive. Do you have rich elderly parents that just won’t die quick enough? Or do you want a “Do Over” new identity.

Then, this presentation is for you! I’ll provide you with the insight and techniques on how to “kill” someone and obtain a real death certificate and shutdown their lives. It focuses on the lack of security controls that allow any of us to virtually kill off anyone or any number of people. Forget the Dexter way of killing someone, I’ll show you how to avoid the messy clean up and focusing in on the digital aspects. You could be dead right now and not even know it.

The presentation will explain the death process and will highlight the vulnerabilities and its implications world-wide.

You will learn:

How to fill in a doctor’s medical cause of death certificate anonymously.

How to become a funeral director and dispose of the body.

How to obtain a Death Certificate.

Once you’ve wrapped your mind around that concept, I will also show you how to “birth” Virtual identities that obtain real birth certificates. You will learn the birth registration process and the security vulnerabilities associated with this as well.

The third and final step of the presentation is “The baby harvest”, a concept that I’ve developed, which involves creating and raising virtual identities. This technique is similar to a shelf company. Virtually will be “born”, registered with the government complete with birth certificates and social security numbers. They can open up bank accounts, get a virtual job to launder money, pay taxes, obtain home loans and obtain life insurance policies. They can be married to anyone (virtual or not) and be directors of companies…. the list is endless and to complete the circle of life, they can be killed off when they are ready for “harvest” for their life insurance payouts or sold as permanent I.D.’s. With no victim, this is taking identity theft to the next level.

Chris Rock has been active in the security industry for the last 20 years and is the founder and CEO of Custodian, a specialized security company that specializes in Security Operations Centres, Penetration testing and independent research. Custodian is an Australian, Middle East and Hong Kong registered company that has been operational for over 9 years. Chris has also spent 12 years in the banking sector and provides security services around the world for small, medium and large companies.

Materials Available Here:https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Rich-Kelley-Harness-Powershell-Weaponization-Made-Easy.pdf

Harness: Powershelgl Weaponization Made Easy (or at least easier)

Rich Kelley security researcher & co-founder of Gray Tier Technologies

The Harness toolset aims to give penetration testers and red teams the ability to pull a remote powershelgl interface with all the same features of the native Powershelgl CLI and more. Several tools and utilities have been released to solve the powershelgl weaponization problem, but no freely available tool give operators the full capabilities of powershelgl through a remote interface. We’ll start the talk with a quick survey of the previous methods of weaponizing powershelgl, and then move into the capabilities of the Harness toolset which includes a fully interactive powershelgl CLI, and remote importing of modules across the wire without staging. We’ll conclude with taking a look at the underlying code that makes the toolset work, and briefly discuss planned features. The Harness toolset will be released open source in conjunction with this talk.

Rich Kelley (@RGKelley5) is a security researcher and the co-founder of Gray Tier Technologies, a small InfoSec start-up based out of Alexandria, VA. After his time in the military he held positions as a network engineer, software engineer, and penetration tester for various government agencies. He recently moved into exploit development and reverse engineering, and is pretty sure he knows less than when he started.

Twitter: @RGKelley5

Materials Available Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Lin-Huang-Qing-Yang-GPS-Spoofing.pdf

Low-cost GPS simulator – GPS spoofing by SDR

Lin Huang Senior wireless security researcher, Qihoo 360 Technology Co. Ltd.

Qing Yang Team Leader of Unicorn Team, Qihoo 360 Technology Co. Ltd.

It is known that GPS L1 signal is unencrypted so that someone can produce or replay the fake GPS signal to make GPS receivers get wrong positioning results. There are many companies provide commercial GPS emulators, which can be used for the GPS spoofing, but the commercial emulators are quite expensive, or at least not free. Now we found by integrating some open source projects related to GPS we can produce GPS signal through SDR tools, e.g. USRP / bladeRF. This makes the attack cost very low. It may influence all the civilian use GPS chipset. In this presentation, the basic GPS system principle, signal structure, mathematical models of pseudo-range and Doppler effect will be introduced. The useful open source projects on Internet will be shared with attendees.

HUANG Lin is a wireless security researcher, from Unicorn Team of Qihoo 360 China. Before entering Qihoo, she worked for telecom operator Orange, for 9 years, as a wireless researcher. Her interests include the security issues in wireless communication, especially the cellular network security, and also other problems in ADS-B, GPS, Bluetooth, Wifi, and automotive electronics.

Twitter: @huanglin_bupt

She is one of the earliest users of USRP in China, and keeps active in SDR/USRP research and development since 2006. She contributed to several UMTS/LTE soft base station projects, e.g. Open Air Interface. In 2009, She wrote one free e-book for GNU Radio training, which is very popular in China.

YANG Qing is the team leader of Unicorn Team in Qihoo 360 Technology Co. Ltd. He has rich experiences in wireless and hardware security area, including WiFi penetration testing, cellular network interception, IC card cracking etc. His interests also cover embedded system hacking, firmware reversing, automotive security, and software radio.

He is the first one who reported the vulnerabilities of WiFi system and RF IC card system used in Beijing subway.

Materials Available here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Samy-Kamkar-README.txt

Extras: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Samy-Kamkar-Extras.rar

Drive It Like You Hacked It: New Attacks and Tools to Wirelessly Steal Cars

Samy Kamkar

Gary Numan said it best. Cars. They’re everywhere. You can hardly drive down a busy freeway without seeing one. But what about their security?

In this talk I’ll reveal new research and real attacks in the area of wirelessly controlled gates, garages, and cars. Many cars are now controlled from mobile devices over GSM, while even more can be unlocked and ignitions started from wireless keyfobs over RF. All of these are subject to attack with low-cost tools (such as RTL-SDR, GNU Radio, HackRF, Arduino, and even a Mattel toy).

We will investigate how these features work, and of course, how they can be exploited. I will be releasing new tools and vulnerabilities in this area, such as key-space reduction attacks on fixed-codes, advanced "code grabbers" using RF attacks on encrypted and rolling codes, and how to protect yourself against such issues.

By the end of this talk you’ll understand not only how vehicles and the wirelessly-controlled physical access protecting them can be exploited, but also learn about various tools for car and RF research, as well as how to use and build your own inexpensive devices for such investigation.

Ladies and gentlemen, start your engines. And other people’s engines.

Samy Kamkar is a security researcher, best known for creating The MySpace Worm, one of the fastest spreading viruses of all time. He (attempts to) illustrate terrifying vulnerabilities with playfulness, and his exploits have been branded:

“Controversial”, -The Wall Street Journal

“Horrific”, -The New York Times

“Now I want to fill my USB ports up with cement”, -Gizmodo

He’s demonstrated usurping typical hardware for surreptitious means such as with KeySweeper, turning a standard USB wall charger into a covert, wireless keyboard sniffer, and SkyJack, a custom drone which takes over any other nearby drones allowing them to be controlled as a massive zombie swarm. He’s exposed issues around privacy, such as by developing the Evercookie which appeared in a top-secret NSA document revealed by Edward Snowden, exemplifying techniques used by governments and corporations for clandestine web tracking, and has discovered and released research around the illicit GPS and location tracking performed by Apple, Google and Microsoft mobile devices. He continues to produce new research and tools for the public as open source and open hardware.

Twitter: @samykamkar

Working together to keep the Internet safe and secure

Alejandro Mayorkas Deputy Secretary of Homeland Security

We all have a role to play when it comes to ensuring the safety and security of the Internet, whether you are a federal employee, the CEO of a company, or a private citizen. Today’s threats require the engagement of our entire society. This shared responsibility means that we have to work with each other in ways that is often new for the government and the private sector. This means that we also have to trust each other and share information. While we have achieved some successes, we have much more work to do. Deputy Secretary Mayorkas will highlight the role that DHS plays in securing the Internet and discuss the challenges and opportunities to collaborate across our society and across borders.

Alejandro Mayorkas was sworn in as Deputy Secretary of Homeland Security on December 23, 2013. Since 2009, following his nomination by President Obama and subsequent confirmation, Deputy Secretary Mayorkas served as the Director of the Department of Homeland Security’s United States Citizenship and Immigration Services (USCIS), the agency charged with operating the largest immigration system in the world. In that position, he led a workforce of 18,000 members throughout more than 250 offices worldwide and oversaw a $3 billion annual budget. While at USCIS he oversaw a number of important programs and enhancements, including the implementation of Deferred Action for Childhood Arrivals (DACA) as well as important reforms that safeguard our nation’s security, and ensure the integrity of the immigration system.

Prior to his appointment at USCIS, Deputy Secretary Mayorkas was a partner in the law firm of O’Melveny & Myers LLP. In 2008, the National Law Journal recognized Deputy Secretary Mayorkas as one of the “50 Most Influential Minority Lawyers in America.”

In 1998, Deputy Secretary Mayorkas was nominated by President Clinton and confirmed by the Senate to be the United States Attorney for the Central District of California, becoming the youngest U.S. Attorney to serve the nation at that time. In addition to leading an office of 240 Assistant U.S. Attorneys, Mayorkas served as the ViceChair of the Attorney General’s Advisory Subcommittee on Civil Rights and as a member of the Subcommittee on Ethics in Government. From 1989 to 1998, Mayorkas served as an Assistant U.S. Attorney for the Central District of California.

Deputy Secretary Mayorkas is a graduate of the University of California at Berkeley and received his law degree from Loyola Law School.

Materials Available Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Etienne-Martineau-Inter-VM-Data-Exfiltration.pdf

Inter-VM data exfiltration: The art of cache timing covert channel on x86 multi-core

Etienne Martineau Software engineer, Cisco Systems

On x86 multi-core covert channels between co-located Virtual Machine (VM) are real and practical thanks to the architecture that has many imperfections in the way shared resources are isolated.

This talk will demonstrate how a non-privileged application from one VM can ex-filtrate data or even establish a reverse shell into a co-located VM using a cache timing covert channel that is totally hidden from the standard access control mechanisms while being able to offer surprisingly high bps at a low error rate.

In this talk you'll learn about the various concepts, techniques and challenges involve in the design of a cache timing covert channel on x86 multi-core such as:

An overview of some of the X86 shared resources and how we can use / abuse them to carry information across VMs.

Fundamental concept behind cache line encoding / decoding.

Getting around the hardware pre-fetching logic ( without disabling it from the BIOS! )

Data persistency and noise. What can be done?

Guest to host page table de-obfuscation. The easy way.

Phase Lock Loop and high precision inter-VM synchronization. All about timers.

At the end of this talk we will go over a working VM to VM reverse shell example as well as some surprising bandwidth measurement results. We will also cover the detection aspect and the potential countermeasure to defeat such a communication channel. The source code is going to be release at that time on 'github'

Etienne holds bachelor's degree in electrical engineering from University Laval at Quebec and is currently a senior technical leader at Cisco Systems. He has over 15 years' mission critical Linux in telecom and space industry experience. His career has covered broad range of high performance / high availability hardware and software technologies, system level architecture and since 2008 a very special focus on the KVM hypervisor. He likes to work on complex and challenging problems but when not working, he likes to spend time with his family and during the night hack virtual machines or rebuild car engines.

Attacking Hypervisors Using Firmware and Hardware

Yuriy Bulygin Advanced Threat Research, Intel Security

Mikhail Gorobets Advanced Threat Research, Intel Security

Alexander Matrosov Advanced Threat Research, Intel Security

Oleksandr Bazhaniuk Advanced Threat Research, Intel Security

Andrew Furtak Security Researcher

In this presentation, we explore the attack surface of modern hypervisors from the perspective of vulnerabilities in system firmware such as BIOS and in hardware emulation. We will demonstrate a number of new attacks on hypervisors based on system firmware vulnerabilities with impacts ranging from VMM DoS to hypervisor privilege escalation to SMM privilege escalation from within the virtual machines.

We will also show how a firmware rootkit based on these vulnerabilities could expose secrets within virtual machines and explain how firmware issues can be used for analysis of hypervisor-protected content such as VMCS structures, EPT tables, host physical addresses (HPA) map, IOMMU page tables etc. To enable further hypervisor security testing, we will also be releasing new modules in the open source CHIPSEC framework to test issues in hypervisors when virtualizing hardware.

Materials Available Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Michael-Robinson-Knocking-My-Neighbors-Kids-Drone-Offline-UPDATED.pdf

Knocking my neighbor’s kid’s cruddy drone offline

Michael Robinson Professor, Stevenson University

My neighbor’s kid is constantly flying his quad copter outside my windows. I see the copter has a camera and I know the little sexed crazed monster has been snooping around the neighborhood. With all of the hype around geo-fencing and drones, this got me to wondering: Would it be possible to force a commercial quad copter to land by sending a low-level pulse directly to it along the frequencies used by GPS? Of course, radio signal jamming is illegal in the U.S and, frankly, it would disrupt my electronics, too. In this presentation, we’ll look at some of the research and issues we encountered, when we attempted to force land two commercial drones (the new DJI Phantom 3 and the Parrot Bepop Drone) by sending GPS signals directly at the drones (while staying under the threshold for jamming and not disrupting anyone else).

Michael Robinson has over 15 years of computer security experience and is currently a computer and mobile device forensic examiner in the Washington, DC area, where he deals with intrusion analysis, incident response, and criminal cases. For over four years he ran IT and IA operations for a Department of Defense agency. He has conducted research on security of mobile devices and is starting to play around in the drone space. He teaches computer forensics at the graduate level at Stevenson University in Maryland.

Materials Available Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Hariri-Spelman-Gorenc-Abusing-Adobe-Readers-JavaScript-APIs.pdf

Abusing Adobe Reader’s JavaScript APIs

Brian Gorenc Manager, HP’s Zero Day Initiative

Abdul-Aziz Hariri Security Researcher, HP’s Zero Day Initiative

Jasiel Spelman Security Researcher, HP’s Zero Day Initiative

Adobe Reader’s JavaScript APIs offer a rich set of functionality for document authors. These APIs allow for processing forms, controlling multimedia events, and communicating with databases, all of which provide end-users the ability to create complex documents. This complexity provides a perfect avenue for attackers to take advantage of weaknesses that exist in Reader’s JavaScript APIs.

In this talk, we will provide insight into both the documented and undocumented APIs available in Adobe Reader. Several code auditing techniques will be shared to aid in vulnerability discovery, along with numerous proofs-of-concept which highlight real-world examples. We’ll detail out how to chain several unique issues to obtain execution in a privileged context. Finally, we’ll describe how to construct an exploit that achieves remote code execution without the need for memory corruption.

Brian Gorenc is the manager of Vulnerability Research with Hewlett-Packard Security Research (HPSR). In this role, Gorenc leads the Zero Day Initiative (ZDI) program, which is the world’s largest vendor-agnostic bug bounty program. His focus includes analyzing and performing root-cause analysis on hundreds of zero-day vulnerabilities submitted by ZDI researchers from around the world. The ZDI works to expose and remediate weaknesses in the world’s most popular software. Brian is also responsible for organizing the ever-popular Pwn2Own hacking competitions.

Prior to joining HP, Gorenc worked for Lockheed Martin on the F-35 Joint Strike Fighter (JSF) program. In this role, he led the development effort on the Information Assurance (IA) products in the JSF’s mission planning environment.

Twitter: @maliciousinput

Abdul-Aziz Hariri is a security researcher with Hewlett-Packard Security Research (HPSR). In this role, Hariri analyzes and performs root-cause analysis on hundreds of vulnerabilities submitted to the Zero Day Initiative (ZDI) program, which is the world's largest vendor-agnostic bug bounty program. His focus includes performing root-cause analysis, fuzzing and exploit development.

Prior to joining HP, Hariri worked as an independent security researcher and threat analyst for Morgan Stanley emergency response team. During his time as an independent researcher, he was profiled by Wired magazine in their 2012 article, “Portrait of a Full-Time Bug Hunter”.

Twitter: @abdhariri

Jasiel Spelman is a vulnerability analyst and exploit developer for the Zero Day Initiative (ZDI) program. His primary role involves performing root cause analysis on ZDI submissions to determine exploitability, followed by developing exploits for accepted cases. Prior to being part of ZDI, Jasiel was a member of the Digital Vaccine team where he wrote exploits for ZDI submissions, and helped develop the ReputationDV service from TippingPoint. Jasiel's focus started off in the networking world but then shifted to development until transitioning to security. He has a BA in Computer Science from the University of Texas at Austin.

Twitter: @wanderingglitch

HP’s Zero Day Initiative, Twitter: @thezdi

Materials Available Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Gregory-Pickett-Staying-Persistant-in-Software-Defined-Networks.pdf

Extras Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Gregory-Pickett-Extras.rar

Staying Persistent in Software Defined Networks

Gregory Pickett Cybersecurity Operations, Hellfire Security

The Open Network Install Environment, or ONIE, makes commodity or WhiteBox Ethernet possible. By placing a common, Linux-based, install environment onto the firmware of the switch, customers can deploy the Network Operating Systems of their choice onto the switch and do so whenever they like without replacing the hardware. The problem is, if this gets compromised, it also makes it possible for hackers to install malware onto the switch. Malware that can manipulate it and your network, and keep doing it long after a Network Operating System reinstall.

With no secure boot, no encryption, no authentication, predictable HTTP/TFTP waterfalls, and exposed post-installation partition, ONIE is very susceptible to compromise. And with Network Operating Systems such as Switch Light, Cumulus Linux, and Mellanox-OS via their agents Indigo and eSwitchd not exactly putting up a fight with problems like no authentication, no encryption, poor encryption, and insufficient isolation, this is a real possibility.

In this session, we'll cover the weaknesses in ONIE, ways to reach the platform through these Network Operating Systems, and what can happen if we don't properly protect the Control Plane these switches run on. I'll even demonstrate with a drive-by web-attack that is able to pivot through a Windows management station to reach the isolated control plane network, and infect one of these ONIE-based switches with malware, malware that's there even after a refresh. You'll even get the source code to take home with you to see how easily it's done. Finally, we'll talk about how to compensate for these issues so that your network doesn't become infected with and manipulated by this sort of persistent firmware-level malware.

Gregory Pickett CISSP, GCIA, GPEN has a background in intrusion analysis for Fortune 100 companies but now heads up Hellfire Security’s Managed Security Services efforts and participates in their assessment practice as a network security subject matter expert. As a security professional, his primary area of focus and occasional research is networks with an interest in using network traffic to better understand, to better defend, and sometimes to better exploit the hosts that live on them. He holds a B.S. in Psychology which is completely unrelated but interesting to know. While it does nothing to contribute to how he makes a living, it does demonstrate how screwed up he actually is.

Twitter: @Shogun7273