- Slides for “A Dive in to Hyper-V Architecture & Vulnerabilities” with Joe Bialek and Nicolas Joly can be found here. (The link on the Black Hat site is still borked.)
- This isn’t an actual DEFCON 26 presentation, but it’s referenced in Vincent Tan’s “Hacking BLE Bicycle Locks for Fun and a Small Profit”, and I want to bookmark it for later: “Blue Picking: Hacking Bluetooth Smart Locks” by Slawomir Jasek.
- Slides for “Ring 0/-2 Rookits: Compromising Defenses” with Alexandre Borges are here.
- Also not a DEFCON presentation, but picked up by way of an Ars Technica story: “Fear the Reaper: Characterization and Fast Detection of Card Skimmers” by Nolen Scaife, Christian Peeters, and Patrick Traynor. In which the authors analyze a bunch of skimmers confiscated by NYPD…and then build a device that can detect skimmers, based on nothing more than the physical properties of how card readers work. Quote of the day: “Security solutions requiring significant behavioral changes are unlikely to be successful.”
- Content for “All your math are belong to us” with sghctoma is here: slides, white paper, and exploit code.
Archive for the ‘DEFCON 26’ Category
More Black Hat/DEFCON 26 updates.
Wednesday, August 15th, 2018DEFCON 26/Black Hat updates: August 14, 2018.
Tuesday, August 14th, 2018I apologize that I wasn’t able to post more coverage over the weekend: as I expected, it turned out to be fun, but packed.
I intended to post this yesterday, but I wasn’t able to find many updates on my lunch hour. Then I got stuck in a gumption trap late in the day at work, and basically came home and collapsed.
In retrospect, that was better, because this story broke late in the afternoon: Caesars Palace security was (in the opinion of at least some DEFCON attendees) a little too aggressive about searching rooms. More from Defiant, a company that was at DEFCON. Statement from Marc Rogers.
Also: badge related coverage if you care. Personally, I don’t need a stinking badge.
Black Hat updates:
- Putting this here for my IBM mainframe friend: “Mainframe [z/OS] Reverse Engineering and Exploit Development” by Chad Rikansrud.
DEFCON 26 updates:
- Haven’t found slides yet, but reference material for “Building Absurd Christmas Light Shows” with Rob Joyce is here.
- Also no slides that I’ve found for “You’d better secure your BLE devices or we’ll kick your butts!” with Damien Cauquil. But: his Twitter feed has an interesting link to “Exploiting BLE Smart Bulb Security using BtleJuice: A Step-by-Step Guide“, a blog post by Vaibhav Bedi (I think). What’s interesting about this post is that it covers the whole process of installing and configuring BtleJuice, “a framework to perform MiTM attacks on BLE devices”. Also: GitHub repo for Btlejack, “everything you need to sniff, jam and hijack Bluetooth Low Energy devices”.
- I’m excited about this one, though I haven’t had time to go through all of it yet: “Ridealong Adventures—Critical Issues with Police Body Cameras” by Josh Mitchell. Slides. five_oh_noes, a body camera scanner. More body camera related stuff.
- GitHub repo for “Breaking Smart Speakers: We are Listening to You” with Wu HuiYu and Qian Wenxiang. At the moment, this includes the presentation slides and Amazon Echo exploit code.
DEFCON/Black Hat updates: round 2.
Thursday, August 9th, 2018Another Ars story based on another Black Hat panel:
The presentation in question is “Understanding and Exploiting Implanted Medical Devices” by Billy Rios and Jonathan Butts. No slides or white paper yet, so I don’t want to comment very much. But: I do also want to point out this article, “The $250 Biohack That’s Revolutionizing Life With Diabetes“. Why? Well…
Some additional interesting looking work:
- “TRITON: How it Disrupted Safety Systems and Changed the Threat Landscape of Industrial Control Systems, Forever” by Andrea Carcano, Marina Krotofil, and Younes Dragoni. “In 2017, a sophisticated threat actor deployed the TRITON attack framework engineered to manipulate industrial safety systems at a critical infrastructure facility. This talk offers new insights into TRITON attack framework which became an unprecedented milestone in the history of cyber-warfare as it is the first publicly observed malware that specifically targets protection functions meant to safeguard human lives.” Slides. White paper.
- “There will be Glitches: Extracting and Analyzing Automotive Firmware Efficiently” by a whole bunch of people.
- And it just wouldn’t be a security conference in 2018 without a Tesla attack: “Over-the-Air: How we Remotely Compromised the Gateway, BCM, and Autopilot ECUs of Tesla Cars” by Ling Liu, Sen Nie, Wenkai Zhang, and Yuefeng Du. White paper is at the link: slides are broken.
That’s all I’ve been able to turn up today. More tomorrow, I hope.
Black Hat 2018/DEFCON 26 0 day updates.
Thursday, August 9th, 2018Some of yesterday’s Black Hat presentations:
- “Stress and Hacking: Understanding Cognitive Stress in Tactical Cyber Ops” by Celeste Paul and Josiah Dykstra.
- “Reversing a Japanese Wireless SD Card – From Zero to Code Execution” by Guillaume Valadon. And here’s the GitHub repo.
- “Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community” by Christian Dameff and Jay Radcliffe.
- “Open Sesame: Picking Locks with Cortana“. “Exploiting the ‘Open Sesame’ vulnerability attackers can view the contents of sensitive files (text and media), browse arbitrary web sites, download and execute arbitrary executables from the Internet, and under some circumstances gain elevated privileges.”
Some others that I didn’t get to the first time around:
- “Software Attacks on Hardware Wallets” by Alyssa Milburn and Sergei Volokitin. “…we show how software attacks can be used to break in the most protected part of the hardware wallet, the Secure Element, and how it can be exploited by an attacker.” Slides. White paper.
- “Screaming Channels: When Electromagnetic Side Channels Meet Radio Transceivers” with a whole big bunch of folks. “…we show that it is possible to recover the original leaked signal over large distances on the radio. As a result, variations of known side-channel analysis techniques can be applied, effectively allowing us to retrieve the encryption key by just listening on the air with a software defined radio (SDR).” Slides. White paper.
Ars Technica has a story up in advance of Justin Shattuck’s “Snooping on Cellular Gateways and Their Critical Role in ICS” presentation later today:
There are a couple of other presentations from yesterday that sound interesting on second look, but the links to them are currently broken. Also, I haven’t had a chance to read through all of these yet: I did give a quick skim to “Stress and Hacking” and “Reversing a Japanese Wireless SD Card” and look forward to a more careful read of both.
I think I’m going to try to post a second update later this evening if the broken links are fixed and/or new content is available. We should also be getting close to the point where the DEFCON 26 media server has preliminary versions of the presentations up…
Edited to add: DEFCON 26 presentations are now live on the DEFCON media server.
DEFCON 26/Black Hat 2018 preliminary notes.
Sunday, August 5th, 2018DEFCON 26 and Black Hat 2018 start up later this week. Again, I’m not going, but I do feel like I’m inching closer to making a return. Full-timers from my group have been sent to Black Hat in the past, so who knows what’s going to happen next year?
What would I do if I was there? A quick skim of the Black Hat briefings schedule doesn’t show a whole lot that really jumps out at me. I’d probably just be hitting targets of opportunity, with a few exceptions:
- “Stress and Hacking: Understanding Cognitive Stress in Tactical Cyber Ops” by Celeste Paul and Josiah Dykstra, because cognitive stress under pressure is something I’m interested in and has wider implications.
- “Reversing a Japanese Wireless SD Card – From Zero to Code Execution” by Guillaume Valadon.
- “Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community” by Christian Dameff and Jay Radcliffe, for obvious reasons.
- “Open Sesame: Picking Locks with Cortana“, with Amichai Shulman, Ron Marcovich, Tal Be’ery, and Yuval Ron. The lockpicking in this case looks less like actual physical lock sport: “In this presentation, we will reveal the “Open Sesame” vulnerability, a much more powerful vulnerability in Cortana that allows attackers to take over a locked Windows machine and execute arbitrary code.”
- “Applied Self-Driving Car Security” because Charlie Miller and Chris Valasek.
What about DEFCON 26? After the jump…