Talks

We have recently been asked to perform a number of security assessments which use Java serialized objects to communicate information between client and server. This approach is quite common, particularly in applications which implement some form of thick(ish) client. However, personally, whenever I see these things flying across my proxy I always get excited and think “there has to be something wrong here…”

So is there something really wrong? What should we be concentrating on when trying to attack these applications?

So you think you're a hacker?

You’re lying in bed after a hard days hacking and you’re having trouble sleeping. You didn’t leave your IP address anywhere did you? Maybe you should just get up and check, just to be sure.

Hackers don’t get caught, and the last thing you want to do is become “famous”, or become bubbas best prison mate! This talk is about operational security for hackers. How you can sleep at night and hopefully stay out of prison.

I will show case studies from “famous” New Zealand hackers who have been caught including myself. This talk will show information from both sides of the coin, how to misdirect forensic investigators and details from those who work on the side of the law.

You might even get to see the rig I roll and the code I use to protect my data at home.

At the very first Kiwicon I demonstrated a beta project I had started called iKAT. You may remember it, the pornographic themed website which automatically hacked internet Kiosks. Over the past three years I have not stopped developing iKAT and I have continued in my quest to become the "Self Proclaimed King of Kiosk Hacking"

39 Kiosk vendors later and I think I have the title! I have been able to break every off-the-shelf kiosk product that I can find, to top it off I am still lawsuit free! I thought it would be only appropriate for the 4th Kiwicon to revisit iKAT and to have a bit of fun hacking Kiosks on stage.

Inspired by the work of Dan Farmer in his seminal survey of the exploitable internet population "Shall We Dust Moscow" (1997), we use two recently developed tools (WhatWeb by Andrew and BlindElephant by Patrick) to update the global vulnerability census for 2010, discovering unpatched and vulnerable devices and applications across a sample of 2 million hosts. We use the results to pose and discuss various (real and imagined) correlations of security posture to other factors, and surprise ourselves (and hopefully you) in the process.

Who is more up to date; the US or Nigeria? What about porn sites vs governments sites? *Nix based or Windows based? Now: *Why* do you think that, and if the actual answer surprises you, what does that help us learn about our thought process as analysts and security professionals? We bring data (and some pretty graphs and maps) to let you test your instincts against reality and learn to ask deeper questions.

Andrew Horton is a Wellington security consultant for Security-Assessment.com. He provides your favourite daily security news at www.MorningStarSecurity.com.

Patrick Thomas is a security research engineer with Qualys. He works on automated vulnerability detection tools, malware detection, pragmatic security, and dabbles in the security implications of public policy and vice versa. He percolates and occasionally dispenses ideas on the above at CoffeeToCode.net.

Internet Exchange Points (IXPs) exist all over the world for the purpose of, as the name suggests, exchanging internet dataz between networks. They're a pretty good way of keeping local traffic off transit links which has all sorts of benefits for network operators consumers of internets alike.

For relatively low cost, IXPs can also get an attacker layer 2 adjacent to a significant number of ISP routers for fun and profit. Sometimes those routers do things that their operators might not expect, and sometimes they do things that their operators probably don't want them to be doing.

Some of the reasons why connecting a Serious ISP Network to an IXP should be approached with a little more caution than it currently appears to be will be covered, along with some examples of what happens when appropriate precautions are not taken.

Mike is Not A Security Professional, but does have keen interest in all things beer. This seems to fit in well with the security industry's interests.

He recently completed a 6 year stint at a web hosting outfit, where he herded packets, muttered at clouds, played Postman Pat, and snuck up on web applications, tricking them into scaling horizontally when they least expected it.

Having now jumped from the content-hosting to the content-consuming side of the internet services fence, he firmly believes that 240/4 is the solution to IPv4 address exhaustion. And if that doesn't save us, then large-scale NAT will.

There's a war going on and depending on which side of the fence you sit, we are winning. Finding a bug is only the beginning; it requires further specialised knowledge to turn that bug into a reliable working exploit that has a commodity value.

Since XPSP2, Microsoft started making advances in OS level mitigation techniques to prevent exploitation. As in any arms race, as one side builds a defence the other side develops a method to circumvent it.

This talk will cover methods introduced since XPSP2 and how these methods can by bypassed to successfully execute arbitrary code. It will also discuss recent advances in bypassing DEP and ASLR and how it is possible - in some cases relatively straightforward - to side step these defences.

One of the few techniques that is lacking in effective public bypass methods is SEHOP, and we will explain how this method developed by skape, 'may' actually be effective when correctly used.

EMET (Enhanced Mitigation Experience Toolkit) is Microsoft's 'strap on' security answer for applications that can't natively secure themselves. Is this the end of the race, or should we expect an Enhanced Exploitation Experience Toolkit to be released in the future?

Have I mentioned ROP?

Over the years, exploitation objectives have changed alongside the associated efforts by vendors to protect their software. Exploitation has moved from remote exploits on Unix servers to the community focusing on client-side targets, such as document viewers and browsers.

Some prime examples of these are the Aurora and IE peers zero-days actively exploited in the wild. These bugs answer many questions related to what the new breed of attacker is focusing on, yet all hype aside the real lesson is: botnet authors are learning how to fuzz for these vulnerabilities but are not able to write reliable exploits to accompany them.

With that premise in mind, this presentation intends to explore the techniques used to exploit the "use-after-free" bug class on Internet Explorer 8, diving into the API internals, reviewing the art of heap crafting and presenting new techniques to improve it.

The whole world is connected with light these days. You probably don't know, or notice (your desktop is just plugged into an rj45 wall jack, right?), but it's likely that your home or office network has some kind of fibre optics in it's path to the Internet, or the other sites in your WAN. In this talk I'll try and explain some of the risks around using fibre optics, as opposed to copper technologies, and what you can do about detecting and protecting from them (what is that encryption stuff anyway?).

I'll also try and explain some of the more commonly used types of fibre technologies and how they're all tied together, to give a better overview for those who just haven't had to work with the stuff before. This bit is probably just more informative than hackery related.

Don't have NSA budget? Don't have a stack of graphics cards or FGPA's lying around collecting dust? Never fear, your cracking efforts can be slightly less pathetic if you spread the effort across all your workmates PC's!

A tool for distributing password/hash cracking, and results from running a dictionary attack against a few thousand AP's I passed on my leisurely sunday stroll through Auckland.

Silverlight and Microsoft Office are two quite different products produced by our favourite multinational software company. Together their powers combine showing what could happen when you let people upload Word or PowerPoint files to your website.

Microsoft Office documents can contain hidden files that will get past your average virus scanner, and won't be noticed while they sit on your SharePoint server. They could also contain Silverlight applications, meaning an attacker can cross all kinds of domain boundaries, and have the word document execute in your browser.

This was done as part of the research for TechEd with Andy Prow from Aura Software Security.

If you're a white hat sellout owning unix boxen during red-team style pentests, you can't really go dropping a kernel mode rootkit on someone's production front frontend internet banking site. Sure, you still need what a root kit offers - hiding files and processes, a persistent access backdoor - but you can't be the guy who takes out the "too critical to pen-test" service (that took your sales guy five months to negotiate testing live) when you bodge in your hacked up kernel module with your shit-ass /dev/mem insmod tekneeq. Sometimes even local privesc is too much for them to handle.

So whats left? You play the shell game.

Let's be honest: hacking webapps sucks.

All that time stumbling around blind. Injecting data, crafting links with 50/50 chance of working, stomping over filesystems with uploaded files*. It all results in pain.

This is a "Panadol" talk. It will look at a couple of short, sharp and hopefully handy pills that will help take the effort (and therefore pain) away from finding vulns and popping shell

fosm hails from the land of orcs and has a penchant for minivacs, mini vans, mini golf, mini skirts, Minnie Riperton, Mac Minis, Big Macs, masturbation and drunken h@x0r photography. One day he hopes to open his own kimono store.

If you have ever helped him prop up a bar and vaguely remember hearing "just one more" about 15 times, then you may be part of this presentation.

Would you like to *wink* come upstairs and see his credit card collection?