Black Hat 2014 – Briefing Summary – Day 1

If you’ve never been to Black Hat, the week long security conference is separated into two parts; a four day (optional) period for technical training courses, followed by two days of security briefings, where researchers share their latest discoveries and vulnerabilities. While the trainings I’ve attended have been excellent, most of the week’s security headlines get generated from the new research shared at the Black Hat briefings (and from DEF CON, later in the week).

In hopes of giving you a virtual Black Hat experience, I’ll summarize the more interesting talks I attended over the past two days, giving you the highlights. Let’s start with briefing day one.

Cybersecurity as Realpolitk

Topic: General state of information security and the Internet

Speaker: Dan Geer

This talk began with a short introduction by Jeff Moss (@TheDarkTangent), the founder of Black Hat and DEF CON, who mostly commented on the disparity between security and complexity. We need to start simplifying overly complex systems if we have any hope of securing them.

 

Dan Geer is a well-known computer security expert, who has warned about potential computer and network dangers long before it was popular to do so. In this talk, Geer covered a wide-range of topics, sharing his thoughts on ten subjects relevant to information security. With so many topics to cover, I can’t summarize it all, but I can share some highlights:

 

  • Freedom, security, convenience… CHOOSE TWO.
  • The CDC is effective at stopping pandemics because they force mandatory disease reporting, have expert away teams, and analyze historical data. Infosec experts should do the same. Perhaps there should be mandatory breach reporting for big incidents, and voluntary, anonymous reporting for small hack incidents.
  • On Net Neutrality: ISPs should have only two choices. Either they can charge what they want for services, but be liable for the content on their wires, or they are protected from liability and don’t inspect content at all.
  • On strike back: Don’t do it (as much as I can understand the desire to).
  • Embedded systems require remote management, or an finite lifetime (because without updates their vulnerability grows over time)
  • US Gov. should pay 10x the price of anyone else to corner the 0day market, and then help vendors fix the issue to quickly decrease the amount of 0day that any attacker can use. I disagree with Geer a bit. While I think it’s a nice idea, I don’t have confidence the US Gov. would share the info with vendors, rather than sit on the exploits for use in their own operations.
  • On Privacy: We have the right to be forgotten.
  • Internet voting: Nope!

 

Geer covered many other topics, but that at least gives you a quick taste of his talk.

 

Cellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol

Topic: Attacking mobile phones using the Carriers management protocol

Speaker: Matthew Solnik & Marc Blanchou

 

This talk had a ton of potential, but fell flat due to execution issues. In a nutshell, the presentation highlighted the Over-the-Air (OTA) remote management tools that mobile carriers built into phones on their network, and how attackers could exploit these built-in tools to hijack your phone, launching man-in-the-middle (MitM) attacks, or even executing remote code on your phones.

 

The presentation included a ton of technical information, which was interesting to fellow researchers, but it was presented in a dry, hard to follow manner. Worse yet, the actual demo at the end, which could have saved the whole talk, failed before it even started. That said, it still covered a very interesting and relevant topic, and I hope phone carriers read Solnik and Blanchou’s slides and research.

 

A Survey of Remote Automotive Attack Surface

Topic: Which cars are the most vulnerable?

Speaker: Charlie Miller & Chris Valasek

 

Even knowing this talk wouldn’t include any new research, I attended it just because Miller & Valasak are such charismatic speakers—and they didn’t disappoint. Last year, this research pair made a splash by demonstrating hacks against a Toyota Prius and Ford Escape. Despite getting tons of media attention, their talk was turned down by Black Hat last year. This year, Black Hat seemed to be making up for that flub, but Miller and Valasek didn’t really have any new technical or hands-on research to present.

 

Rather, in this presentation the duo mostly explored the potential of a remote attack surface against cars, and also enumerated a bunch of different cars using online information, measuring how vulnerable they think various models are.

 

As far as the remote attack surface, Miller and Valasek didn’t uncover anything new, or do any real tests, but instead shared research from others, such as the UW’s attack on tire pressure sensors, etc… They also discussed how built-in Bluetooth, Radio data systems, cellular, Wi-Fi, and car apps all present remote attack service. However, they didn’t uncover or share any new vulnerability or prove one exists.

Next they described how they measured the vulnerability level of various cars from many manufacturers. Essentially, they got mechanic accounts to all these manufacturers and used the mechanical technical docs to figure out which systems a certain model car used. The more remote systems a car presents, and the closer those systems connections are to other mechanics on the car, and the more vulnerable it is. They also brought up the idea of “cyberphysical” systems, such as cars that have self-parking or proximity detection and response. These “drive-by-wire” cars allow digital systems to actually turn the wheel or brake, so obviously they present a lot of real-world risk.

 

In the end, the talk was a lot of fun to listen to, but didn’t add a whole lot new to the car hacking conversation. They did say they are releasing a big paper covering the most vulnerable cars they found sometime at the end of the week. So go check it out if you’re interested.

 

Government as Malware Authors: The Next Generation

Topic: Exploring evidence that governments are writing malware

Speaker: Mikko Hypponen

 

I’ve always liked Hypponen’s engaging presentation style, and recently had the pleasure to dine with and present along side him at WatchCom’s Paranoia conference in Norway. If you’ve seen his TED talk, you probably have heard his views on the Snowden NSA leaks and governments involvement in Stuxnet and other advanced attacks. This presentation was essentially more of the same, other than he also shared a little government hacking history from F-Secure’s perspective; showing and sharing some spear phishing attachment examples they’d collected as early as 2003. He also covered the some of the latest phishing attachment tricks like the right-to-left unicode trick I mentioned in one of my weekly videos. It was an interesting talk that I’d recommend to anyone, but one I’d essentially seen before.

 

Pulling the Curtain on Airport Security

Topic: Vulnerabilities in TSA scanning equipments

Speaker: Billy Rios

 

This was a great talk; one of the best I saw. Billy Rios is a soft-spoken, but wicked smart security researcher who’s found many flaws in embedded devices. This time he researched some of the scanning equipment used by the TSA in airports. First, here are some interesting TSA stats:

 

  • TSA employees around 50,000 people at 400 airports in the US.
  • They spend $7.39 billion a year.
  • They are REQUIRED to spend $250 million on new screening gear.
  • We (as taxed citizens) pay for all this, so should consider its efficacy and usefulness important.

 

In any case, Rios found and bought a bunch of scanning equipment on Ebay that the TSA uses. He then reversed it and found a lot of very basic, low-hanging vulnerabilities… Circa 1990 security flaws like hard-coded service credentials and the like. He tested devices like x-ray scanners, fingerprint time clocks, and itemizers (the systems that sniff for drugs). I won’t go into all the details, but he basically found pretty big, often remotely exploitable issues in all these embedded systems.

 

His take-aways? First, if you use embedded devices you should audit them for risks and vulnerabilities. Second, you should trust, but always verify.

 

Breaking the Security of Physical Devices.

Topic: Radio signal reversing, and embedded device security

Speaker: Dr. Silvio Cesare

 

At a high-level, this talk was very similar to the last one, in that Dr. Cesare targeted embedded devices. He gathered together various, common home automation systems consumers might get at Home Depot or Target. Things like an analog baby monitor, various types of home alarm systems, and even the keyless entry fobs we use to unlock our cars. Then he showed how to defeat all these systems by analyzing and reversing their radio signals. Once the signal was reverse, he could either eaves drop or launch various key replay attacks.

 

If you are into radio signal tech and security, this was a very interesting talk. He shared how you could use cheap software defined radio equipment to do the capture and analysis, and even shared how to get relatively cheap spectrum analyzers. He also shared how to demodulate various types of radio signals, whether AM or PWM, and covered details on how you might crack rolling key codes. It was very interesting stuff, but very technical, and mostly for those into radio frequency hacking.

 

So that’s it for day one. As you can see, Black Hat briefings cover a wide gamut of interesting infosec related topics. You always learn something new, and it’s great just to hang out around people who are as passionate about the topic as you. I’ll return tomorrow with my summary of the day two briefings.

— Corey Nachreiner, CISSP (@SecAdept)

 

 

 

 

 

Good News! You Might Get Your Cryptolocker Encrypted Files Back

You probably remember Cryptolocker; a very nasty piece of ransomware that successfully encrypted files on many computers, and made its authors millions in ransom.  If not, you can learn more about it here. Though it wasn’t horribly advanced, it did use industry standard public/private key encryption, making it almost impossible for good guys to actually crack the encryption and get your files back.

However, there’s some great news on that front!

This week, FireEye and Fox-IT published a site called decryptcryptolocker.com. If you share your email address, and one of your Cryptolocker infected files with this site, they will email you the private key and a tool that can decrypt all your Cryptolocker files. If you were one of the folks that didn’t have a good backup, you finally have an option to recover files other than just paying the criminals (never a good idea).

So how did FireEye and Fox-IT accomplish this? Essentially, by gaining control of, and taking down Cryptolocker’s command and control (C&C) infrastructure (where the criminals stored all their private keys). If you’d like to know more about it, I suggest checking out FireEye’s blog post.

This is awesome work, and hopefully a big relief to anyone that still has Cryptolocker infections. That said, there are many Cryptolocker copycats and variants. This takedown has gained access to a specific group’s C&C servers and keys, but not all ransomware variants. There is a chance this tool won’t decrypt the files for every Cryptolocker variant, and it surely won’t help with the copycats.

In any case, it’s great to see a score for the good guys.

— Corey Nachreiner, CISSP (@SecAdept)

BadUSB – WSWiR Episode 115

Android Fake ID, Backoff PoS Attack, and BadUSB

With Blackhat and DEF CON only a week away, it’s not surprising to see news of new vulnerabilities and attack vectors popping up as researchers hint at their upcoming presentations. If you are interesting in this threat news, but have no time to track it down yourself, this weekly video can fill you in.

Today’s show shares details about the Android Fake ID vulnerability, talks about a new PoS system attack campaign, and warns of an industry-wide USB problem researchers will disclose at Blackhat. Check out the video for the details and some advice, then scroll down to the Reference section if you are interested in other infosec news from the week.

As an aside, I will be attending Blackhat next week, which means I may not post the video at its regular time. However, it also means I’ll cover my favorite briefings from the show, so if you can’t attend be sure to tune in to get a taste of the popular security conference. Have a great weekend.

(Episode Runtime: 10:52)

Direct YouTube Link: https://www.youtube.com/watch?v=51VT-CJJKB4

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

iOS Backdoor – WSWiR Episode 114

Firefox 31, Tails 0day, and iOS Backdoor

Are you curious about the latest network breaches, dangerous new zero day exploits, or breaking security research, but too busy to find all this information on your own? No worries. We summarize the most important security news for you in our weekly security video every Friday.

In this week’s episode, you’ll learn how the latest Firefox update makes it harder to download malware, why you can’t rely on some anonymizers, and whether or not you should worry about the rumored backdoor in iOS. Check out the video for the full scoop, and don’t forget to peruse the extra stories in the Reference section below.

(Episode Runtime: 7:51)

Direct YouTube Link: https://www.youtube.com/watch?v=qg1wsjzjC4Q

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Weak Passwords are Good? – WSWiR Episode 113

Oracle Patches, Project Zero, and Password Problems

Another week, another big batch of InfoSec news. If your IT job is already overwhelming you with tasks, leaving you no time to keep up with computer and network security, “I’ve got ya bro.” Check out our weekly security news summary for all the important action.

Today’s episode covers Oracle’s quarterly Critical Patch Update (CPU), a neat security project from Google, and a bevy of password security related news and issues. It’s all in the video, so give it a play. Also, don’t forget the Reference section below for other interesting news.

Enjoy your summer weekend, and stay safe!

(Episode Runtime: 8:59)

Direct YouTube Link: https://www.youtube.com/watch?v=yOtbuwhqZVo

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Hardware Malware – WSWiR Episode 112

Tons of Patches, Facebook Botnets, and Infected Hand Scanners

After a couple weeks of hiatus, we’re finally back with our weekly security news summary video. If you want to learn about all the week’s important security news from one convenience resource, this is the place to get it.

This episode covers the latest popular software security updates from the last two weeks, and interesting Litecoin mining botnet that Facebook helped eradicate, and an advanced attack campaign that leverages pre-infected hardware products. Watch the video for the details, and check out the Reference’s for more information, and links to many other interesting InfoSec stories.

Enjoy your summer weekend, and stay safe!

(Episode Runtime: 7:37)

Direct YouTube Link: https://www.youtube.com/watch?v=oAHYUW1KkM0

Episode References:

Extras:

— Corey Nachreiner, CISSP (@SecAdept)

Microsoft Service Bus DoS Mostly Affects Enterprise Web Developers.

Among this week’s Microsoft security bulletins is one that likely only affects a small subset of Microsoft customers, and thus not worth a full security alert.

Microsoft Service Bus is a messaging component that ships with server versions of Windows, providing enterprise developers with the means to create message-driven applications. According to Microsoft’s bulletin, Service Bus suffers from a denial of service (DoS) vulnerability involving it’s inability to properly handle a sequence of specially crafted messages. If you have created an application that uses Service Bus, an attacker who could send specially crafted messages to your application could exploit this flaw to prevent the application from responding to further messages. You’d have to restart the service to regain functionality.

Windows itself doesn’t really use Service Bus for anything, but if you have internal applications that do, this vulnerability may be significant to you. If you use Service Bus, be sure to check out the bulletin to get your updates. — Corey Nachreiner, CISSP (@SecAdept)

Adobe Patches Rosetta Flash Vulnerability

Summary:

  • This vulnerability affects: Adobe Flash Player  14.0.0.125 and earlier, running on all platforms (and Air)
  • How an attacker exploits it: By enticing you to run specially crafted Flash content (often delivered as a .SWF file)
  • Impact: Varies, but in one case an attacker can leverage this flaw to gain access to sensitive content from other web domains you visit.
  • What to do: Download and install the latest version of Adobe Flash Player (version 14.0.0.145 for computers)

Exposure:

Adobe Flash Player displays interactive, animated web content called Flash. Although Flash is optional, 99% of PC users download and install it to view multimedia web content. It runs on many operating systems, including mobile operating systems like Android.

In a security bulletin released this week, Adobe announced a patch that fixes three vulnerabilities in Adobe Flash Player 14.0.0.125 and earlier, running on all platforms.

Adobe characterizes two of the vulnerabilities as “security bypass” flaws, and states that attackers could exploit at least one of them to take control of the affected system. However, it’s the third vulnerability that is most interesting and is getting media attention.

A security researcher, Michele Spagnuolo, posted a blog article describing a complex, multi-layered vulnerability called the Rosetta Flash flaw, which involves both the Flash vulnerability, but also depends on JSONP-based web applications. If you’re interested in the intricate technical details of the attack, I recommend you check out the Spagnuolo’s blog post, or presentation. The scope of the vulnerability is a little easier to understand. If an attacker can trick your users into running specially crafted Flash content, he can potentially take advantage of this flaw to steal your user’s information from certain third party domains that use JSONP-based applications. When first discovered, this included domains like Ebay, Tumblr, and some Google applications However, these big companies have since modified their web applications to prevent this flaw.

In any case, Adobe rates these issues as a “Priority 1” issues for Windows and Mac, and recommends you apply the updates as soon as possible (within 72 hours).   However, the vulnerability technically affects other platforms as well, so I recommend you update any Flash capable device as soon as you can.

Solution Path

Adobe has released new versions of Flash Player (14.0.0.145 for computers) to fix these issues. If you allow Adobe Flash in your network, you should download and install the new versions immediately. If you’ve enabled Flash Player’s recent “silent update” option, you will receive this update automatically.

  • Download Flash Player for your computer:
NOTE: Chrome and newer versions of IE ship with their own versions of Flash, built-in. If you use them as you web browser, you will also have to update them separately, though both often receive their updates automatically.

For All WatchGuard Users:

If you choose, you can configure the HTTP proxy on your XTM appliance to block Flash (and Shockwave) content. Keep in mind, doing so blocks all Flash content, whether legitimate or malicious.

Finally, our Reputation Enabled Defense (RED) and WebBlocker services can often prevent your users from accidentally visiting malicious (or legitimate but booby-trapped) web sites that contain these sorts of attacks. Nonetheless, we still recommend you install Adobe’s Flash update to completely protect yourself from all of these flaws.

Status:

Adobe has released updates to fix these Flash vulnerabilities.

References:

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept)

WatchGuard Releases Appliance Updates to Fix OpenSSL Flaws

WatchGuard has released several important updates to software for all product lines over the past couple of weeks to address reported vulnerabilities. Last month the OpenSSL team released an update for their popular SSL/TLS package, which fixes six security vulnerabilities in their product, including a relatively serious Man-in-the-Middle (MitM) flaw. More details about these vulnerabilities and their impact are available at the WatchGuard Security Center. If you are not already signed up, we recommend that you subscribe to the blog to get regular updates about security vulnerabilities, WatchGuard products, and general security news.

Here are the releases that have been posted to patch the vulnerable version of OpenSSL.  As always, maintenance releases also include many significant bug fixes. Full details are listed in the Release Notes for each release.

  • 11.3.8 for e-Series devices
  • 11.6.8 for XTM 21,22,and 23 devices
  • 11.7.5 for XTM devices
  • 11.8.4 for XTM and Firebox T10 devices, which is also localized into all of the WatchGuard supported languages.
  • 11.9.1 for XTM and Firebox T10 devices
  • Hotfixes for version 9.2 and 10.0 for XCS appliances
  • SSL 3.2 Update 2 for SSL 100 and 560 appliances.

Other highlights in the new Fireware 11.9.1 release include:

  • Support for default gateway on different subnet
  • Several improved warning and informational messages throughout the product

More information including screenshots are available in the What’s New presentation.

Do These Releases Pertain to Me?

The OpenSSL patch is available for all e-Series, XTM appliances, and Firebox T10. Please choose the version that is relevant for your environment and devices. Upgrade to 11.9.1 to get the latest enhancements to the product.

How Do I Get the Release?

e-Series, XTM, and Firebox appliances owners who have a current LiveSecurity Service subscription can obtain updates without additional charge by downloading the applicable packages from the Articles & Software section of WatchGuard’s Support Center. To make it easier to find the relevant software, be sure to uncheck the “Article” and “Known Issue” search options, and press the Go button. Select the appropriate downloads for your devices. Please read the Release Notes before you upgrade, to understand what’s involved.

If you need support, please enter a support incident online or call our support staff directly. (When you contact Technical Support, please have your registered Product Serial Number, LiveSecurity Key, or Partner ID available.)

  • U.S. End Users: 877.232.3531
  • International End Users: +1.206.613.0456
  • Authorized WatchGuard Resellers: +1.206.521.8375

Don’t have an active LiveSecurity subscription for your XTM appliance? It’s easy to renew. Contact your WatchGuard reseller today. Find a reseller ?

Windows Updates Mend Critical Journal Vulnerability & More

Severity: High

Summary:

  • These vulnerabilities affect: All current versions of Windows (and related components like XML Core Services)
  • How an attacker exploits them: Multiple vectors of attack, including enticing you to malicious web sites, or into interacting with malicious documents or images.
  • Impact: In the worst case, an attacker can gain complete control of your Windows computer
  • What to do: Install the appropriate Microsoft patches as soon as possible, or let Windows Automatic Update do it for you

Exposure:

Today, Microsoft released four security bulletins describing five vulnerabilities in Windows and related components, such as XML Core Services. An attacker could exploit the worst of these flaws to potentially gain complete control of your Windows PC. We recommend you download, test, and deploy these critical updates as quickly as possible.

The summary below lists the vulnerabilities, in order from highest to lowest severity.

Windows Journal is a basic note taking program that ships with Windows systems (though the server versions of Windows do not install it by default). It suffers from a vulnerability involving how it  handles specially crafted Journal files (.JNT). If an attacker can trick you into opening a malicious Journal file, perhaps embedded in an email or web site, he can exploit this flaw to execute code on your computer, with your privileges. If you have local administrative privileges, the attacker gains full control of your computer.

Microsoft rating: Critical

  • MS14-039:  On-Screen Keyboard Privilege Elevation Vulnerability

Windows ships with an accessibility option called the On-Screen Keyboard (OSK), which displays a virtual keyboard on your display you can use for character entry. It suffers from a local elevation of privilege (EoP) vulnerability. Basically, low privileged processes can run the OSK and use it to run other programs with the logged in users privileges. However, to exploit this flaw an attacker would first have to exploit another vulnerability in a low integrity process, which lessens the severity of this issue.

Microsoft rating: Important

  • MS14-040:  AFD Privilege Elevation Vulnerability

The Ancillary Function Driver (AFD) is a Windows component that helps manage Winsock TCP/IP communications. It suffers from a local elevation of privilege (EoP) issue. By running a specially crafted application, an attacker can leverage this flaw to execute code with full system privileges, regardless of his actual user privilege. However, in order to run his special program, the attacker would first need to gain local access to your Windows computers using valid credentials. This factor significantly reduces the risk of this flaw.

Microsoft rating: Important

  • MS14-041:  DirectShow Privilege Elevation Vulnerability

DirectShow (code-named Quartz) is a multimedia component that helps Windows handle various media streams, images, and files. It suffers from a local elevation of privilege (EoP) vulnerability. If an attacker can exploit another vulnerability to gain access to a low integrity process, she could then exploit this flaw this flaw to elevate her privileges to that of the currently logged in user.

Microsoft rating: Important

Microsoft’s Patch Day Video Summary:

Microsoft has recently started producing short videos to summarize each month’s Patch Day, which I’ve linked here for your convenience.

(Runtime: 2:24)

Direct YouTube Link: https://www.youtube.com/watch?v=3j-5-xIMgks

Solution Path:

Microsoft has released various updates that correct all of these vulnerabilities. You should download, test, and deploy the appropriate updates throughout your network immediately. If you choose, you can also let Windows Update automatically download and install them for you. As always, you should test your updates before deploying them.

The links below point directly to the “Affected and Non-Affected Software” section of each bulletin, where you can find links to the various updates:

For All WatchGuard Users:

WatchGuard’s XTM appliances offer defenses that can mitigate the risk of some of these flaws; especially the Critical Windows Journal vulnerability. If you choose, you can leverage our proxies to prevent your users from receiving Journal files (.JNT) via email, web sites, or FTP sites. However, attackers can exploit some of the other flaws locally. Since your gateway XTM appliance can’t protect you against local attacks, we recommend you install Microsoft’s updates to completely protect yourself.

Status:

Microsoft has released patches correcting these issues.

References:

This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).


What did you think of this alert? Let us know at your.opinion.matters@watchguard.com.

Follow

Get every new post delivered to your Inbox.

Join 7,553 other followers