Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1162 Thanks!
We.
So I guess everyone
here knows the pain of security
issues and that some made it to the news
and made a laugh, but some made us cry.
And our next guest
will take us to a little security
expedition in Birken Land.
So watch out, there are dangerous
security problems.
I had to have him a warm applause
and have fun with the talk.
Welcome, everybody.
Let's start with talk of a security
expedition embarking land.
Yeah, I'm talking about information
security and our three
fundamental aspects close Ally Land.
And that's the reality today.
But let's see what are the three
fundamental aspects of information
security?
It's CIA.
So first, think about this
guys here.
But it's totally wrong because
these are the three fundamental aspects.
It's C for confidentiality.
It's I went to great integrity
and a free availability and are the
free fundamental aspects.
But I will show you now that all this
free aspects are gonna have
problems in today's information security
and all of them. It's like somehow
broken.
I look completely false security, one
on one for everybody, for people who are
really into it security.
So there are a lot of different
acronyms there.
Let's check it out.
So for first, there is severe
severe stands for common vulnerabilities
and exposures.
It's a industry standard and it's a
naming convention, and it's
for public, publicly known security
vulnerabilities.
There is an example of CV
that's the CV of EternalBlue.
That's the exploit zero day
from the NSA, which was used for
WannaCry, for example this
severe number.
Then there is also CVST.
CVST is common
vulnerability scoring system.
It's like a scoring system for
for scoring there
that the vulnerability like see a race
like it's like not a big problem in
tennis, like just shut, shut down the
system and crash it away
and built a new one or fix all the bugs.
And it's based on a formula and are
depending on different metrics, and it's
also free and open industry standard.
Well, let's go to the first security
fault. So it's one it's like
command injection.
So the idea is
to inject all controlled commands into
a system like, for example,
like the classic one is like some command
interface on your rotor American like
ping to some hosts and then
you're just like, make semicolon and
put some bash commands in there and you
can just execute some commands in your
router if it's like really bad
implemented.
It's like a classic command injection.
Let's check out the first
category of me.
It's called Yeah, just fail.
So the first category is just fail.
And that's my example for this.
It's the npm five
point 7.0 release
sort of thing is this
release was not
properly tagged as a prerelease,
so it was not a release, but it was a
prerelease and it was
rolled out by update and people just
updated it. And the problem
was it fucked up all permissions from
the file system.
If you run it as sudo, so it
should recursively in the folder.
So if you like, run it and
you could like fix it easy, you have to
like restore a backup to fix all the
file permissions.
And that's the severe number down there
and have like really interests checked
out the the
GitHub issue for that.
It is quite well,
funny enough to create some
crying was also involved.
Let's check it out.
So there was this first comment was
just destroyed.
Free production server after single
deploy surfing.
OK?
And then there's the next guy who says,
Why are you using a prerelease version
in production?
Just asking.
But the problem was it wasn't released as
prerelease, and he didn't know that it
was like a bug approval is.
So it's not the the fault
of Jogi that the update just destroyed
pre-production server.
There are even more comments, but they're
like my two favorite about this issue.
So the next one is also one really
sad category.
It's called Can
I has the new bank, please?
So maybe you read about it.
So if you have a great mobile app for
banking and you got this warning,
so it's on German, but it's dead
something or someone is like changing
your connection and
our connection test to a secure out
bank that you say that it's
not possible for a secure connection.
So please contact support.
So you forget this finding when a mobile
banking app, it would just shut it down
and don't use it.
But if you're the great
bank.
Com Direct Bank of Germany,
you just write on Twitter and tell the
people, Oh, we know the issue, but
just press OK and you can just use
the app. So the problem was there
are SSL certificate just run out
and they just say, OK, we don't care.
It's you can just still use this app.
And so they're telling the users
to still use this unsecure app for
mobile. Banking.
So if you have this bank, maybe
maybe you should, like, go to other
bank and put your money, where
to like care for it security.
Let's go to the next storm
terminology.
So back door Victoria is built in
method to bypass notification
or encryption of our system, and
I have for two examples
for a back door.
The first one is Cisco, so
Cisco is a big network equipment vendor
and has like has a long vector history.
But there is a positive thing there.
They are doing internal auditing and I
found quite a lot of backdoors
during their internal auditing.
So that's a positive thing.
But still, there is a problem there
because in their products and they're
very creative about fitting synonyms
for the backdoors.
I have free examples for you.
So the first one is, are undocumented
user a privilege level 15?
That's been OK. It's quite creative.
But the other one is even better
undocumented static user credentials
for a different administration, and it's
very difficult.
It's also it's like even a better name.
But my favorite is the undocumented
test interface.
There's not some part on the road.
Just connect there and you get root
access.
Really nice backdoor.
But if even more of them, but they're
like free examples for their creative
synonyms for backdoor.
So the next one is really cool.
So 10 the AC
15 back door.
So it's a Chinese internet affair
out there, and
they're easy root access and free
steps on this device.
So the first one is
your request.
You make a request to slash, go from
slash, tell it on the altar and
it starts to tell it on the order.
The next step is you choose freely
from free existing default icons
on a device that the route that counts if
like a user admin
and another a third account.
And then you just need to
guess the password and then you have root
access on account under some guesses
for the password.
Well, it isn't a test, but it's close.
It has as much letters as test.
The password was one two three four
four all free accounts
and then you're looking at if root access
and or alter, it's really handy.
So if you lost your root password
or for admin, I kind of just use this
one.
So we the ninth is called, they want
their passwords back.
So please don't use this password for
your author.
And and up the door if you get firmware
upgrades. It's also a problem
that often devices don't get updates.
So the next one out bypass
is a notification bypass.
Like, you can log in somewhere
without user name or
without password or
without both.
So that's the idea
behind a notification bypass.
Well, let's go to Fight
Club.
Do you know from which your fight club
was? When was Fight Club released?
Some ideas, which year it was released,
it was released on 1999.
So the blast from the past
and 1999 there was
this company called the Netscape
and Head and Netscape
Enterprise server and Netscape Phosphoric
Server as software.
And there was a remote attack.
Very good privilege gained via
HP basic modification.
That was 1999.
Well, that's already
a really bad
security bug.
But well, what's the history
of forgetting us?
Back to the future, yeah, well, let's go
back to the future to 2018.
Um, well, there is HP.
I look for notification bypass
and remote code execution, so
each piece I look for is a
remote management console for servers.
It's a it's a hydrocarbon.
You can remotely access a server sent
and there was a notification bypass and a
remote execution in this.
Otherwise it was found by the
Airbus research team.
They invested five men, mostly men,
months for reverse engineering the whole
firmware.
It is from 2017, but the
broad public was knowledge
was in 2018, when they presented their
whole research at the conference.
And it's quite
interesting how it works.
I have a GIF of the life demo here
and you can check it out.
So they are requesting
the interface and it says
400 one unauthorized.
So they use great party
tools and just print
twenty nine times a.
Then to add a header to the request.
With the Kadra
connection with that is 229
times to eight and then
press enter. And the good full admin
access. So it's like, OK.
And yeah, administrator great.
Yeah, it's really fun because you have
like 10 times the service out there.
You can just get administration
privileges for twenty nine days.
Um, yeah.
The problem is, you see,
this equation 1999
equals 2018.
Mathematically, it's not quite correct,
but in I.T.
security, it is because
in both cases it wants to buffer
overflow, which cause it calls the bug.
Um, so if a buffer of offload citing
security back, they managed
to overwrite the
data and they could like access
administration and no threat if I can't.
Let's get to the next category.
Next category is that
our richness?
So it's the opposite of that to me.
To me, that minimization what is like our
goal in I.T. security because
we don't need all all that of
the people, we should just use the data
we need for services.
So all the thanks to GDPR.
So it's unnecessary to have too much that
things also like digital gold of
the modern times
there was Google Plus
there, half life affected 500000
users by the leak.
They also stolen partially sensible
data.
And
the thing is, although Google plus Google
Plus was shut down, also because of
this part, well,
it's only 500000 users.
It's not a lot.
Well, let's check out on Friends of
Facebook.
So they have like approximately 30
million users affected,
like six times as much as
Google Plus leak was affected,
but they still didn't didn't shut down.
I don't know why, but said
maybe next time.
But you see, there's a lot of
data leaks happening 2018,
and a lot of user data was affected.
Well, let's check out the next category.
It's called D.O.C..
Denial of Service said
the idea behind iOS is
make a system unavailable, temporary
or permanently.
Um, so who if you
have a friend who have a friend, who
have a friend that has IP camera?
Noel Norman
is friends with high peak cameras, oh,
one person, at least one person.
So this one friend has
a camera, maybe as this IP camera
and device to snap a camera.
You can make it easy denial-of-service.
So you just send the post request to this
camera with a huge body size
to the slash, you're out
and the camera just crashes.
So it's really handy to just send a post
request and it just crashes.
There is a proof of concept on GitHub
about this.
So if you have it at home, you can try to
yourself or you can throw it away because
I don't think it get update.
And yeah, it's also a
classic iottie embedded hardware,
which like its bad implemented
and just crashes. When you send out huge
bodies us,
then our next category
is RC.
You all heard it at HP I live for.
So our CS remote code
execution.
So the idea is you can execute
on a rural remote, target your own
code or programs.
Um, and so
most of you are probably gamers, and
most of you also use this what is like
a well known gaming platform
instead of steam?
Yeah, Nintendo. But yeah, steam is a
good, a good, good gaming
platform because Steam
had a remote code execution
for nearly 10 years
and it was like this year found
it when you sent the mail from UDP
packet, it was enough to trigger the
exploit.
There is a really extensive write up
under the pitch here, so
for ten years it was like theoretically
possible to exploit the remote code
execution in steam
like a lot of users would be
affected.
We don't know if it was exploited,
but it was in the cloud.
They are debug.
Really impressive is that
after their reporting,
the Steam team pitched it after
eight hours, so after eight hours it was
already patched. But but a steam team?
So our next
thing is P.O.S.
proof of concept.
So they're here for proof of concept is
that you have, like some example.
And if that to show that you can
exploit the bug.
So the classic proof of concept
is that you pop up a calculator
on your system and
that's like the classic
thing. Get to show the people that you
exploit to the remote code execution or
code execution, a system that you can
like run calculator to
X or X.
So.
So in my mind, in my first two iterations
of this talk, I didn't have a life
demo and then all that time
people came to me and told me,
Hello, can I have a life demo?
And so I told me so.
So I said, OK, well, let's prepare
something.
And yeah, we will have a life demo
and what could possibly go wrong?
Surface especially prepared leapt
to.
So I have here,
no, I don't want updates, no,
I have for it all to 16 04
four before pictures.
I have a virtual box before
debut system.
It's nearly pitched,
so let's start my virtual box system.
So.
So I'm already sorry for the use of the
name of dispirit tool box it was at first
my mailbox tests over
there are test emails server,
but you will see yourself.
It did a good job as a mail server, but
now it has to be exploited.
So, um,
so if you are using
a computer, no, you normally use it to
surf on the internet and check
out web pages, and
you also want some cool desktop
backgrounds for your laptop.
So this is really not so
could be more fancy.
And then you see this fancy web
page where you know they offer you sweet
cat pictures and then say, OK,
let's download this sweet cat picture.
I want this cat picture.
OK, let's download it,
let's admit.
Okay.
And it's broken,
no.
Well, my life, they were just failed.
But we will try again.
So.
So let's just download
again.
Nope.
Well, then we'll just
do the reset game.
That works most of the time.
Oh.
So.
Well, let's test again.
No, it should probably work.
So let's go again to our great
page, or it can download cat pictures.
OK.
It seems to work.
So I just open my download
and I just got 100 cook, this
popped up on my screen.
So just off the dollar folder.
Well, there is a great tool
in a command line on Linux.
You see all these great calculators
maybe can use.
I can calculate fast 100 of them.
So it's OK,
kill all.
It's calc
good that it's not a windows because
I don't know what a command and windows
for that.
All right, so
what happened?
So I explored
that that gold script, remote code
execution, so it
was overseen sort
of pitched some on
quite the same vulnerability
in gold script two years ago, but they
overseen this edge case
and it just triggered
when it's passing postscript and the
thumbnail passer of
events in the in the Nautilus
file manager powers the thumbnail
and in a thumbnail embedded is there is
the remote code execution script, and
in my case, it pops up 100 calculators.
It was found by Davis.
Or maybe this one on
Google security researchers and there
are multiple CVEs assigned.
Well, that's the first life demo, but
I have a second one, so
everyone know blockchain is really
the new hype in 2018.
But I have a better hope for you.
It's called exploit
chain.
So for this all,
we have to pray for the demo
gods that it works.
So maybe someone it's like a MacBook
to like sacrifice or something like
this.
Let's let's hope that it works.
So we go back to
our virtual machine.
Oh, I have to delete it now.
Oh, such great remote
executions.
Yeah.
So you say, OK,
this this cat picture is somehow broken,
but this interesting website
offers another picture
and it's in
4K resolution, it should be
even better.
Let's test it out.
Let's download the better cat picture.
So.
So it's really fast,
like in my home country, Austria,
or I don't have internet.
Yes, 3.5 kilobyte.
Come on, Internet.
Well, I have I think
I have a copy of this on
my laptop
because we don't want to wait
ten minutes.
Oh, it's getting faster.
But now you feel, you know, how people
feel if some
if some 10 megabit
internet at their home.
Well, I don't wait for the download.
I have a copy on my
desktop, so it just
say we just downloaded it.
OK,
so we go again or downloads and
there is this cool.
Yeah, yeah. Broken.
Let's delete.
So there is, I say, let's we have
downloaded it and then
this happens again until
it pops up.
And I got this one.
Oh, what just happened?
So let's see.
I have for Shell here with fruit,
and it's called the Milky Way.
So let's check out.
The whole system,
so it's also Milky Way hostname,
let's see Milky Way, so we have a shell
on the host system of the virtual
box.
Let's check out here.
Yeah. So I got my username of the host
system. I got the running VMS in
the virtual machine.
I got my running mail.
And so to check
the really show that the one host system,
I would just shut it down.
Oh, power of.
And my letter was shot on.
So.
What the fuck did just happen?
Um, well, I've
implant exploit chain and are just
part of my laptop on their root shell, on
my whole system.
And so the explanation was, I
thought, a dysphoric cat pictures.
I opened the Nautilus.
I triggered the remote code execution
of a script, and then
I used the VirtualBox
escape exploit to escape to
the host system.
And then I saw like a third exploit.
I just used dirty car to get root
root root shell on the whole system.
So that was the the whole exploit chain,
and it's now part of the laptop.
So the setup is it's
the whole system is unpatched, are
open to 16.
Oh, for four.
It has to be a specific VirtualBox
version. It is five to six with
this number.
The guest system is nearly
patched. Debian nine with
good and on a guest
user. I have no password option for the
pseudo rights and it's a self-written
exploit chain.
The public available exploits in
Python and Bash and I also
modified the proof of concept
because the the first
proof of concept of the virtual box
escape only worked on on the command
line before. If no graphic
user interface and I
implemented it, that it works on the
graphic user interface too.
So the virtual box escape uses Typekit
all right to ram for
exploit.
So the shared video buffer between host
and guest system and
there is excellent writing about proof
of concept author.
And in the end, I put
a shell code into the buffer and it got
executed by the but against
and it's a bug in in
in the optimization of the compiler
of the VirtualBox compile process.
So dirt can't.
It's too severe.
It's homework for the audience to check
out. What's the problem, but dart to cart
to get root access on the device.
So the next thing?
Let's check out hardware security.
There is also hardware out there with all
the software.
Let's check out our
favorites or one of my favorites
because like a lot of five, for a
lot of fuck ups, it's meltdown
and specter. So Meltdown and specter
box are like design faults
in the CPU in a modern CPU architecture,
and it leads to sensible data
exfiltration extraction of their CPU.
It's like a hoverboard.
So the thing is the
speculative execution is used,
so it pre-computer undervalues
at the same time and devalues it.
Don't use it, just throw it away.
But with this feature,
you can extract the pre-computer
values which would throw away.
There are software fixes out there for
that, but it's really a big
performance loss.
So, yeah, software fixes
there, but so big performance loss that
even some companies need to buy new
hardware because they don't have enough
performance for the software.
There was a great meltdown pitch
by Microsoft for Windows
seven and Server 2008.
There was the PLM for pitch tables
accessible for everyone on the system.
So appealing for pitch numbers are the
master pitch tables in the system, which
should be only readable right through by
the kernel itself.
So no user should be accessible to it
and just everyone could like just right
in there and modify it and load
on pages.
So in the end, it was like this.
Like, I get people for paid tables to
people for pitch tables.
Everyone gets people for pitch tables.
So it's really bad because like everyone
could just modify the whole system and
like mess of it around
and there was a pitch.
They fix it like a month later, but it
was still a really bad pitch.
Well, some of you also like drive cars
are some of you maybe drive,
especially this car, it's BMW.
So BMW has sought to sue
telematics control unit in there,
and there are affected vehicles
from 2012 to 2018,
and there was a remote attack via Chisom
that could could they could execute
arbitrary unauthorized
diagnostic requests on a canvas
or they are working with BMW.
They should release two thousand
nineteen extensible writes up about
about vulnerabilities.
Now we just know what it's like a remote
attack in your car and you can execute
arbitrary, unaddressed diagnostic
requests. But there are no details about
what's the fault?
So probably you heard of you
use looks for a look picking, for
example.
But some people are really like
comfortable and they use locks with a
fingerprint reader.
So I have like a look like this.
And then you see this
screw there and then you think
that should be a secure lock?
The vendor thinks it is because
there is. This guy on Twitter could look
pick a lawyer who like checks out
looks if lock picking, and
he got this look from this company.
And they told him,
well, the money quote is the look is
invincible to the people who do not
have a screwdriver.
Well, like, everyone has a screwdriver
more or less to him, more of her.
So you just get your screwdriver, opened
the lock and you don't even leave a
fingerprint.
So it's a really bad lock design.
And yeah, 2018 security.
Not here.
Well, our next thing is quite
interesting. So.
Combine the words
mining rigs that the center
600 in Iceland.
So if you combine this verts,
you get this headline
Bitcoin Heist 600 powerful
computer stolen in Iceland.
So wait, Iceland is
an island and there is like water
all around.
And this computer was in a
datacentre like
some mining rigs. So how you steal
600 mining rigs on a datacentre
on Iceland were all on water
around?
Well, we don't know.
But they're just escaped six on mining,
just escaped from a data center in
Iceland.
But there is bonus content.
So that's all already ridiculous
enough. But it could be it can be
get more ridiculous because,
well, they got like a suspect
and they put this into jail
and the suspect managed to flee out
of jail, get on a plane
and on a plane was also the prime
minister of Iceland also,
and he flew to to Sweden on
the plane.
That's like the bonus content.
So you got the suspect sources get
out of the jail VR
window and then gets on a plane to
Sweden.
Nice trial.
So the next,
however, fuck up.
It's it's a combination of
solid and hard disks.
So if you have
if a combined is, you get
death def for two hard disks,
though the roster not stuck.
It's all stock operation
in in the Baltic states or in
Sweden.
And there was a gas based
fire suppression system, so if a fire
starts, it would like start and kill the
fire and
then it destroy it, the hard disks
by releasing the gas at
the high speed.
And this caused some repressions
and destroyed the hard disks.
And like the well,
the sad thing is there was
no fire at the data center.
They
released it by accident
and by accident. They also destroyed
their heart risks.
And the other problem was there were
not enough hard disks in Sweden
for the servers.
So I had to get Newhart's
out of other countries that
were not operational for five hours.
They should start at 9:00 in the morning,
and it's not like at two o'clock in the
afternoon and
there were affected markets.
Narang included Sweden, Finland,
Denmark, Iceland and the free Baltic
states. But this accident?
So they had to import the machines
to to make operational again.
And there's also a link to another video
where the guys are in the data center
and they have a monitoring when the hard
disks.
And they show on the harpists, at
the at the data center and you
see on the monitoring that they are just
rests in the air.
So if you're shot at Tartus,
you can destroy them if bad luck.
Um, well, I'm nearly at
the end.
Let's uh, my future
predictions.
I mean, I must say 2018
was really rich of fuck ups.
I don't have everything there was
like some days ago. The US them Esquire
light a remote code execution down there.
There was even more stuff there.
I can't check out
everything.
But, well, 2018 already
made a good year for five foot cups.
But my prediction for 2019
is the following
Oh, it
can't get better.
It will be just the race to the
yellow guys. I t
and the bombs are I.T.
security, and it will try
not only to run away rules to try
to fix the stuff, but until
now we have some were just running away
off the box and not fixing them.
So I hope that one will not be
the whole reality, but just a part of
it.
And also one question I also
asked myself is why should
I care about all this stuff I just
told here?
Um yeah.
And my answer is we should
care because security problems
affect us all in some way.
It affects myself for like software.
I used to have boxing there.
It affects my grandmother.
If she is somebody who's out
there for the internet, it affects my
neighbor investor, my security cameras,
if it affects everyone because everyone
uses hardware and software of boxing
there. And so my
my motto is, in the end,
make the world a safer place.
Report security vulnerabilities
the research.
And because
if the world is a safer place,
everyone has also a better life.
So if interestingly, today
all the stuff I did most
of my research on the COVID at the base,
so there is.
So if you read obvious, it's quite fun
and interesting. You get quite
interesting surveys out there like
some command injection
micro servers.
Why not?
So there is, for example, TV to tell a
sitcom for CV details.
There are also other web pages, but
they're quite interesting surveys out
there like also getting remote
execution by email in outlook
is always interesting.
Why not
that most of my presentations
are the questions of the of the people
here?
Thank you.
Thank you, Hetty, for the talk.
We have two microphones on the left
and on the right, and if there are any
questions, please
feel free to ask them.
So maybe I will start with a question.
What's your favorite security issue
this year?
I mean, this year, like
meltdown and Specter was quite hyped,
but like one of my favorite was this
npm fuck up because like people
just update the servers and the whole
production is like just fucked up and
are not even like their fault.
It's like was my one of my favorite
and this contract bank, which just tells
the users, Just ignore your certificate.
It's everything's fine.
It's like the the the worst
thing you can do as a bank.
Shut up and take my money.
So do we have some questions now?
Well, then
OK, so let's give her a big
applause and thank you for that talk.
So there are also some contact details,
you can also ask me in person, I
can also show I the public
published a source code of my exploits
and gets up in the ring to Congress.
And you can also talk to me and I can
show the exploits again on my machine,
if you like else and
try to Congress.
Stay safe and pet your systems.
Thank you very much.