The Hex Factor at SANS London 2009

The competition is now officially over and I have to say it was AWESOME!

Those that made it to BruCON had a chance to play it, those that came to SANS London 2009 also had their fun, all the rest of you - bad luck :-/ maybe next time.

The Hex Factor was run for four evenings/nights at The Fox Bar and Restaurant located literally next to the Excel center where SANS courses were hosted. What can be better than beer, hacking and a spirit of competition?!

Tasks set by the authors were varied in difficulty and topics they covered. One category was about history and culture of hacking with a bit of general teaser tasks and was called Once Upon A Time, like finding a name of candy shop at <street name>, so that was a soft introduction.

My favorite category was Out Of The Box category (also known as Pure Leetness), where questions were really 'out of the box' and solving them was the best fun I had for a long time! First 100 points for finding a number 'hidden' in the message was really simple and here's how I did it:



I didn't have time to do the one for 200 points, but finally after some time I managed to solve the 300 points one - finding a secret number hidden in the PDF file - hats off to Didier Stevens for this task - it was amazing! Didier's blog was a great guide and help in the process.


Third category was Pwned and consisted of physical box with
sensors you had to trigger in the right order to get the code and two
systems to be penetrated. As I said, the difficulty was varied and so
were the nominal point values for each task, from 100 to 300, but you
could also get the partial points if you did only part of the task
properly. Of course during competition like this one you are never alone... Hello brotha!

Anyway, it was all very very friendly competition - beer infused with brains hurting after the classes (typical for 'SANS Fire Hose Syndrome').

Third category of tasks was Binary fu where you had to work your way through programs delivered as .exe files and get the secret codes out of them. First one was easy, but again I had no time to go through the remaining two. That is the reason why our team (I was working with Chris Riley, better known as @ChrisJohnRiley) was called Drunk and going home.

At the end we were #4 at the leader board but as it turned out, two teams of the first three were the same people, so kind of we are #3, so here we are - two of three winning teams, already in The Hex Factor t-shirts!

I'd like to say THANK YOU to all the people behind The Hex Factor - it was really awesome experience and great fun, so I hope it's not the last time we see The Hex Factor. See you next time!

CONFidence09.02 - post mortem

Well... my plan to blog live from the CONFidence was good but still remained to be more of a plan than a reality. Twitting went much better (possibly because you can twitt between chats with people, drinks, etc) so I'll wrap up what happened and how it went.

The conference was great - I really liked the lectures (those I actually made to), loved the chat with speakers and it was awesome to meet some old friends and make some new contacts. Overall, if you didn't come to Warsaw for CONFidence09.02 you missed quite a lot.

Day 1 summary
There was very nice presentation by Felix "FX" Lindner on how 'awesome' Cisco IOS is, Claudio Criscone (@paradoxengine) talked about security in virtualization environments, Frank Breedijk renamed hist AutoNessus to Seccubus (new twitter feed at @seccubus), Leonardo NVE Egea showed us how you can use the satellites to work as your downlink (and it seemed much easier than actually you would think), Pavol Luptak pretty much owned the RFID there (yes, the basic cloning kit is just €30), Elisa dropped the pressure a bit with Power Point Karaoke where Felix "FX" Lindner was presenting about detecting unknown alcohols, Raoul Chiesa gave great presentation about knitting (yes, knitting) and I was rolled into a presentation about IT slang/acronyms and there was something about insulting someone :-) and that was just the first day.

Day 2 summary
For those that survived the 'afterparty' on the evening/night/morning you had a chance to see nice explanation of the cold boot attack given by Nadia Heninger, Nick DePetrillo discussed 'what could go wrong' with intelligent power grids and believe me... there's a lot! Jacob Applebaum (@ioerror) gave us some TOR love and a lot of TOR laptop stickers. Alessio "mayhem" Penasilico (@mayhemspp) and Raoul Chiesa gave nice presentation on history of hacking telcos - there was some good info there... just before Raoul killed it all with final presentation dissecting the underground economy (with some slides show just after the cameras and other recording equipment was turned off). That was a really good one...

Finishing off, Frank has posted a bunch of posts about presentations we saw in Warsaw. They are:

• Fusing 3rd party threat feeds to obtain better threat intelligence - Eddie Schwartz
• Router Exploitation - Felix "FX" Lindner
• My Seccubus slide deck (slides from Frank's presentation)
• My TLS renegotiation vulnerability slides (Frank's lightning talk during one of the breaks)
• Mifare Classic anaysis - Pavol Luptak
• Power Hungy People - Nick DePetrillo
• The Tor Project - Jacob Appelbaum
• Underground economy - Raoul Chiesa
  

That's it for now - just make sure you get there next time :P

Claudio Criscione - Virtualization security

Claudio gave today brilliant presentation about virtualization security... Just a few bullet points from the presentation.

• It turned out that VMWare hypervisor is running Tomcat to give you the admin interface - oldie (shall I read it 'unpatched') but goldie, right?
• You can do MiTM against VMWare VI Client... and as presented at the demo, that works like a charm, plus...
• ... if you can MiTM you can pwn the box - clients.xml that is served by the server contains a URL of the client .exe to be executed - boom, you can change that!

Just to give you the idea - during live demo Claudio forced the admin PC (the one running VI Client) to format drive C: and there was no option to stop it, it pretty much kicked off right away.

There was much more than that - also Xen and Ubuntu got their share here but the practical demo was based on VMWare.

Lessons learned?
Treat VM hosts and their apps just as another computer, another system and make sure you secure them the same way as any other system. Think of patch management and what happens when you revert to a snapshot (it may be old and unpatched so you bring back unpatched or already compromised system), think of separation of duties and access (physical and logical).

CONFidence09.02 - day 1 kicked off

Almost half of the day at CONFidence09.02 has already passed. Some interesting stuff of course...

Starting with Dragorn's and RenderMan's "Wireless threats; They're not dead yet!" we've heard once again how bad and how dead WEP really is. Good refresher for some people I guess. Best part was discussing client side attacks via wifi - airpwn style but without goats this time, using malicious JS with such a nice feature like browser side caching, defeating SSL, hiding all of that in plain sight with call-home feature that will be very hard to notice in most of environments.

Then I skipped several presentations - I really needed a reboot :-)

Next one I made to was Felix "FX"Lindner talking about how sweet hacking Cisco IOS can be. Frank (@autonessus) has already blogged about this one so I'll just put a few notes here.

• Cisco's HTTP admin interface runs off their understanding of HTTP and not Apache.
• IOS doesn't have recovery procedure for software crashes due to it's monolithic structure - the only remedy is to reboot the whole box (quite easy to spot even by untrained admin - the networkz are down!) which takes time (even several minutes).
• Cisco has added TCL scripting in some versions of IOS :-)

More to follow... and yes, we use #confidence0902 as hashtag.

Twitter, SPAM and zombie hookers

Came out of a blue - no context, nothing... BTW - we've got new URL shortening service.
All would be almost 'fine' but WTF is that? Not that I wouldn't guess but I'm just curious how owned you can get :-)

As a matter of fact, you can get owned pretty bad and what I've seen I would expect to be just a starter... the main course is coming soon!

WARNING: All the information provided in this post is available on the Internet. Links presented on screen shots should be considered malicious - do not visit them unless you really know what you are doing. You have been warned.

Just as your mother told you...

The best way IMHO to check stuff like that is the old school way...

Looks broken, right... redirect ok - that's what I've expected, but then... hold on - Client-Peer IP is not mine in any way... so who owns this one?

Isn't that just sweet? You go to a website and the traffic goes via proxy somewhere in China. Well - that's not all in fact. Let's grab a clean VM, make snapshot just in case, connect - let's see what a sexy girl has to offer, right?

NSFW

Don't to that at work or you may get strange looks from people around (at best) ;-)

The Bait

Page loads and looks like a blog - that's what the URL would suggest, but if you look in the source... I said THE SOURCE, not the boobs on the page!

Right... in the source you find the gems. First of all the page is using GeoIP JavaScript include from Maxmind - we all know it works well - to give the reader more personalized experience when you read the story (don't even tell me you are still looking at the photos - lol). As an effect the page resolves that I connect from IP address in London and that the poor girl comes from 'a small town near London , H9' and has to work as a stripper to pay her college fees...

London, H9... hold on - London doesn't have H9 post code (although on the page it looks like it was a part of address). GeoIP information is used in several places and looks quite... convincing... as long as you focus on the boobies... oh and forget about the fact that the bottom of the page says 'She is single boys!!!! She lives in my hometown of London' - right, somebody doesn't even have a spell check :-]

The Shot

Let's look at the gems on the top shelf... I don't have a lot of time to look at it properly, so just quick bullet points:

1. We have a JavaScript that contains two functions 'encoding' their input. Well kind of encoding because it uses ord() to do it and it seems the author is not very skilled, but anyway - he/she managed to produce working code
2. Call to encode function with referrer URL given as parameter - why someone is trying to steal my referrer info?
3. JavaScript print out an IFRAME linking to HTML file and passes encoded string as a parameter. The file came back empty, but GET string is left in their logs :-)

Getting the referrer string doesn't look that bad... right? Anyway, why do they want to know where am I coming from? Is that like SEO and affiliate tracking for malware? Interesting!

Post Mortem

Not much of it... As I said I don't have time to play with it properly and see if for example I actually get something from this 'empty' html file. It would be trivial to provide further payload if the victim provides properly encoded referrer string that is of attacker's interest.
How effective it would be if the bad guys used this just to check via which channel the victim came to them (they can also find out which channels are the most successful - it's just like marketing campaigns)? The next logical step would be to provide customized exploit - if victim came from Twitter do bad stuff to a Twitter user, Facebook - get them owned on Facebook, etc.

Surely the guys are learning and their intentions are not good. Keep an eye out and don't get yourself fooled!

Windows 7 Haz Cheezburgerz!

Simply AWESOME!

Came via e-mail from one of 'marketing' guys so I don't know the real origin (except obvious one) but the sender's comment was spot on!

Look at the monster burger. It's five inches tall and of course is made with seven beef patties in honor of Windows 7. What's the message here? Eat this burger to feel as slow and bloated as Windows? I don't get it.

... and neither do I but as a poster it's a nice one for laugh. In fact Windows 7 is so much faster than Vista that there is nothing to compare ;-) so Burger King should be selling V-shaped burgers some time ago when Vista came out. Well - never mind... but thanks for this e-mail and a good laugh :-)

BTW. If there is a person that would understand what the advert is all about (and I don't mean translating the text) or can see the 'hidden message', please enlighten me :-)

RSA Security Bloggers Meet Up 2009 London

It's already a matter of past but still - the first official RSA Security Bloggers Meet Up 2009 in London was held in Fountains Abbey at 19:30 on 20 October 2009. It was a great evening - meeting people that live and share every bit of security related information they can - to educate and entertain :-)

I just want to say thank you to Dale Pearson of Security Active for getting all of it prepared and to all the sponsors - IronKey, ISACA, Qualys, RSA and others - for helping Dale and sponsoring the meet up. Dale has posted a summary and photos from the meet up at Security Active's blog. If I've missed anybody in above, please forgive me.

For me this meeting was a chance to see some people I've already met earlier (like @stefant and several others) and some I was trying to almost 'hunt down' in London for quite some time (@xme is perfect example here) so for me the meet up was a real success :-)

Thanks again and see you all next time!