BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Coming out sixes and eights…

Posted July 29, 2010    Marc Maiffret

We arrived in Las Vegas Tuesday evening for BlackHat and linked up with everyone at the Caesars Hotel lobby bar. The Caesars lobby bar has become a staple of BlackHat as it creates a really great environment of both hackers and IT folks having a few drinks and talking more openly about what is happening in the trenches. Two of the more interesting conversations we were a part of included some friends describing their recent penetration test of a SCADA environment, to the extent of controlling power for a major metropolitan area; to another with various researchers discussing what the current going rates are for zero-day vulnerabilities. It is clear from talking with folks that the number of zero-day vulnerabilities and their usage is well beyond what we think people typically understand the problem to be. For every one major zero-day attack we might eventually hear of, there are many others which continue to go under the radar. More than all of the good conversations with people at various social events during BlackHat, there were some really great talks this year worth mentioning.

As we previously blogged, in BlackHat USA 2010 or Bust, we were excited to see our old friend and colleague Barnaby Jack hack ATM machines. There are a lot of extremely intelligent people whom present at BlackHat, but few who posses the showmanship as Barns has. His talk did not disappoint as he ended by hacking two physical ATM machines on stage across a network and made them spit out all of their cash onto the floor.

Another talk we really enjoyed was Charlie Miller and Noah Johnson talking about BitBlaze and in general how to better analyze crash dumps found during automated fuzzing. This area of research has been picking up a lot of steam lately as researchers have turned the art of fuzzing really into a cpu and time problem in which, as Charlie put it, the real problem is not finding vulnerabilities within products, it is being able to analyze thousands of potential crashes to see which ones are worth investigating for exploitability.

Julien Tinnes and Tavis Ormandy delivered a great talk about “Ring0 exploitation” which we hope makes people a little less leery in wanting to dive in looking for kernel vulnerabilities. Reading through eEye research advisories you will see kernel and related vulnerabilities has always been an eEye area of focus and we really think more eyes need to take a look at some of these internals as there are definitely plenty more vulnerabilities to be found.

Another theme at this years BlackHat was talks discussing ROP (return oriented programming) exploits. As we previously mentioned, due to a lot of security improvements such as DEP, non-executable memory, there has been a lot of research done on how to bypass these safeguards. There were a few talks about this at BlackHat and a lot of jokes over drinks about DEP being dead. One of the great talks at this year circulating this area of research was by Dino Dai Zovi. In Dino’s talk he showed off a great tool (BISC) that helps to automate building the first steps of a ROP exploit. We think we will be many more exploits in the wild that take advantage of these techniques in the coming months.

All in all, between some great new research and catching up with a lot of good friends and colleagues, BlackHat was a great one this year! The conference might be over now, but there are still the last vendor parties of the week with Microsoft’s being one of the big ones left tonight. We will be hopefully linking up with our friends at Threatpost for a game or two of craps so wish us luck, or sixes and eights…

-eEye Research

Tags:
,

Leave a Reply

Additional articles

PowerBroker for Unix & Linux helps prevent Shellshock

Posted September 25, 2014    Paul Harper

Like many other people who tinker with UNIX and Linux on a regular basis, BASH has always been my shell of choice.  Dating back to the early days moving from Windows to a non-Windows platform, mapping the keys correctly to allow easy navigation and control helped ensure an explosion of use for the shell. Unfortunately,…

Bash “Shellshock” Vulnerability – Retina Updates

Posted September 24, 2014    BeyondTrust Research Team

A major vulnerability was recently discovered within bash which allows arbitrary command execution via specially crafted environment variables. This is possible due to the fact that bash supports the assignment of shell functions to shell variables. When bash parses environment shell functions, it continues parsing even after the closing brace of the function definition. If…

pbps-blog3

7 Reasons Customers Switch to Password Safe for Privileged Password Management

Posted September 24, 2014    Chris Burd

It’s clear that privileged password management tools are essential for keeping mission-critical data, servers and assets safe and secure. However, as I discussed in my previous post, there are several pitfalls to look out for when deploying a privileged password management solution. At this point, you may be wondering how BeyondTrust stacks up. With that,…

Tags:
, , , , ,