BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Coming out sixes and eights…

Posted July 29, 2010    Marc Maiffret

We arrived in Las Vegas Tuesday evening for BlackHat and linked up with everyone at the Caesars Hotel lobby bar. The Caesars lobby bar has become a staple of BlackHat as it creates a really great environment of both hackers and IT folks having a few drinks and talking more openly about what is happening in the trenches. Two of the more interesting conversations we were a part of included some friends describing their recent penetration test of a SCADA environment, to the extent of controlling power for a major metropolitan area; to another with various researchers discussing what the current going rates are for zero-day vulnerabilities. It is clear from talking with folks that the number of zero-day vulnerabilities and their usage is well beyond what we think people typically understand the problem to be. For every one major zero-day attack we might eventually hear of, there are many others which continue to go under the radar. More than all of the good conversations with people at various social events during BlackHat, there were some really great talks this year worth mentioning.

As we previously blogged, in BlackHat USA 2010 or Bust, we were excited to see our old friend and colleague Barnaby Jack hack ATM machines. There are a lot of extremely intelligent people whom present at BlackHat, but few who posses the showmanship as Barns has. His talk did not disappoint as he ended by hacking two physical ATM machines on stage across a network and made them spit out all of their cash onto the floor.

Another talk we really enjoyed was Charlie Miller and Noah Johnson talking about BitBlaze and in general how to better analyze crash dumps found during automated fuzzing. This area of research has been picking up a lot of steam lately as researchers have turned the art of fuzzing really into a cpu and time problem in which, as Charlie put it, the real problem is not finding vulnerabilities within products, it is being able to analyze thousands of potential crashes to see which ones are worth investigating for exploitability.

Julien Tinnes and Tavis Ormandy delivered a great talk about “Ring0 exploitation” which we hope makes people a little less leery in wanting to dive in looking for kernel vulnerabilities. Reading through eEye research advisories you will see kernel and related vulnerabilities has always been an eEye area of focus and we really think more eyes need to take a look at some of these internals as there are definitely plenty more vulnerabilities to be found.

Another theme at this years BlackHat was talks discussing ROP (return oriented programming) exploits. As we previously mentioned, due to a lot of security improvements such as DEP, non-executable memory, there has been a lot of research done on how to bypass these safeguards. There were a few talks about this at BlackHat and a lot of jokes over drinks about DEP being dead. One of the great talks at this year circulating this area of research was by Dino Dai Zovi. In Dino’s talk he showed off a great tool (BISC) that helps to automate building the first steps of a ROP exploit. We think we will be many more exploits in the wild that take advantage of these techniques in the coming months.

All in all, between some great new research and catching up with a lot of good friends and colleagues, BlackHat was a great one this year! The conference might be over now, but there are still the last vendor parties of the week with Microsoft’s being one of the big ones left tonight. We will be hopefully linking up with our friends at Threatpost for a game or two of craps so wish us luck, or sixes and eights…

-eEye Research

Tags:
,

Leave a Reply

Additional articles

webinar1

On Demand Webinar: Advanced Windows Tracing

Posted April 17, 2015    BeyondTrust Software

Webinar: Security MVP, Paula Januszkiewicz, shows Windows administrators how to be more aware of what happens whenever somebody does something within the system.

Tags:
, ,
5

The Delicate Art of Remote Checks – A Glance Into MS15-034

Posted April 15, 2015    Bill Finlayson

Remote vulnerability detection – using ms15-034 as an example.

Tags:
, ,
databreach

2015 Verizon Data Breach Investigations Report: More End Users as Threats

Posted April 15, 2015    Scott Lang

The 2015 Verizon report says end users are the number one source of insider abuse incidents. Find out how to mitigate the risks.

Tags:
,