BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Coming out sixes and eights…

Posted July 29, 2010    Marc Maiffret

We arrived in Las Vegas Tuesday evening for BlackHat and linked up with everyone at the Caesars Hotel lobby bar. The Caesars lobby bar has become a staple of BlackHat as it creates a really great environment of both hackers and IT folks having a few drinks and talking more openly about what is happening in the trenches. Two of the more interesting conversations we were a part of included some friends describing their recent penetration test of a SCADA environment, to the extent of controlling power for a major metropolitan area; to another with various researchers discussing what the current going rates are for zero-day vulnerabilities. It is clear from talking with folks that the number of zero-day vulnerabilities and their usage is well beyond what we think people typically understand the problem to be. For every one major zero-day attack we might eventually hear of, there are many others which continue to go under the radar. More than all of the good conversations with people at various social events during BlackHat, there were some really great talks this year worth mentioning.

As we previously blogged, in BlackHat USA 2010 or Bust, we were excited to see our old friend and colleague Barnaby Jack hack ATM machines. There are a lot of extremely intelligent people whom present at BlackHat, but few who posses the showmanship as Barns has. His talk did not disappoint as he ended by hacking two physical ATM machines on stage across a network and made them spit out all of their cash onto the floor.

Another talk we really enjoyed was Charlie Miller and Noah Johnson talking about BitBlaze and in general how to better analyze crash dumps found during automated fuzzing. This area of research has been picking up a lot of steam lately as researchers have turned the art of fuzzing really into a cpu and time problem in which, as Charlie put it, the real problem is not finding vulnerabilities within products, it is being able to analyze thousands of potential crashes to see which ones are worth investigating for exploitability.

Julien Tinnes and Tavis Ormandy delivered a great talk about “Ring0 exploitation” which we hope makes people a little less leery in wanting to dive in looking for kernel vulnerabilities. Reading through eEye research advisories you will see kernel and related vulnerabilities has always been an eEye area of focus and we really think more eyes need to take a look at some of these internals as there are definitely plenty more vulnerabilities to be found.

Another theme at this years BlackHat was talks discussing ROP (return oriented programming) exploits. As we previously mentioned, due to a lot of security improvements such as DEP, non-executable memory, there has been a lot of research done on how to bypass these safeguards. There were a few talks about this at BlackHat and a lot of jokes over drinks about DEP being dead. One of the great talks at this year circulating this area of research was by Dino Dai Zovi. In Dino’s talk he showed off a great tool (BISC) that helps to automate building the first steps of a ROP exploit. We think we will be many more exploits in the wild that take advantage of these techniques in the coming months.

All in all, between some great new research and catching up with a lot of good friends and colleagues, BlackHat was a great one this year! The conference might be over now, but there are still the last vendor parties of the week with Microsoft’s being one of the big ones left tonight. We will be hopefully linking up with our friends at Threatpost for a game or two of craps so wish us luck, or sixes and eights…

-eEye Research

Tags:
,

Leave a Reply

Additional articles

dave-shackleford-headshot

Your New Years Resolution: Controlling Privileged Users

Posted January 27, 2015    Dave Shackleford

Is 2015 the year you get a better handle on security? The news last year was grim – so much so, in fact, that many in the information security community despaired a bit. Really, the end-of-the-year infosec cocktail parties were a bit glum. OK, let’s be honest, infosec cocktail parties are usually not that wild…

Tags:
, , ,
flash-logo

Adobe Patches Zero-Day Flaw Being Exploited in the Wild

Posted January 22, 2015    BeyondTrust Research Team

Earlier this week, French malware researcher Kafeine reported on a new Adobe Flash zero-day vulnerability that was being exploited in the wild using the latest versions of the Angler Exploit Toolkit. “Any version of Internet Explorer or Firefox with any version of Windows will get owned if Flash up to 16.0.0.287 (included) is installed and enabled”…

Tags:
, , , , ,

Your Data Security Strategy Starts with Deploying a Least Privilege Model (part 2 of 2)

Posted January 22, 2015    Scott Lang

In last week’s blog, we talked about how controls and accountability must be put into place so that only the right folks can access data and the systems on which that data resides, and that employing a least privilege model helps to achieve that and more. We’re using conclusions and data from a recent report…

Tags:
, , , ,