BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Coming out sixes and eights…

Posted July 29, 2010    Marc Maiffret

We arrived in Las Vegas Tuesday evening for BlackHat and linked up with everyone at the Caesars Hotel lobby bar. The Caesars lobby bar has become a staple of BlackHat as it creates a really great environment of both hackers and IT folks having a few drinks and talking more openly about what is happening in the trenches. Two of the more interesting conversations we were a part of included some friends describing their recent penetration test of a SCADA environment, to the extent of controlling power for a major metropolitan area; to another with various researchers discussing what the current going rates are for zero-day vulnerabilities. It is clear from talking with folks that the number of zero-day vulnerabilities and their usage is well beyond what we think people typically understand the problem to be. For every one major zero-day attack we might eventually hear of, there are many others which continue to go under the radar. More than all of the good conversations with people at various social events during BlackHat, there were some really great talks this year worth mentioning.

As we previously blogged, in BlackHat USA 2010 or Bust, we were excited to see our old friend and colleague Barnaby Jack hack ATM machines. There are a lot of extremely intelligent people whom present at BlackHat, but few who posses the showmanship as Barns has. His talk did not disappoint as he ended by hacking two physical ATM machines on stage across a network and made them spit out all of their cash onto the floor.

Another talk we really enjoyed was Charlie Miller and Noah Johnson talking about BitBlaze and in general how to better analyze crash dumps found during automated fuzzing. This area of research has been picking up a lot of steam lately as researchers have turned the art of fuzzing really into a cpu and time problem in which, as Charlie put it, the real problem is not finding vulnerabilities within products, it is being able to analyze thousands of potential crashes to see which ones are worth investigating for exploitability.

Julien Tinnes and Tavis Ormandy delivered a great talk about “Ring0 exploitation” which we hope makes people a little less leery in wanting to dive in looking for kernel vulnerabilities. Reading through eEye research advisories you will see kernel and related vulnerabilities has always been an eEye area of focus and we really think more eyes need to take a look at some of these internals as there are definitely plenty more vulnerabilities to be found.

Another theme at this years BlackHat was talks discussing ROP (return oriented programming) exploits. As we previously mentioned, due to a lot of security improvements such as DEP, non-executable memory, there has been a lot of research done on how to bypass these safeguards. There were a few talks about this at BlackHat and a lot of jokes over drinks about DEP being dead. One of the great talks at this year circulating this area of research was by Dino Dai Zovi. In Dino’s talk he showed off a great tool (BISC) that helps to automate building the first steps of a ROP exploit. We think we will be many more exploits in the wild that take advantage of these techniques in the coming months.

All in all, between some great new research and catching up with a lot of good friends and colleagues, BlackHat was a great one this year! The conference might be over now, but there are still the last vendor parties of the week with Microsoft’s being one of the big ones left tonight. We will be hopefully linking up with our friends at Threatpost for a game or two of craps so wish us luck, or sixes and eights…

-eEye Research

Tags:
,

Leave a Reply

Additional articles

Restricted Area Sign

Implementing Least Privilege for Windows the Easy Way

Posted July 31, 2014    Morey Haber

The concept of least privilege states that asset users should have the lowest level of access privileges required to effectively conduct their jobs. Implementing least privilege can bring several benefits to your organization, including: Increased security by reducing the attack surface available to users and to potential attackers who compromise user systems via phishing, malware,…

Tags:
, , ,
gartner market guide image - aug 2014

Introducing the Gartner Market Guide for Privileged Account Management

Posted July 29, 2014    Chris Burd

Gartner recently released a new Market Guide for Privileged Account Management (PAM), and we’d like to share a complimentary copy with you. The report includes PAM market analysis and direction, vendor overviews, and recommendations for selecting PAM solutions for your environment. BeyondTrust is one of two representative vendors (out of 20) to address all solution…

Tags:
, , , , , , , ,
Integrating Least Privilege and Password Management to Solve Account Security Challenges

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Posted July 24, 2014    Morey Haber

There is a reason all BeyondTrust Privileged Account Management (PAM) solutions share the PowerBroker name: They all inherently enable you to reduce user-based risk and can be integrated under a centralized IT risk management platform. Here’s one common use case that demonstrates how this integration changes the playing field. Consider the challenge of privileged access:…

Tags:
, , , , ,