2014 in Review [HackSoc]

A lookback at some of the interesting infosec events of 2014, overview of 5 topics. POODLE, Regain, BadUSB, Sony Hack & FDE. Given at Abertay Ethical Hacking Society.

Transcript

1. 2014 in review Michael Jack tl;dr
2. mikey$ whoami • Michael Jack • 2nd year EH • EH society member • talking @ securitayIV • i fucking love crypto • fuck you David Cameron •@MikeyJck
3. 2014 year of the vuln?
5. vuln stats
6. Padding Oracle On Downgraded Legacy Encryption technically: “a protocol downgrade support that then exploits a legacy encryption implementation”
7. Padding Oracle On Downgraded Legacy Encryption Why? Resulted in widespread depreciation of SSLv3
10. The Fucks TLS - History • 1994 - SSL 1.0 developed by Netscape • Feb 1995 - SSL 2.0 along with Netscape Navigator • 1995 - PCT specification from MS • 1996 - SSL 3.0 Total redesign by Netscape et al • Demand for standardisation - IETF • 1999 - TLS 1.0 (RFC 2246) - upgrade of SSL 3.0 • 2006 - TLS 1.1 • 2008 - TLS 1.2 - the good shit • 2011 - Latest TLS RFC 6176 • TLS 1.3 - DRAFT
11. POODLE • SSLv3 doesn't validate padding bytes in HTTP requests • Encrypt THEN MAC • allows attacker to steal cookies/ http auth header contents • more practical than BEAST (2 seconds per byte) • (latest practical sslv3 bar-mitzva attack rc4)
12. POODLE • final 8 bytes of http request padding, 7 padding 1 checksum, not specified by sslv3 • therefor it’s never checked • attacker copies valid http cookie from MitM • pastes into padding block of http request to example.com https://www.imperialviolet.org/2014/10/14/poodle.html
13. return of the POODLE • padding used in TLS = subset of SSLv3 padding • technically SSLv3 decoder function would work if dropped into TLS • wouldn't check padding bytes though.. • reintroducing POODLE for some implementations of TLS • Everything less than TLS 1.2 w/ AHEAD ciphers is insecure https://www.imperialviolet.org/2014/12/08/poodleagain.html
14. Don’t roll your own crypto
15. Regin Malware • ‘nation state’ • US(NSA?) & GCHQ • months/ years to develop • designed to gather ‘intelligence’ • focus on remaining undetected
16. Regin Malware • ‘nation state’ • NSA & GCHQ • months/ years to develop • designed to gather ‘intelligence’ • focus on remaining undetected Why? UK uses CNE against close ally(s) within the EU
17. the fuck are Belgacom?
18. Belgacom - Timeline • At some point before March 2011 GCHQ had compromised Belgacom with what would later be discovered as Regin • the name appeared for the first time on the VirusTotal website on March 9th 2011 • Undetected in Belgacoms networks until symptoms in Summer 2012 • June 2013 - after an update exchange falls over Belgacom contact M$ who had no clue? • Belgacom sys admins suspect virus > hire Fox IT • Belgacom informs authorities & Belgian MI get involved
19. GCHQ Belgacom Status Reports April - June 2011 July - Sept 2011 Jan - March 2012
20. Using Belgacom to ‘seed’
21. one more thing…
22. the damage? • 120 ‘systems’, 70 personal computers • Backbone cisco routers… • belgacom got ownd • sept 16th pr: “At this stage there is no indication of any impact on the customers or their data,” it said. “At no point in time has the delivery of our telecommunication services been compromised.””
23. malware analysis
24. Malware Analysis • encrypted virtual file system containers • variation of rc5 w/ 64-bit block size & 20 rounds CFB mode • bi directional C2, P2P C2, proxy mode } all encrypted
25. Malware Analysis
26. attack vector • GCHQ/ CSEC venture to ‘automate’ NOC hunting • identifying sys admins and NOCs • compromise privileged users, fight smart right?
27. if you’re ever parsing router config files… via GCHQ network analysis centre
28. there’s more.. • “Security Researchers Withheld Regin Malware Details For 'Global Security' Reasons” - TechDirt • Kaspersky, Symantec, Fox IT & F-Secure • Fox IT: “We didn't want to interfere with NSA/ GCHQ operations” • all suspected nsa/ gchq but reluctant to publish “waiting for someone else to do it first”
29. How it should go down
30. BadUS
31. • “Reprogramming USB peripherals. • To turn one device type into another, USB controller chips in peripherals need to be reprogrammed. • widespread… no protection from such reprogramming.” • Phison 2251-03 board BadUS https://srlabs.de/badusb/ https://github.com/adamcaudill/Psychson also £20 amazon £20 amazon *see the github wiki £5 amazon *caveats check the wiki! https://opensource.srlabs.de
32. https://srlabs.de/badusb/
33. https://srlabs.de/badusb/
34. Mitigations • av can’t scan usb firmware (or GPU memory btw) • freebsd gives option to disable usb enumeration • gdata usb guard, free, winx86/64 • f/w code signing/ lockdown at factory • Ironkey - ‘secure’ usb maker code signing
35. other work in this area https://www.eff.org/files/2014/01/06/20131230-appelbaum-nsa_ant_catalog.pdf
36. Sony Pictures Entertainment http://oag.ca.gov/system/files/12%2008%2014%20letter_0.pdf
37. How bad was it? http://oag.ca.gov/system/files/12%2008%2014%20letter_0.pdf
38. Timeline
39. http://www.reddit.com/r/hacking/comments/2n9zhv/i_used_to_work_for_sony_pictures_my_friend_still/
40. Timeline • Nov 24th - skeletor on screens & file name lists
41. Timeline • Nov 24th - skeletor on screens & file name lists • Nov 28th - ‘Alice’, ‘Fury(800k)’, ‘Mr Turner’, et al seeded online • Sony = fucking raging “theft of SPE content is a criminal matter”
42. Timeline • Nov 24th - skeletor on screens & file name lists • Nov 28th - ‘Alice’, ‘Fury(800k)’, ‘Mr Turner’, et al seeded online • Sony = fucking raging “theft of SPE content is a criminal matter” • Nov 30th - Sony as FBI for help in recovering movies…
43. Timeline • Nov 24th - skeletor on screens & file name lists • Nov 28th - ‘Alice’, ‘Fury(800k)’, ‘Mr Turner’, et al seeded online • Sony = fucking raging “theft of SPE content is a criminal matter” • Nov 30th - Sony as FBI for help in recovering movies… • Dec 2nd - 12:52am* ~ elegant St. Regis Bangkok spe internal documents were released in troves https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack/ *http://www.bloomberg.com/news/2014-12-07/sony-s-darkseoul-breach-stretched-from-thai-hotel-to-hollywood.html
44. Leak 1 | Dec 2nd • 24GB Compressed • 47k SSNs “most” next to name, address, dob etc • Excel(523), (75)PDF, Word(3) • SSNs appeared in more than 400 locations • - http://www.identityfinder.com/us/Press/20141204210449
45. FBI Flash Alert | Dec 2nd • FBI warns US companies that “destructive” cyber attack has occurred • “The report said the malware overrides all data on hard drives of computers, including the master boot record, which prevents them from booting up” • Don’t name victim SOP http://www.reuters.com/article/2014/12/02/us-sony-cybersecurity-malware-idUSKCN0JF3FE20141202
46. Timeline • Nov 24th - skeletor on screens & file name lists • Nov 28th - ‘Alice’, ‘Fury(800k)’, ‘Mr Turner’, et al seeded online • Sony = fucking raging “theft of SPE content is a criminal matter” • Nov 30th - Sony as FBI for help in recovering movies… • Dec 2nd - 12:52am ~ elegant St. Regis Bangkok spe internal documents were released in troves • Dec 3rd - GOP ‘leader?’ tells RBS “Today more interesting data will be presented for you” https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack/
47. • Bonus.rar & List.rar = 1.18GB • 500 plaintext creds • certs probably any keys • more creds • shit passwords • list.rar int & external sys info • & some payment info fuck you PCI Leak 2 | Dec 3rd
48. Timeline • Nov 24th - skeletor on screens & file name lists • Nov 28th - ‘Alice’, ‘Fury(800k)’, ‘Mr Turner’, et al seeded online • Sony = fucking raging “theft of SPE content is a criminal matter” • Nov 30th - Sony as FBI for help in recovering movies… • Dec 2nd - 12:52am ~ elegant St. Regis Bangkok spe internal documents were released in troves • Dec 3rd - GOP ‘leader?’ tells RBS “Today more interesting data will be presented for you” • Dec 5th - in email to spe staff hackers “not only you but your family will be in danger” https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack/
49. Timeline • Nov 24th - skeletor on screens & file name lists • Nov 28th - ‘Alice’, ‘Fury(800k)’, ‘Mr Turner’, et al seeded online • Sony = fucking raging “theft of SPE content is a criminal matter” • Nov 30th - Sony as FBI for help in recovering movies… • Dec 2nd - 12:52am ~ elegant St. Regis Bangkok spe internal documents were released in troves • Dec 3rd - GOP ‘leader?’ tells RBS “Today more interesting data will be presented for you” • Dec 5th - in email to spe staff hackers “not only you but your family will be in danger” • Dec 5th - 100GB compressed /22 files seeded for torrent https://www.riskbasedsecurity.com/2014/12/a-breakdown-and-analysis-of-the-december-2014-sony-hack/
50. • 3 files • SPE_03_01.RAR = sony brazil • SPE_03_02.RAR = imageworks vancouver & spe • Both mostly financial • SPE_03_03.RAR = incident reports, more personal data creds Leak 3 | Dec 5th
51. • continued through 16th December • gigs of email (outlook) spools • lots on combatting piracy, mpaa docs, strategy, take down stats • personal info, NDAs, Research docs • sony pe = fubar Timeline
52. Attribution is Hard • fake call by USgovt • North Korea (USgovt, FBI, NSA, CloudStrike) • 3rd party (MarcRogers, others?) • North Korea 3rd party
53. North Korea FBI Dec 9 Jan 9th Admiral Michael Rogers NSA Director https://firstlook.org/theintercept/2015/01/09/nsa-played-key-role-linking-north-korea-sony-h/ http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation
54. NSA SIGINT http://www.spiegel.de/media/media-35679.pdf http://www.spiegel.de/media/media-35680.pdf 8th Jan 2007
55. NSA SIGINT http://www.spiegel.de/media/media-35679.pdf
56. • USgovt still says it’s NK • Imposed economic sanctions • heralded as new age • hopefully we get to read Mandiant’s report… Sony Pictures Entertainment
57. Disk Encryption on by default since 2014
58. iOS Forensics • requires pairing record from paired computer • upto iOS 7.1.2
59. Undocumented Services • lockdownd (tcp:62078) • com.apple.pcapd (libpcap) • com.apple.mobile.file_relay • com.apple.mobile.house_arrest
60. com.apple.pcapd • wi-fi/ usb • “Connecting to this service immediately starts a packet sniffer on the device” • “installed by default on all devices”
61. com.apple.mobile.file_relay • around since iOS 2 • maintained by apple over the years • used by forensic tools • provides physical artifacts vs. logical (actual sqlite3 dbs.. gzipped cpio archive) • ‘deleted’ data recover
62. iOS 2: com.apple.mobile.file_relay • AppleSupport • Network • WiFi UserDatabases • CrashReporter SystemConfiguration
63. iOS 7: com.apple.mobile.file_relay https://pentest.com/ios_backdoors_attack_points_surveillance_mechanisms.pdf
64. com.apple.mobile.file_relay https://pentest.com/ios_backdoors_attack_points_surveillance_mechanisms.pdf
65. com.apple.mobile.house_arrest • originally for itunes • access to /Library • image caches, dm database, deleted messages, etc
67. iOS 8 • September 17th • removed undocumented services • encrypt all the things • secure enclave • https://www.apple.com/privacy/
68. Secure Enclave • Based on ARM Trust Zone • ARMv8-A instruction set • A7, A8, A7X SoC (iPhone 5S, iPad Air & Mini 2) • all crypto keys & operations live here • Enclave Unique ID fused into silicon
69. iOS Key Derivation • Passcode & UID • combined using 80ms PBKDF2-AES • only hardware knows UID UID https://apple.com/privacy/docs/iOS_Security_Guide_Oct_2014.pdf
70. Android L • Android FDE since 3.0 Honeycomb • now enabled by default!! • previously software implementation flaws • hardware support for crypto
71. Disk Encryption • iOS Good FDE by enabling a pin/ password • OS X prompt for FDE on install • Android L Better FDE by enabling pin/password • Bitlocker.. eh
72. Other Things • Heartbleed • NSS cert vuln • usual Java/ Flash vulns • iOS 8 still Jailbreakable • XEN vuln that forced EC2 to reboot • lots of NSA docs
74. Ghost • CVE-2015-0235 • glibc vulnerable since November 2000 • ‘fixed’ May 2013 between glibc 2.17 & 2.18 • buffer overflow via method ‘gethostbyname()’ • 4bytes/ 8bytes overwritten by digits, dots, \0 • fully working exploit
75. SecuriTayIV Information Security conference • launched in 2012 • Only Student Led InfoSec Con in UK • 150 attendees • 2/3 tracks • Abertay • 27th February • a Friday ;) http://securi-tay.co.uk @AbertayHackers
76. 2015 What’s in Store • Govts coming after crypto • moar DDoSing… • usability of crypto tools • BH Asia far more practical attack on RC4 • moar cyber
77. Thanks!