HITCON 2017 Zeroday 發表會

https://zeroday.hitcon.org/vulnerability/ZD-2016-00306

Transcript

1. )*5$0/;FSPEBZ
   䧮䟝銴⤑㹆涸J1IPOF4&⛓飑暟"QQ䢔呪
   

   View Slide

2. )J 䧮僽*OOEZ
   BLB加啄
   

   View Slide

3. ➛㣔䧮銴铞♧⦐
   飑暟"QQ剤㥪㢵䓳럊涸佦✲
   @ sཀպ̼
   @
   

   View Slide

4. ⿡䎃厥♧㣔
   䧮罉꠸騈䧮铞
   ؇̫٥
   
   

   View Slide

5. 厥飑暟笪畀剤馄⤑㹆ꣳꆀ㉂ㅷ
   ⿶ⶍ㥪䧮䟝䳖䩛堥
   s٥Ī٥A
   
   

   View Slide

6. View Slide

7. 搭䖕䧮⦛㽠䩧Ꟛ
   #VSQ4VJUFꟚ㨥溏꣚溏
   ง๑•̀@•́
   ง
   

   View Slide

8. 䧮欽7VFKT㻨✫♧⦐溏匢
   ⢵䮋鼇⤑㹆涸㉂ㅷ
   齡儘⦬䊨⡲ⶍ㥪㖈欽7VFKT鄄OPEFKT䵆䖤㥪汥蕲
   Aİs
   
   

   View Slide

9. ٧(́◕◞౪◟◕
   
   

   View Slide

10. 䱺衽涮植♴鎎㋲涸"1*
    须俲剤⸈㺙
    ಠ@ಠ
    

    View Slide

11. 剤⦐䊨Ⱘ〭⨞KBEY
    〳⟃⿾管陼"OESPJE"QQ
    ҙŐ
    ұѨѠѽ♧
    

    View Slide

12. s̫A
    _ԍ
    

    View Slide

13. s̫A
    _ԍ
    

    View Slide

14. 昸✫䵻⤑㹆涸J1IPOF4&
    ٧ ԫӟ
    ظ
    

    View Slide

15. 㻨玑䒭䵻飑
    

    View Slide

16. 穡卓剤"1*鸠䏞ꣳⵖ
    鼩剤♧❉㼭稣眏尝岤䠑ⵌ
    İ
    
    
    
    

    View Slide

17. 穡卓䧮♧⦐鿪尝䵻ⵌ
    இŐஇ
    

    View Slide

18. 㔐곃♧♴
    s٥Ī٥A
    
    

    View Slide

19. "&4$#$1,$4
    s٥Ī٥A
    
    

    View Slide

20. 1BEEJOH0SBDMF
    sİA
    
    

    View Slide

21. 'JYFE,FZ*7
    sİA
    
    

    View Slide

22. 䧮ⶍⶍ僽♶僽铞䧮⦛欽
    #SVQ4VJUF
    s٥Ī٥A
    
    

    View Slide

23. 飑暟笪畀䥰鑪剤
    44-5-4ゅ
    s٥Ī٥A
    
    

    View Slide

24. sİA
    
    

    View Slide

25. 䖕⢵䟝䟝"QQ鿪㻨涸鸏
    랃昈✫㥪⫹剤溏ⵌTRMJUF
    sŐA
    
    

    View Slide

26. @ sཀպ̼
    @
    

    View Slide

27. 卓搭剤42-*OKFDUJPO
    @ sཀպ̼
    @
    

    View Slide

28. ˙08"415PQ.PCJMF3JTLT'JOBM-JTU
    ˙.8FBL4FSWFS4JEF$POUSPMT
    ˙.*OTFDVSF%BUB4UPSBHF
    ˙.*OTVDJFOU5SBOTQPSU-BZFS1SPUFDUJPO
    ˙.6OJOUFOEFE%BUB-FBLBHF
    ˙.1PPS"VUIPSJ[BUJPOBOE"VUIFOUJDBUJPO
    ˙.#SPLFO$SZQUPHSBQIZ
    ˙.$MJFOU4JEF*OKFDUJPO
    ˙
    鸏䧮尝剤庠麕
    魨⟨阮㶶贫㶸㖈1SFGFSFODF.BOBHFS酆꬗
    

    View Slide

29. 㥶卓䧮僽䟅䠑余乹罏
    ̫
    
    

    View Slide

30. 䎙㣔䖕䧮䪾须俲侮椚♧♴
    ⚓♳)*5$0/;FSPEBZ
    

    View Slide

31. View Slide

32. ⼿⸔鹎遤醳庠
    

    View Slide

33. 恠Ꟁ涸麕玑н sŐA
    й
    • 2016/11 送出
    
    • ⽉月底廠商才有回應
    
    • 修到⼀一半請我複測，接著交給其他廠商做檢測
    
    • 拖了了半年年，2017/05 終於公開了了！⼼心好累
    

    View Slide

34. 鸏⚆歲涸怪峯⿶㼱✫♧⦐
    sӟA
    
    

    View Slide

35. 昸➊랃剚剤鸏랃㢵怪峯
    sŐ
    
    

    View Slide

36. 醳醢顦♳䊨玑䌌
    ಠ@ಠ
    

    View Slide

37. IUUQTMBVSFOUHJUIVCJPTPJOKFDUJPOT
    

    View Slide

38. 䖰㷸绢㻨玑䒭涸儘⦬
    㽠ⴀ✫㉏겗
    ⡹涸罉䌌铞♶㹁㽠僽怪峯⢵彂
    䠮闒➮雊䧮⦛剤䊨⡲
    

    View Slide

39. 䖎㢵剅硃䲿⣘涸眕⢿玑䒭
    㽠剤㉏겗
    ⡹⿡剅㽷缺1)1涸剅♧㹁䪪涸ⵌ42-*OKFDUJPO
    

    View Slide

40. ♧饱㔐㜡怪峯
    鍑对剤㉏겗涸➃來肬➮⦛
    ؇̫٥
    
    

    View Slide