Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/96 Thanks!
It's a great pleasure to introduce
Sergei and Ghaleb, who will
now tell you some more about
why Scott, it is important for us and why
it's deeply broken.
Thanks.
Hello, Congress.
Nice to meet you again.
Here we are, Mr Gay and
Ghaleb. But
as well as usual, we only fragments
of strange golf team.
Here's our team and
I ask you to applaud those guys
who work with us.
Thank you, guys.
Last year, we have a very good time here
in Congress, and
after this we decided to
spend more time.
How can I say our system has scarred
the system to get some
new materials to talk here again?
So here we are, and we are talking
about our first release.
Our first release is new business
metric to
estimate cost of vulnerability,
how to estimate it.
You can now
to find any vulnerabilities
to find vulnerability in this year's
environment.
You need not so much
money you can download
already to passing stuff from
scans DOT Iowa
gripped by ElasticSearch.
And
if you want to put it in Excel,
it's most expensive part for
me. It's cost more than
9000 because I hate it.
But if
you have, I don't know the student,
you can ask to do it by himself.
Why are we talking about it?
Because for last year, things
change it in 2012,
we have Google Showdown
and the voice was very slow
and boring.
And now we have
that mob massacre on special
homebrew scanner for Industrial Protocol.
And it's what is simple to
get the new information up to
date information about Ikea's
system in internet.
Here it is.
So at a moment
in our knowledge base, we have
more than 60000
of different ices devices.
Of course, most of the devices
in the U.S.
but Germany on second
place and on fifth place is
Italy, not Vif
pizza owns only.
And if you will check
this statistic about by vendors,
we will find out. But
uh.
Mhm.
On the fifth place,
we can find not very common
vendors not, I don't know, Siemens
or ABB.
Why? Because a lot of Ikea's
devices connected to internet
not directly, but via
special network devices,
which can be fingerprinted
by common methods.
If you check our statistics
for top 10 devices,
we will find
a wind cube on the first place.
What is what is it?
This is smart grid device.
They use it to control
solar and wind
power generation
stuff. So for me,
Smart Grid its next big
thing in Ikea's security
because many people buying
some devices install it
at home connected to internet to
control power, to understand
how many energy were generated,
and these
create additional vulnerabilities
in such devices.
Finally, things related to protocol
you can see on this slide with only
two per cent of
the all exposed
devices was fingerprinted
by using industrial protocol like
a seven mode bus olara
ninety eight person,
a person eats 8TB,
SMTP and all other stuff which
most needed by Ikea's
devices to
work too.
I don't know to what
to do things, which was
so they're there just for
communicating with operators, for
monitoring, for like management,
configuration and so on.
But they're they're just there
for us to make this stat..
Yeah.
Think of lab from
industrial protocol.
Point of view of most common protocol is
a seven and mode bus, but
this only because we
have tools to fingerprint this protocol.
And maybe this statistic
will change next
time because we will create
additional toolkit.
So our first special
release for Congress.
It's a list of
dogs and fingerprints
you can use to find
Ikea's devices in your network
or in or in
internet.
Please enjoy responsibly
why it's important.
You know, we for
finding devices in the internet, not
just for Putin in
Excel and to visit Congress.
We are working with different
sorts of
international agency like impact
of ENISA to
remove these devices from
internet.
So I think if you will launch
that map next time to find one
or two, I don't know.
Power grid, device and internet, you will
behave in a similar way.
And maybe we have our jerks, they will do
it by themselves next time.
But you know, all these statistics, it's
only part of the full
picture because very
often during security assessment,
you can find
a remote desktop.
Or Arab men on the perimeter.
And of I see us network.
And if you will guess password one
two three four five you will find
with this
device, which you can connect with
via a remote management protocol.
It's engineering station,
which was exposed to internet
by operator to
simplify his day by
day work.
This very common situation,
but things can be
more interesting.
For instance, during the assessment of
transportation system, we
found that
one genius during
deployment of
train entertainment system
plug
broadband internet from train
to internet access from
the train to the same
switch, which
connected to computer based interlocking
system and process or
always transportation stuff,
you know, signaling and so on.
So if you connect something
to internet, when internet can
connect to you?
So what about industrial protocols?
There are a lot of different information
about this, and we have a lot of
dedicated talks about industrial
protocols by Scott Strangelove.
In short, there are a lot
of them.
Some of them are easy.
Some of them are more complex,
like not only manipulating some
tax on policies and changing the state,
for example, of some turbine,
they also can reconfigure devices.
They also can refresh the devices
and so on. And most of the stuff nowadays
you can find on the internet like things
for fingerprints and black things, or
even even the libraries to communicate
with the different devices.
Wireless protocols, but
not everything is is research nowadays.
Like, for example, anyway is fault
tolerant as a protocol.
It's not even detected by Wireshark,
and it's a lot of
similarities we've broken at GCP
protocol in terms of broadcasting
requests in the subnet and given all
the components to
start the communication between them.
And this is just
a work in progress, and
we hope that's soon
Alexander more and will share with us
what assuring the sector.
So here comes the first
special release for this anniversary to
free its
brute force of semen spiels sees
as free as
a model for Hydra.
We will run at them on.
We can keep introduction.
I think everybody here can use a map.
To find devices on
a 100 on Portal
102, it's.
Seven protocol
after you can use, for instance,
abuse is come to
its open source tool, you can easily
contributed.
To check
this sport against seven fingerprints.
Yep. Here is the list
of the devices and one of device
written.
It's got the capability and we can
see what this is a seven
three handed you'll see.
So after you
can use
new hydro
thing to one Houser who built
it.
To.
Fine to check this device
against the most common.
Passwords.
They also got it during our penetration
test.
And here is a magic, it's worth
it should work for sure, it's video
assistance.
So
here it is.
And once again, thank you for
one thousand the hikers chased him.
So again,
about last year, last year, we
talked a lot about different
vulnerabilities, and we
had no ability to disclose a lot of
details.
But this year
we can try to
put some some things about
these vulnerabilities and
at.
Talking about them, we will try to build
some attack vector on
Simmons to see installation.
Let's just assume we're somehow
I have an access
to the subnets with Simmons
to see my pills cease and shared
a server and
here it goes. Where and off to rest
and.
Well, first of all, in their ability,
it's actually it's actually
very bad because it's very easy
to use.
It gives you a lot of
privileges and there are
too many devices facing the internet
right now.
Well, we will just not talk about
it, but
we will give a small challenge.
First one who will guess the protocol,
who will get a free T-shirt out of free
beer after this talk
or that during tomorrow's workshop?
So we are
waiting.
OK, here is the guy.
OK, I will.
So we we did not
get told and told you anything
about this vulnerability.
But now when we have
a remote A.C.
gates, it's access to the database.
OK, what?
What next should we do?
Are we to
develop our attack vector?
We should think about post exploitation
just about once we can
get on the compromised cost.
And there
is a next vulnerability.
Next vulnerability is about the
encryption of passwords.
Scale up. Scan the user's passwords in
the project database.
This decryption model is
in the in our Metasploit model
that can harvest a lot of different
valuable information from this database.
And the last year,
we actually wasn't that responsible
because we didn't told
a lot about this
decryption, about this encryption.
But actually, as it was on the
slide, it just if
you make an exclusive
or of ciphertext plus user
plus this encryption key,
then you will get the passwords in
clear text.
Well,
yeah, that's it.
Actually, most of the last
system they like follows the
trend of using saw and
exclusive for and it comes in many faces
like they're trying to rotate
something to use like
some tables as a key,
which is more like most serious
encryption, but
still bets.
And actually, what
else what
what are the things that we saw in icier
systems this year is a
real, simple substitution
encryption.
So guys were storing
passwords like we have a simple
table of substitution of
chars.
But on the other hand,
not everybody is that bets and
sometimes like Simon still
portal. We see this thinks
this is the project file, and
this is like
a very good hashing of
skin, a user password.
It's not even MD5.
And we were like, What the hell?
What we are going to do?
But next thing is that they roll
down their password length
and this and this the same file,
which simplifies the cracking
process a lot, actually.
Actually, there are two
hints.
The next hint is
is some structure that
represents the password itself
itself, but somehow hidden by
by by eBay unique bytes.
Yeah, it seems like it was here,
but now it's overwritten.
So and now we're
on the scatter server, and
we are not, for example, we are not
a privileged user.
We're like an operator that
can control some things
like he can monitor processes so
maybe he can react in some
situations, but he has no
complete access to the process.
So what should we do?
We should analyze the windows
to see architecture itself.
So if we look a little deeper,
then much deeper.
OK, so
we can see that there is a core
service on this kind of server
that that is working with
several internal Vince's protocols like
CLB, Alisher says, and
so on.
And what's this protocol
course service does?
She's working with components, so this
service is managing
the communications between different
components and components alike.
It's from IPL policy and so on.
So and
this components, they should call
some function from the service
to register itself, and
this is the function they need to call.
And the first argument is very
interesting. It's called components
goods.
So right now, to access
any components from unprivileged user,
we should somehow control this
component goods and what?
See if we can send it in our
user package.
Yes.
Well, sending it to our user packets.
And now, like,
I don't know how operator will do it,
but somehow, if
have some skills can manage to craft
the special packets of special payload
to control pulses from
very low profile accounts on
the set of.
Next, vulnerability now
was presented by two more
units of legacy of Black
Hat.
It's a exosphere
out of battle, a very straight forward
vulnerability, so you can
send to better example
file, which will trigger
a server to request
additional look among file, which
gives you a process about server.
And after this server
will
send in some information
from file system by
HTTP or SMB
or other protocol
you can manipulate with it.
This is very interesting one
vulnerability because a lot of guys
have a vulnerability.
Even Trustwave for more security
have this issue.
You know, in
a ruse to protect you against
zero day exploit.
But when we start to check
this vulnerability against ISIS's
environment, we
start to thinking how we can
apply this vulnerability to ISIS.
And one of the target, of course,
project.
You know what is a project in this case?
It's a
type of development project.
So you have a program, you have
additional configuration and typically
configuration storage in X amount
files.
So we decided to research can project
be trusted and
can project can be
used to spread malware
like a dope file
use at that moment.
Unfortunately, Project
cannot be trusted because most
of the ICAC system don't
have built-in integrity control
features. So if somebody
can modify
project vs Project
View, use it on different
scale the system and can
be used to execute, for instance,
any code and to patch system.
So how it can be abused
when it's it's very trivial
task.
You can simply patch even
handlers. For instance, if you have even
handlers on mouse, click
on your ICSA
project when somebody's clicking
on the button. I don't know how to launch
a rocket.
You can
watch it and add
something like create, text, file and
write your memoir here.
Of course, you should convert it to ask
him, but this is not a challenge.
But, you know, sometimes we have
a question, of course.
But you know, and there keep
require to have
anti-virus on the Scotland network,
so you should
make your malware invisible
for antivirus.
It was a joke.
But the
oh here is typical
setup of
antivirus in Scotland at work.
As you can see,
where there's exceptions
and exceptions
include all scarred the stuff
sky, the installation of Sky,
Project Path and so on.
And, you know, this scarred
the system never seemed compliant.
Why?
Because this is
when the requirement.
So if you work
against if you want to
hack, I don't know.
I see a system sometimes is very useful
to read documentation.
So now we will talk about
vulnerabilities again.
Now you can see on the slides.
This is the statistics of
vulnerabilities by a scholar, Strangelove
by all this people you saw on the second
slide.
And now
we have like more than
one hundred and fifty different
vulnerabilities.
And if
we see this, we see
by type.
You can see that most of them are
easy to use and easy to find cross-site
scripting attacks by.
But next is a remote code
execution.
And that's not your Windows server
like from from this year.
This is old hardware and
software, and this software
does not have a.
Most of the time, most of the
time it does not have that.
The execution prevention.
So exploitation is very, very
easy.
And you don't
see from this diagram the
whole picture like this
called choices that were made by
different vendors, like
how cool it would be to write your own
server. And this of the statistics
of appreciation to be server
and maybe to write your
own DNS server.
Also, this is the statistics for, I say,
has been, well, these vulnerabilities.
Well, I don't know.
This software can be fixed because
they will have again vulnerabilities for
20 years.
They're only the only fix
is actually to use some
existing software.
And I think actually it
would be easier.
So why the fixing
is it's so hard process
also, because
as you see, this is Vince's
C HMRC
software and this is the dates when
different libraries and code was
compiled.
Actually, most of the code was compiled
before the Stuxnet.
So we can see like
how, how, how small
part of things have changed.
So how cold this bugs are found
here is muffin, you just
take some solution, you just drip
it on components like it.
You might be able to see sketches of
several juicy server and so on.
You understand how they communicate,
how they process data, how they store
data.
Then you find a number
of entry points and try to analyze
it with a black box of gray box.
Reverse engineering, so on and so on.
What?
Well, let's assume, for example,
you see well,
when you found like entry points,
you see something like this.
And most of the time when they found
different vulnerabilities, we see these
things, all these things, I bet
they are not actually read your
vulnerabilities you can exploit.
But this is like a small signs
that you can somehow control the memory
of the code and so on and so on.
And this is not
the picture from the real world because
the data like receiving
and data processing, they're usually
in different libraries, in different
objects and so on structures.
So looking at this picture,
we thought that we built a small
challenge called friends
modeling abilities with simple
rogue access.
And what we did with the compiled
one of a binary and
gripped it for rest coal.
And we saw something like this.
And then we gripped the same function
for the users of this
or this variable.
Of course, you can see
that we can see the cold picture like
one of the builds in the sea of geo
geology.
So the assignments we can see,
like other variables, we can see
the goals nearby.
But but we can see this.
Well, as I said,
this wasn't going to
work in the real world
until we actually
took one solution the compiled to
the call code libraries
and so on, and then
work well. We wrote a
script like 50
50 lines
like not not not only to grab
just on the lines, all the data.
And this is one of the example.
So there are a lot of
output like this that
was and surely
these things should be
reviewed by fans and so on.
But the results
verified results were amazing.
We found seven remote code execution
executions and four doses
with this cheap script,
not like all those
pricey static analyzers.
Imagine what Leanne Lynskey can
do with this.
So who is
this?
We don't know yet.
Maybe next year.
Well,
let's think about the way
these things can actually
happen, because that's that's
that's very much.
And maybe the programmers,
they don't know about security a lot,
but this is the piece of code
in between those risks.
The they're checking the buffer for some
limits and they're printing the string.
That's OK.
Here is the buffer overflow.
But next thing they do is they
allocate the memory and copy the buffer.
And though sometimes internet is a very
dangerous place.
And one day during the Twitter
conversation, we understood that all
things we're doing does
not exist.
Because there are no penetration
testing in, say, this environment.
And so
was very bad.
So we decided to share with
you, mine secret of Ikea's security
when you go in to
make.
I see a spin test.
Please remember
for ITP Test, your goal
is to break stuff for
I see a spin. Test your goal
not to break stuff.
Or you will be fired.
So life at your
home, your favorite zero
to keep your Kali Linux
and take
your camera.
Because in most cases, assessment,
we call with paparazzi style assessment
of you.
And sometimes you even don't touch
keyboard. You ask an operator
to provide information
for you. So you say, OK, guys, let's
let's open registry editor.
Let's find these like these line and so
on.
Especially for production environment.
So how to work in this
situation?
Most important thing is to have
a job.
If you don't have a lab,
you have you believe
you free your system in real environment
and this will be, you
know, be dangerous.
So
the brain part
of the lab here and tomorrow,
we will have a small workshop,
if you will join.
We will be happier.
And the police sorry
for this promotion, but
if you will join us, please bring in
some network devices like virus
access point and switches, because
we don't have it here in Germany
too much.
And if one
thing about this is
sometimes when you are doing assessments
with a good cold, it's simple for us.
Style, though show showing
actually operators, for example, how to
escape kiosk mode on their
eyes so they can access file system,
they can access and so
on. And actually,
almost all customers have
their own laboratories.
So when your unless
you are doing for the first
party, are doing a TPM test and then the
scheduling expand test
in the lab.
And then with this paparazzi style,
you can connect all this results
and it's not always celebratory
because things are changing all the time.
And for example,
some parts of this data is just
in the process of integrating with the
call. For example, plans some
parts of the system, like the turbine is
broken and it's on repair.
And sometimes it's, you know, somewhere
and some thermal power plants, you
don't need so much energy and some parts
are turned off. So it's all about
proper methodology and time
and project management.
Sometimes it's
so important.
Part of
I see is security.
It's fixing stuff not to break and
stuff about fixing stuff, and
we want to share our experience.
Here's a typical fix
in timeline in
2010 11.
Somebody put in block
information about zero days
in Scott
the system and in
two thousand
thirteen, it's still
actual information.
So vulnerabilities was
not. Fix it and now
available for sale.
I think
one more example of our
experience
we trying to reach one
big shop and the vendor
of Scott, the system to fix
vulnerability.
We spend a lot of time if you out any
response we call in to the phone, send an
email. No answer.
But thanks for.
As for conference, we met
guys from Japan society and ask them to
help us.
Say, OK, connection is established.
Please send information about
vulnerability vitiate
and starting
to wait.
And the one day guys from Japan third
say, Guys, everything is
fine.
Customer list completed.
We'll discuss them. Releases why it's so
important.
It's important because guys from
this vendor decide not
to publish information
about weeks, but silently
patch it without any notification.
You know, last time I saw it in
it evoked in the beginning of the
century, but in this first
vote is still come on.
We will silently patch this
vulnerability without any notification.
Its moment we still don't know.
Is it budget honored
and postscript
on?
Last year, we have a question
about Scotland, the.
So even more bras go to
the cloud and the
positive crowd, you can easily find
it in the internet if
you need it sometimes feels
more difficult.
For instance, a car that
is a crowd can mean a
deep connection to a Utah machine
when you can monitor
your system.
We try to check it how it swarms
and find.
I guess for you.
Yes, I guess.
Or maybe oil.
I think everybody should have his
own gas will.
But the problem with
its glyphosate,
we've kiosk mode.
But you can escape from the kiosk
and connect to
guests view of our guy.
So I don't know how to manage it.
So scarred the insect out is maybe
a good thing, but
still it's have a lot of
vulnerabilities.
And of course, funny stuff.
We fix him when we say,
Guys, you have a problem with your
cloud installation.
Somebody can escape kiosk mode and
do bad things.
We'll say, OK, yes,
he can, but just don't do
it in your environment.
We view not.
But somebody who knows.
Also, this is his writing that this is
a virtual machine, but their internal
network interface with local IP addresses
and so on. So we can develop and attack
model?
Not. No.
So thank you and questions,
please.
So, yes, for the questions, I would like
to ask you to keep your questions
short to actually ask questions if
you'd like to comment on something
sentiment email.
She'd like to give them advice.
Set them on email tubes and questions
can come now. Signal Angel.
Do we have questions from the internet?
Yes, we have one question.
Have you seen?
Have you seen anything like a proxy
or translator between IEC
101 and 104
open on the internet?
Because that would be
in the legacy systems.
Please repeat the question and hold your
mic steady at your mouth.
Have you seen anything like a proxy
or translator between
IEC 101 and
104 open to the internet?
Like?
I see it.
Like this, like
here is IEC one 04.
We actually don't have any
complete information about
what's behind this, so we're just
fingerprinting these things.
We can't differentiate
sphinx like it's peroxides gateway.
It's actually RTU or so on.
Thank you.
Microphone one, please ask the question
how much of the stuff
is which is visible on the internet,
is some testing research
or a honeypot stuff and how much
of it is actual?
I see some wrinkles with some of the
Google Docs.
There was stuff that just didn't look
right. So can
you estimate how much of them are
just honeypots or research networks and
how many of them are real stuff
where we will be really thankful
for the feedback about the dorks?
But we like this
like an open project, we can
differentiate, as I said, about
the things that's behind those IP
addresses and debate behind the banner.
So if you somehow managed to understand
this and tell us that this is a false
positive, we will delete this
dark delete this IP address and so
on.
No, no. The docs are OK.
It's just it looks weird.
The stuff looks weird sometimes.
Yeah, for sure. But hey,
you know, I am not sure.
But at
the moment, very a lot of I can
import maybe one thousand.
But for these numbers,
it's a very small,
very little percent of false positives.
OK, thanks.
Thank you. Thank you.
Microphone number two, please ask the
question. Hello.
I would like to know the systems
you see on the internet. It's just like
monitoring stuff.
What can you do, for instance, control
atomic reactors?
Can you shed some light on that, how deep
the control goes that you can achieve
over these things?
Do you think we should put an honest
answer to that life on stage here or what
you like to ask that question again in
private later on?
Yeah, actually it would be better
if thank you then.
Are there any more questions?
Signal, Angel, do we have any more
questions from the internet?
They don't want to know anything.
So thank you for being
here. Thank you. So guys, thank you for
that astonishing great talk.