Tuesday 12 March 2013

BlackHat EU this week

I am looking forward to speaking at BlackHat EU again on Thursday of this week as I will be talking on the subject of "Hacking Appliances: Ironic exploits in security products" which is an area of research I have particularly enjoyed.

http://www.blackhat.com/eu-13/schedule/briefings-14.html

In short, I will be discussing some of the vulnerabilities I have escalated to various vendors of popular Security Appliances during 2012, and demonstrating how these vulnerabilities could be exploited in realistic scenarios.

 
There will be some root shell, for those of us who like that sort of thing, but I think the most interesting aspect is that most of the vulnerabilities were typical OWASP Top 10 type issues, or other fairly basic misconfigurations, which could be found and exploited in a few days using typical attack techniques.

People outside the Pentesting community find it surprising when I tell them that most popular Security Appliances I have looked at had fairly basic and rather easy to find vulnerabilities. Most of the products I looked at were popular and widely deployed, so the concerning thing is that companies using these products (and the vendors who produce them) were unaware that these products suffered from such issues.

In regard to the irony; I have certainly seen some ironic issues over the past 18 months, for example issues like:
• A URL filter which could be fully compromised with a malicious URL
• Email filtering products which could be fully compromised with malicious emails
• A single-sign-on system where all the credentials could be extracted in an unauthenticated way
• A firewall that could be fully compromised from the outside due to authentication-bypass
• A secure remote access gateway which could give unauthenticated external attackers free and easy access to the internal network

I showed some of these issues last year, I will be showing a few more during my talk on Thursday.
(by "fully compromised" I generally mean a root shell on the underlying operating system)


27 comments:

  1. Replies
    1. Hey Guys !

      USA Fresh & Verified SSN Leads with DL Number AVAILABLE with 99.9% connectivity
      All Leads have genuine & valid information

      **HEADERS IN LEADS**
      First Name | Last Name | SSN | Dob | DL Number | Address | City | State | Zip | Phone Number | Account Number | Bank Name | Employee Details | IP Address

      *Price for SSN lead $2
      *You can ask for sample before any deal
      *If anyone buy in bulk, we can negotiate
      *Sampling is just for serious buyers

      ==>ACTIVE, FRESH CC & CVV FULLZ AVAILABLE<==
      ->$5 PER EACH

      ->Hope for the long term deal
      ->Interested buyers will be welcome

      **Contact 24/7**
      Whatsapp > +923172721122
      Email > leads.sellers1212@gmail.com
      Telegram > @leadsupplier
      ICQ > 752822040

      Delete
    2. QUALITY SSN DOB DL HIGH CREDIT SCORES Leads
      CC with CVV Fullz (USA, UK, CANADA)
      Tutorials & E-Books For Ethical Hacking
      Tools For Everything You Need

      I'm On Telegram = @killhacks & I C Q = 752822040

      Stuff available for
      (Spamming, Carding, Ethical Hacking, LINUX, Programming, Scripting, etc. )

      Deals in all kind of Tools, Tutorials, E-books, Leads/Fullz/Pros
      Availability 24/7
      FASTEST DELIVERY

      Build Your Own Business with proper guide & Legit Tools
      Always glad to serve

      GOOD LUCK
      Here I'm:
      I C Q = 752822040
      Tele-gram = @killhacks

      Delete
  2. Do you need a loan at 3% to pay your bills or start up a business of your own? If yes ,contact US with this following details... GLOBAL SOLUTION FINANCE COMPANY
    globalsulutionfinance89@gmail.com

    (1)Full Name
    (2)Loan Amount Needed
    (3)Duration
    (4)Country
    (5)Phone numbers
    Email Us: globalsulutionfinance89@gmail.com
    Tell : +919205335862
    Website: https://gsfcloan.com/
    Best Regards,

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Coaxial Cable Manufacturer And Supplier

    Mandeep Cables Pvt. Ltd. highly flexible coaxial cables consist of various features, including rust-resistance and extended utility that collectively makes our products of impeccable quality and suitable for industrial usages, such as telecom and radio etc. Call Us +91 9560718414.

    ReplyDelete
  5. DO YOU NEED FINANCIAL HELP? $5000 to $20,000,000.00 No credit check

    Repaid over 1 year to maximum of 30 years at a low interest rate of 3%.

    Approval in 15-30 minutes Open 7 days a week from 24/7 Service available

    nationwide Whatsapp:+919205335862 E-MAIL

    globalsulutionfinance89@gmail.com Tell : +919205335862

    ReplyDelete
  6. Do you need Finance?
    Are you looking for Finance?
    Are you looking for a money to enlarge your business?
    We help individuals and companies to obtain loan for business
    expanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

    ReplyDelete
  7. Do you need Finance?
    Are you looking for Finance?
    Are you looking for a money to enlarge your business?
    We help individuals and companies to obtain loan for business
    expanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

    ReplyDelete
  8. Attention,
    Dear Sir/Madam,
    I am a registered private money lender Apply for a quick and convenient
    loan to pay off bills and to start a
    new financing your projects at a cheapest interest rate of 3%. Do
    contact us today with loan amount
    needed as our minimum loan offer is 1,000.00 to
    any choice of loan amount.I am
    certified ,registered and legit lender.You can
    contact me today if you are interested in getting
    this loan, contact me for more information about
    the loan process, process like the loan terms and
    conditions and how the loan will be transferred to
    you. I need your urgent response if you are
    interested.fasterloanservice@gmail.com
    Website.http://k7leai867.ulcraft.com/
    Whats app
    +919971369537

    ReplyDelete
  9. Good articles, Have you heard of LFDS (Le_Meridian Funding Service, Email: lfdsloans@outlook.com --WhatsApp Contact:+1-9893943740--lfdsloans@lemeridianfds.com) is as USA/UK funding service they grant me loan of $95,000.00 to launch my business and I have been paying them annually for two years now and I still have 2 years left although I enjoy working with them because they are genuine Loan lender who can give you any kind of loan.

    ReplyDelete
  10. J'ai découvert une prêteuse particulière qui m'a fais ce prêt de 56.000 €.
    si vous aviez besoin d'un prêt veuillez la contacter.
    E-mail: samyaguenfoudi.fr@gmail.com



    Bonjour moi on m'appelle ROUSIE David Antonin je vie en Lacuisine
    en Belgique âgée de 49 ans, J'exerce comme fonction: Déléguée Médicale je suis tomber sur un Raphaël APELBAUM qui voulait me octroyer un prêt mais il me demande des frais je lii et répondu non il ma dit qui prenne les frais de charge il me demandez de payer 782 euros .
    Je vous propose de lire ou de devinez ce qui se passe dans ma tête quand je vois ses frais .
    surtout en ce période de confinement ou c'est la galère au niveau pécune ????
    Je suis à la retraite et j'ai une pension de 1006euros , faite le calcul et dites moi combien il va me rester si je lui donne 792 euros , j'ai une femme ,un loyer , une voiture des frais mensuels
    Pouvez -vous vivre avec 214 euros ,parce que je pense que ce ne sont pas les seuls frais ,il y en aura après .
    j'ai doute et surtout quand j'ai recu un appel d'une personne avec un fort accent africain me demandant de faire tous de suite le mandat.
    Je ne vais relever toutes les inepties de ce message, les innombrables fautes d'orthographe qu'un médecin, même à la retraite, ne ferait pas, et toutes les incohérences qui prouvent que l'on est en présence d'une arnaque.
    Inutile de dire aussi que l'adresse semble fausse, et les recherches pour trouver cette personne ont été vaines.
    Le principe de l'arnaque est simple : mener la victime jusqu'à l'accord de l'obtention de son prêt, et lui demander de payer des frais de déblocage qu'elle devra envoyer au Bénin par Western Union, car la charmante dame à la retraite est partie entre temps en vacances en Afrique...
    Souhaitons que ces informations évitent à certains de se faire arnaquer par cet escroc

    le jeudi passé ma belle soeur m'appel qu'elle a reçu un prêt chez une Prêteuse qu'elle voulait acheter une terrain donc elle a reçu son prêt et elle m'a proposé Madame Samya GUENFOUDI une prêteurs particulier.
    C'est ainsi que son mail : samyaguenfoudi.fr@gmail.com
    J'ai décidé d'aller vers lui j'ai pris note du mail dans la soiré j'ai fait ma demande je lui est exposée mon cas j'ai confiance en elle parce que tant que ma belle soeur a reçu son prêt moi aussi j'aurais mon prêt.

    Et évidemment j'ai reçu mon prêt.

    C’est avec Mme Samya GUENFOUDI que la vie nous sourit à nouveau ma femme adorée et moi ,c’est une dame de cœur simple et fiable ,je vous en prie de prendre contact avec Mme Samya GUENFOUDI a son adresse mail qui est : samyaguenfoudi.fr@gmail.com

    Grâce a ma belle soeur , aujourd'hui j'ai reçu mon prêt.

    MERCI Merci ma belle soeur.

    ReplyDelete
  11. My name is Mrs. ivy. I live in singapore
    and i am a happy woman today? and i
    told my self that any lender that rescue my
    family from our poor situation, i will refer
    any person that is looking for loan to him,
    he gave me happiness to me and my family, i
    was in need of a loan of $250,000.00 to
    start my life all over as i am a single
    mother with 3 kids I met this honest and GOD
    fearing man loan lender that help me with a
    loan of $250,000.00 U.S. Dollar, he is a GOD
    fearing man, if you are in need of loan and
    you will pay back the loan please contact
    him tell him that is Mrs. ivy Roland that
    refer you to him. contact MrFrank Rogers
    via clemalphafinance@gmail.com
    Whats app +91-9818603391

    ReplyDelete
  12. Hey Guys !

    USA Fresh & Verified SSN Leads with DL Number AVAILABLE with 99.9% connectivity
    All Leads have genuine & valid information

    **HEADERS IN LEADS**
    First Name | Last Name | SSN | Dob | DL Number | Address | City | State | Zip | Phone Number | Account Number | Bank Name | Employee Details | IP Address

    *Price for SSN lead $2
    *You can ask for sample before any deal
    *If anyone buy in bulk, we can negotiate
    *Sampling is just for serious buyers

    ==>ACTIVE, FRESH CC & CVV FULLZ AVAILABLE<==
    ->$5 PER EACH

    ->Hope for the long term deal
    ->Interested buyers will be welcome

    **Contact 24/7**
    Whatsapp > +923172721122
    Email > leads.sellers1212@gmail.com
    Telegram > @leadsupplier
    ICQ > 752822040

    ReplyDelete
  13. Thanks for sharing...
    Leanpitch provides online training in Scrum Master during this lockdown period everyone can use it wisely.
    Scrum Values

    ReplyDelete
  14. Hello Everyone !

    USA SSN Leads/Fullz available, along with Driving License/ID Number with good connectivity.

    All SSN's are Tested & Verified.

    **DETAILS IN LEADS/FULLZ**

    ->FULL NAME
    ->SSN
    ->DATE OF BIRTH
    ->DRIVING LICENSE NUMBER
    ->ADDRESS WITH ZIP
    ->PHONE NUMBER, EMAIL
    ->EMPLOYEE DETAILS

    *Price for SSN lead $2
    *You can ask for sample before any deal
    *If you buy in bulk, will give you discount
    *Sampling is just for serious buyers

    ->Hope for the long term business
    ->You can buy for your specific states too

    **Contact 24/7**

    Whatsapp > +923172721122

    Email > leads.sellers1212@gmail.com

    Telegram > @leadsupplier

    ICQ > 752822040

    ReplyDelete
  15. Hi Guy's

    Fresh & valid spammed USA SSN+Dob Leads with DL available in bulk.

    >>1$ each SSN+DOB
    >>2$ each with SSN+DOB+DL
    >>5$ each for premium (also included relative info)

    Prices are negotiable in bulk order
    Serious buyer contact me no time wasters please
    Bulk order will be preferable

    CONTACT
    Telegram > @leadsupplier
    ICQ > 752822040
    Email > leads.sellers1212@gmail.com

    OTHER STUFF YOU CAN GET

    SSN+DOB Fullz
    CC's with CVV's (vbv & non-vbv)
    USA Photo ID'S (Front & back)

    All type of tutorials available
    (Carding, spamming, hacking, scam page, Cash outs, dumps cash outs)

    SMTP Linux Root
    DUMPS with pins track 1 and 2
    Socks, rdp's, vpn's
    Server I.P's
    HQ Emails with passwords

    Looking for long term business
    For trust full vendor, feel free to contact

    CONTACT
    Telegram > @leadsupplier
    ICQ > 752822040
    Email > leads.sellers1212@gmail.com

    ReplyDelete
  16. You have done good work by publishing this article here. I found this article informative and beneficial. Also, check Republic Wireless Plans

    ReplyDelete
  17. The content of your blog is exactly what I needed, I like your blog,
    I sincerely hope that your blog a rapid increase in traffic density,
    which help promote your blog and we hope that your blog is being updated.
    wordpress
    blogspot
    youtube
    ស្លតកាស៊ីណូអនឡាញ

    ReplyDelete
  18. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon. data science certification course in chennai

    ReplyDelete
  19. QUALITY SSN DOB DL HIGH CREDIT SCORES Leads
    CC with CVV Fullz (USA, UK, CANADA)
    Tutorials & E-Books For Ethical Hacking
    Tools For Everything You Need

    I'm On Telegram = @killhacks & I C Q = 752822040

    Stuff available for
    (Spamming, Carding, Ethical Hacking, LINUX, Programming, Scripting, etc. )

    Deals in all kind of Tools, Tutorials, E-books, Leads/Fullz/Pros
    Availability 24/7
    FASTEST DELIVERY

    Build Your Own Business with proper guide & Legit Tools
    Always glad to serve

    GOOD LUCK
    Here I'm:
    I C Q = 752822040
    Tele-gram = @killhacks

    ReplyDelete
  20. very informative and impressive article. Thanks for sharing with us
    cyfuture cloud

    ReplyDelete