Athcon 2013

I am just on my way back from presenting at Athcon 2013 – the premier IT Security conference in Greece.

http://www.athcon.org/

It was my first time at Athcon, but I have to say that I was impressed. The organisers did a great job with the venue and facilities, and choosing speakers which had a great mix of content and technical depth.

I presented my research on “Hacking Security Appliances” (which I have previously presented at BlackHat Europe, and Dublin Source earlier this year). That’s probably my last time presenting that particular material, as I want to keep things fresh and I'm currently working on various ideas I have for interesting new research.

For reference my base slides and white-paper for the material are here:
https://media.blackhat.com/eu-13/briefings/B_Williams/bh-eu-13-hacking-appliances-bwilliams-wp.pdf
https://media.blackhat.com/eu-13/briefings/B_Williams/bh-eu-13-hacking-appliances-bwilliams-slides.pdf

I saw good solid presentations from other speakers including the following:

Max Sobell - Security of NFC wallets
Michele Orru - Using BeEf for custom shellcode and inter-protocol attacks
Jurriaan Bremer - Automated de-obfuscation of android apps and malware
Kostas Papapanagiotou - History of OWASP Top 10

(and also had a good meal out in Athens last night, with some of the other speakers, which was great fun)

Athcon also had a “capture the flag” (CTF) competition hosted by Symantec (unfortunately I didn't get time to take part, but is seemed to be very popular).

All in all a great conference that I would like to attend (and speak there) again.

BlackHat EU this week

I am looking forward to speaking at BlackHat EU again on Thursday of this week as I will be talking on the subject of "Hacking Appliances: Ironic exploits in security products" which is an area of research I have particularly enjoyed.

http://www.blackhat.com/eu-13/schedule/briefings-14.html

In short, I will be discussing some of the vulnerabilities I have escalated to various vendors of popular Security Appliances during 2012, and demonstrating how these vulnerabilities could be exploited in realistic scenarios.

 

There will be some root shell, for those of us who like that sort of thing, but I think the most interesting aspect is that most of the vulnerabilities were typical OWASP Top 10 type issues, or other fairly basic misconfigurations, which could be found and exploited in a few days using typical attack techniques.

People outside the Pentesting community find it surprising when I tell them that most popular Security Appliances I have looked at had fairly basic and rather easy to find vulnerabilities. Most of the products I looked at were popular and widely deployed, so the concerning thing is that companies using these products (and the vendors who produce them) were unaware that these products suffered from such issues.

In regard to the irony; I have certainly seen some ironic issues over the past 18 months, for example issues like:
• A URL filter which could be fully compromised with a malicious URL
• Email filtering products which could be fully compromised with malicious emails
• A single-sign-on system where all the credentials could be extracted in an unauthenticated way
• A firewall that could be fully compromised from the outside due to authentication-bypass
• A secure remote access gateway which could give unauthenticated external attackers free and easy access to the internal network

I showed some of these issues last year, I will be showing a few more during my talk on Thursday.
(by "fully compromised" I generally mean a root shell on the underlying operating system)