Tuesday, 12 March 2013

BlackHat EU this week

I am looking forward to speaking at BlackHat EU again on Thursday of this week as I will be talking on the subject of "Hacking Appliances: Ironic exploits in security products" which is an area of research I have particularly enjoyed.

http://www.blackhat.com/eu-13/schedule/briefings-14.html

In short, I will be discussing some of the vulnerabilities I have escalated to various vendors of popular Security Appliances during 2012, and demonstrating how these vulnerabilities could be exploited in realistic scenarios.

 
There will be some root shell, for those of us who like that sort of thing, but I think the most interesting aspect is that most of the vulnerabilities were typical OWASP Top 10 type issues, or other fairly basic misconfigurations, which could be found and exploited in a few days using typical attack techniques.

People outside the Pentesting community find it surprising when I tell them that most popular Security Appliances I have looked at had fairly basic and rather easy to find vulnerabilities. Most of the products I looked at were popular and widely deployed, so the concerning thing is that companies using these products (and the vendors who produce them) were unaware that these products suffered from such issues.

In regard to the irony; I have certainly seen some ironic issues over the past 18 months, for example issues like:
• A URL filter which could be fully compromised with a malicious URL
• Email filtering products which could be fully compromised with malicious emails
• A single-sign-on system where all the credentials could be extracted in an unauthenticated way
• A firewall that could be fully compromised from the outside due to authentication-bypass
• A secure remote access gateway which could give unauthenticated external attackers free and easy access to the internal network

I showed some of these issues last year, I will be showing a few more during my talk on Thursday.
(by "fully compromised" I generally mean a root shell on the underlying operating system)


31 comments:

  1. Replies
    1. Hey Guys !

      USA Fresh & Verified SSN Leads with DL Number AVAILABLE with 99.9% connectivity
      All Leads have genuine & valid information

      **HEADERS IN LEADS**
      First Name | Last Name | SSN | Dob | DL Number | Address | City | State | Zip | Phone Number | Account Number | Bank Name | Employee Details | IP Address

      *Price for SSN lead $2
      *You can ask for sample before any deal
      *If anyone buy in bulk, we can negotiate
      *Sampling is just for serious buyers

      ==>ACTIVE, FRESH CC & CVV FULLZ AVAILABLE<==
      ->$5 PER EACH

      ->Hope for the long term deal
      ->Interested buyers will be welcome

      **Contact 24/7**
      Whatsapp > +923172721122
      Email > leads.sellers1212@gmail.com
      Telegram > @leadsupplier
      ICQ > 752822040

      Delete
    2. QUALITY SSN DOB DL HIGH CREDIT SCORES Leads
      CC with CVV Fullz (USA, UK, CANADA)
      Tutorials & E-Books For Ethical Hacking
      Tools For Everything You Need

      I'm On Telegram = @killhacks & I C Q = 752822040

      Stuff available for
      (Spamming, Carding, Ethical Hacking, LINUX, Programming, Scripting, etc. )

      Deals in all kind of Tools, Tutorials, E-books, Leads/Fullz/Pros
      Availability 24/7
      FASTEST DELIVERY

      Build Your Own Business with proper guide & Legit Tools
      Always glad to serve

      GOOD LUCK
      Here I'm:
      I C Q = 752822040
      Tele-gram = @killhacks

      Delete
    3. Hi Guy's

      I'm selling fresh & Updated fullz pros of many countries
      Mainly USA UK Canada Bulk Info Available

      You can get samples for testing as well for bulk orders only
      All info will be valid & provided with guarantee
      Used, Invalid, Bad, Wrong & Unmatched fullz will be replace immediately

      Real Docs DL Front Back with selfie also available in bulk
      No sampling for id's, just provide you video proof or hidden info for proof

      Payment only in crypto accepted
      Stuff available in huge quantity

      SSN DOB DL ADDRESS EMPLOYEE & BANK INFO USA FULLZ
      SIN DOB ADDRESS MMN PHONE EMAIL FULLZ CANADA
      NIN DOB ADDRESS PHONE EMAIL SORT CODE & ACCOUNT NUMBER FULLZ UK

      Here we're available

      What's App = +1.. 727... 788... 6129
      Tele Gram = @ killhacks & @ leadsupplier
      Skype = @ peeterhacks
      E mail = dghacks2 at g mail dot com

      Fullz USA SSN DOB DL & DL DOCS FRONT BACK with SELFIE
      Fullz USA High Credit Scores
      Fullz USA Business EIN Company
      Fullz USA Young & Old Age
      Fullz USA DL issue & expiry dates with SSN
      Fullz USA DL MVR

      Fullz UK NIN DOB ADDRESS
      Fullz UK NIN DOB ADDRESS SORT CODE & ACCOUNT NUMBER
      Fullz UK DL Front back with Selfie

      Fullz CANADA SIN DOB ADDRESS PHONE
      Fullz CANADA SIN DOB ADDRESS MMN EMAIL PHONE
      Fullz CANADA DL Front back with selfie

      Fullz CC with CVV USA UK CANADA
      Dummps with Pin Track 101 & 202
      Fresh Combos|IP's|Proxies
      Fresh SMTP RDP C-panels
      Fresh web-mailers

      What's App = +1.. 727... 788... 6129
      Tele Gram = @ killhacks & @ leadsupplier
      Skype = @ peeterhacks
      E mail = dghacks2 at g mail dot com

      Many other stuff we can provide you
      Contact us fast for fresh stuff & Fullz|Pros

      #USAFULLZ #USASSNDOB #USASSNDOBDL #SSNDLFULLZ #USADLDOCS #EINPROS #CCUSA #CVVUSA
      #NINUKFULLZ #UKNINDOBPROS #NINSORTCODEUK #UKPROSMMN #UKFULLZ
      #CANADAFULLZ #CANADAPROS #CANADASIN #SINDOBPROS #SINDOBMMN #CANADASINMMN

      Delete
  2. Do you need a loan at 3% to pay your bills or start up a business of your own? If yes ,contact US with this following details... GLOBAL SOLUTION FINANCE COMPANY
    globalsulutionfinance89@gmail.com

    (1)Full Name
    (2)Loan Amount Needed
    (3)Duration
    (4)Country
    (5)Phone numbers
    Email Us: globalsulutionfinance89@gmail.com
    Tell : +919205335862
    Website: https://gsfcloan.com/
    Best Regards,

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. Coaxial Cable Manufacturer And Supplier

    Mandeep Cables Pvt. Ltd. highly flexible coaxial cables consist of various features, including rust-resistance and extended utility that collectively makes our products of impeccable quality and suitable for industrial usages, such as telecom and radio etc. Call Us +91 9560718414.

    ReplyDelete
  5. DO YOU NEED FINANCIAL HELP? $5000 to $20,000,000.00 No credit check

    Repaid over 1 year to maximum of 30 years at a low interest rate of 3%.

    Approval in 15-30 minutes Open 7 days a week from 24/7 Service available

    nationwide Whatsapp:+919205335862 E-MAIL

    globalsulutionfinance89@gmail.com Tell : +919205335862

    ReplyDelete
  6. Do you need Finance?
    Are you looking for Finance?
    Are you looking for a money to enlarge your business?
    We help individuals and companies to obtain loan for business
    expanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

    ReplyDelete
  7. Do you need Finance?
    Are you looking for Finance?
    Are you looking for a money to enlarge your business?
    We help individuals and companies to obtain loan for business
    expanding and to setup a new business ranging any amount. Get a loan at affordable interest rate of 3%, Do you need this cash/loan for business and to clear your bills? Then send us an email now for more information contact us now via Email:maxcreditfinance@googlemail.com

    ReplyDelete
  8. Attention,
    Dear Sir/Madam,
    I am a registered private money lender Apply for a quick and convenient
    loan to pay off bills and to start a
    new financing your projects at a cheapest interest rate of 3%. Do
    contact us today with loan amount
    needed as our minimum loan offer is 1,000.00 to
    any choice of loan amount.I am
    certified ,registered and legit lender.You can
    contact me today if you are interested in getting
    this loan, contact me for more information about
    the loan process, process like the loan terms and
    conditions and how the loan will be transferred to
    you. I need your urgent response if you are
    interested.fasterloanservice@gmail.com
    Website.http://k7leai867.ulcraft.com/
    Whats app
    +919971369537

    ReplyDelete
  9. Good articles, Have you heard of LFDS (Le_Meridian Funding Service, Email: lfdsloans@outlook.com --WhatsApp Contact:+1-9893943740--lfdsloans@lemeridianfds.com) is as USA/UK funding service they grant me loan of $95,000.00 to launch my business and I have been paying them annually for two years now and I still have 2 years left although I enjoy working with them because they are genuine Loan lender who can give you any kind of loan.

    ReplyDelete
  10. J'ai découvert une prêteuse particulière qui m'a fais ce prêt de 56.000 €.
    si vous aviez besoin d'un prêt veuillez la contacter.
    E-mail: samyaguenfoudi.fr@gmail.com



    Bonjour moi on m'appelle ROUSIE David Antonin je vie en Lacuisine
    en Belgique âgée de 49 ans, J'exerce comme fonction: Déléguée Médicale je suis tomber sur un Raphaël APELBAUM qui voulait me octroyer un prêt mais il me demande des frais je lii et répondu non il ma dit qui prenne les frais de charge il me demandez de payer 782 euros .
    Je vous propose de lire ou de devinez ce qui se passe dans ma tête quand je vois ses frais .
    surtout en ce période de confinement ou c'est la galère au niveau pécune ????
    Je suis à la retraite et j'ai une pension de 1006euros , faite le calcul et dites moi combien il va me rester si je lui donne 792 euros , j'ai une femme ,un loyer , une voiture des frais mensuels
    Pouvez -vous vivre avec 214 euros ,parce que je pense que ce ne sont pas les seuls frais ,il y en aura après .
    j'ai doute et surtout quand j'ai recu un appel d'une personne avec un fort accent africain me demandant de faire tous de suite le mandat.
    Je ne vais relever toutes les inepties de ce message, les innombrables fautes d'orthographe qu'un médecin, même à la retraite, ne ferait pas, et toutes les incohérences qui prouvent que l'on est en présence d'une arnaque.
    Inutile de dire aussi que l'adresse semble fausse, et les recherches pour trouver cette personne ont été vaines.
    Le principe de l'arnaque est simple : mener la victime jusqu'à l'accord de l'obtention de son prêt, et lui demander de payer des frais de déblocage qu'elle devra envoyer au Bénin par Western Union, car la charmante dame à la retraite est partie entre temps en vacances en Afrique...
    Souhaitons que ces informations évitent à certains de se faire arnaquer par cet escroc

    le jeudi passé ma belle soeur m'appel qu'elle a reçu un prêt chez une Prêteuse qu'elle voulait acheter une terrain donc elle a reçu son prêt et elle m'a proposé Madame Samya GUENFOUDI une prêteurs particulier.
    C'est ainsi que son mail : samyaguenfoudi.fr@gmail.com
    J'ai décidé d'aller vers lui j'ai pris note du mail dans la soiré j'ai fait ma demande je lui est exposée mon cas j'ai confiance en elle parce que tant que ma belle soeur a reçu son prêt moi aussi j'aurais mon prêt.

    Et évidemment j'ai reçu mon prêt.

    C’est avec Mme Samya GUENFOUDI que la vie nous sourit à nouveau ma femme adorée et moi ,c’est une dame de cœur simple et fiable ,je vous en prie de prendre contact avec Mme Samya GUENFOUDI a son adresse mail qui est : samyaguenfoudi.fr@gmail.com

    Grâce a ma belle soeur , aujourd'hui j'ai reçu mon prêt.

    MERCI Merci ma belle soeur.

    ReplyDelete
  11. My name is Mrs. ivy. I live in singapore
    and i am a happy woman today? and i
    told my self that any lender that rescue my
    family from our poor situation, i will refer
    any person that is looking for loan to him,
    he gave me happiness to me and my family, i
    was in need of a loan of $250,000.00 to
    start my life all over as i am a single
    mother with 3 kids I met this honest and GOD
    fearing man loan lender that help me with a
    loan of $250,000.00 U.S. Dollar, he is a GOD
    fearing man, if you are in need of loan and
    you will pay back the loan please contact
    him tell him that is Mrs. ivy Roland that
    refer you to him. contact MrFrank Rogers
    via clemalphafinance@gmail.com
    Whats app +91-9818603391

    ReplyDelete
  12. Hey Guys !

    USA Fresh & Verified SSN Leads with DL Number AVAILABLE with 99.9% connectivity
    All Leads have genuine & valid information

    **HEADERS IN LEADS**
    First Name | Last Name | SSN | Dob | DL Number | Address | City | State | Zip | Phone Number | Account Number | Bank Name | Employee Details | IP Address

    *Price for SSN lead $2
    *You can ask for sample before any deal
    *If anyone buy in bulk, we can negotiate
    *Sampling is just for serious buyers

    ==>ACTIVE, FRESH CC & CVV FULLZ AVAILABLE<==
    ->$5 PER EACH

    ->Hope for the long term deal
    ->Interested buyers will be welcome

    **Contact 24/7**
    Whatsapp > +923172721122
    Email > leads.sellers1212@gmail.com
    Telegram > @leadsupplier
    ICQ > 752822040

    ReplyDelete
  13. Thanks for sharing...
    Leanpitch provides online training in Scrum Master during this lockdown period everyone can use it wisely.
    Scrum Values

    ReplyDelete
  14. Hello Everyone !

    USA SSN Leads/Fullz available, along with Driving License/ID Number with good connectivity.

    All SSN's are Tested & Verified.

    **DETAILS IN LEADS/FULLZ**

    ->FULL NAME
    ->SSN
    ->DATE OF BIRTH
    ->DRIVING LICENSE NUMBER
    ->ADDRESS WITH ZIP
    ->PHONE NUMBER, EMAIL
    ->EMPLOYEE DETAILS

    *Price for SSN lead $2
    *You can ask for sample before any deal
    *If you buy in bulk, will give you discount
    *Sampling is just for serious buyers

    ->Hope for the long term business
    ->You can buy for your specific states too

    **Contact 24/7**

    Whatsapp > +923172721122

    Email > leads.sellers1212@gmail.com

    Telegram > @leadsupplier

    ICQ > 752822040

    ReplyDelete
  15. Hi Guy's

    Fresh & valid spammed USA SSN+Dob Leads with DL available in bulk.

    >>1$ each SSN+DOB
    >>2$ each with SSN+DOB+DL
    >>5$ each for premium (also included relative info)

    Prices are negotiable in bulk order
    Serious buyer contact me no time wasters please
    Bulk order will be preferable

    CONTACT
    Telegram > @leadsupplier
    ICQ > 752822040
    Email > leads.sellers1212@gmail.com

    OTHER STUFF YOU CAN GET

    SSN+DOB Fullz
    CC's with CVV's (vbv & non-vbv)
    USA Photo ID'S (Front & back)

    All type of tutorials available
    (Carding, spamming, hacking, scam page, Cash outs, dumps cash outs)

    SMTP Linux Root
    DUMPS with pins track 1 and 2
    Socks, rdp's, vpn's
    Server I.P's
    HQ Emails with passwords

    Looking for long term business
    For trust full vendor, feel free to contact

    CONTACT
    Telegram > @leadsupplier
    ICQ > 752822040
    Email > leads.sellers1212@gmail.com

    ReplyDelete
  16. You have done good work by publishing this article here. I found this article informative and beneficial. Also, check Republic Wireless Plans

    ReplyDelete
  17. The content of your blog is exactly what I needed, I like your blog,
    I sincerely hope that your blog a rapid increase in traffic density,
    which help promote your blog and we hope that your blog is being updated.
    wordpress
    blogspot
    youtube
    ស្លតកាស៊ីណូអនឡាញ

    ReplyDelete
  18. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon. data science certification course in chennai

    ReplyDelete
  19. QUALITY SSN DOB DL HIGH CREDIT SCORES Leads
    CC with CVV Fullz (USA, UK, CANADA)
    Tutorials & E-Books For Ethical Hacking
    Tools For Everything You Need

    I'm On Telegram = @killhacks & I C Q = 752822040

    Stuff available for
    (Spamming, Carding, Ethical Hacking, LINUX, Programming, Scripting, etc. )

    Deals in all kind of Tools, Tutorials, E-books, Leads/Fullz/Pros
    Availability 24/7
    FASTEST DELIVERY

    Build Your Own Business with proper guide & Legit Tools
    Always glad to serve

    GOOD LUCK
    Here I'm:
    I C Q = 752822040
    Tele-gram = @killhacks

    ReplyDelete
  20. very informative and impressive article. Thanks for sharing with us
    cyfuture cloud

    ReplyDelete
  21. Genuine & Fresh Fullz Leads Pros Available
    USA UK Canada All states available
    Legit & Verified Info
    Fresh Spammed & Never sold
    Fullz with Real ID|DL photo front & back available as well

    Hit me up Here:

    Email - bigbull0334 (at) onion mail . org
    I C Q - 752822040 - (at)killhacks
    T3l3 Gr@m - (at)leadsupplier - (at)killhacks
    Skyp3 - (at)peeterhacks

    Real ID |DL Photo front back with selfie & ssn
    SSN DOB DL Address Employee & Bank info USA all states
    SIN DOB Address MMN Phone no. Canada (ON|BC|AL states)
    NIN Dob DL Address Sortcode Email Phone UK All states
    High Credit Scores Pros Fullz
    Young & Old Age info Fullz 2002 above & 1960 below
    Business EIN Company profiles Fullz
    UberEats|Doordash|Cashapp|Paypal Account opening Info with Real dl Photo
    SBA|PUA|UI|Tax Return Filling Fullz
    Bulk Quantity Available

    CC with CVV & billing Address
    Dumps with pin Track 101 & 202
    Carding Cash out Methods|Loan Applying Methods
    SMTP|RDP|C-PANELS|SHELL
    WEB_MAILERS|BULK MAIL SENDER|BULK SMS SENDER
    SMTP LINUX ROOT
    Scam Pages|Scam Page Scripting
    Spamming Full Package with guides & tutorials with tools
    Hacking Stuff available

    Just buy our stuff & Start learning & Earning online
    Work from home & Get Rich

    ReplyDelete
  22. تأتي ماكينة تعبئة سكر اصابع للفنادق والمطاعم بواجهات تحكم سهلة الاستخدام يمكن للعمال التعامل معها دون الحاجة إلى تدريب مكثف ويمكن برمجتها لتلبية احتياجات الإنتاج المختلفة بسهولة.مكنها التعامل مع أكياس بأحجام وأشكال مختلفة، مما يوفر مرونة في عمليات التعبئة.تكيف مع المواد المختلفة: مناسبة لتعبئة أنواع مختلفة من السكر سواء كان حبيبات أو مسحوق.

    ReplyDelete
  23. Hi Guy's

    I'm selling fresh & Updated fullz pros of many countries
    Mainly USA UK Canada Bulk Info Available

    You can get samples for testing as well for bulk orders only
    All info will be valid & provided with guarantee
    Used, Invalid, Bad, Wrong & Unmatched fullz will be replace immediately

    Real Docs DL Front Back with selfie also available in bulk
    No sampling for id's, just provide you video proof or hidden info for proof

    Payment only in crypto accepted
    Stuff available in huge quantity

    SSN DOB DL ADDRESS EMPLOYEE & BANK INFO USA FULLZ
    SIN DOB ADDRESS MMN PHONE EMAIL FULLZ CANADA
    NIN DOB ADDRESS PHONE EMAIL SORT CODE & ACCOUNT NUMBER FULLZ UK

    Here we're available

    What's App = +1.. 727... 788... 6129
    Tele Gram = @ killhacks & @ leadsupplier
    Skype = @ peeterhacks
    E mail = dghacks2 at g mail dot com

    Fullz USA SSN DOB DL & DL DOCS FRONT BACK with SELFIE
    Fullz USA High Credit Scores
    Fullz USA Business EIN Company
    Fullz USA Young & Old Age
    Fullz USA DL issue & expiry dates with SSN
    Fullz USA DL MVR

    Fullz UK NIN DOB ADDRESS
    Fullz UK NIN DOB ADDRESS SORT CODE & ACCOUNT NUMBER
    Fullz UK DL Front back with Selfie

    Fullz CANADA SIN DOB ADDRESS PHONE
    Fullz CANADA SIN DOB ADDRESS MMN EMAIL PHONE
    Fullz CANADA DL Front back with selfie

    Fullz CC with CVV USA UK CANADA
    Dummps with Pin Track 101 & 202
    Fresh Combos|IP's|Proxies
    Fresh SMTP RDP C-panels
    Fresh web-mailers

    What's App = +1.. 727... 788... 6129
    Tele Gram = @ killhacks & @ leadsupplier
    Skype = @ peeterhacks
    E mail = dghacks2 at g mail dot com

    Many other stuff we can provide you
    Contact us fast for fresh stuff & Fullz|Pros

    #USAFULLZ #USASSNDOB #USASSNDOBDL #SSNDLFULLZ #USADLDOCS #EINPROS #CCUSA #CVVUSA
    #NINUKFULLZ #UKNINDOBPROS #NINSORTCODEUK #UKPROSMMN #UKFULLZ
    #CANADAFULLZ #CANADAPROS #CANADASIN #SINDOBPROS #SINDOBMMN #CANADASINMMN

    ReplyDelete