Athcon 2013

I am just on my way back from presenting at Athcon 2013 – the premier IT Security conference in Greece.

http://www.athcon.org/

It was my first time at Athcon, but I have to say that I was impressed. The organisers did a great job with the venue and facilities, and choosing speakers which had a great mix of content and technical depth.

I presented my research on “Hacking Security Appliances” (which I have previously presented at BlackHat Europe, and Dublin Source earlier this year). That’s probably my last time presenting that particular material, as I want to keep things fresh and I'm currently working on various ideas I have for interesting new research.

For reference my base slides and white-paper for the material are here:
https://media.blackhat.com/eu-13/briefings/B_Williams/bh-eu-13-hacking-appliances-bwilliams-wp.pdf
https://media.blackhat.com/eu-13/briefings/B_Williams/bh-eu-13-hacking-appliances-bwilliams-slides.pdf

I saw good solid presentations from other speakers including the following:

Max Sobell - Security of NFC wallets
Michele Orru - Using BeEf for custom shellcode and inter-protocol attacks
Jurriaan Bremer - Automated de-obfuscation of android apps and malware
Kostas Papapanagiotou - History of OWASP Top 10

(and also had a good meal out in Athens last night, with some of the other speakers, which was great fun)

Athcon also had a “capture the flag” (CTF) competition hosted by Symantec (unfortunately I didn't get time to take part, but is seemed to be very popular).

All in all a great conference that I would like to attend (and speak there) again.

BlackHat EU this week

I am looking forward to speaking at BlackHat EU again on Thursday of this week as I will be talking on the subject of "Hacking Appliances: Ironic exploits in security products" which is an area of research I have particularly enjoyed.

http://www.blackhat.com/eu-13/schedule/briefings-14.html

In short, I will be discussing some of the vulnerabilities I have escalated to various vendors of popular Security Appliances during 2012, and demonstrating how these vulnerabilities could be exploited in realistic scenarios.

 

There will be some root shell, for those of us who like that sort of thing, but I think the most interesting aspect is that most of the vulnerabilities were typical OWASP Top 10 type issues, or other fairly basic misconfigurations, which could be found and exploited in a few days using typical attack techniques.

People outside the Pentesting community find it surprising when I tell them that most popular Security Appliances I have looked at had fairly basic and rather easy to find vulnerabilities. Most of the products I looked at were popular and widely deployed, so the concerning thing is that companies using these products (and the vendors who produce them) were unaware that these products suffered from such issues.

In regard to the irony; I have certainly seen some ironic issues over the past 18 months, for example issues like:
• A URL filter which could be fully compromised with a malicious URL
• Email filtering products which could be fully compromised with malicious emails
• A single-sign-on system where all the credentials could be extracted in an unauthenticated way
• A firewall that could be fully compromised from the outside due to authentication-bypass
• A secure remote access gateway which could give unauthenticated external attackers free and easy access to the internal network

I showed some of these issues last year, I will be showing a few more during my talk on Thursday.
(by "fully compromised" I generally mean a root shell on the underlying operating system)

Symantec have fixed some exploits in Symantec Message Filter

Looks like Symantec have finally fixed some security issues I raised with them back in January 2012 for Symantec Message Filter 6.3.

It took them 6-months - so I am not impressed with their patching-cycle, or their focus on IT Security generally (this is supposed to be a security product after all).

Basically, as I described at BlackHat EU back in May 2012, this product-installer had versions of Tomcat and MySQL which were 7 years old, with default content and no patches (so the product had well-known third-party exploits right out of the box).

Additionally (which I felt I couldn't describe at the time, because it was 0-day) there were session-management and information-disclosure issues in the administrative UI, plus Cross Site Request Forgery (CSRF) of administrative-functions and XSS.

More detail is here:
http://www.symantec.com/security_response/securityupdates/detail.jsp?suid=20120626_00&fid=security_advisory&pvid=security_advisory&year=2012

The CVEs are:

CVE-2012-0300
CVE-2012-0301
CVE-2012-0302
CVE-2012-0303

More on Exploiting Security Gateways

Here is a quick update on some of my exploit-development research into finding exploits in Security Gateways.

This is the video from my presentation at BlackHatEU 2012 back in May, which shows some typical examples of exploits I had found in the period from October 2011 to March 2012 (all of the issues in the demo videos have now been addressed).

(this video is around 40 minutes, and may take a minute or so to start depending on your connection)

If you are interested in the technical side, the white-paper that went with this presentation can be found here:
http://www.nccgroup.com/en/learning-research-centre/security-testing-audit-compliance-resources/white-papers/

Since then I have continued my research project, and to-date have found around 80 exploits (most of which are in Security Gateways, though I have also started to look at some other types of appliances as well). Fixes and updates have been released for at least 25 of these exploits so far, though the majority are still in the respective vendor's patch-cycle (this means that these products are improving, which is a positive outcome).

Some vendors are very reactive, a few vendors (especially Symantec and Barracuda) don't seem to be able to turn around fixes within a reasonable timeframe (Symantec still have not addressed serious issues I raised with them back in January 2012 - despite me chasing them). The good news is that many vendors address issues within a couple of months or so, and some within a few days - which is excellent!

As for a briefest of summaries; this research is continuing to uncover more and more similar issues, showing alarming trends in the insecurities of security-product Web UIs. For example:

Almost all Security Gateway products had

• Unauthenticated information disclosure
• XSS with session-hijacking

The majority had

• CSRF of admin functions
• Command-injection
• Privilege escalation

Several had

• Direct authentication-bypass
• Stored out-of-band XSS and OSRF

A few had

• Gateway Denial-of-Service
• There were a wide variety of more obscure issues

Also, the majority had bruteforce password guessing issues (and though I considered this too basic for my research, this is also a big failure on the part of these software vendors)

Basically speaking, almost all of the Security Gateways I looked at could be compromised by an attacker, and used as an entry point to break into corporated networks.

More recently, and of particular interest I have been looking at ways of exploiting these systems via insecure backup/restore functions, using request forgery to perform arbitrary file-upload. I feel this is an interesting attack-vector because it usually results in a "root shell" - maybe I will do a post on that at some point to explain how the attack works.

Anyway, there are plenty more similar products out there, so I will continue looking. If you have any suggestions of products you think I should look at (especially security appliances) let me know.