Black Hat DC 2008 Speaker List

Keynote - Quest for the Holy Grail

Jerry Dixon

Online fraud has become pervasive and increasing at an alarming rate affecting all organizations, private and public. This talk will provide an overview of current trends affecting both government and private sector companies, what enables online fraud, what are some of the barriers, and suggestions for what organizations should be doing to combat the problem.

Jerry Dixon is currently Infragard's National Member Alliance's Vice President for Government Relations, he currently serves as Director of Analysis for Team Cymru, and the former Executive Director of the National Cyber Security Division (NCSD) & US-CERT, of the Department of Homeland Security. During his time at Homeland, Jerry led the national effort to protect America's cyber infrastructure and identify cyber threats. Prior to being chosen to lead NCSD, Mr. Dixon served as the Deputy Director of Operations for the U.S. Computer Emergency Readiness Team (US-CERT). Mr. Dixon was instrumental in creating US-CERT, which serves America as the 24x7x365 cyber watch, warning, and incident response center that protects the cyber infrastructure by coordinating defense against and response to cyber attacks. Mr. Dixon led the initial development of US-CERT's capabilities for analyzing and reducing cyber threats and vulnerabilities, disseminating cyber threat warning information, and coordinating incident response activities across federal, state, local government agencies, and private sector organizations, making it Homeland Security's primary element of cyber preparedness and response. Before joining NCSD, Mr. Dixon was the founding director of the Internal Revenue Service's (IRS) Computer Security Incident Response Capability. In this role, Mr. Dixon led their operational cyber security capability for the IRS and developed their ability to detect and respond to protect American taxpayer's private information from security attacks. Mr. Dixon has also served as Director of Information Security for Marriott International, a global private sector company, where he led cyber security planning, security architecture, and security operations.

Bad Sushi - Beating Phishers at Their Own Game

Nitesh Dhanjani, Senior Manager and Leader of Application Security Services, Ernst & Young LLP

Billy Rios, Microsoft

This talk will expose tactics and tools used by phishers, show how easy it is to hack into servers that are used to perform phishing, demonstrate how easy it is so follow a phsisher's trail to find out how they share information on US Citizens including SSNs, bank account numbers, credit card numbers, ATM PINs, you name it.

Phishers usually setup their sites on servers they have compromised. In other words, the phishers have already done the hard work and it is easy to gain access to these servers. Due to the sheer volume of sites that need to be setup to perform a successful phish, phishers tend to be sloppy and leave traces everywhere.

This talk will expose some of the tactics and tools used by phishers. Actual walk-through of how compromised hosts were accessed to gain information about the phishers will be presented.

This talk will also show how easy it is to construct a trail from a compromised host to obtain information about individuals that is spewed on hacker message boards located outside the United States.

Nitesh Dhanjani - In addition being an actual reincarnation of Dawkins' Spaghetti Monster, Nitesh Dhanjani is also a rare type of Blowfish that is poisonous to phishermen across the world. Once netted, Dhanjani's poison quickly disables the phishermen and spreads to the their prized lines and lures. Currently, only two individuals, namely Chuck Norris and Bruce Schneier, are known to handle this toxic poison without fear of death.

Billy Rios lives in a phish bowl and is constantly being sent emails from acquaintances all over the world. Billy has won the Internet lotto several times, is expecting large sums of abandoned money from a long lost relative in the Congo, and has received checks accidentally made out for 30,000 instead of 30 US dollars.

Entertainment Talk - Social Engineering

Peter Earnest, Founding Executive Director of the International Spy Museum

Get the inside story from a true insider. Peter Earnest will share his expertise in espionage. Once Peter has shared his exclusive accounts, the audience is invited to join in an open-ended discussion.

Peter Earnest is the founding executive director of the International Spy Museum and a 35 year veteran of the Central Intelligence Agency (CIA). He served 25 years as a case officer in its Clandestine Service, primarily in Europe and the Middle East. He ran wide range of intelligence collection and covert action operations including counterintelligence and double agent operations working with the Federal Bureau of Investigation and military intelligence. Assigned to the Office of the Director of Central Intelligence, he served as an Inspector with the Inspector General, liaison with the U.S. Senate, and director of media relations and spokesman. A member of the Senior Intelligence Service, he received the CIA¹s Medal of Merit and Career Intelligence Medal. He is Chairman of the Board of the Association for Intelligence Officers (AFIO). As Museum director, he has played a leading role in its extraordinary success as a Washington attraction and he has frequently been interviewed by the major media in radio, TV, and the press on current intelligence issues.

Biometric and Token-Based Access Control Systems

Zac Franken, Freelance Security Consultant

An overview and demonstration of common access control and biometric systems. This talk will include the key elements of their implementation and includes in-depth technical analysis of their common weakness.

I will then demonstrate bespoke hardware developed to perform an attack that renders most access control systems useless.

Zac Franken is a freelance consultant based in the UK with over 20 years of computing and security experience. At present he is researching physical access control systems. He started work back in ’87 as a Unix Systems Administrator and founded of one of the UK’s top Internet development shops in ’94. His work has been quoted in international press and he is a frequent speaker at security conferences. Zac has been Operations Director for DefCon so long that he can no longer be officially considered sane.

Comments to Follow the Keynote

Andy Fried, IRS

After Jerry Dixon's keynote, Andy Fried will give more details about the latest phishing challenges related to IRS.

Andy Fried is a Senior Special Agent with the Treasury Inspector General for Tax Administration¹s System Intrusion and Network Attach Response Team (SINART). His organization is responsible for investigating computer security incidents involving the Internal Revenue Service.

During his 17 year career with Treasury, he is credited with developing his agency¹s Computer Investigative Specialist (CIS) program, whose members are responsible for analyzing seized computers, as well as the SINART program, whose mission is to investigate computer intrusions and conduct pro-active network penetration testing.

In 1986, while working at the Kennedy Space Center, he developed one of the first suites of software programs specifically designed for analyzing seized computers. His software was distributed, free of charge, to law enforcement agencies throughout the world.

Developments in Cisco IOS Forensics

FX, Recurity Labs GmbH

Attacks on network infrastructure are not a new field. However, the increasing default protections in common operating systems, platforms and development environments increase interest in the less protected infrastructure sector. Today, performing in-depth crash analysis or digital forensics is almost impossible on the most widely used routing platform. This talk will show new developments in this sector and query the audience for their experience, input and wishes.

Felix ‘FX’ Lindner runs Recurity Labs. FX has over 10 years experience in the computer industry, eight of them in consulting for large enterprise and telecommunication customers. He possesses a vast knowledge of computer sciences, telecommunications and software development. His background includes managing and participating in a variety of projects with a special emphasis on security planning, implementation, operation and testing using advanced methods in diverse technical environments.

FX is well known in the computer security community and has presented his and Phenoelit's security research on Black Hat Briefings, CanSecWest, PacSec, DEFCON, Chaos Communication Congress, MEITSEC and numerous other events. His research topics included Cisco IOS, HP printers, SAP and RIM BlackBerry. Felix holds a title as State-Certified Technical Assistant for Informatics and Information Technology as well as Certified Information Systems Security Professional.

Cracking GSM

David Hulton, Steve Pico Computing, Inc.

This talk is about GSM security. We will explain the security, technology and protocols of a GSM network. We will further present a solution to build a GSM scanner for 900 USD. The second part of the talk unravels a practical solution to crack the GSM encryption A5/1.

Hacking VoIP through IPSec Tunnels

Sachin Jogkelar, Sipera VIPER Lab

One of the primary advantages of Voice over IP (VoIP) is that it allows mobile operators and enterprises to extend their core telephony networks. And, with WiFi-enabled VoIP phones, users can connect to their core telephony servers over the Internet from any remote location. Often, such remote VoIP is secured using IPSec VPNs, which, as this demonstration will show, is not sufficient to secure VoIP.

In this presentation, we will show how to exploit a SIM card from an IPSec VPN-enabled GSM/VoIP phone to launch attacks through the IPSec tunnel. This demonstrates that IPSec VPNs are not sufficient to secure VoIP, and that it is possible to embed exploits inside the tunneled traffic to generate attacks on the core telephony network. More importantly, with all VPN tunnel traffic considered “trusted,” such attacks go undetected and can have a devastating impact on the core network.

While there are several ways to implement VPNs and authenticate remote phones, for the purpose of this demonstration, the demonstration will focus on EAP-SIM based authentication that is typically implemented in dual-mode GSM/VoIP phones.

With GSM 2G mobile network standards, GSM phones are equipped with a SIM module (typically a smart card) to allow the gateway server of the core telephony network to authenticate the identity of the GSM phone and to enable over-the-air encryption of the voice traffic. When such a GSM phone is also equipped with a VoIP module, the standard GSM authentication security strength is insufficient in the context of the IP-network. This problem is solved by extending the GSM authentication with the EAP-SIM (Extensible Authentication Protocol) mechanism (RFC 4186). Essentially, the GSM SIM runs GSM algorithms using credentials stored in the SIM card and challenges received from the core network to set up an IPSec tunnel with the network, and then routes all VoIP traffic through the tunnel. As far as the core network is concerned, any device that responds successfully to its challenges, and abides by the negotiated security parameters, is a legitimate device -- which is where the problem lies. As this demonstration will show, it’s easy to become an authenticated subscriber on the network and launch attacks on the core infrastructure.

The presentation and demonstration will include following:

• Introduction to SIM-based authentication and IPSec VPN setups.
• Explain how to extend free open-source tools to exploit the SIM card using a Linux laptop and turn it into a seemingly legitimate mobile phone.
• Demonstrate successful setup of IPSec tunnel from the laptop with a SIM reader. This is the heart of the demonstration and will show the vulnerability in the core telephony networks which allows the attacker to pose as a legitimate phone and subsequently launch attacks on the network and other legitimate users. The vulnerability exists because the core network does not monitor activities inside the IPSec tunnel as it assume everything received within the tunnel is trusted.
• Show attacks through the IPSec tunnel by writing simple applications that inject attack traffic inside the tunnel. We will demonstrate IKE protocol message flooding attacks (IKE_SA_INIT, IKE_SA_AUTH) and RTP flooding attacks.
• Discuss the impacts of the attacks and other possible ones. For example, with all network elements available, there several other application level attacks that can be launched on a UMA network, such as IMSI Reconnaissance, Session Anomalies, and Location Update spoofing.

Sachin Joglekar is a VoIP vulnerability researcher for past 4 years. He is currently working with Sipera’s VIPER Lab which conducts vulnerability research on various VoIP, mobile, and multimedia products and services. Sachin was a seed engineer for Sipera’s VoIP IDS/IPS product.

Sachin holds a Masters of Science, Computer Science degree from the University of North Texas with specialization in computer security and a Bachelors of Engineering, Electronics degree from Mumbai (Bombay) University, India.

A Picture's Worth: Digital Image Analysis

Dr. Neal Krawetz, Hacker Factor Solutions

Photoshop, 3D Studio Max, Maya, other programs can readily create high quality images and alter existing pictures. Services such as MySpace, Google Video, and Flickr make it trivial to distribute pictures, and many are picked up by the mass media. However, there is a problem: how can you tell if a video or picture is showing something real? Is it computer generated or modified? In a world where pictures are more influential than words, being able to distinguish fact from fiction in a systematic way becomes essential. This talk covers some common and not-so-common forensic methods for extracting information from digital images. Using these techniques, you will not only be able to distinguish real images from computer generated ones, but also identify how they were created.

SCADA Security

Jason Larsen,IOActive, Inc.

It’s not often that an attacker has the opportunity to actually break things; and while breaking software is fun, breaking hardware can be even more rewarding. Process control systems are where the physical hardware of the real world meets the software we all know and love.

One of the great unknowns of the process control world is how many physical valves, pumps, and breakers can be damaged by a remote attacker who has gained access to the control systems. Reinstalling a computer or restarting an embedded device isn’t fun, but cutting out a valve and replacing it is even less fun. For example CNN carried an article explaining how a several-ton electric generator was made to jump off the floor and permanently damage itself.

In this presentation, smaller and more common components will be connected and tested to failure as they normally appear in the field. We will discuss classes of hardware failure as well as how much control and knowledge of the process is required to drive the hardware component to the point of failure.

Jason Larsenis a Principal Security Consultant at IOActive and a recognized thought leader in control systems and IDS/IPS creation and modification. Mr. Larsen specializes in software-related audits and testing, including deep experience in protocol reverse engineering and custom binary exploits. At IOActive, he helps clients develop secure software using innovative methods to detect weakness and anticipate exploits through his application review design, threat modeling, and auditing of environment and application code-base.

Mr. Larsen has established some of the key tools used in the history of IPS development, including the creation of a Supervisory Control and Data Acquisition (SCADA) Penetration Toolkit, a Shellcode Compression tool, Hogwash, Snort, and SPUD. His work as Chief Security Architect and Analyst of Last Resort for the Department of Energy has won him national recognition, most notably for his on-record penetration and control of the electrical power grid. He is expert with a wide range of operating systems, including Windows, Linux, Unix, Tru64, Solaris, embedded systems, cell phones and cell towers.

Oracle Security

David Litchfield, NGS Software

David Litchfield specializes in searching for new threats to database systems and web applications. He has lectured to both British and U.S. government security agencies on database security and is a regular speaker at the Blackhat Security Briefings. He is a co-author of "The Database Hacker's Handbook", "The Shellcoder's Handbook", "SQL Server Security", and "Special Ops". In his spare time he is the Managing Director of Next Generation Security Software Ltd.

URI Use and Abuse

Nathan McFeters, Ernst & Young, LLP

URIs link us to commands and programs which have been written by developers and are subject to all of the same code flaws that any other system might be, what is most interesting is that the usage of URIs links us to that back end application through a browser, making Cross Site Scripting attacks a possible trigger for any flaws we may discover.

This presentation will discuss the subject of URI attacks, glossing over several 0-days that were originally discussed at DEFCON 15, Black Hat Japan 2007, and Black Hat Federal 2008 and will move into more recent research that exposes applications functionality resulting in some scary attacks. Examples will include stack overflows, command injections, format string flaws, utilizing an application to send all of a user's pictures to an arbitrary server, etc. All of these attacks are leverage able thru XSS exposures, and thus XSS, CSRF, Phishing, and Anti-DNS Pinning attacks will be combined with the URI attacks to devastating effect.

Nathan McFeters is a Senior Security Advisor for Ernst & Young's Advanced Security Center based out of Chicago, IL. Nathan has performed web application, deep source code, Internet, Intranet, wireless, dial-up, and social engineering engagements for several clients in the Fortune 500 during his career at Ernst & Young and has spoken at a number of prestigious conferences, including Black Hat, DEFCON, ToorCon, and Hack in the Box.

Prior to taking the position with Ernst & Young, Nathan paid his way thru undergrad and graduate degrees at Western Michigan University by doing consulting work for Solstice Network Securities a company co-founded with Bryon Gloden of Arxan, focused on providing high-quality consulting work for clients in the Western Michigan area.

Nathan has an undergraduate degree in Computer Science Theory and Analysis from Western Michigan University and a Master of Science Degree in Computer Science with an emphasis on Computer Security, also from Western Michigan University.

(un)Smashing the Stack: Overflows, Countermeasures, and the Real World

Shawn Moyer, Agura Digital Security

As of today, Vista, XP, 2K03, OS X, every major Linux distro, and each of the BSD's either contain some facet of (stack, lib, heap) protection, or have one available that's relatively trivial to implement / enable.

So, this should mean the end of memory corruption-based attacks as we know it, right? Sorry, thanks for playing.

The fact remains that many (though not all) implementations are incomplete at best, and at worst are simply bullet points in marketing documents that provide a false sense of safety.

This talk will cover the current state of software and hardware based memory corruption mitigation techniques today, and demystify the myriad of approaches available, with a history of how they've been proven, or disproved. Our focus will be on building defense-in-depth, with some real-world examples of what works, what doesn't, and why.

As an attendee, you should come away with a better understanding of how to protect yourself and your boxes, with some tools to (hopefully) widen the gap between what's vulnerable and what's exploitable.

Shawn Moyer is CISO of Agura Digital Security, a web and network security consultancy. He has led security projects for major multinational corporations and the federal government, written for Information Security magazine, and spoken previously at BH and other conferences.

Shawn is currently working on application security architecture for a global Fortune 200, and spends far more time than he should obsessing about horology.

Exploiting Live Virtual Machine Migration

Jon Oberheide, University of Michigan

As virtualization becomes increasingly popular in enterprise and organizational networks, operators and administrators are turning to live migration of virtual machines for the purpose of workload balancing and enhanced management. However, the security of live virtual machine migration has yet to be analyzed. We shed light on this poorly explored area and demonstrate the importance of secure migration through attacks on the migration data plane of existing virtualization products. In particular, we show how a malicious party can exploit the latest versions of the popular Xen and VMware virtual machine monitors (VMMs) and present a tool to automate the manipulation of a guest operating system's memory during a live virtual machine migration across the network. In addition to presenting sample exploits against a VM's userland applications and kernel, we show how the manipulation of a live VM migration can lead to the compromise of the entire VMM/hypervisor.

Jon Oberheide is a researcher at the University of Michigan, where he previously received a B.S. in Computer Science and is currently pursuing a PhD. While his interests as an independent researcher span code, network, and physical security, his current academic work focuses on the threats posed by modern malware to enterprise environments. Prior to his PhD work, Jon held positions at Merit Network in Research and Development and at Arbor Networks in the Arbor Security Engineering and Response Team (ASERT).

Scanning Applications 2.0 - Next Generation Scan, Attacks and Tools

Sheeraj Shah, Blueinfy

Ajax, Web Services and Rich Internet (Flash) are redefining application security scanning challenges and strategies. We are witnessing some emerging attack vectors like Cross Site Scripting with JSON, Cross Site Request Forgery with XML, WSDL scanning, XPATH injection with XML streams etc. This presentation will cover Web 2.0 attacks, new scanning tools for assessment and approaches for Web 2.0 code analysis with demonstrations. Professionals can apply knowledge in real life to secure Web 2.0 application layer.

This presentation will focus on core Web 2.0 security issues along with assessment toolkit developed by the presenter. 1.) It is imperative to analyze Web 2.0 application architecture with security standpoint. We will evaluate real life vulnerabilities with Google, MySpace and Yahoo. 2.) Web 2.0 technology fingerprinting is very critical step to determine application security posture. 3.) Crawling Ajax driven application is biggest challenge and we will cover approaches to address this critical issue by dynamic DOM event management with Ruby. 4.) Scanning Web 2.0 application for security holes is an emerging issue. It needs lot of JavaScript analysis with DOM context to discover XSS and XSRF vulnerabilities in Ajax and Flash with new attack vectors hidden in payload structures like JSON, XML, JS-Arrays etc. 5.) Addressing assessment methods and tools to discover security lapses for SOAP, REST and XML-RPC based Web Services along with innovative fuzzing.

Sheeraj Shah B.E., MSCS, MBA, is the founder of Blueinfy, a company that provides application security services. Prior to founding Blueinfy, he was founder and board member at Net Square. He also worked with Foundstone (McAfee), Chase Manhattan Bank and IBM in security space. He is also the author of popular books like Hacking Web Services (Thomson 06), Web Hacking: Attacks and Defense (Addison-Wesley 03) and Web 2.0 Security. In addition, he has published several advisories, tools, and whitepapers, and has presented at numerous conferences including RSA, AusCERT, InfosecWorld (Misti), HackInTheBox, Blackhat, OSCON, Bellua, Syscan, ISACA etc. His articles are regularly published on Securityfocus, InformIT, DevX, O’reilly, HNS. His work has been quoted on BBC, Dark Reading, Bank Technology as an expert.

Security Failures in Secure Devices

Christopher Tarnovsky, Flylogic Engineering, LLC.

Flylogic Engineering, LLC. specializes in analysis of semiconductors from a security "how strong is it really" standpoint. We offer detailed reports on substrate attacks which define if a problem exists. If a problem is identified, we explain in a detailed report all aspects of how the attack was done, level of complexity and so on. This is something we believe is unique and allows the customer to then go back to the chip vendor armed with the knowledge to make them make it better (or possibly use a different part).

Preparing for the Cross Site Request Forgery Defense

Chuck Willis, Principal Consultant, MANDIANT

Computer Forensic cases often involve an analysis of a user’s web browser’s cache and history in order to reconstruct actions that a user took online. Corporations also routinely monitor Internet activity of users and illicit or inappropriate use can result in disciplinary actions. These and other types of online investigations also involve looking at third-party web sites and applications for actions that can be attributed to a user of interest. This presentation will describe how all of these types of investigations can be mislead by an incredibly common web vulnerability known as Cross Site Request Forgery. This type of forgery can be used to force a user to submit data to online web applications and also can manipulate a user’s local cache and history. Using this vulnerability a user can be forced to make Internet searches, fetch arbitrary image files or web pages, post messages to online forums, or even manipulate the user’s account in common web sites. Also covered in this presentation will be methods to detect or rule out the use of this vulnerability during an investigation.

Chuck Willis is a Principal Consultant with MANDIANT (http://www.mandiant.com/), a full spectrum information security company in Alexandria, Virginia, where he concentrates in web application security, research, and development. Prior to joining MANDIANT, Chuck performed security software engineering, penetration testing, and vulnerability assessments at a large government contractor and also conducted computer forensics and network intrusion investigations as a U.S. Army Counterintelligence Special Agent. Chuck holds a Master of Science in Computer Science from the University of Illinois at Urbana-Champaign and has previously spoken at the Black Hat Briefings, the OWASP AppSec Conference, the IT Underground security conference in Europe, DefCon, and ShmooCon. Chuck has contributed to several open source security software projects and is a member of the Open Web Application Security Project, a Certified Information Systems Security Professional, and a Certified Forensic Computer Examiner.

DTRACE: The Reverse Engineer's Unexpected Swiss Army Knife

David Weston, Science Applications International Corporation (SAIC)

Tiller Beauchamp Science Applications International Corporation (SAIC)

Security researchers face many challenges when searching for vulnerabilities and reverse engineering applications. Simple fuzzing can be time consuming and fruitless and require many different tools to fully instrument the target. Applications and malware can detect and evade traditional debuggers and generate phantom exceptions. Kernel and driver bugs can be difficult to discover and debug. This paper will examine how DTrace, a kernel based dynamic scriptable tracer, can help security researchers overcome these challenges.

DTrace, created by SUN and originally intended for performance monitoring, is one of the most exciting additions to OS X Leopard and is being ported to Linux and BSD. DTrace offers an unprecedented view of both user and kernel space, which has many interesting implications for security researchers. In this paper we explore and build upon the use of DTrace as a security research tool.

Many of the features of DTrace can be leveraged to discover new exploits, unobtrusively monitor malware and even protect against buffer overflow attacks. We will walk the reader through the interesting applications of DTrace, showing how to trace fuzz data through vulnerable system calls, generate code coverage graphs of vulnerable and network accessible functions and trace code paths in target applications over the network visually with IDA Pro, all without the overhead of stopping and starting the application that traditional debuggers impose. In order to overcome the limitations of DTrace, we will introduce a DTrace-based programmatic framework written in Ruby. This framework supports vulnerability discovery through binary instrumentation by offering function level code coverage, stack visualization and integration with the IDA debugger. Finally we illustrate how the framework is used to efficiently discover vulnerability and engineer an exploit.

David Weston is security researcher and penetration tester at Science Applications International Corporation. Pursuing a graduate degree his research interests include: Fuzzing and Reverse Engineering. He has an undergraduate degree from the University of California at Santa Barbara

Tiller Beauchamp works as a senior security consultant for SAIC providing security auditing services to large commercial, state and DoD customers. His areas of expertise include network penetration testing, web application security, IPv6 and exploit development. Beauchamp earned his M.S. in Computer Science from the University of Oregon with a specialization in software engineering. He has worked as the lead developer for Team Defend, SAIC's portable computer and network defense exercise. Beauchamp is also responsible for maintaining the company's penetration toolkit and penlab.