I thought it would be great to cover events from international conferences. Not just in a general overview, but to talk about the most interesting presentations. I present to your attention the first hot top ten.
1. Awaiting a harmonious tandem of IoT attacks and ransomware
In 2016, we witnessed a rapid increase in ransomware attacks. Just as we hadn't fully recovered from these attacks, a new wave of DDoS attacks using IoT hit us. In this presentation, the author provides a step-by-step description of how a ransomware attack occurs. How ransomware works and what a researcher should do at each stage to counteract ransomware.
He relies on established methodologies. The speaker then sheds light on how IoT is used in DDoS attacks: explaining the role auxiliary malware plays (for subsequent assistance in conducting a DDoS attack with an IoT army). He also discusses how the tandem of ransomware and IoT attacks could pose a significant threat in the coming years. The speaker is the author of the books "Malware, Rootkits & Botnets: a Beginner’s Guide", "Advanced Malware Analysis", and "Hacking Exposed: Malware & Rootkits Secrets & Solutions", so the presentation is well-informed.
2. "Open your mouth, say 0x41414141": Attack on medical cyber infrastructure
Connected medical devices are an everyday clinical reality. Such devices are valuable aids for medical staff, as they automate a significant portion of routine tasks. However, these devices contain numerous vulnerabilities (both software and hardware) that pose a wide field of opportunity for potential attackers. In the report, the speaker shares personal experiences conducting penetration tests on medical cyber infrastructure and discusses how attackers compromise medical equipment.
The speaker describes: 1) how attackers exploit proprietary communication protocols, 2) how they find vulnerabilities in network services, 3) how they compromise life-support systems, 4) how they exploit hardware debugging interfaces and the system data bus; 5) how they attack primary wireless interfaces and specific proprietary wireless technologies; 6) how they infiltrate medical information systems, then read and edit: personal health information of patients; official medical records, the content of which is typically kept hidden even from the patient; 7) how they disrupt the communication system used by medical equipment to exchange information and official commands; 8) how they restrict medical staff's access to the equipment; or even block it entirely.
During his penetration tests, the speaker discovered numerous issues with medical equipment. Among them: 1) weak cryptography, 2) the possibility of data manipulation; 3) the potential for remote replacement of devices, 4) vulnerabilities in proprietary protocols, 5) unauthorized access to databases, 6) hard-coded immutable logins/passwords. Additionally, other sensitive information stored either in the device firmware or in system binaries; 6) the susceptibility of medical equipment to remote DoS attacks.
After reviewing the report, it becomes clear that cybersecurity in the medical sector today is a clinical case that requires intensive care.
3. A toothy exploit at the tip of a context advertising skewer.
Every day, millions of people log into social networks: for work, entertainment, or simply out of habit. Beneath the surface of social networks are invisible Ads platforms, responsible for delivering relevant contextual advertising to social media visitors. Ads platforms are easy to use and very effective. That's why they are in high demand among advertisers.
In addition to the ability to reach a wide audience, which is highly advantageous for businesses, Ads platforms also allow for highly targeted marketing—down to a specific individual. Furthermore, the functionality of modern Ads platforms even enables advertisers to choose which of the numerous devices that specific individual uses to display ads.
Thus, modern Ads platforms allow advertisers to reach any person, anywhere in the world. But this capability can also be exploited by malicious actors—as a gateway into a network where their intended victim operates. The speaker demonstrates how a malicious advertiser can exploit an Ads platform for highly precise targeting of their phishing campaign, aimed at delivering a personalized exploit to a specific individual.
4. How Real Hackers Evade Targeted Advertising
We use many computerized services in our daily lives. It's hard to give them up, even when we find out that they are conducting total surveillance on us. So extensive that they track every movement and every keystroke.
The speaker clearly explains how modern marketers employ a wide variety of esoteric targeting methods. We about mobile paranoia and total surveillance. Many readers took it as a harmless joke, but the presented report shows that modern marketers are indeed fully utilizing such technologies to monitor us.
What can we do? The context advertising industry, which fuels this total surveillance, is advancing by leaps and bounds. Modern Ads platforms can track not only a person's online activity (keystrokes, mouse movements, etc.) but also their physiological features (how we press keys and move the mouse). Thus, the modern tracking tools of Ads platforms, integrated into the services we can't imagine life without, creep under our underwear and even under our skin. If we can't refuse these overly watchful services, why not at least bombard them with useless information?
The report showcases an original device (a software-hardware bot) that allows: 1) injecting Bluetooth beacons; 2) obfuscating data collected from the vehicle's onboard sensors; 3) falsifying mobile identification parameters; 4) obscuring typing patterns (on keyboards, mice, and touch sensors). This information is known to be used for targeting ads on mobile gadgets.
During the demonstration, it is clear that after activating the original device, the tracking system goes haywire; the information it collects becomes so noisy and inaccurate that it will be of no use to our observers. As a good joke, the presenter shows how, thanks to the presented device, the 'tracking system' starts mistaking a 32-year-old hacker for a 12-year-old girl who is madly in love with horses.
5. 20 Years of MMORPG Hacking: Better Graphics, Same Exploits
The topic of MMORPG hacking has been discussed at DEF CON for 20 years. In honor of the anniversary, the speaker describes the most significant moments from these discussions. Additionally, they share their adventures in poaching within online games, starting with Ultima Online (in 1997) and the subsequent years: Dark Age of Camelot, Anarchy Online, Asheron's Call 2, ShadowBane, Lineage II, Final Fantasy XI/XIV, and World of Warcraft. Including several recent entries: Guild Wars 2 and Elder Scrolls Online. And this is far from the speaker's entire list of achievements!
The report provides technical details on creating exploits for MMORPGs that help acquire virtual currency, which is relevant for almost every MMORPG. The speaker briefly discusses the ongoing confrontation between poachers (exploit creators) and the "fish inspection authority"; as well as the current technical state of this arms race.
It explains the methodology for detailed packet analysis and how to configure exploits so that server-side detection of poaching does not occur. It also presents a fresh exploit that, at the time of the report, had an advantage over the "fish inspection authority" in the arms race.
6. Hack the Robots Before Skynet Comes
Robots are currently a hot topic. In the near future, they will be everywhere: on military missions, in surgical operations, in the construction of skyscrapers; shopping assistants in stores; hospital staff; business assistants, sexual partners; home cooks, and full-fledged members of families.
As the ecosystem of robots expands, and their influence in our society and economy grows rapidly, they begin to pose a significant threat to humans, animals, and businesses. Essentially, robots are computers with arms, legs, and wheels. Given the current state of cybersecurity, they are vulnerable computers with arms, legs, and wheels.
The software and hardware vulnerabilities of modern robots allow attackers to harness the physical capabilities of the robot to cause property or financial damage; or even accidentally or intentionally create a threat to human life. Potential threats to everything in proximity to robots grow exponentially over time. Moreover, they increase in contexts that the established field of cybersecurity has never encountered before.
In his recent research, the speaker discovered numerous critical vulnerabilities in consumer, corporate, and industrial robots from well-known manufacturers. The report reveals technical details of current threats and explains how attackers can compromise various components of the robot ecosystem, alongside demonstrations of working exploits.
Some of the issues identified by the speaker in the robot ecosystem include: 1) insecure communications; 2) potential memory corruption; 3) vulnerabilities that allow remote code execution (RCE); 4) risks to file system integrity; 5) authorization problems, and in some cases, total absence of authorization; 6) weak cryptography; 7) firmware update issues; 8) privacy concerns; 9) undocumented capabilities (also vulnerable to RCE, etc.); 10) weak default configurations; 11) vulnerable open-source 'robot management frameworks' and software libraries.
The speaker provides live demonstrations of various hacking scenarios related to cyber espionage, insider threats, property damage, and more. By describing realistic scenarios observed in the wild, he explains how the insecurity of modern robotic technology can lead to breaches. He elaborates that hacked robots can be even more dangerous than any other compromised technologies.
The speaker also emphasizes that raw research projects go into production before security issues are resolved. Marketing always seems to win out. This unhealthy state of affairs needs urgent correction. Before Skynet arrives. Although... The next report suggests that Skynet might have already arrived.
7. Militarization of Machine Learning
Risking being labeled a mad scientist, the speaker is nonetheless delighted by his "new devilish creation," proudly presenting DeepHack: an open-source hacking AI. This bot is a self-learning web application hacker. It is based on a neural network that learns through trial and error. Yet, DeepHack approaches the possible human consequences of its trials and errors with alarming indifference.
Using just one universal algorithm, it learns to exploit a variety of vulnerabilities. DeepHack opens the door to the realm of hacker AIs, many of which we can expect to see in the near future. Consequently, the speaker proudly describes his bot as "the beginning of the end."
The speaker believes that AI-based hacking tools, which will soon appear following DeepHack, represent a fundamentally new technology that both cyber defenders and cyber attackers will soon have to harness. He guarantees that next year each of us will either be creating our own machine-learning hacking tools or desperately trying to defend against them. There is no third option.
Also, whether in jest or earnest, the speaker states: "No longer the prerogative of devilish geniuses, the inevitable dystopia of AI is already available to everyone today. So join us, and we will show you how you can participate in the annihilation of humanity by creating your own militarized machine learning system. Of course, if the guests from the future don’t prevent us from doing it."
8. Recall Everything: Implanting Passwords in Cognitive Memory
What is cognitive memory? How can a password be "implanted" into it? Is it even safe? And why go to such lengths? The idea is that by using this approach, you won’t be able to spill your passwords—even under duress; while still retaining the ability to authenticate within the system.
The report begins with an explanation of what cognitive memory is. It then explains the differences between explicit and implicit memory. Next, it discusses the concepts of consciousness and the unconscious. It also explains what consciousness actually is. The manner in which our memory encodes, stores, and retrieves information is described. The limitations of human memory are outlined, as well as how our memory learns. The report concludes with a discussion of modern research on human cognitive memory, particularly how passwords can be integrated into it.
The ambitious statement presented in the title of the presentation was not fully resolved by the speaker, but several intriguing studies were mentioned that are on the verge of addressing the posed task. In particular, research from Stanford University, which focuses on this very topic. Also mentioned was a project for developing a human-machine interface for visually impaired individuals – directly connected to the brain. The speaker refers to research conducted by German scientists, who managed to establish an algorithmic connection between electrical brain signals and verbal phrases; their device allows text to be typed simply by thinking about it. Another intriguing study referenced by the speaker involves a neuro-phone, an interface between the brain and a mobile phone, using a wireless EEG headset (Dartmouth College, USA).
As previously noted, the ambitious statement presented in the title of the presentation was not fully resolved by the speaker. However, the speaker points out that despite the absence of technology for implanting passwords into cognitive memory, malware that attempts to extract them already exists.
And the little one asked, "Do you really think that cyber-attacks on the power grid can only be carried out by government hackers?"
Uninterrupted electricity supply is paramount in our daily lives. Our dependence on electricity becomes especially evident when it's turned off – even for a short period. Today, it is widely believed that cyberattacks on power grids are extremely complex and accessible only to government hackers.
The speaker challenges this established view and presents a detailed description of an attack on power grids, the costs of which are manageable even for non-governmental hackers. He showcases information gathered from the Internet that will be useful for simulating and analyzing a target power grid. He also explains how this information can be used for modeling attacks on power grids worldwide.
The report also demonstrates a critical vulnerability discovered by the speaker in General Electric Multilin products, which are widely used in the energy sector. The speaker describes how he fully compromised the encryption algorithm used in these systems. This algorithm is applied in General Electric Multilin products for secure communication between internal subsystems and to manage these subsystems, including for user authorization and access to privileged operations.
By obtaining access codes (as a result of the encryption algorithm compromise), an attacker can completely disable the device and cut off electricity to specified sectors of the power grid; block operators. Furthermore, the speaker demonstrates a technique for remotely reading the digital traces left by equipment vulnerable to cyberattacks.
10. The Internet Already Knows I’m Pregnant
Women's health is big business. There are countless Android applications on the market that help women track their monthly cycle, know when the chances of conception are highest, or monitor pregnancy status. These applications encourage women to record the most intimate details of their lives, such as mood, sexual activity, physical activity, physical symptoms, height, weight, and much more.
But how private and secure are these applications? After all, if an application stores such intimate details about our personal lives, it would be good if it didn't share this data with anyone else; for instance, with a partner company (engaged in targeted advertising, etc.) or with a malicious partner/parent.
The speaker presents the results of their analysis of cybersecurity across more than a dozen applications that predict the likelihood of conception and track the course of pregnancy. They found that most such applications have serious issues with cybersecurity in general and privacy in particular.
Source: habr.com
