Having won 2 pwn2owns and a couple CTFs, I stopped hacking partially because of frustration with the tools. Why are we still using GDB? Why is IDA the gold standard for static analysis, when really it's objdump with a few graphs. Even hexrays, why is C the best way to view a program? I'll talk about my adventures with Project Zero, and my attempt to start addressing this problem with QIRA. And I'll suggest directions for future development, in hopes the future generations will have a more pleasant binary exploitation experience.

2015 is Flash Year. Attackers almost use flash player vulnerability to attack PC users. Zero-day attacks found in 2015 are almost Flash Player vulnerabilities. Exploit kits all equip flash 0-day and newly patched n-day to do bad things in 2015.

In our Hadoop server, there are millions of suspicious flash samples from our sourcing channels, and thousands newly added every day. We want to discover Flash 0-day attack and newly patched n-day attack actively in the wild from these big set samples. So, I need a good performance and low false alert automation method to process the big set samples.

In this presentation, I will introduce the method which I used to discover zero-day attacks and the tools I developed to help processing the big set samples.

Microsoft Office 2010 and later versions employ Agile Encryption algorithm in their documents. Unlike previous versions, the password is hashed numerous times so that it cannot be easily reversed back to plaintext. Moreover, the encryption algorithms utilized and the number of hash iterations are flexible and are constantly improved over time. However, there is a vulnerability in the file format specification that can allow an attacker to later decrypt strongly encrypted documents without the password as long as the attacker has access to the originating MS Office program. This is possible by tricking MS Office into creating a nearly undetectable master key when it creates encrypted documents. I will explain how to install this master key for decryption by using a crafted backdoor program. In this talk, I will explain and demo how to backdoor MS Office to create predictable master keys in AES encrypted documents.

In our topic, we will dissect and unclose some undocumented and uncovered internals inside flash for detecting flash exploits. There are 3 parts in our topic:

• Identify (Possible) Exploit: Find vector in loop using static detection
• Stop exploit: a lightweight page heap for FixedMalloc in flash
• Distinguish real exploits: Find *bad* vector, especially when *bad* vector operation are JIT-ed

N/A

Google became one of the most important sources of information, as it aggregates all about user's online and offline activities, analyses it and gives recommendations. Location and browsing history, credit card data, purchases, connected devices and applications, contacts and calendars, notes and mails, photo albums, synced passwords and web form data, Hangouts chats and much more - all that data data is stored in multiple places, accessible via protocols and require authentication. You'll learn how to authenticate at Google servers without using a browser (though credentials are still required), and how to get all this information without leaving the traces.

Recently, there’s a common business model which provides web services with advertisements to profit from users. The most direct way of web advertising would be displaying ads on the web pages when the users browse them on the personal computers. Whenever they’re reading a blog, searching on Google, or watching videos on YouTube, there will be a myriad of ads which affect their viewing experience. That’s why ad-blocking extensions like AdBlock and Clearly came into existence.

In times where everyone owns a cellphone, mobile advertising (advertisements on mobile devices) is one of the most profitable businesses for the companies. And for the users of extensions like AdBlock or AdAway to block the ads on their cellphones, they must gain “ROOT” access first. However, we have been repeatedly warned by the information security experts that we shouldn’t give ROOT access to the apps recklessly, or we might be welcoming hackers with open arms and then be haunted by potential virus infection and information security issues. Is it worth it to sacrifice the basic protections on your cellphone to remove ads?

This has become the era of developers, where various SDKs offer ultimate convenience for mobile application developers. However, have you ever thought about the issues existed within the SDKs? This speech brings out all sorts of SDK problems on Android and iOS platforms originated from companies like Google, Apache, Alibaba and Tencent, including information leak, improper encryption/decryption, sandbox escape, code execution, etc. Not only does this speech analyzes and discloses original 0-day exploits in widely used SDKs released by Alibaba and Tencent, but also talks about the detection and defense of these issues, the experiences while analyzing them, and the reflections about creating and using related tools.

N/A

N/A

With so many web technologies around, there are attacking methods as much, with plenty of know-hows and “combo attacks” to catch people off guard. Among these attacks, the ones targeting at the “properties” are the most likely to be overlooked. Some of these fun “properties” and neglected skills would be demonstrated in this speech. Anyways, think of this speech as an advanced version of Web Security!

With the popularity of LBSNs(Location-based Social Networks), many LBS apps including Wechat, SayHi, Weibo, etc. provided a feature "Nearby", which can be used to find other users nearby and make friends with strangers. However, while searching people around, the user himself, as well as his own location, will also be exposed to others. We examine the security of several popular LBSN apps and show how hackers are able to track the locations of any users who are using the "Nearby" feature. At last we show a real-world experiment of tracking all users in Beijing via a popular LBSN app. We build a Wall of Sheep to show the people whose location privacy is leaked, and many celebrities are on it.

In this talk, I’ll be sharing stories of how I learned programming and writing game cheats. Also, I'll touch on the techniques that I learned on the way, and insights into the ecosystem and industry around online game cheats.

N/A

Telecommunication networks are essential infrastructure in today’ society. Both individuals and business depend on telecom operators to ensure reliable and protected communication for both traditional mobile services and increasingly for machine to machine (M2M) and Internet of Things (IoT) applications.

Increasingly Telecom companies are concerned with the vulnerabilities in the SS7 network. The SS7 telephony messaging protocols are 30 years old this year making them dinosaurs in a digital world pre-dating mobile phones, digital switching and the world wide web. However, there are more people using the SS7 network that the internet.

We will consider the range of possibilities of an intruder who accessed the holy of holies of telecom companies — SS7. The talk will address attacks aimed at: disclosure of subscriber’s sensitive data including his or her location, DoS, unauthorized intrusion into communication channel. The research also covers ways to get access to the SS7, types of protection against such attacks and methods of investigating incidents related to vulnerabilities in a signaling network.

Demo is available.

Duration: 45-50 minutes

Related topics: Mobile, New network attacks technologies, 3G/4G security, Protocol security/Exploitation, SS7 security.

• Overview of iOS Security Features
• Sandbox Permission Leaks
• Application Security and Attacks
• Script-initiated Attacks
• Implementation of Script-initiated Attacks
• Defense Advices on Script-initiated Attacks

Introduction to CTF competitions, my life and learning experience, difficulties I have confronted with, introduction to tools and techniques in CTF, for instance: binary patch

Introduction to bamboofox

N/A

A Hybrid Malware Probing System for Android Applications (APKProbe)

Google's Android is the world's most prevalent mobile operating system, and as such has become a target for cyber criminals seeking to exploit it as an attack vector. Today the security community typically uses two approaches in analyzing the security of an Android application: 1) static analysis of Java source codes by decompiling the APK (Android application package); and/or 2) dynamic analysis of the running APK inside a virtualized environment. Unfortunately, these approaches are not always effective due to: 1) increasing number of obfuscator (scrambling source codes into nonreadable) and packer (encrypting source codes into anti-decompiling), and 2) anti-sandboxing techniques used by advanced malware to avoid being analyzed in virtualized environment.

In this talk, we present and demonstrate APKProbe, the first malware detection model (to our knowledge) tuned for analyzing Android applications, which combines both semantic-based static analysis to overcome packers and physical machine-based, dynamic analysis to circumvent antisandboxing techniques. Our proof-of-concept testing shows that such a hybrid approach yields acceptable results: 78% detection rate with 11% false positives.

Keywords: Android, Static Analysis, Dynamic Analysis

Security in hospitals and medical devices

Over the years we have seen much improvement in the space of cyber security and various industries like banking, entertainment, systems. However the healthcare industry has far to go in terms of understanding the risks on their infrastructure and the scope of improvement in their security policy.

Researchers have pointed out that the security in hospitals remains 5 years behind other industries.Some of the factors that are responsible for this include:

• Being un aware of the risks
• Non availability of skilled personnel
• Emerging new technologies and threat vectors

The talk shall discuss what the threats over a hospital architecture, the possible entry points and also the impact of a breach. It would also cover the devices in healthcare and how can they be abused using the HL7 protocol.

N/A

The legendary data recovery techniques, the notorious espionage firmware EQUATIONDRUG which even cannot be formatted by the NSA...what are these all about? Can we only rely on costly professional hardwares and equipments to learn about the techniques? This talk will guide you through the untold secrets of hard drives with the firmware tools developed by OSSLab.

N/A

Abstract

Plead is an advanced RAT written in shellcode. Though seldom discussed publicly, it has been used to target governments, thinktanks, corporations, media etc in Taiwan for several years.

In this talk, we will give technical analysis of its functionality and reversion. We'll also show you how compromised devices are used by PLEAD as its C2 cloud to attack Taiwan. Finally we want to discuss the relationship between Plead with another notorious group, Taidoor, from their ovelapped C2 infra.

Agenda:

• Introduction
• Plead began
• Plead analysis
• Plead malware families
• Phantom in routers
• Conclusion

IoT devices are claimed to be vulnerable to massive attack. We tried to assess the status quo with two IoT honeypots in Taipei and Munich, backed by real devices like LIFX, Philips Hue, D-Link and Samsung IPCams, gaming consoles, WDCloud and SmartTV. After four months of observation, we conclude that IoT is somewhat "probed" but still far from being massively attacked.

Undoubtedly, playing games is one the most public entertainment.

The output value of mobiles games reach dozens of billions dollars every year. However, most companies never notice the security problems of their games so far. Indeed, most developers have been working overtime with all their strength for endless features and migrations; no one would like to mention the security issue.

So now, I would like to share some easy ways to enhance a mobile game that just downloaded from stores, which includes adding features, fixing bugs, improving the UI, and even boosting the performance. It should work for most online and offline games.

With the enhancement of network speed and stability, mobiles games will become a focus sooner or later. I hope I can give an early-alarm to game developers and players to think highly of mobile games security.

N/A

Being a member of an awesome CTF team is a rewarding experience. CTF players push themselves, forgoing sleep for the promise of cracking a challenge and getting that flag. Between CTFs, they practice and work on tools and strategies. Friendships are forged on and off of the "battlefield".

Shellphish is the oldest active CTF team in the world. We were there from the beginning of the sport (or, at least, almost the beginning). What's more, Shellphish is thriving -- we prepared for and coordinated in our successful qualification for this year's Defcon CTF and the DARPA Cyber Grand Challenge, with the qualifying events weeks apart. Aside from being the oldest team at DEFCON CTF, we are also one of only two CTF teams among the CGC finalists.

We're not bragging, we're just extremely enthusiastic! In this talk, I'll discuss two topics: Shellphish itself, and our participation in the DARPA Cyber Grand Challenge.

First, we'll start with our team "culture" -- what enables us to maintain such an enthusiasm, for such a wide variety of activities, for such a long time? How does Shellphish continue to exist and grow? How do we attract and train new members?

Then, we'll move on to some of the interesting stuff our team does -- specifically, the main focus of the talk will be Shellphish's participation in the DARPA Cyber Grand Challenge. How does a ragtag group of hackers manage to qualify for such a complex, difficult competition? What pushed our team to do it? How did we organize the effort, integrate the right tools, and ensure success? We'll go through Shellphish's whole brainstorming, design, implementation, and competition process.

After the talk, you'll understand the different components of the Cyber Reasoning System that we ended up with, what motivated us to design the system the way we did, how it works, and how it's applicable to CTFs in general. We hope to show that a group with the right focus and skills can succeed and have fun when participating in highly-competitive security challenges.

N/A

Due to software quality issues, recent attacks on various systems are getting serious, and the software security issues therefore become an important research topic. These attacks on the software vulnerability will not only endanger the information infrastructure, but also impact the human safety. To improve the overall robustness of the system, we need a penetration test system to audit related systems. We have proposed the concept of the exploit toolchain to automate the whole process of fuzzing, exploitation, and post-exploitation integration with the metasploit framework.

For the exploitation process, we must be able to bypass the recent protections and mitigations of the operating system, for example ASLR (Address space layout randomization) and DEP (Data Execution Prevention). We have enhanced the ROP (Return-oriented programming) technique to bypass ASLR and DEP protections by searching gadgets with larger sizes.

N/A

N/A

In 2014, Microsoft introduced two new exploit mitigations, called Isolated Heap and MemoryProtection.These mitigations greatly increases the difficulty of use-after-free(UAF) vulnerability exploit, but there are still many ways to bypass the mitigations when the pointer to the freed block didn’t remains on the stack.

In order to completely prevent UAF vulnerabilities exploit，Microsoft Edge browser introduced a new memory management called MemGC. MemGC Use the mark and sweep algorithm for memory management.

In this presentation, the first part will sketch the MemGC Internals by discussing about its data structure, its memory allocate, free, mark and sweep. The second part will discuss Why MemGC can effectively prevent the UAF'S exploit. The third part will discuss some weaknesses of MemGC.

Defending against Advanced Persistence Threat (APT) attacks has become a blooming topic in recent years. Organizations, enterprises, and specially governments have all been designated targets of APT attacks. Since APT attacks are well crafted with advanced tactics, potential targets of APT attacks should understand how to detect, prevent, and respond to these cyber attacks.A newfangled trend that has been affecting people’s lives is the cloud service technology. Almost everybody enjoys the cost efficient and convenient features of cloud services. Yes, almost everybody, including actors. Hackers love cloud services just as much as you do, and probably even more so. When sophisticated hackers recognize the benefits of cloud services on their attack infrastructure, a second front is opened.In this talk, we will present APT malware which leverage several cloud services (including numerous blog services provided by multiple platforms, and cloud storage services such as Dropbox, Google Drive, Cloudme…etc) as their attack infrastructure. We will introduce our analysis of malware and explain how actors perform their attacks through the cloud. Additionally, we will explain the advantages malware brings with cloud services and how to respond to these threats. Furthermore, we will also uncover potential targets of these trojans, which might be a bigger concern to the audience.