Shmoocon 2009 Notes

I attended Shmoocon V over the weekend and had a good time as usual. There are always interesting people, the usual suspects, and some good talks. I think Shmoocon is still a great conference for the money. The bags given to attendees this year were by far the best of the four years I've been. There were some very good entries to the Barcode Shmarcode contest and I also saw some entertaining runs through the lockpick contest.

These notes do not include every time slot.

Friday

1500: Bruce Potter started the con with his opening remarks. He said that Shmoocon added around 500 tickets this year, bringing the total number of attendees above 1600. To have enough space, they had to add another room down the hall from the main area. The satellite room was out of sight of the main area, but not too difficult to find. Potter said that moving to the next larger space available instead of adding the one room would have been overkill and cost too much for the number of attendees.

One of the things I really like about Shmoocon is their involvement in charities. As usual, tshirt proceeds went to charities, in this case the buyer's choice between the EFF and Johnny Long's Hackers for Charity. Shmoocon also had a raffle with proceeds going to Covenant House, as did the proceeds from the Hacker Arcade. It is nice to see Bruce and other Shmoocon organizers promoting charity among their peers.

Potter often will make a small comparison between Shmoocon and other conferences, and this year he mentioned other conferences charging large amounts for training. Conversely, at Shmoocon if you want to learn something in a non-classroom environment, you can try to participate in Shmoocon Labs to help build a functional enterprise-like environment rather than just slapping together a simple wireless network. As an example, this year they had an open wireless network, a WPA-enabled wireless network, and third using RADIUS. All attendees are welcome to walk through the room serving as their NOC and ask questions.

I really like The Shmoo Group's philosophy when it comes to running a conference. They try to be very transparent and take feedback, don't overcharge, and just generally want everyone to have a great time while still providing good technical content. It's a really attendee-friendly conference, right down to the 0wn the Con talk near the end.

Finally, Potter went on a rant about how security isn't working. Nothing to see here, move along. ;)

1600: The first technical talk I heard was Matt Davis and Ethan O'Toole presenting Open Vulture - Scavenging the Friendly Skies Open Source UAV Platform. Open Vulture is a software application and library designed to control unmanned vehicles. It was a neat talk though not a topic I know much about. Some of the possible uses for this would be controlling an unmanned vehicle to sniff wireless networks or take photos. They even have a GPS navigation module.

Saturday

Saturday is always the meat of the conference since it is the only full day and most people haven't been there long enough for the late nights to catch up to them.

1000: I enjoyed Matt Neely's presentation, Radio Reconnaisance in Penetration Testing. Matt had a lot of practical advice for radio reconnaisance, including recommending some relatively inexpensive hand-held scanners, the AOR 8200, Uniden Bearcat BCD396T, and the Uniden Bearcat SC230, which also happens to be a good choice for NASCAR. He pointed out what features to look for in scanners, for example channel memory.

His anecdotes from penetration tests included sniffing wireless headsets from blocks away, even when the phone is hung up. Apparently, many wireless headsets transmit constantly even if on the cradle, effectively functioning like a bug for eavesdropping. He has also used video converters when sniffing video.

When testing a client's casino, he visually scouted the location to help identify their hand-held radios, and then was able to get information from casino security through their radio communications, including their radio link to the police. He got a ton of information useful for social engineering and more, like guard names, the dispatcher's name, times of shift changes, and the lingo used by the guards.

At another client site, he noticed people using wireless headsets and got those added to the rules of engagement. Once they were added, he was able to eavesdrop on calls to the help desk for password resets, people calling their voicemail, and found that the headsets would keep transmitting even when the phone was hung up. Matt was able to get passwords, voicemail passwords, and assorted Personally Identifiable Information (PII) that was sensitive or could be used for social engineering. Rules of engagement and adhering to applicable laws are very important if you don't want to end up in jail after eavesdropping on voice communications.

I also talked to Neely the next day regarding learning about RF for a personal project I am interested in. He was very helpful and nice, just like most Shmoocon presenters I've ever spoken with. Hopefully, I will have time to start learning more about RF and playing around with it for a "fun" project.

1100: Next, I attended Fail 2.0: Further Musings on Attacking Social Networks presented by Nathan Hamiel and Shawn Moyer. Their talk was fun and definitely relevant. Their main focus was that "social engineering + vulnerabilities in social networks = ROI". They pointed out a number of ways to manipulate various social networking sites, including malicious code like IMG to CSRF, CSS javascript hijacking, and request forgeries (POST to GET).

One good anecdote was getting permission from Marcus Ranum to make a phony profile in his name and then using it to socially engineer others, particularly security professionals, on a social networking site. They actually got Ranum's sister to attempt to contact them through the phony profile.

Hamiel and Moyer demonstrated technical tricks to force someone to "friend" you and also posting a comment with code that will force the user to log out, effectively denial-of-servicing the person off his or her own profile. They also told anecdotes about posing as a recruiter, joining groups on LinkedIn so they could more easily build up a lot of connections, then looking for candidates with government security clearances and getting many responses to their inquiries.

1400: I skipped the 1200 talks to have a long lunch with some friends, then attended Jay Beale's Man in the Middling Everything with the Middler. The talk had a very slow start because of audience interaction, particularly involving Shmooballs and launchers.

Jay Beale's Middler is a tool to help leverage man-in-the-middle attacks, including injecting javascript, temporary or permanent redirects, session hijacking, and more. It seems like a neat tool and was released to the public at his talk. Jay pointed out some dangers of mixed HTTP and HTTPS sites and their vulnerabilities to things like injected javascript, stored session keys, intercepted logout requests, and replacing HTTPS links in proxied pages with HTTP links. Although the Middler has some specific support right now for attacking social networking sites and wide area sites like Google/GMail and live.com, it uses a plugin architecture so we should expect to see more plugins targeting specific sites.

1600: I had heard a good talk last year by Enno Rey and Daniel Mende, and combined with my focus on network security monitoring I definitely was interested in their presentation this year, Attacking backbone technologies. Their main focuses this year were BGP, MPLS, and Carrier Internet, one example of the latter being Carrier Ethernet. They were careful to point out that you really have to be part of the "old boys club" of trusted backbone providers to successfully use most of their attacks and that not just anyone would have enough access to core backbones to download their tools and use them for successful penetration testing or attacks.

For BGP, they mentioned that it is mostly manually configured, thus making it susceptible to simple mistakes like the famed AS7007 incident or the Youtube/Pakistan blocking incident. Rey and Mende also did a live demonstration using their "bgp_cli" tool to inject routes, and demonstrated how a single BGP packet signed with MD5 can be used to crack rather than brute forcing directly against a router that limits the number of attempts per second.

Multiprotocol Label Switching (MPLS) is deployed on carrier backbones and uses a trusted core assumption while attacks from outside the core are not possible. Rey and Mende demonstrated their "mpls_redirect" tool to modify MPLS Layer 3 VPN labels and redirect traffic. This is possible in part because of trusting carrier insiders and can be used to send traffic to different customer networks. Rey had a great line where we called it "branching" the traffic because he was told, due to his thick German accent, he should not use the word "forked" (or "fokt" as it sounded when he said it).

These two definitely are in a position to test the security of major providers from an insider perspective, which is not the norm, and they do a good job explaining some of the issues they find.

1700: David Kennedy's Fast-Track Suite: Advanced Penetration Techniques Made Easy was probably the most crowded presentation I attended. One suggestion I have for getting a good seat at Shmoocon is to plan your schedule ahead and note the presentations that are likely to be crowded. If you are not changing rooms, do not get up and lose your seat, because rooms definitely end up standing room only sometimes.

Kennedy was a good presenter. When you have fun on the podium, it definitely shows and keeps everyone attentive. He had a lot of audience participation as he showed a slide and said "Let's Pop a Box" each time before he used Fast-Track to own a system. When he started to forget "Let's Pop a Box," someone from the audience would invariably ask him if he forgot something or shout "Pop a Box!" as Kennedy did a face-palm.

Fast-Track itself is obviously pretty neat. He showed a variety of automated attacks against different targets that most often ended with a reverse shell back or reverse VNC back to his attacking system. He also talked about his evasion technique using Windows debug to download his stager, which is actually just a version of Windows debug without the 64k size limit.

Fast-Track 4.0 includes some new features like logging and payload conversion so you can load your own payloads to deliver. Although Fast-Track has a smaller list of exploits than Metasploit, Kennedy said that he strives to make them available across as many OS versions as possible. Version 4.0 also includes a mass client attack using ARP poisoning combined with emailed links to targets. The malicious page will display a generic "loading please wait..." message as it launches a multitude of attacks, but Kennedy said that 4.1 will also include browser profiling for more targeted exploits. One really nice feature is the auto-update to update a multitude of tools included in Fast-Track. Although I didn't look into it yet, I did wonder if it had any SNMP attacks and I think a SNMP auto-own attack would be a neat and not too complicated addition if it's not there yet.

Sunday

1000: I really feel for anyone in this time slot. After a weekend of hacking and partying, the number of people in any room is much smaller than the number of people at 1000 on Saturday. The numbers increase as people drag themselves into the talks through the hour.

I attended Re-Playing with (Blind) SQL Injection by Chema Alonso and Palako during this hour. I was starting to think I made the wrong choice because they started off slow and quite dry, but maybe they were included in the ones recovering from the previous night's festivities. By the second half, they started to have a little fun and had some funny moments, including a slide with, "Yes, we can!" Another funny moment was when they found a database username length of two and referred to it as "the most famous Microsoft SQL user..."

Although we've all probably seen or read about blind SQL injection before, they did have some interesting techniques and used their Marathon Tool to ease the tedious nature of blind SQL injection. One thing I liked was their method of using timing to seperate a True answer page from a False answer page if there is no visible or code difference. Most SQL engines have slightly different supported methods to introduce time-based blind SQL injection so a response that is timed above a certain value can be considered true. Even those that don't include time-delay functions can be leveraged with by running a "heavy" query only if a "light" query first returns as true. An example of a heavy query that would slow the response after a successful light query is multiple cross-table joins.

Alonso and Pakato also did a good job answering questions. They definitely seemed more comfortable by the end of their presentation.

1100: Chris Paget is a very entertaining presenter and clearly had fun showing off his RFID reader during EDL Cloning for Under $250. He demonstrated how easy it is to read, clone, and write RFID cards created as part of the Western Hemisphere Travel Initiative. By design, these cards are supposed to be readable from 30 feet but it is trivial to read them at more than 200 feet and much longer distances, possibly around half a mile, should be possible. The cards also have no encryption or authentication.

Paget was able to buy an enterprise-level card reader by Motorola on eBay. Although he needed to perform some repairs on the RFID reader, the whole sniffing setup was only around $250. The card reader has no real security mechanisms for logon and listens on port 3000.

There are no federal anti-skimming laws to prevent RFID skimming/sniffing, though CA and WA states do have laws. Paget was able to grab a lot of information through war driving with his setup and pointed out that correlation means the cards can provide more than just an anonymous number. For instance, if you detect the same card tag twice you could compare it to photos to see whose face you saw twice. You could also correlate against other data like credit cards containing RFID to figure out which data belonged to which person.

Eventually as RFID cards become more common, this could present more serious issues like collecting tons of RFID card data until you get one where the person's appearance is close enough that you could use his identity, or terrorists could use it to identify targets in a crowd.

Paget stated that the supposed purpose for the cards was to enhance security, which clearly is a failure, and also to speed border crossings, which also has been a failure since users still have to present their cards directly. Paget believes that WHTI is broken but that RealID could be an alternative if it was revamped to fix all the serious problems. Ideally, among other recommendations, he advocates a contact smartcard rather than one that can be read remotely.

Another Shmoocon in the books. Thanks to the Shmoo Group, speakers and attendees for a good time.

Tweet

Shmoocon 2009 tickets

Tickets for Shmoocon 2009 went on sale at noon EDT today. All the "Early Bird" tickets for $100 went quickly but there are still some "Open Registration" for $175 and "I Love Shmoocon" for $300.

I like the way Shmoocon sells their tickets using three different rounds with three different price points in each round. Here is their chart with dates of sales. Noon is always the start time. Shmoocon itself is February 6 - 8.

Date Tickets to be Sold	Early Bird	Open Registration	I love ShmooCon
November 1, 2008	200	300	10
December 1, 2008	200	300	20
January 1, 2009	100	100	20

One really cool contest I noticed this year is Barcode Shmarcode. The Shmoocon ticket has always been simply a barcode they email to you after you purchase. This year, they want people to modify their barcodes to be unique and awesome while still scanning properly. They'll grade on originality, best use of theme, best use of materials, and most error free scan. I look forward to seeing the results.

Tweet

Shmoocon 2008 Notes

I attended my third Shmoocon in a row, Shmoocon 4. As with most conferences, there were some winning talks and some that struggled. I'll have more to say about over-all quality when I discuss the "0wn the Con" session. Since I find myself with a fairly fuzzy memory about specifics of talks I attended at previous Shmoocons, this post is mainly to prevent that from happening again.

I went to H1kari's talk titled "Intercepting Mobile Phone/GSM Traffic." Once again, he was talking about using FPGA, this time to assist in breaking GSM encryption. He also had a lot of nice tidbits about weaknesses in GSM, both in implementation and design. I didn't take notes, but I seem to recall that he mentioned some broadcasts occurring in plain text and that, for some reason, the last 10 bits of the A5 key are zeroed out. (Someone correct me if I am remembering incorrectly). After he finishes computing what are basically GSM rainbow tables, H1kari was talking about cracking GSM in as little as 30 seconds using 16 FPGA and a large amount of disk space. The rainbow tables are being computed using 68 FPGA.

He didn't really address 3G other than saying it is generally superior in terms of security when compared to GSM.

I wandered into the last few minutes of Deviant Ollam's "New Countermeasures to the Bump Key Attack". Although I didn't see enough to comment on the content of the talk, he was getting a great response from the audience and seemed like an entertaining speaker.

The keynote was supposed to be by Edward Felten of Princeton's Center for Information Technology Policy. He apparently had the flu, so one of his graduate students, J. Alex Halderman, had to stand in. Halderman did quite a good job talking about their experience auditing and exploiting voting machines, especially considering what was probably short notice. Most of the information from the talk was widely circulated by the media at one point or another. The keynotes have been consistently good at Shmoocon, so I plan on getting to the keynote at any future Shmoocon I attend.

On day two I attended "SIPing Your Network" by Humberto J. Abdelnur, Radu State and Olivier Festor. There was some very interesting technical content, including discussion of fuzzing, remote eavesdropping, crashing one particular phone using a single packet with an empty data field, and attacking HTTP-enabled phones with cross-site scripting and SQL injection. Their SIP fuzzer is called KiF.

The presenters stated that they can remotely eavesdrop by dialing an IP phone, having it pick up with no user interaction, and then leave the phone in a state where it appears that the call is hung up but the phone will still send voice data. They had technical difficulties with a demo, and really waited too long to skip the demo and push on. They lost some of the audience as a result, but other than that I thought it was a good presentation.

At the end, the presenters, who are French, had a slide with information on their SIP fuzzer's license. The presenters indicated that, since it could be classified as an attack tool and because of French law, there are some restrictive requirements including that the license agreement has to be signed and sent in by the end user via snail-mail.

Jay Beale presented "They're Hacking Our Clients! Why are We Focusing Only on the Servers?" I didn't see any of his opinions as particularly surprising, but it was well presented and he was engaging. It did surprise me when a comment from the audience accused him of fear-mongering. At least in my experience, it is so simple to exploit clients and get internal access that the notion of needing a smart attacker to write a custom exploit against locked-down servers is unnecessary. At this point, I agree with what I think Beale was trying to point out, which is that security has been so focused on Internet-facing servers that clients are relatively easy to exploit and leverage in an attack.

Beale talked about problems with small offices that have private information on client workstations, using the example of his dentist. This struck home for me since my friend mentioned sitting in his dentist's office once and finding their WAP wide open with the factory default administrator account and password.

During the portion of the talk devoted to the difficulty with keeping Windows clients up-to-date in an enterprise, he mentioned non-standard or non-Microsoft software, and vulnerable browser plugins, Adobe Acrobat's plugin for example. It made me think of Richard Bejtlich's posts about thin clients. Of course, thin clients present their own problems and aren't immune to all the security problems of stand-alone desktops, but they may offer advantages by reducing the burdens that are a part of updating.

"VoIP Penetration Testing" by John Kindervag and Jason Ostrom was another interesting talk about voice over IP. The main focus of the presentation was Ostrom's VoIP Hopper, which is a nice pen-test tool that he used to show how insecure VoIP implementations can be. With Cisco VoIP phones, he showed how their default install has the PC-port on the back enabled, it sends out CBP packets, and it has a sticker on it with the MAC address. Some or all of these defaults can be used along with VoIP Hopper to gain access to the VoIP VLAN.

"Advanced Protocol Fuzzing - What we learned when bringing Layer2 logic to SPIKE Land" by Enno Rey and Daniel Mende was a good example of two guys with a strong background in networking who decided to bring fuzzing into their area of expertise and share what they learned. Within a relatively short time, my impression was that they went from little experience fuzzing to customizing SPIKE, and they successfully did a live demonstration showing their ability to crash a Cisco 35xx-series remotely. Dave Aitel already mentioned it on his DailyDave mailing list. This was pretty cool stuff, and it will be interesting to see how quickly others jump into the game.

"0wn the Con" with the Shmoo Group is a talk they have every year that discusses their finances, selection process for talks, methods of collaboration, and more. They also took a lot of feedback from the audience. The main thing I want to point out is that it is really hard to get both consistently good presentations and not rely on the same few presenters every year. Shmoo doesn't want the same old thing, but they want good talks, so it is a difficult balance between risk and reliability. I would say the talks are inconsistent in quality, but it is worth it in my opinion to prevent the talks or presenters from being stale, or having too many repeats from other conferences.

One funny thing is that it took this long for someone to suggest making electronic feedback forms available on the Shmoocon website for each talk. Four years into it, and finally someone has the brilliant idea that people should be able to provide feedback from their laptops while they're listening to the talk instead of using a pen and paper and turning it in at the end of the conference. D'oh!

Tweet

Black Hat DC and Shmoocon 2008

Since Richard is a corporate schmuck now, I see the only training he is offering for the year is at Black Hat DC in February. I have heard him as a speaker at Shmoocon and in some smaller groups. I seem to recall that he presented a snippet of TCP/IP Weapons School at one local meet and would definitely recommend it. I think he will be ready to tweak the class to the appropriate skill level of his audience.

The Black Hat training classes seem decent if unsurprising. Metasploit 3.0, Reverse Engineering with IDA Pro, ROOTKIT, TCP/IP Weapons School, and Web Application (In)Security probably would interest me the most. Instructor-led training is expensive!

Speaking of Shmoocon, I plan to be there for all three days. It's an enjoyable event.

Tweet