For the 7th time in a row Stormbringer and I visited the Chaos
Communication Conference in Berlin. It was fun as always, I had my
second talk about libdetox and we were able to drink many beers and I
also listened to some interesting talks. A writeup about the different
talks follows:
Day 1
Rop Gongrijp: 27C3 Keynote - We come in Peace
Rop talks about Wikileaks, free speach, journalism and how unhappy
people can be used to change the world. An angry energy is needed to
change something. Although we come in peace it is important to use our
unhappiness to change something.
Branko Spasojevic: Code deobfuscation by optimization
Static binary translation is used to remove obfuscation. Basic blocks
are merged and false conditional jumps are removed using static flag
tracking. This approach is very limited as no dynamic data is checked.
Dominik Herrmann lexi: Contemporary Profiling of Web Users - On Using
Anonymizers and Still Get Fucked
Distinguish individual anonymized web users using the set of hosts they
access. Use machine learning and patterns to differentiate between
individual users. Find bots that access weird patterns. Solution to hide
from these analyses: Use additional background web-traffic that
obfuscates real traffic.
Felix Gröbert: Automatic Identification of Cryptographic Primitives in
Software
Use PIN on windows to analyze malware and automatically find crypto
blocks inside the application. Generate execution trace with all
executed instructions. Categorize cryptographic algorithms and select
instruction combinations that are used by these algorithms. Search for
these instructions, search for loops and categorize crypto.
Collin Mulliner Nico Golde: SMS-o-Death - From analyzing to attacking
mobile phones on a large scale.
Get large collection of phones, get baseband station, get a faraday cage
and start fuzzing SMS to kill phones.
Peter Stuge: USB and libusb - So much more than a serial port with
power
How to handle USB devices and how to use libUSB. New findings for USB1 /
2 / 3
vanHauser: Recent advances in IPv6 insecurities
Bruce Dang Peter Ferrie: Adventures in analyzing Stuxnet
A Microsoft-take on analyzing malware. Insights into the structure of
malware decompilation. Description of all the 0day exploits used in
Stuxnet. (And yes, the exploits are really embarrassing for Microsoft).
Great talk!
Alien8 Astro: Pentanews Game Show - Your opponents will be riddled as
well
Game show with nerd questions. Most of them too easy.
Day 2
Michael Steil: Reverse Engineering the MOS 6502 CPU - 3510 transistors
in 60 minutes
Interesting talk about the MOS 6502 CPU (used in Nintendos, Apple II and
so on).
Karsten Nohl Sylvain Munaut: Wideband GSM Sniffing
Use super cheap mobile phones (4 of them) to sniff GSM communications.
Use SMS routing information to get location of target phone, find cell,
get close to target phone (to the same cell), decrypt TMSI - temporary
session key, wait for call, decrypt call using rainbow tables. BAM,
cheap surveillance.
Karsten Becker Robert Boehme: Part-Time Scientists - One year of
Rocket Science!
Nerds trying to get to the moon. They already built the rover and are
now building the lander. Nice pictures and some information about how to
get to the moon and what to do if you are only a part-time scientist.
FX of Phenoelit: Building Custom Disassemblers - Instruction Set
Reverse Engineering
Inside of the Stuxnet code there was a lot of SS7 code that is used for
Siemens Controllers. FX developed a disassembler for these machine codes
using a free version of the Siemens compilers. He reverse engineered the
complete tool-chain and verified that parts of the code were
disassembled correctly. He also showed bugs in the Siemens disassemblers
and how to hide hand-written code from the Siemens disassemblers.
Andreas Bogk: Defense is not dead - Why we will have more secure
computers - tomorrow
Talks about the SAFE computer of the DoD. Use type-safe languages with a
garbage collector to reduce bugs. Use type-checking and type-guarantees
even on operating-system level. Construct additional hardware that
type-checks all objects as well.
Daniel J. Bernstein: High-speed high-security cryptography: encrypting
and authenticating the whole Internet
Get rid of DNSSEC and encrypt every single communication. Use UDP
instead of TCP and move everything to a secure protocol. New protocol,
new form of DNS, view from the perspective of a cryptographer.
Ralf-Philipp Weinmann: The Baseband Apocalypse - all your baseband are
belong to us
Ralf-Philipp Weinmann: The Hidden Nemesis - Backdooring Embedded
Controllers
Day 3
bushing marcan sven: Console Hacking 2010 - PS3 Epic Fail
How to hack secure crypto systems and how to break the chain of trust.
Finding bugs in console software... They had a couple of nice exploits
to get around the software security system of modern consoles and showed
a way how they could install and develop homebrew software on modern PS3
consoles.
Henryk Plötz Milosch Meriac: Analyzing a modern cryptographic RFID
system - HID iClass demystified
Use old legacy information about RFID to crack the new cards. Use holes
in crypto systems or wrong implementations to escalate privileges.
Harald Welte Steve Markgraf: Running your own GSM stack on a phone -
Introducing Project OsmocomBB
Get old and cheap phones, crack level 1 software and use a serial line
to control the phone. Implement 2nd, 3rd, and higher levels in software.
Make calls and send texts in a complete open-source and free
implementation.
Steven J. Murdoch: Chip and PIN is Broken - Vulnerabilities in the EMV
Protocol
Harald Welte: Reverse Engineering a real-world RFID payment system -
Corporations enabling citizens to print digital money
Free money in Taiwan. They use the Mifare system for public transport
and for small payments. They use a card-only validation scheme that
relies on the security of the card only. All state is safed on the
customer card. Generate your own card with your individual amount of
money on that card. Get free stuff.
Felix von Leitner Frank Rieger: Fnord-Jahresrückblick 2010 - von
Atomausstieg bis Zwangsintegration
Genial wie immer. Spassiger Jahresrueckblick.
Damien M: illescamps Julien Vanegue: Zero-sized heap allocations
vulnerability analysis - Applications of theorem proving for securing
the windows kernel
Ray Stefan 'Sec' Zehl: Hacker Jeopardy - Number guessing for geeks
Fun as always :)
Juergen Pabel: FrozenCache - Mitigating cold-boot attacks for
Full-Disk-Encryption software
Day 4
Julia Wolf: OMG WTF PDF - What you didn't know about Acrobat
Security holes in the PDF parser. Find problems and discrepancies in
different PDF parsers. A PDF can be hidden in a ZIP that can be hidden
in an EXE file. Stack different types and get around the protection of
AV products.
maha/Martin Haase: Ich sehe nicht, dass wir nicht zustimmen werden -
Die Sprache des politischen Verrats und seiner Rechtfertigung
Stilistische Tricks ueber Sprache, Politik und Umgebung
Sergey: Hackers and Computer Science
Sergey talks about the hacker culture and hacker ethics in general. Nice
easy-listening talk about the nerd/hacker culture.
kornau: A framework for automated architecture-independent gadget
search - CCC edition
Automatically find gadgets in programs for return to libC attacks. Finds
function tails that can be used as new gadgets. Also checks
half-instructions (e.g., jumping into an instruction to get a different,
unintended instruction).
Lars Weiler: Data Analysis in Terabit Ethernet Traffic - Solutions for
monitoring and lawful interception within a lot of bits
Product show of different black boxes. Connect multiple network ports to
black boxes. Black boxes filter and drop lots of traffic. Remaining data
can be analyzed by normal PC / analysis machine.