What We Saw at Black Hat 2022
The 2022 Black Hat conference—summer'southward week-long commemoration of all things infosec—kicked off with an inspiring exhortation by Parisa Tabriz, Director of Engineering at Google. She urged attendees to forget the status quo and stop playing security Whack-A-Mole.
Using examples from her oversight of Google Chrome and the Project Zero team, she laid out iii principles to improve security research. First, don't just fix problems as they popular upward; seek the root cause. Second, place milestones in your process and celebrate reaching them. (Nothing fancy; she mentioned a poetry slam and homemade HTTPS cake.) Finally, build out your coalition. Keep advice most your project and its progress open upwards to direction and outward to colleagues and partners.
With the keynote satisfyingly complete, we headed for the always-enlightening sessions. Of course, we two reporters couldn't perchance comprehend them all, but we charted a path visiting sessions that would interest both ourselves and you, our readers. Nosotros plant plenty to adore—and to fear.
SATCOM Hacking For Fun and Terror
In 2022, researcher Ruben Santamarta presented several proof-of-concept attacks on satellite communications (SATCOM) systems. Four years later, he returned to Black Chapeau to show that his concepts were non only real but far rosier than the truth.
Not merely are SATCOM systems loaded with backdoors, making them badly easy to control remotely, but Santamarta as well found that many are accessible via the cyberspace. During his research, he was able to discover airplane systems registering on the Shodan search engine while the planes were flying. He even saw malware trying to automatically install itself on an airplane, and he found all kinds of botnets sitting on maritime SATCOM systems.
The most shocking discovery Santamarta made was that he could potentially use a hijacked antenna as a weapon. Not only could he indicate the antenna at whatever he wished, just he could too coax it into transmitting far more power than it was ever intended to ship. This could cause electronic systems to malfunction and even crusade burns on people. It was the kind of startling, sobering talk filled with rueful laughter that really makes Black Chapeau complete.
Self-Driving Cars Are Surprisingly Safe
Chris Valasek and Charlie Miller used to display dramatic car hacks—for example, remotely taking control of a Jeep and driving it into a ditch. They now work for Cruise, GM's cocky-driving auto division. Instead of attackers, they're now protectors, working to brand self-driving cars prophylactic.
Miller and Valasek always put on a good show. They antiseptic the taxonomy of cocky-driving cars, from the automation-complimentary Level 0 to the current Level 4, which is completely automatic but restricted to driving a known area. Sad: Level five, Kitt from Night Rider, doesn't exist nonetheless.
Expert news! Those stories you lot read about tricking self-driving cars by modifying street signs, blinding their radar, and so on? They're but not true. Modern cocky-driving cars run only in areas that have been exhaustively mapped. Even if you should knock downward a stop sign, the car still knows to stop. You're probably safer in a self-driving car than in ane yous're driving yourself.
Enter God Manner
Researcher Christopher Domas has spent a long time mucking effectually in the guts of computers, looking for means to exploit vulnerabilities in depression-level processes. We're talking most the stuff that makes your CPU run here. While researching patents related to the x86 CPU compages, he discovered several clues that suggested that undocumented commands could allow someone with the lowest level of access on a computer (ring 3) to leap to the highest level (band 0).
After buying 57 computers for enquiry, Domas set near looking for these secret commands. He chose for his target the VIA C3 CPU that had a hidden RISC core aslope the x86 core. To search out the hidden commands, he treated it like a black-box problem, sending in tons of inputs and observing the outputs to divine what was happening in the middle.
Using timing side-channel analysis, Domas was able to determine when 1 of his inputs did something. During his research, he would have to use a similar technique several times. At one betoken, he had seven computers hooked upwards to a main computer that could automate the procedure of sending possible inputs. He fifty-fifty set a relay box to power-bicycle the test computers when they inevitably froze up from the instructions he sent. This portion of the enquiry solitary took three weeks of constant testing.
Domas' difficult work was rewarded when he eventually discovered all the necessary steps to talk to the hidden RISC core and use information technology to gain a level of access that should be incommunicable. Information technology's the kind of story Black Hat
Sirenjacking
When security researcher Balint Seeber moved to San Francisco, he was startled by the weekly ritual testing of the emergency sirens. He quickly moved to marvel most these wailing horns mounted on poles around his city and began to wonder how it all worked. Fortunately, Seeber is really into radio, and he set to work discovering what made these systems tick.
Forth the fashion, he spent hours surreptitiously mapping and photographing sirens around San Francisco, looking for clues equally to how they communicated. He also grabbed tons of data with software-divers radio and an enormous system of antennas installed in his attic. His detective work paid off when he not only reverse-engineered how the city of San Francisco controls its
Through an ethical disclosure procedure, Seeber informed the urban center and the siren manufacturer, leading to a patched system for the metropolis. Not only that, some additional work uncovered similar vulnerabilities in the siren system for Sedgwick Canton, Kansas.
Software-defined radio talks at Black Hat are always fun considering of the specialized knowledge and detective work that goes into the security research. Notably, Seeber was able to notice disquisitional pieces of information—including a look within the siren control box and sound of a Sedgwick canton siren control system broadcast—from local news broadcasts uploaded to YouTube.
Voice Authentication Cracked With Ease
Accept yous trained your smart speaker to respond only to your phonation? Practise you log into your online bank business relationship by speaking a special phrase? As voice recognition improves, some companies begin to treat it as voice authentication. John Seymour and Azeem Aqil, security experts from Salesforce, ready out to make up one's mind the safety of voice hallmark. Their goal: break into an account using a synthesized voice and practice it in a reasonable time, with reasonable hardware. That is to say, practise it in days, not months, using a desktop, not a server farm.
Using readily available open up-source tools and resources, they eventually came up with a method to go from a voice in a YouTube video to a functioning synthesized imposter in a 24-hour interval or two. Normally, the creation of a working vocalisation synthesizer needs 24 hours of audio input with transcription. They managed to get the job washed with 10 minutes of audio by amplifying the samples and using a technique called training transfer, which let them first teach the model to speak and then fine-melody information technology to match the target.
Attacking Critical Infrastructure
Any time you see the name Marina Krotofil on the Blackness Chapeau sessions list, information technology'south worth your while to attend her talk. Often highly technical, her work is some of the most interesting in the field of defending critical infrastructure such every bit factories and power plants from attackers seeking to disable or ransom them. Her previous work includes using bubbles to cripple a manufacturing plant. Yeah, bubbles.
At Black Lid 2022, she was joined by fellow researchers Younes Dragoni and Andrea Carcano. Together, they examined the Triton malware, which was designed to set on safety system controllers—the last line of defense at an industrial site. The researchers tore Triton apart and explained, step past step, what information technology does and why. Information technology's like following in the footsteps of the attackers.
For reasons unknown, Triton was never given a malicious payload to deliver. I thing the three researchers could conclude was that Triton was as well valuable a resources to just be intended to close down the factories it infected. It might have been fabricated for something far more dramatic or dangerous.
Hacking Voting Machines Is Easy; Reputable Elections Are Hard
The Russian interference campaign with the 2022 US election is the single biggest cybersecurity story since Edward Snowden, and it has renewed interest amid researchers about relevant issues, such as voting systems. Terminal year, Carsten Schuermann, an Acquaintance Profesor at Information technology University of Copenhagen, hacked a WinVote electronic voting machine at DefCon. This twelvemonth at Black Lid, he showed that while hacking these voting machines is trivially simple, confirming whether an attack has occured is enormously hard.
Schuermann had a lot to say about the importance of paper ballots and standard election audits in order to reinforce republic. But he also institute some weird stuff on the WinVote machine. Anomalous attempts to punch out via its modem, files that appear identical simply are flagged as altered, and a Chinese MP3 were just a few of the oddities. These really might be the earth's worst voting machines.
Fifty-fifty Sloppy Hackers Get the Appurtenances
Stealth Mango sounds similar a grapheme on an Adult Swim cartoon, just information technology's actually the name of a serious surveillanceware tool that's been implicated in nation-country attacks. Andrew Blaich and Michael Flossman of Lookout have a long history of discovering and taking down such nation-state malware.
Their presentation revealed that you don't have to be sophisticated or clever to plant malware and steal data. During the grade of their investigation, they found that Stealth Mango'due south creators hadn't locked down their ain systems, so Blaich and Flossman captured a re-create of the stolen information. They also found names, email addresses, and social media accounts of the perpetrators embedded in the code; sloppy! Pawing through the command and command servers, they identified the location of the attacks, in the government center of Islamabad, Islamic republic of pakistan. That control-and-control center is now kaput, but they await Stealth Mango's creators will be back.
Agreement Meltdown
The Meltdown vulnerability is notable for two things: being catastrophically bad and enormously widespread. This vulnerability, like the God
In their talk at Black Hat, three of the key researchers backside the discovery of Meltdown gently guide the audience through how Meltdown works and how they found it in the kickoff place. They also took a moment to call out the applied science industry as a whole, proverb information technology'southward time that critical components similar CPUs start being designed with security first, rather than speed and performance.
Cyber Warriors Need Beloved Too
This year Black Hat added a focus on mental wellness in cybersecurity, with four tracks devoted to the field of study. Josiah Dykstra and Dr. Celeste Paul, both researchers for the NSA, explored the trouble of stress for
Another session examined the connectedness between autism and cybersecurity brilliance. The panel included Rhett Greenhagen, who worked at the Department of Defence force for years, has been diagnosed as existence on the autism spectrum, and now does security research for McAfee; Casey Hurt, the Chief of Information Balls at the Department of Defense and Rhett's old boss; and Dr. Stacy Thayer, a specialist in organizational and business psychology. Talking most the problems and benefits of hiring workers on the autism spectrum, the panel concluded that such workers tin can be extremely helpful, seeing patterns others don't, as long as management supports them.
Dr. Christian Dameff, an Emergency Medicine physician, and Jay Radcliffe, a security researcher, spoke on fighting exhaustion, depression, and suicide in the security customs. And Jamie Tomasello, the senior manager of security operations at Duo Security and a certified information privacy professional, shed light on the of habit amidst those stressed out by a security career.
Air Gap? What Air Gap?
When yous actually, really need to keep a secret, it'due south a proficient thought not to put it on a motorcar connected to the internet. Only when you disconnect that secret-keeping estimator, you've created an air gap, and that'southward considered one of the best ways to keep data secure. Correct? Well, not then much.
Researcher Mordechai Guri has spent years finding new means to movement information off air-gapped computers in increasingly difficult scenarios. At Black Chapeau, he did a quick rundown of some of his great air-gap escapes.
He's found ways to leak data through speakers, fan noise, the sound of the arm in a difficult bulldoze, and magnetic fields. In one example, he created software that could convert the monitor cable into a rudimentary FM antenna to transmit data. In another scenario, he used the path betwixt the CPU and the RAM as a cellular antenna.
Fearless Twitterbot Hunters
If y'all recently lost a raft of Twitter followers, it's probably because Twitter swept abroad thousands of fake accounts—bots designed to spew spam or to amplify fake posts with likes and retweets. Jordan Wright and Olabode Anise, researchers from Duo Security, decided to meet if they could railroad train a machine-learning system to distinguish bot accounts from real people.
They used the Twitter API to gather a vast repository of accounts, tweets, and metadata. Using this data shop, they trained a auto-learning network to sort bot accounts from proficient accounts. Only the network wasn't equally accurate as they had hoped. Taking a different approach, they took their verified collection of
Defeating LTE Networks With Just $200
Running a cellular network is hard. Not only do yous take all those pesky consumers to worry about, but you besides need to manage and optimize all these cellular base stations to provide coverage for the cellphones. Enter Self Arrangement Networks (SONs). These are smart networks on which the cellular base of operations stations accept data from each other and the cellphones they service to automatically configure and optimize themselves for better performance and less homo intervention.
The trouble, as researcher Altaf Shaik discovered, is that the SON LTE blueprint is built on a error: it blindly trusts the information information technology receives from cellphones and other base stations. Using just $200 worth of equipment, Shaik showed how to confuse and entangle SON networks, force the shutdown of base
Cracking Cryptography at a Altitude
At past Black Hat conferences, we've seen techniques for keen cryptographic calculations by measuring changes in the voltage drawn by a smartphone or by measuring electromagnetic radiations emitted when electronic switches toggle between values. But the power-measurement pull a fast one on required replacing the smartphone's battery with a current-analysis tool, and the radio-moving ridge method worked only in close proximity to the phone.
A group of academics from Eurocom demonstrated a technique for neat crypto at distances upwards to 10 meters by borer the radio frequency racket emitted past a smartphone. Admittedly, the demo required a very specific setup. But they pointed out that since such tapping is possible at all, it could well become more than flexible and more unsafe.
Stealing Secrets from VPNs With Compression
Pinch is a skilful thing. It makes big files smaller and more manageable. VPNs are proficient things, too. They ensure that three-letter of the alphabet agencies and your ISP can't spy on or profit from your net traffic. Surely putting them together is a good matter, right?
Non exactly.
Using a Compression Oracle attack, researcher Ahamed Nafeez showed how he could extract hole-and-corner information that should be secured past the VPN. The assault hinges on how compression algorithm works: by taking repeated elements and replacing them with
The proficient news is that Nafeez'south attack hinges on the victim visiting an HTTP site, just these are rapidly condign extinct, and only equally rapidly, they're being flagged every bit malicious by default. We can thank Parisa Tabriz'due south Google Chrome team for pushing HTTPS to replace insecure HTTP.
When Skilful Security Goes Bad
Antivirus utilities typically eliminate known malware and ignore known proficient programs. Some of them ship unknown files, ones not known to exist either good or bad, to the cloud for farther analysis. And that'southward not necessarily safety.
Ido Naor is a senior researcher for Kaspersky, and Dani Goland is a self-styled "23-yr former coding machine." The ii are also cofounders of VirusBay, a social network that helps security researchers share ideas and samples. They pulled downwardly an immense quantity of files from a well-known antivirus aggregator, specifically choosing files that no antivirus detected as malicious. Running these through various filters and assay scripts, they turned up tons of information that should take been private, such as contracts and internal company communications. They concluded that security companies need to take a difficult look at sending private information to the deject for examination and should non retain not-malicious samples.
Fear, Loathing, and Two-Cistron Hallmark
You know that two-cistron authentication immensely enhances the security of your online accounts. So why don't yous use information technology? Dr. Jean Camp, a professor at the University of Indiana, and Sanhari Das, a
They then gave each study participant a Yubikey and observed equally the participants attempted to register the device on a secure site. Many ran into trouble, including quite a few who completed the registration demo and figured they were done. Dr. Army camp passed recommendations to Yubico, most of which were followed.
The written report concluded that consumers just don't understand the benefits of using ii-gene hallmark and the risks of doing without it. They're very afraid of losing admission to their accounts if something goes incorrect, and they're not agape of the remote possibility that someone might hack their accounts. Going forrad, Das and Dr. Military camp advise we need clear, simple warnings, like the Surgeon General's alert on cigarette packs.
Source: https://sea.pcmag.com/torguard-vpn/28851/what-we-saw-at-black-hat-2018
Posted by: ochoacompal.blogspot.com
0 Response to "What We Saw at Black Hat 2022"
Post a Comment