Events

Hack In The Box 2014 KUL

The Hack In The Box (HITB) SecConf 2014 was held from the 13 to the 16 of October, in Kuala Lumpur, Malaysia. More than 500 people from around the world participated in the event. Unfortunately, 2014 was the final round of this nice event.

HITB-2014_01

The event is made up of four main elements: Technical training sessions, a security conference, Capture the Flag ‘Live Hacking’ Attack & Defense Competition, Developer Hackathon (HackWEEKDAY) and A CommSec Village & Technology Showcase Area.

Although there were many interesting presentations at the conference, I have too little space here to introduce all of them, so let’s take a look of three of them.

HITB-2014_02

Filippo Valsorda gave a presentation entitled “Exploiting ECDSA Failures in the Bitcoin Blockchain”. Elliptic Curve Digital Signature Algorithm (ECDSA) is an EC-based signature scheme as implemented in TLS, DNSsec and PS3. He pointed out that ECDSA might not be as secure as it is believed to be.

HITB-2014_03

Haroon Meer, Marco Slaviero and Azhar Desai picked up the topic of “sockpuppet”- a false online identity adopted for deceptive purposes – in their presentation. They demonstrated mass-posting, mass-voting and mass-down-voting at some forums, with the help of only one line of bash script. The presentation was entitled “Weapons of Mass Distraction: Sock Puppetry for Fun & Profit”.

HITB-2014_04

Mike Ryan’s “The NSA Playset: Bluetooth Smart Attack Tools” presentation introduced a series of tools used by the NSA and demonstrated keyboard hijacking via Bluetooth using some of the tools.

For those who are interested, the presentation materials are available at the official web site of HITB2014.

HITB-2014_05

The CTF session was also quite interesting. Let’s take a look at Challenge 2.

As a problem to solve, a pcap file was provided. It was a capture of some network traffic.

HITB-2014_06

Inspecting the file, you could find that ICMPv6 packets contain unknown strings that start with “G01”. In fact, the strings are G-codes, computer numerical control commands (for industrial hardware, 3D printers, etc.). If is it run using emulator software, a string is displayed – this is the answer to the problem.

HITB-2014_07

In my opinion, CTF is a good exercise for IT engineers, because it gives the chance to learn technologies that are not familiar to you.

In the closing session, the event organizers announced the end of HITB KUL and the beginning of a new event “HITB GSEC“. This is planned to take place in Singapore in October 2015.

HITB-2014_08

I hope the new HITB GSEC will be as fantastic as HITB KUL and I’m looking forward to meeting great security specialists there again!!

Hack In The Box 2014 KUL

Your email address will not be published.

 

Reports

The SessionManager IIS backdoor

In early 2022, we investigated an IIS backdoor called SessionManager. It has been used against NGOs, government, military and industrial organizations in Africa, South America, Asia, Europe, Russia and the Middle East.

APT ToddyCat

ToddyCat is a relatively new APT actor responsible for multiple sets of attacks against high-profile entities in Europe and Asia. Its main distinctive signs are two formerly unknown tools that we call ‘Samurai backdoor’ and ‘Ninja Trojan’.

WinDealer dealing on the side

We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack.

APT trends report Q1 2022

This is our latest summary of advanced persistent threat (APT) activity, focusing on events that we observed during Q1 2022.

Subscribe to our weekly e-mails

The hottest research right in your inbox