Events

Hack In The Box 2014 KUL

The Hack In The Box (HITB) SecConf 2014 was held from the 13 to the 16 of October, in Kuala Lumpur, Malaysia. More than 500 people from around the world participated in the event. Unfortunately, 2014 was the final round of this nice event.

HITB-2014_01

The event is made up of four main elements: Technical training sessions, a security conference, Capture the Flag ‘Live Hacking’ Attack & Defense Competition, Developer Hackathon (HackWEEKDAY) and A CommSec Village & Technology Showcase Area.

Although there were many interesting presentations at the conference, I have too little space here to introduce all of them, so let’s take a look of three of them.

HITB-2014_02

Filippo Valsorda gave a presentation entitled “Exploiting ECDSA Failures in the Bitcoin Blockchain”. Elliptic Curve Digital Signature Algorithm (ECDSA) is an EC-based signature scheme as implemented in TLS, DNSsec and PS3. He pointed out that ECDSA might not be as secure as it is believed to be.

HITB-2014_03

Haroon Meer, Marco Slaviero and Azhar Desai picked up the topic of “sockpuppet”- a false online identity adopted for deceptive purposes – in their presentation. They demonstrated mass-posting, mass-voting and mass-down-voting at some forums, with the help of only one line of bash script. The presentation was entitled “Weapons of Mass Distraction: Sock Puppetry for Fun & Profit”.

HITB-2014_04

Mike Ryan’s “The NSA Playset: Bluetooth Smart Attack Tools” presentation introduced a series of tools used by the NSA and demonstrated keyboard hijacking via Bluetooth using some of the tools.

For those who are interested, the presentation materials are available at the official web site of HITB2014.

HITB-2014_05

The CTF session was also quite interesting. Let’s take a look at Challenge 2.

As a problem to solve, a pcap file was provided. It was a capture of some network traffic.

HITB-2014_06

Inspecting the file, you could find that ICMPv6 packets contain unknown strings that start with “G01”. In fact, the strings are G-codes, computer numerical control commands (for industrial hardware, 3D printers, etc.). If is it run using emulator software, a string is displayed – this is the answer to the problem.

HITB-2014_07

In my opinion, CTF is a good exercise for IT engineers, because it gives the chance to learn technologies that are not familiar to you.

In the closing session, the event organizers announced the end of HITB KUL and the beginning of a new event “HITB GSEC“. This is planned to take place in Singapore in October 2015.

HITB-2014_08

I hope the new HITB GSEC will be as fantastic as HITB KUL and I’m looking forward to meeting great security specialists there again!!

Hack In The Box 2014 KUL

Your email address will not be published. Required fields are marked *

 

Reports

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Subscribe to our weekly e-mails

The hottest research right in your inbox