HackInBo Spring Edition 2022 - 18° Edizione #HiB22

In the last two years, a major spike of malicious applications on mobile devices was reported in multiple European countries, including Italy, since both local and international TAs (Threat Actors) are taking advantage of this digital transformation, in view of the rapidly increasing volume of digital transactions and availability of fresh targets. During our presentation, we will deep dive into modern Android banking trojans including the most consolidated strategies found in the wild, and provide to the audience real-world examples based on our daily analysis.

Fine prevista per le 11:30

Negli ultimi tre anni abbiamo assistito ad un'impennata di vulnerabilità critiche su soluzioni per la difesa dei sistemi personali ed aziendali, quali dispositivi che governano l'accesso alle VPN, la gestione del traffico web/mail e la sicurezza perimetrale. Spesso il denominatore comune di questi prodotti è l'utilizzo di tecnologie open source nel loro core (principalmente Linux come sistema operativo) su cui tuttavia girano componenti proprietari in C/C++ che non possono essere facilmente fuzzati (in mancanza dei sorgenti) e librerie obsolete, anche più di dieci anni. Per chi di mestiere si occupa di portare alla luce falle di sicurezza, il reverse engineering manuale è solitamente una delle poche risposte in questi casi, sebbene non l'unica. Come si procede quindi? In questo talk mostreremo un caso tipico e sintomatico di quanto grave sia la situazione legata all'utilizzo di tali dispositivi, presentando una vulnerabilità 0day che affligge un prodotto di punta del segmento security appliance. Vedremo in particolare come il mancato rispetto di alcune comuni security best practice, congiuntamente al disprezzo delle più basilari procedure di hardening, abbiano permesso di trasformare un bug normalmente non exploitable, in una vulnerabilità in grado di consentire l'esecuzione di codice remoto in modalità privilegiata sul sistema. Tutto in one-shot.

Fine prevista per le 13:00

Un momento di svago prima di ricominciare con i talk del pomeriggio!

Fine prevista per le 14:30

Security for organizations and critical infrastructures usually rhymes well with IT security. In years, we have built tools, practices, polices to prevent, detect, mitigate and respond to attacks targeting endpoints like PCs, servers (and maybe mobile phones), critical networks as well as the network infrastructure they are connected with. On the other hand, network-connected devices, like printers, small routers, Wi-FI APs, and even badge readers or access control systems, are often much less considered in the scope of the typical security posture. Such devices are often regarded as "hardware" and only relevant from a functional point of view. In this talk we discuss how devices may pose severe threats to the security of organizations and, potentially, critical infrastructures. We will show how important it is to consider devices as relevant endpoints and apply proper security practices. We will give a live demonstration, on stage, of how a simple overlook in a security policy, may allow an attacker to penetrate a network, bypassing existing security measures. We will also demonstrate how a compromised device can become an entry point for mounting further attacks, allowing an attacker to extend control over other devices or to directly target the infrastructure. We will then discuss how it may be possible for a proximal attacker to leverage vulnerable implementations for exploiting the Wi-Fi SoC (System-on-Chip) present on the device. We will cover, by analyzing public vulnerabilities, how he could then compromise the Application SoC and gain full control the device. This would allow him to gain a foothold in the network where the device is located, without performing any IP traffic and leveraging a stealthy attack vector. Finally, we will analyze the scenario where a Wi-Fi SoC vulnerability may be used for a worm-like propagation across neighboring devices. This would allow an attacker to compromise all the Wi-Fi capable devices, without performing any IP traffic ever. This would also allow him to cross network security boundaries without being detected. We believe that should an attack like the ones described in our talk succeed, it may be potentially devastating in the context of sensitive organization and critical infrastructures. Reflections will be performed all along the talk, covering possible mitigations and improvements, both in technology and processes. We will point out how an the passive use of technology is likely insufficient, and an improved security posture is required in order to tackle these attacks, which are, nowadays, within reach of advanced attackers. We hope our thought-provoking talk will make the audience aware of the threats posed by connected devices in security critical infrastructures, as well to as start a reflection on the best practices to apply in order to minimize the related risks.

Fine prevista per le 16:00

Utilizziamo quest'ultima parte di evento per fare qualche domanda ai relatori

Fine prevista per le 17:15