SSTIC 2016 – Day Two
Links to reports from other days:
A first glance at the U2F protocol (Florian Maury and Mickaël Bergem)
The presentation aims to compare the U2F protocol with other dual-factor solutions and to draw out the advantages/disadvantages.
U2F is a strong authentication (2-factor) protocol designed to address the problems posed by authentication with weak credentials, as well as phishing attacks with replay in two-factor protocols using SMS as the second factor.
As specified by the FIDO alliance, its main advantage is its ease of use. A simple USB key allows the token (created using asymmetric cryptography) to be used for authentication, requiring minimal user action (the user only needs to press a key).
Although this protocol offers numerous low-cost security measures for the user, it is currently deployed in very limited numbers. Furthermore, it is not perfect (it remains vulnerable to SLOTH attacks).
How to not break LTE crypto (Benoit Michau and Christophe Devine)
The presentation focuses on vulnerabilities in cellular modems and the circumvention of LTE security procedures. To evaluate LTE standard implementations in different equipment (including Qualcomm, Mediatek, and Samsung modems), an infrastructure consisting of a base station (Ettus USRP and Amarisoft eNodeB), a Python core network (corenet) and several Android smartphones were built.
After a brief review of the mechanics of an LTE connection (identification, sending connection capabilities, mutual authentication with the core network using a secret present in the SIM card, establishment of a secure channel via the NAS protocol and then via RRC), examples of vulnerabilities are provided:
- A tested modem accepts a null integrity check (EIA0-RRC). This configuration allows data interception during mobile reconnections to a fake cell tower (establishment of a new RRC channel without encryption and without integrity check);
- Some modems can transmit information other than their IMSI/TMSI even when the NAS protocol is not enabled.
Vulnerabilities were identified in all the modems tested. While manufacturers can quickly fix the vulnerabilities, deploying the patches to subscribers remains a laborious process: making the patches available to mobile phone manufacturers, then distributing them to mobile operators… The speaker concluded by stating that the transparency of the various manufacturers is insufficient.
Methodology for extracting signatures from AIS signals (Erwan Alincourt and Pierre-Michel Ricordel)
This conference focuses on AIS (Automatic Identification System): a radio beacon system for locating ships. This system was developed in the 2000s without any regard for safety.
After a review of the different types of transponders (commercial vessels, pleasure craft, simple receivers, distress beacons…), the speakers present possible misuse of AIS: identity falsification, position falsification, deliberate system shutdowns, hijacking of administration capabilities (e.g. to remotely change a transponder's operating frequency without the user's knowledge and lead to a denial of service), injection of falsified data (distress calls, arbitrary addition of boats…), etc.
The testing platform uses affordable, off-the-shelf hardware. Furthermore, the protocol specifications are publicly available. Based on the premise that the logic layer cannot guarantee security, the speakers focused on the physical layer to try to detect anomalies (false position transmissions, identity theft, etc.). Two characteristics in particular can be used:
- The signal strength can be compared to the boat's presumed distance.
- The shape of the radio signals from an AIS transmitter can be analyzed and compared to previously received signals.
Comparisons and attacks on the HTTP2 protocol (Georges Bossert)
Georges Bossert presented us with a state-of-the-art overview of the HTTP 2.0 protocol. Its predecessor, the SPDY protocol developed by Google, was deployed on a few websites starting in 2009. SPDY's main objective is to significantly reduce latency during web browsing. To achieve this, several features have been implemented:
- Unlimited number of concurrent streams on a TCP connection
- Prioritizing requests
- Header compression
- The client is not always the initiator during data exchange (stateful state machine)
In November 2012, the HTTP 2.0 protocol appeared and brought some improvements compared to SPDY:
- SSL is not required to use it (SPDY requires an authenticated stream).
- The compression algorithm is faster
- Prioritization is better managed
Currently, most high-traffic websites use HTTP 2.0 (Google, Facebook, Twitter, etc.). Browsers need to be updated to use this new protocol. However, if your browser was updated less than three years ago, compatibility is guaranteed. Finally, servers also have a version compatible with HTTP 2.0.
Even though the theoretical implementation should be identical for each web server, differences can be observed in practice. These differences can be exploited to identify the remote server. For example, the four main web servers (Apache, Nginx, H2O, and Tomcat) can be fingerprinted in just a few requests.
Evolution of integrated circuit attack techniques (Olivier Thomas)
Chips are everywhere today: in credit cards, transport tickets, car keys, passports, pacemakers… The speaker presents the three main types of attacks that can be carried out on these chips:
- Non-invasive attacks: this involves testing a chip using everything around it (bus, power supply, clock, etc.)
- Semi-invasive attacks: the chip can be opened and analyzed, but cannot be physically modified (fault injection with lasers, electromagnetic attacks)
- Invasive attacks: The "Rolls-Royce" according to the speaker, because anything goes (including physical modification of the chip).
After a brief review of printed circuit boards, transistors, side-channel attacks, and optical attacks, the speaker focused his presentation on invasive attacks, which—according to the speaker—are possible on all commercially available chips. The first step is chip deprocessing, a complex process during which images of each chip layer are created (e.g., via chemical/physical processes or using plasma). These layer images can then be analyzed: reading the ROM, the flash memory, and reconstructing the chip's logic gates.
When asked "Where are you with regard to recent chips?", the speaker replied "we are very close" and "we will discuss it possibly in private".
App vs Wild (Stéphane Duverger)
Sometimes a system must remain operational even when running in a hostile environment (such as a malicious kernel following a compromise). To address this issue, Stéphane Duverger presented a tool he developed.
The constraints are as follows:
- The environment in which the application runs is unmaintained and infected.
- No changes should be made to the application.
- No OS knowledge is required (the tool should work on most architectures)
The goal is to guarantee the integrity and confidentiality of the application code. The data is not considered sensitive here.
The proposed solution lies in virtualization. A bare-metal micro-hypervisor (ramooflax) hosts the operating system that will run the application to be protected. The principle is to use a suite of encrypted applications, which will be decrypted on the fly by the hypervisor and allocated in isolated memory areas.
However, a polymorphic binary (code that modifies its instructions on the fly) or one launched by a JIT-Compiler cannot be used here.
Winbagility: Stealth debugging and virtual machine introspection (Nicolas Couffin)
Dynamically analyzing code running in kernel mode (drivers) requires a suitable environment. The driver runs in a virtual machine controlled by a debugger on the host machine. However, this method has several drawbacks:
- It modifies the behavior of the target system (booting in /DEBUG mode)
- It can cause a failure during code integrity checking
- It can generate BSODs if PatchGuard protection is enabled.
The goal here is to analyze code dynamically with PatchGuard enabled and without modifying the target system. To achieve this, the debugger will be attached one level below, that is, to the hypervisor. HyperBreakoints have been developed specifically for this purpose to pause the hypervisor. The implementation details are explained in more detail in the slides.
In terms of performance, the execution of instructions in debug mode is fast enough for this method to be a solid alternative to traditional analysis.
Unlocking Android by simulating a keyboard/mouse (Antoine Cervoise)
Today, attacks to unlock Android devices are numerous, especially on older versions of the system. This presentation focuses on methods to unlock the phone using an inexpensive solution connected via the USB OTG port (which allows you to connect a keyboard or mouse).
The solution (based on Arduino and Raspberry Pi) uses a brute-force attack on authentication (PIN code, pattern, password).
In conclusion, this presentation presents a cheap and automated way to unlock an Android without physically attacking the phone and without implementing complex attacks.
The Metabrik Platform: Rapid Development of Reusable Security Tools (Patrice Auffret)
Metabrik is a platform for the rapid development of tools. It is based on a UNIX-like shell, a language (based on PERL), and more than 200 "briks".
These "briks" bring together a set of functionalities, sometimes relying on standard tools that are references in their fields, to which missing functionalities can be added.
The goal of this platform is to centralize scripts (in order to reuse them), to automate everything in command lines and to provide a standardized syntax that makes understanding faster, but also easier to remember.
DYODE: Do Your Own Diode, an open-source diode for less than €200 for industrial networks (Arnaud SOULLIE and Ary Kokos)
The purpose of this presentation is to demonstrate that it is possible to manufacture a network diode at an affordable price. As a reminder, a network diode is a gateway that allows information to be transmitted in only one direction. This security feature is physically ensured by the use of copper-to-optical converters and the connection of only one (out of two) optical TX -> RX cables. Therefore, the use of the TCP protocol is not possible through a diode; only the UDP protocol allows unidirectional data transfer.
This project was conceived following feedback from various manufacturers: the price of this equipment can deter many companies. For a price of around €200, the DYODE project allows the creation of a unidirectional channel and currently offers three functionalities:
- Flat file transfer
- Modbus data transfer
- Screen sharing without interaction
Several limitations exist, however, including a low transfer speed (a few MB/s) and no guaranteed high availability (due to the use of non-hardened components).
Rumps
To end this day on a high note, we'll finish with the famous "Rumps" that are the strength of SSTIC. In no particular order, you'll find, for example:
- Why is the image on the video projector blurry in the amphitheater?
- Some figures and anecdotes about ticketing
- Twitter hacks to win great prizes or followers
- A brute-force attack on Mifare UIDs using Proxmark to deceive beer dispensers in certain bars
- A new example of an attack on an encrypted hard drive
- The creation of a script that adds all commercially available antivirus programs to the Windows WMI "AntiVirusProduct" table (without installing them) has consequences: some malicious code no longer runs.
As every year, the day ended with the famous Social Event, which took place at the Halle Martenot in Rennes. This year's event featured a badge reader who randomly "insulted" participants as they entered and exited, and a significant police presence in the square (for events unrelated to the conference).
