Post-Vegas-Con Roundup - 2017-08-01

Posted on  by

Last week was the BsidesLV, Blackhat and Defcon trifecta of security conferences. Lots of interesting news coming out of them, and below are some of things we found interesting. You can check out slides from Blackhat and Defcon.

For those interested in the physical aspects of security:

This contactless payment “borrowing” hack is pretty neat, allowing a coordinated attacker to relay contactless payment information over short distances, effectively allowing you to make payments with someone else’s device.

Google researchers went over research into evaluation of secure USB hardware devices.

One amateur electronics developer investigated security measures of a safe, and took advantage of several properties to take cracking it from a 4 month procedure to a maximum of 1 hour and 13 minutes.

Lots of coverage came about due to setting up some voting machines to be hacked, showing a lot of vulnerabilities including old software, accessible ports, poor wifi security allowing remote access, and more. Some of those in attendance have started blogging about the things they tried.

Google went on stage to cover the many steps they have taken to reduce the Android attack surface, having realized that exploit mitigation is not a viable strategy, esecially when you are up to billions of devices. They have noticed an uptick in lower level vulnerability disclosures, which they partially credit to thir bug bounty incentives, as well as their locking down of user space making vulnerabilities higher up harder to accomplish.

Security researchers have been digging into the ShadowBrokers, and went over some of their findings. Fortuitous timing in that ShadowBrokers also did an update last week, detailing further steps to sign up to their monthly data dumps. They also commented that June’s data dump has not been leaked by whoever had signed up, with July’s dump being sent to “subscribers” shortly.

Research into other bad actors led to the discovery that 95% of ransomware pay outs were coordinated via the BTC-e trading platform. The research involved harvesting bitcoin wallets from malware binaries, and tracking transactions through the blockchain. As part of the research, the financials of ransomware became a little clearer, with some months clearing $2 million in payments. In related news, the owner of BTC-e has been arrested on a number of money laundering charges, not just related to ransomware, but also to several bitcoin heists from the past few years.

Researchers delved into how hacker’s control panels can have vulnerability problems themselves, allowing for takeover and shut down of these networks.

Patrick Wardle, chief security researcher at Synack, went over his research into Mac malware with Fruitfly, where he wrote a custom C&C server to analyze actions in a controlled environment, and led him to reverse engineer the (simple in this case) communication protocol.

ShieldFS is a file system extension revealed at BlackHat, which intends to protect against ransomware. Using machine learning to detect ransomware as it happens, ShieldFS also leverages copy on write to store copies of modified files, allowing easy recovery (because we have a copy) of files that were encrypted.

Finally, Black Hat’s annual Pwnie awards had their winner’s (and losers) announced, ranging from the Equation Group for creating the exploits behind WannaCry, to Google’s research into practical SHA-1 collisions with SHAttered.

android conferences hardware malware mobile ransomware