News
PHDays V. Day One: How to Intercept SMS and Hack Satellite
Positive Hack Days launched on May 26, and on the very first day, cybersecurity experts demonstrated various techniques that are used to hack ATMs, online banking systems, mobile carriers' networks, energy, transport, and industrial companies. More than 50 reports were presented at the Word Trade Center. A number of hands-on labs, round tables were held as well. The organizer provided several video streams to broadcast the most interesting events on the forum's website. Damage caused by a cyberattack can be measured in billions of dollars, while its actual cost is rather low. According to the Positive Research center, anyone with less than 10,000 dollars is able to gain remote access to somebody else's SIM card, which means access to the subscriber's traffic, SMS, calls and location data. Twenty percent of SIM cards are vulnerable to such attacks. It is also possible to obtain a subscriber's confidential information by attacking his mobile carrier's equipment. An attack on a GSM cell can cost about 1,000 dollars. To hack a base station, an intruder might need only a PC and access to the SS7 network. Banking systems keep pace with the telecommunications sector. An ATM can hold 10 million rubles. And when it comes to hacking the cash machine, you might only need a Raspberry Pi for $60. Last year, Russia took second place in the world (after Palestine) for the quantity of ATMs that can be detected by special search engines and remotely reprogrammed by using insecure protocols and exploiting numerous vulnerabilities in Windows XP. The situation with e-money is not much better. In 2014, 70% of Android applications and 50% iOS apps contained vulnerabilities that gave access to an e-money account. Devices that seem harmless at first sight, such as wireless USB modems, can also constitute a danger to users. Mobile operating system developers are slick at fixing vulnerabilities, while modem firmware developers haven't paid much attention to security until recently. According to Positive Technologies researchers, 27 out of 30 firmwares contained critical vulnerabilities. Timur Yunusov presented a report, which reveals how easy it is for an intruder to enable automatic identification and infection of 4G modems in order to intercept traffic, manipulate an account and SMS, break into a computer connected to such a modem. The philosophical conception of PHDays V involved certain elements of cosmological theories. However, practical aspects were as well in the range of interest, which is why the forum's organizer held the session named Amateur Radio for Space Communication. Speakers discussed information security of space stations; in particular, they discussed the Fobos-Grunt crash considering a version based on external influence. The radio amateur Dmitry Pashkov claims that it is quite possible to jam signals between a control center and a spacecraft. You will find the necessary equipment in any electronics store. Except for an antenna— you'll have to make it by yourself. By using homemade devices, Dmitry managed to obtain solar eclipse images from Meteor-M No. 2 (a Roscosmos satellite) and to get the most up-to-date weather forecast. How to Protect A more effective fight against vulnerabilities in information systems and measures for protection of national interests have been discussed at the most "governmental" section — Today's Russia in Unfriendly Cyberworld. Dmitry Finogenov (FSB department #8), Alexander Radovitsky (RF Ministry of Foreign Affairs), Alexander Baranov (Federal Tax Service), Vadim Dengin, Andrey Tumanov, and Ilya Kostunov (deputies of the State Duma) took part in the discussion. Alexey Andreev (Positive Technologies) and Alexey Lukatsky (Cisco) were speaking on the part of the expert community. The government officials promised that a new Russian IS concept would have been published by the end of 2015. Vadim Dengin urged Russian Internet users (over 70 million people at the moment) to always be responsible for their words (in court as well) and said, that the security of citizens, data privacy in particular, was the task #1 for the government; therefore, the federal law on data processing center (DPC) transfer to the Russian territory won't be postponed. "The international business totally agrees with that," he said. Vadim's colleague Ilya Kostunov had recently revealed that Google Analytics was installed in all the Russian governmental bodies. Thus, he made an inquiry to the Prosecutor General's Office and Ministry of Economic Development. Ilya mentioned that Russia had had an opportunity to launch its own payment system with chip cards back in 2000.
Making Money on Cyberwar
It is well known that insider info about ups and downs of large corporations, if gained in time and played right, can earn you millions on the stock market. It’s hackers’ prerogative to get hold of such data or to influence a company’s activity by cracking critical business systems. So why not make some dough on your skill at Positive Hack Days V? This year PHDays participants will be able to become part of our virtual country — the United States of Soviet Unions (USSU) — and trade stocks on the PHDays Stock Market. All forum attendees will be able to buy and sell “company” stocks (firsthand or using a broker) and gain advantage from insider info on the stock market. The hacker contest participants will be able to effect share prices by hacking railway companies, power plants, news agency sites, and other resources. In addition, successful hacking attacks may give you some useful information. You may spend virtual money to treat yourself to a drink in our bar or to buy souvenirs with the forum’s logo. For additional info, feel free to address our specialists that will be located next to the bar counter in the WTC Congress Hall.
Rock Bands, Artists and Cyberhybrids at PHDays V
PHDays, an international forum on practical security held on May 26-27, continues to attract an ever increasing audience including many from the arts including musicians, artists, retrofuturists, and writers. PHDays is not just a technical event but one that encompassed the culture associated with the cyber community. Our non-technical program includes our first cyberpunk short story competition. Six Million Characters of Cyberpunk
Schneider Electric Thanks the Winner of the Positive Hack Days Hacker Contest
Early April, Schneider Electric has released several updates and patches fixing vulnerabilities in the software used for creating SCADA and HMI systems at nuclear power plants, chemical plants and other critical units. The vulnerabilities which even a novice attacker could exploit were found in InduSoft Web Studio 7.1.3.2, InTouch Machine Edition 2014 7.1.3.2 as well as previous versions of these products. Among bugs fixed — arbitrary code execution and non-encrypted storage/transfer of sensitive data. The vendor recommends downloading the new patches as soon as possible.
PHDays V Contest Program Published
Positive Hack Days V will take place at WTC on May 26-27. Preparations are well underway: the program of reports and hands-on labs is being formed (you can vote for a performance at the site), new spots from a variety of countries joined the PHDays Everywhere initiative, and there's more to come. Traditionally, the forum organizes many contests. Today we will take a look at the challenges and prizes for the Internet users and PHDays guests. Challenges at the Venue Please note that you will need a laptop to participate in most of the contests. Leave ATM Alone ATM physical attacks are gradually giving place to software attacks. At this contest, everyone can try his or her hand at detecting ATM vulnerabilities.
PHDays V: How to Create Your Own Shodan, Find ROP Shellcodes, and Automate Reverse Engineering
The fifth Positive Hack Days international forum on practical security will take place in Moscow World Trade Center on May 26-27. With the second wave of Call for Papers finished, we present a new portion of reports. Automation: Reverser’s Helper Reverse engineering often implies thorough analysis of an application system code, and the star tool here is a disassembler. Researchers encounter various difficulties — from deciding on an order of function processing and differences in system versions to inability to fully debug and emulate the code in built-in systems. In his report Anton Dorfman, who presented a workshop on mastering shellcode at PHDays III, will share his experience in creating a reverse engineering plugin based on IDAPython, which is capable of conducting primary automated code analysis and transferring results from a currently researched system to its other versions. How to Create Your Own Shodan The acclaimed international security specialist Igor Agievich will cover the topic of creating a search system identical to “the world’s most dangerous search engine” — Shodan.
What's New in the PHDays Program: supercomputer protection, iOS security, exploit selling
The first stage of Call for Papers has finished recently and we'd like to announce another batch of reports that will be presented on May 26 and 27 at PHDays V (you can find the first and the second announcements on Habrahabr). Speakers will discuss how to improve iOS application security and what hackers find attractive about supercomputers. They will also address the relationship between sellers and buyers of zero-day vulnerability exploits. Debugging automation Alexander Tarasenko's report is devoted to debugging automation using WinDbg. Attendees will gain skills in writing scripts using the built-in WinDbg's engine, and also in Python and Pykd extension. The report will be interesting for code researchers and developers of software that requires uncommon debugging tools. iOS security Prateek Gianchandani, a member of OWASP and an information security engineer at Emirates, will lead a hands-on lab on developing exploits for iOS applications. During the demonstration, the speaker will use his own application with typical vulnerabilities. Participants will learn how to improve iOS applications' security level at the stage of development. Upon the introductory part, participants will try to test iOS applications by themselves. On guard of supercomputers Felix Wilhelm and Florian Grunow from ERNW, a German infosec company, will tell about the IBM General Parallel File System, abouts its architecture and vulnerabilities. The system is used in certain known supercomputers (such as IBM Watson), which makes it a prime target for attackers aiming at both data stored in the file system and the system's powerful resources. The speakers will demonstrate the exploitation of two security bugs in IBM GPFS. Exploit selling Alfonso De Gregorio, the founder of BeeWise and chief consultant at secYOUre, will speak about the relationship between sellers and buyers of zero-day vulnerability exploits, about morals in the exploit market. Hash hacking at fifth gear Alexey Cherepanov took part in the development of John the Ripper and maintains its GUI interface. He will tell us how to speed-up hash hacking by using code generation methods. Fast and useful In addition to standard reports the PHDays V program includes an extensive FastTrack that involves informative and dynamic short speeches. Sergey Kharkov, a specialist at National Research Nuclear University MEPhI, will tell attendees how to tap a GSM-based phone by attacking a GSM network and replacing the base station. Moreover, Sylvain Pelissier, a cryptologist and a security engineer at Kudelski Security, will show how sometimes file encryption tools allow cracking user passwords. During Denis Gorchakov's presentation, the audience will learn how to prevent payment fraud. He will speak about a hardware and software system for virus analysis, detection of botnet control centers and data collectors. The second stage of Call for Papers started on February 16. It will last till March 31, so you still have a chance to become a speaker at PHDays this year. We also invite you to participate in CFP launched by our partner, the HITB conference. We look forward to seeing you at Positive Hack Days V!
PHDays V: Encryption Standards, M&A in Yandex and Chemical Attacks
Early December was marked with Call for Papers opened for everyone willing to speak at Positive Hack Days V. Later we announced the first speakers introducing John Matherly, the creator of Shodan, John Bambenek, a cyber detective, and Chris Hadnagy, a professional social engineer. The first CFP stage was over at the end of January. Today we present a new portion of reports included in the technical, practical and business program of upcoming PHDays. The forum guests will learn how to fortify a corporate IT system digitally, how to bypass Moscow Metro Wi-Fi authorization, and how attackers exploit vulnerabilities in physical processes. Yandex: Security for Mergers and Acquisitions When a company buys another company, nobody ever thinks of a security audit. If, by any chance, it comes to the limelight, the current regulatory requirements alone are analyzed. Yandex is actively purchasing technological projects all over the world now and then detonating the media scene with news about another grand merger. An information security analyst of the search giant, Natalya Kukanova, will throw light on how and why they included the security audit into the merging processes (M&A). The audience will learn what to check in case of M&A deals, how to organize audit, and how to interpret its results. All bullet points will be exemplified by real Yandex' deals. Encryption Standards of the Future Markku-Juhani Saarinen will detail into the NIST-sponsored CAESAR project, which is an international crypto competition aimed at the creation of a new AE security standard instead of AES-GCM (this algorithm was certified by the USA and NATO to handle secret information, but was detected to contain various security problems). The speaker will acquaint his audience with CAESAR cyphers and consider weak and strong points of the current encryption standards and algorithms in Russia (e.g. the GOST R 34.10-2001 signature algorithm). Markku-Juhani Saarinen has been studying information security and cryptography and developing cryptographic software for more than 15 years already. Around OSX Sandbox Alexander Stavonin will analyze how OSX (a sandbox designed with TrustedBSD) security tools work and how widely they are used by third-party applications. He will demonstrate potential problems and exploitation of TrustedBSD by cybercriminals — all exemplified by the source code. How to Build a Digital Fortress An information security and forensics expert from Bulgaria, Alexander Sverdlov, will take his floor at PHDays for the third time (his workshops on cyber forensics attracted a full house in 2013 and 2014) and will teach how to build an impregnable digital fortress. The audience will study how to enhance router protection installing alternative operating systems (Qubes OS, BSD Router project, SRG/STIG), to stop exploits, and to analyze application security. If Hackers Were Chemists Researchers and cybercriminals repeatedly demonstrate ways to hack SCADA systems that control electricity, transport and critical infrastructure elements such as chemical plants. However, dealing with such facilities, information security specialists often ignore the role of physical processes. Such processes (e.g. a chemical reaction) can keep on running despite the actions of cybercriminals with full control over an infrastructure or management system. Yet if malicious users learn to exploit physical conditions, they will be able to affect reaction and process flows. The consequences are threatening: it's not that hard to imagine an explosion on a chemical plant provoked by a temperature monitoring sensor driven mad by a hacker in a cistern with a hazardous substance. Maryna Krotofil, a Doctoral Candidate at Hamburg University of Technology, will put the audience in touch with the main stages of attacks aimed at destroying a specific physical process.
Tickets for PHDays V Now Available
Ticket sales for the forum on practical information security Positive Hack Days V will start on Wednesday, December 23.
CFP is open
Positive Hack Days V, the international forum on practical information security, opens Call for Papers on December 3. If you want to share your research results or have something to tell the community about, you are welcome to join PHDays speakers on May 26 and 27, 2015. The first stage is until January 30, 2015. Find any details about the format, participation rules, and CFP instructions on the PHDays website: http://www.phdays.com/program/call_for_papers/ See you at PHDays V!