Skip to main content

Posts

Talking OT Security at HouSecCon 2021

I will be delivering a talk at HouSecCon (on October 7, 2021), about security assessment methodologies for OT infrastructure. The talk is entitled -- "OT Security -- Assessment Methodologies for Securing the Things that do the Things" The agenda can be found here: HouSecCon Agenda What's the talk about???   When Information Security professionals attempt to cross-apply their skills to OT (Operational Technology), they often find an environment that, compared to IT infrastructure, is considered beyond reproach.We are often told — “do not patch”, “do not scan”, “do not attempt to harden”, “do not even look at these systems or PEOPLE WILL DIE”. While these risks can be sensationalized, the mishandling of OT infrastructure can indeed result in operational downtime, safety issues, and the potential for loss of life. Drawing from years of OT security experience, the speaker will discuss risk-conscious, white-glove approaches that can be used to effectively assess and secure OT

Alexa Hacking at DEF CON 29

This year, I delivered a talk at DEF CON 29 IoT village on the social exploitation of victims proxied through Alexa voice assistant devices.  Check out the Video here!!! The talk was live-streamed on Twitch on Friday, August 6th at 3:30pm PT on the IoT Village Twitch Channel . If you missed the live talk, check out the video on YouTube here: What's the talk about??? As voice assistant technologies (such as Amazon Alexa and Google Assistant) become increasingly sophisticated, we are beginning to see adoption of these technologies in the workplace. Whether supporting conference room communications, or even supporting interactions between an organization and its customers — these technologies are becoming increasingly integrated into the ways that we do business. While implementations of these solutions can streamline operations, they are not always without risk. During this talk, the speaker will discuss lessons learned during a recent penetration test of a large-scale “Alexa for

Cyber Cyborgs Among Us

 Not quite human...and not quite machine I recently had the privilege to interview Len Noe on the Set Solutions podcast. Not only is Len an awesome human being...he's also a little bit more than human being. Sometimes referred to as cyborgs, grinders, transhuman, or biohackers. Len has augmented his own biology with technology in order to begin transforming himself into the ultimate cyber weapon. He has multiple implants in his hands that can be used to support different types of cyber attacks. He introduced multiple different attack scenarios during his talk at the RSA Conference "Biohacking: The Invisible Threat" , and will be covering them again at BlackHat USA later this year!!! While there still remains a stigma and some controversy around this trend, I would argue that Len is just ahead of his time. With multiple major R&D firms investing in similar capabilities (such as Elon Musk's Neuralink ), Len and others like him, are blazing a trail for what lies in t

Bootstrap Fail - Persistent XSS via Opportunistic Domain Sniping

This is the story of how a failed Bootstrap implementation on a website allowed me to gain JavaScript code execution into thousands of user browsers. How I Found It? Before I get into the story, I'll quickly explain how I found this vulnerability in the first place.  I have started developing a new opportunistic approach for acquiring persistent XSS (Cross Site Scripting) on various web-services across the Internet.  This methodology consists of the following steps: Use custom web-crawler to spider web services across the Internet and scrape source code. It iterates through IP addresses and hits the web-root content for every IP address. It then identifies websites that are using externally hosted JavaScript. This is achieved for each server by… Reviewing the HTML source code for <script> tags with a source (src) value containing a full web-address (rather than a local path). An example would be <script type='text/javascript' src='https://domain.name/path/to/ho

Bypassing GSuite CAPTCHA for Username Enumeration and Password Spraying

While performing a recent assessment of an organization using GSuite, I discovered that the implementation of CAPTCHA to stop automated activity is wholly inadequate, and I was able to accomplish both username enumeration and password spraying with relative ease.  Classic Username Enumeration When you enter an invalid email address in the Google login form, you are returned an error which states -- "Sorry, Google doesn't recognize that email."  But when you enter a legitimate email address, you are prompted for a password.  This varied response is the basis for any username enumeration attack. Automate the process of iterating through a list of emails, then measure the responses to determine which are legitimate. But of course, Google throws another wrench in the mix, which might seem at first to be a show-stopper. After a couple of invalid usernames are supplied, Google throws you a CAPTCHA to solve. I quickly discovered while interacting with this, that the best way to

DEF CON Safe Mode -- Yippie-Ki-Yay!!!

This past weekend was DEF CON SafeMode.  Hutch from SocioSploit presented on the threats of MFA bypass facilitated through Social Engineering in conjunction with real-time replay session instantiation attacks. Yippee-Ki-Yay MFA'er - Bypassing Multi-Factor Authentication with Real-Time Replay Session Instantiation Attacks In the not-too-distance past, it was fairly easy for red-teamers to conquer almost any environment with a combination of password sprays, or by leveraging social engineering to lure victims to fake login sites and harvest their credentials. But in the current landscape, there are new road-blocks to contend with. Nearly every company and organization has now deployed some form of Multi-Factor Authentication (MFA) on their perimeter services. Fortunately, for red-teamers, the vast majority of implementations of MFA across the Internet (email-based, SMS, OTP, and push requests) all share a common critical flaw that can still be easily circumvented using a modern revis

Another "Fappening" on the Horizon?

So in case you aren't fully up-to-speed on useless hacker trivia, "The Fappening" (also sometimes referred to as "Celebgate") was a series of targeted end-user cyber attacks which occurred back in 2014 (which strangely feels like forever in tech years), that resulted in unauthorized access to the iCloud accounts of several prominent celebrity figures.  Following these breaches, photographs (for many including personal sexually explicit or nude photos) of the celebrities were then publicly released online.  Most evidence points to the attack vector being spear phishing email attacks which directed the victims to a fake icloud login site, and then collected the victim's credentials to subsequently access their real icloud accounts. Migration to MFA In response to these events, Apple has made iCloud one of the very few social web services that implements compulsory MFA ("Multi-Factor Authentication").  But while they might be ahead of the indust