Earlier this week I gave a talk to our internal hacking teams about the difference between good hackers and great ones that have been able to impact our field. I included three extended quotes - two from writers and one from Hamming that influenced my approach early on. Maybe
I did it! ntcrack is now running 57% faster than hashcat for large wordlists! I kind of invented a technique for getting macOS to cache chunks of the file to the kernel file cache very precisely for a dramatic speed increase.
Best lockdown advice I got kicked in today, it was from a mate who’s ex-military. He said “at some point you or your crew are going to be so sick of it you’ll no longer care about the danger and just want to get out - prepare for that and shut it down”
This ssh-agent exploitation write up is worth reading to the end. First up the whole chain and how they figured it out is well documented and super interesting. They chain a bunch of shared library loads to create a jump into their executable shell code. But there’s a hidden gem
It’s weird that this is a *secret*. Most Ad/analytics SDKs send detailed information for most applications. Apps are the ad blocking workaround the industry found after browsers started marking it harder.
A guy on reddit reversed engineered
#TikTok
Here’s what he found on the data it collects on you
It’s far worse than just stealing what’s on your clipboard:
Windows 11 now has a subsystem for Android.
@AlpacaSec
figured out how to use it for his next mobile pentest and wrote it all up so you can too. cc
@sensepost
Everybody is calling prompt injections “jailbreaks” meanwhile _simo36 is out here getting full code exec chains with Apple’s Neural Engine to remind us what a real jailbreak looks like.
Here's a detailed write-up of the EAP bug that affected all Apple devices (except watchOS), CVE-2019-6203. It includes a deep dive into MSCHAPv2 there's some code at too
I’ve been waiting for this for most of the year. Craig Koorn built a BloodHound for AWS IAM & related elements. Which finally just got a public release. Hugely useful for securing your AWS environments. cc
@0xdabbad00
I’m really enjoying the lack of conferences in infosec right now. Just a ton of super accessible blog entries and webinars/streams. It’s so in line with our egalitarian roots, with none of the travel & money barriers we hadn’t really acknowledged were blocking us.
If you’re into WiFi hacking, Fri 4pm Track2
@defcon
we’ll be releasing brand new EAP attacks (by
@Michaelk654
), a dockerised WiFi prac env requiring no hardware, a rewritten mana using
@bettercap
& walking through some lesser known coolness in mana
... to my surprise morphed into a C++ interview. I had no pen, paper, or anything else to write; so I had to dictate the solutions to the C++ exercises out if my head.
Hadn't coded in a few months (sabbatical), hadn't prepped.
Interview did not go great.
iOS 14 adds random MAC address when you join a WiFi network to prevent tracking your device at an Ethernet level. Interestingly, the locally administered bit isn’t set so you can’t tell it’s random. I wonder if it does it at WiFi frame level?
This write up of the 2016 Bangladesh SWIFT hack from end to end including technical & criminal info is amazing When I talk about emulating criminals, this is what I mean. Red Teamers spend so much time faffing on low ROI activities for customers.
🎉We're super excited to publicly release assless-chaps, our super fast MSCHAPv2 cracking tool
Our DEF CON
@rfhackers
Village talk with
@_cablethief
& me explaining it is out
Our new hashcat modes 27000/27100 have been merged too!
Something in
@doctorow
’s
@defcon
talk has been sitting with me all day. To summarise badly:
Tech workers were looked after when it was a scarce skill. The layoffs make it clear it isn’t as scarce anymore.
As the saying goes - the future is here just not evenly distributed.
1/2
I've been on Twitter for 11 years today, and as much as everyone disses it, I've gotten so much from it. The little security niche we have on here is pretty epic.
F*ck yeeeeesss, finally. Multi-threaded rust NThash cracking M1 Pro CPU beating hashcat Metal GPU for every metric. (hashcat all rockyou hashes left out because it takes over 10mins)
Do you need to grep large files often? I just published singrep It's short for "singe's grep". It's very fast on a modern Linux/macOS systems using single file parallelism. On my MacBook Pro it's twice as fast as rip grep & 47x faster than normal grep.
We’ve used
@_cablethief
’s new EAP relay attack in some live projects
@sensepost
It’ll get you on the network while you crack the MSCHAPv2 challenge/response. Cryptobinding should prevent it, but it’s not enabled by default (I’m guessing due to a lack of practical attacks)
Just finalised this year's
@sensepost
artwork. Presenting Just Another SensePost Hacker. An old skool cyberpunk with the winner of our internal polyglot competition on the HUD (inspired by old Just Another Perl Hacker competitions). Stickers & shirts will be available in Vegas.
I really appreciate how accessible
@taviso
makes his write ups. His processor use-after-free discovery is super interesting
In particular the bit at the end where he described how he generated two equivalent pieces of assembly that executed differently
We’ve taken pretty much all the Active Directory tradecraft from the years and distilled it into this
@sensepost
course. The hard part has been finding the Goldilocks zone for intermediate hackers - not too entry level, not too AD 1%, but just right. It’s being given at
@x33fcon
Congrats to
@leonjza
for becoming the new CTO of
@sensepost
. I couldn't think of a better person for the job. He understands our values instinctively; making the world safer, constant learning & sharing, and an intense integrity. I know he'll rock it.
My whole immediate family has tested positive for COVID. Only 3/5 of us had symptoms. I was the worst, had three rough days but feel better today. Thank goodness I was double vaxxed.
Inspired by
@Niki7a
's request - here's a Hellfire Hacking Club t-shirt/sticker design you're welcome to use. It's a stylised Eddie playing the season finale's guitar solo in the upside down. See you at
@defcon
Just in case, for my non-ZA hacker friends, there is no white genocide in South Africa. It’s a myth being pushed by far right racists.
@AfricaCheck
is an independent fact-checking group who have good detail on it
I have asked Secretary of State
@SecPompeo
to closely study the South Africa land and farm seizures and expropriations and the large scale killing of farmers. “South African Government is now seizing land from white farmers.”
@TuckerCarlson
@FoxNews
If you're a MBP macOS user with a touch bar, this will let you use sudo with touch ID:
sudo sed -i.bak $'2i\\\nauth sufficient pam_tid.so\n' /etc/pam.d/sudo
Of all the security design and architecture things I've been involved in over the years, the one that gives me the most regular contentment is the advent of static websites. Run the dynamic site internally, publish the static externally, serve via CDN. Nothing to hack.
I was watching a TLP Red presentation on tracking actors in a
#threat
group, and the researcher used advertising intelligence
#ADINT
to get precise
#location
data. I hadn’t heard the term and found this paper
I strongly disagree with this. Tool building when exploring a problem space is hugely useful. For e.g. when I first had to start poking at mainframes I built tools to explore each new level of surface area I got access to & it helped immensely.
As part of my mission to make wifi hacking more accessible, I've created a free, online & interactive
@teamKatacoda
course on monitor mode, WPA cracking & tshark. It's quick (and alpha). I'd love some feedback & sharing:
Wanted to start collecting container breakout techniques. Pull requests welcome. Here's an example of the filehandle technique.
@_staaldraad
had a hand in it too.
It's
@sensepost
's 20th birthday today, & a month since my 10th year anniversary. It's been amazing; from sleep deprived months building things on foreign shores, the fear in a friend's eyes before they stop onstage
@defcon
for the first time, to ^5's after some pwnage.
Save yourself a pentest;
@ollieatnccgroup
wrote down the most common ways red teams will breach you, & how to defend against them in an easy to read writeup at:
Do these *before* you start on a red team program, or use them as outcomes for purple.
Silently trigger a
@ThinkstCanary
token when someone views a text file in a terminal (e.g. cat).
From
@stokfredrik
's BlackHat talk
Caveat - the terminal must support OSC7 (macOS does).
This WiFi mesh talk was great - they just ARP spoof and the routers happily spit out backhaul mesh traffic onto the front end WiFi network. Then the control protocols are all super vulnerable.
The
@mybroadband
team asked me to comment on how to protect yourself after the latest data leak. Instead I suggested we should put pressure on legislators to not give credit bureaus so many privacy exceptions in our legislation.
New WiFi vulns that downgrade power save buffered frames! As always
@vanhoefm
has usable code ready to go, this time without limitations to specific atheros cards. The readme is also super accessible if you aren’t the type to read the paper.
Slides for the x86_64 workshop we gave earlier are up at
You can build the Dockerfile or pull the image from singelet/x86_64_workshop:latest if you'd like to play.
We'll try clean up the recording and post it later.
Thanks for joining us at 0xC0FFEE.
When I was young,
@haroonmeer
taught me two super important things
1) Stop lying about your motivation. Don’t pretend you aren’t doing it for fame or validation from respected peers or whatever floats your boat just because it doesn’t sound lofty and beautiful. 1/5
Unpopular opinion; it's awesome that a CISSP counts as a Masters degree! Anything which lets people hack the stupid degree requirements the world has baked in the better. If you weren't fortunate enough to get a degree - go get a CISSP and claim it!
If you want to extract the certificates used in EAP (TLS/PEAP/TTLS etc.) interaction, you can use this
Useful for closing them with especially when going after macOS/iOS clients (who will present the cert details & ask the user).
Me: “Don’t write the full PoC now. It’s late and it’s been a long day. Come at it with fresh eyes in the morning.”
Also me: *lays awake thinking about the code all night*
You can get cmd exec with a simple cmd in your Whois info for an IP you control “~| <cmd>” then triggering a ban.
The vuln is a chain from fail2ban’s mail-whois action invoking mailutils “mail” but not sanitising cmd exec keywords in the Whois info piped to it.
Simultaneously honored and deeply embarrassed by the profile on me by
@mybroadband
. The bit they cut, but I think is really important to note, is that if more kids had access to computers at the age I did, this could be the norm.
This is one of the most needlessly elaborate Linux persistence approaches I've made. Creates a malicious dynamic linker that will suid any file dropped in /tmp/sensepost. Dockerfile'd for demo purposes.
Hah,
@alkalinesec
built a BrainFuck interpreter using NSPredicate to demonstrate
@CodeColorist
’s point that NSPredicate effectively gives you eval() in Objective C.
Me: “Don’t write the full PoC now. It’s late and it’s been a long day. Come at it with fresh eyes in the morning.”
Also me: *lays awake thinking about the code all night*
Weird request, but I’d like to listen. Women, people of colour, gender non-binary & disabled people. Would you mind sharing one thing you wish white men hackers like me would know/stop doing/do at hacker cons? I won’t argue just listen & hope to learn.
*rage* Stop blaming South Africa for discovering a COVID-19 variant because we do genome sequencing with a fraction of the budget you do. Discovering it because we invested in the tools and you didn't doesn't mean it started here.
Switching *wired* Ethernet speed from 10Mhz to 100Mhz to generate radio signals on 125Mhz as morse code (CW). Includes PoC. Ham radio and side channels oh my.
I joke that "ethical hacker" is a stupid name, because it presumes that hacking isn't ethical. Given how often I've had plumbers mess me around, I want to start making the good ones call themselves "ethical plumbers".