OrangeCon

To see our schedule with full functionality, like timezone conversion and personal scheduling, please enable JavaScript and go here.
09:15
09:15
5min
Orange is the new Black
Fish_, Cherry and Stef

Welcome to Orangecon!

Main track
Main track
09:20
09:20
40min
Cybersecurity’s New Imperative: Metawar - Defending the Cognitive Infrastructure.
Winn Schwartau

Winn’s keynote is a call to action. Winn challenges us with a new goal: Strengthen and defend the human mental immune system. Our brains, sensory nervous systems, and minds are the new attack surface. Will the hacker community rise to the challenge of solving the most existential threat it has ever faced?

Main track
Main track
10:00
10:00
30min
Low Energy to High Energy: Hacking Nearby EV-Chargers Over Bluetooth
Daan Keuper

During the first Pwn2Own Automotive, organised by ZDI in Tokyo in January 2024, Computest Sector 7 successfully demonstrated exploits for vulnerabilities in three different EV-chargers. All three could be exploited to execute arbitrary code on the charger, with the only prerequisite being close enough to connect to Bluetooth.

Main track
Main track
10:30
10:30
30min
Break
Main track
10:30
30min
Break
Second track
10:30
30min
Break
Workshop track 1
10:30
30min
Break
Workshop track 2
11:00
11:00
60min
Detect and Reverse engineer - Quick wins for defenders
Yassir Laaouissi

In this workshop we will use Ghidra and some famous public samples to identify quick detection engineering wins.

Workshop track 1
Workshop track 1
11:00
60min
HackTheBox & CTF Methodology - Hands-on workshop
Remco van der Meer, Jorian Woltjer

Learn how getting better at cybersecurity can be both fun and educational using CTFs and practice machines!

Workshop track 2
Workshop track 2
11:00
30min
Making penetration testing auditable
Brenno de Winter

Penetration testing can vary widely in execution, sometimes providing clear insights, and other times leaving much to be desired. For clients, these tests are essential for ensuring product security and often hold significant audit value. The COVID-19 crisis revealed a powerful opportunity: enhancing client assurance through more transparent and reliable pentests, a necessity increasingly driven by evolving legislation.

This realization sparked the creation of a groundbreaking collaboration. Clients, software developers, pentesters, auditors, and information security researchers now join forces in a unique alliance. Our mission? To empower every knowledgeable professional to contribute, ensuring that every crucial aspect is thoroughly examined.

Welcome to the Methodology for Information Security Research with Audit Value – a comprehensive, participatory approach that elevates the standards of penetration testing. Embrace this innovative methodology and transform how you achieve security and compliance!

Main track
Main track
11:00
30min
Securing devices or profits? Examining the device security of a network appliance vendor
Hal Martin

This talk is about the hidden devices that connect you, which are not often in the spotlight but frequently in many places: SMB network appliances. Specifically, my research has focused on Cisco Meraki wired routers and wireless access points.

Secure boot is the most widely used technology to ensure the integrity of a device’s boot chain. Adversaries, both criminal and state-sponsored, are moving down the software stack and closer to firmware to gain persistence and evade detection. However, secure boot is only as strong as its weakest link, which is often the vendor implementing it.

Recently, it has become apparent that some vendors have not been adequately securing, or even changing the example keys used to sign their firmware; the so-called PKFail.

The talk will focus on the following:
* The current state of Cisco Meraki’s device security model, spanning multiple devices and product generations
* Mistakes made in implementing secure boot, allowing for execution of unsigned code on devices employing secure boot

Come and find out if the teleworker gateway, or the wireless router used in your child’s school, are really as secure as the manufacturer claims they are. And is the intent behind securing these devices really to prevent adversaries from compromising them, or more to protect the profits of the manufacturer selling them?

Track 2
Second track
11:30
11:30
30min
Elevate Your Skills: From COM object fundamentals to UAC bypasses
Tijme Gommers

When did you last use or analyze a UAC bypass? And did you fully understand its internals?

User Account Control (UAC) is a security feature in Windows that limits the set of privileges available to users. And so, bypassing UAC enables threat actors to utilize privileges otherwise not available. A lot of the publicly available UAC bypasses exist, and most of them abuse functionality in COM objects to achieve their goal. However, COM is a largely undocumented part of Windows, making it difficult to truly understand how this process technically works.

In 30 minutes, I will teach you the basics of UAC and COM. Largely visualized, I explain how UAC works, what COM is, and how you can communicate with COM objects. As we progress, I explain in an easy-to-follow way how you can exploit COM objects to bypass UAC.

Lastly, I demo the exploitation of UAC through COM, and I share the code so you can start experimenting with UAC and COM by yourself.

Track 2
Second track
11:30
30min
The Registry Rundown
Cedric Van Bockhaven, Max Grim

Thought you knew how the Windows Registry worked? We have some tricks up our sleave to abuse the Remote Registry for extended remote reconnaissance and moving laterally to other systems, even bypassing typical remote UAC restrictions to gain code execution.

Main track
Main track
12:00
12:00
30min
Exploiting the Core: A Deep Dive into Kernel Driver Vulnerability Hunting
Jan-Jaap Korpershoek

In a world where user-mode security is often prioritized, vulnerabilities in kernel drivers pose significant risks and can lead to privilege escalation and other severe system compromises. This presentation offers a thorough guide to identifying and analyzing these vulnerabilities. We will examine the impact of kernel driver vulnerabilities, including their exploitation in real-world attacks and their use by red teams. We will demonstrate methods for building a driver database from diverse sources while filtering for only the most promising drivers.

We will then delve into the most important technical features of kernel drivers such as user-to-kernel communication, driver architecture, and essential functionionality. Finally, we will elaborate on identifying and assessing many common vulnerability types such as heap overflows, handle leaks, and race conditions. Additionally, we will provide some practical advice on setting up research environments, debugging, and automated analysis to get you set up right away. By the end of the presentation, you'll be equipped to start your own kernel driver vulnerability research. Based on our current results, we expect many vulnerabilities are still to be found!

Track 2
Second track
12:00
30min
Securing OT, too hard or not for me?
Erwin Paternotte

We read regularly in the news that critical infrastructure or OT networks should be better secured. We learn about APTs attacking these networks, or the latest ICS zero day vulnerabilities demonstrated during Pwn2Own. Mostly advanced attacks, which could feel overwhelming and hard to defend against, but is this actually true? If we think a bit longer about this we can come up with the following questions:

  • Are these actually the biggest threats to your OT environment you should be focusing on?
  • Should we just accept OT networks are insecure and could be easily hacked?
  • Or is there something that could be done to improve the security of these environments?

During this talk we will try to answer these question by combining threat intelligence and first hand security testing experience of OT environments and systems. We will share common vulnerabilities or configuration weaknesses and recommendations for improvements. Hopefully, after this talk you have the feeling not all is lost, and there is still a lot of room for improving the security of OT networks and systems.

Main track
Main track
12:30
12:30
60min
Lunch
Main track
12:30
60min
Lunch
Second track
12:30
60min
Lunch
Workshop track 1
12:30
60min
Lunch
Workshop track 2
13:30
13:30
30min
An angel, python, root and config walked into a bar...
Timothy Hjort

How many times do we need to kill the NsaRescueAngel? What's up with this messed up python webserver? Why the hell did this command injection get reimplemented?! Those were my words whilst digging into ZyXEL's NAS326 firmware from which I found multiple zeroday vulnerabilities earlier this year, which this talk will use for a case study and discuss the consequences of bad design and subpar patching.

Track 2
Second track
13:30
60min
Be lazy like a cat, making pentesting fun again
Brenno de Winter, Mischa van Geelen

Effective pentesting is labor-intensive, especially when it comes to validation and reporting. Standardization can help, but it may also inadvertently increase the workload. In this workshop, you will receive practical tools and strategies to reduce the workload by making standardization a part of the solution.

Join us and discover how to streamline your pentesting processes, enhance efficiency, and achieve superior results without the added stress.

Workshop track 2
Workshop track 2
13:30
120min
Getting familiar with DESFire
Sebastiaan Groot

MIFARE DESFire is the stronger, slightly more expensive sibling of the MIFARE family of smartcards. This workshop aims to cover the basics of the card's functions as well as how the most important crypto works. After a short lecture, it is up to you to analyze captured DESFire traces of vulnerable reader implementations with a Proxmark3 and program your own DESFire card to bypass the reader's security.

Workshop track 1
Workshop track 1
13:30
30min
Protecting organizations against AITM: lessons learned.
Rik van Duijn, Wesley

Protecting Hundreds of Organizations Against AiTM: Lessons Learned" dives into the evolving threat of AiTM) attacks. Our presentation highlights the transition from basic phishing tactics to sophisticated methods that compromise organizational security. The presentation outlines the journey from oldschool phishing attacks, to phishing framework like UADMIN, and the introduction of tools like Evilginx. And now the SaaS providers allowing anyone to buy access to an AiTM platform.

We’ve introduced a free method of detecting AiTM attacks. Which has allowed us an insight into the scale of AiTM attacks atleast against Microsoft M365 tenants. This prompted the development of a fingerprinting tool to gain an insight into the different actors performing these attacks and typical methods they employ.

We give an insight into a popular AiTM SaaS platform and the revenue stream hosting such software creates. The session ends by outlining common techniques to prevent these types of attacks. Most organizations use M365 and experience attacks using AITM to bypass MFA. At the same time SaaS providers are building AITM services that allow targeteted attacks allowing for supply chain attacks (AITM targeted against admin sites for: pypi, npmjs and rubygems). At the same time used for very specific scams for example against booking.com. Attackers use the booking.com hotel login to extract creditcard information for upcomming hotel guests.

Main track
Main track
14:00
14:00
30min
All cops are broadcasting: Breaking TETRA after decades in the shadows
Wouter Bokslag

This talk will present details of the TETRA:BURST vulnerabilities - the result of the first public in-depth security analysis of TETRA (Terrestrial Trunked Radio). This European standard for trunked radio is used globally by government agencies, police, military, and critical infrastructure, for applications ranging from voice communications to SCADA telecontrol of energy distribution, oil rigs and train safety systems.

Authentication and encryption within TETRA are handled by proprietary cryptographic cipher-suites, which had previously remained secret for over two decades through the use of restrictive NDAs. Last year, we presented the result of a two-year research project, and disclosed both open-source implementations of the secret primitives as well as a first public security assessment of the technology. Several critical vulnerabilities were identified, including a deliberate backdoor.

Track 2
Second track
14:00
30min
Offensive Development in Modern Languages
Cas van Cooten

As an (offensive) security professional, building tools to support your operations is no longer optional. Not only do you need custom malware to stay undetected on your target, the large scope of modern environments requires many different variants of automation to stay ahead. This talk will discuss what having an "Offensive Development" capability means, how modern languages like Rust or Go can help (or work against you), and how to take your code beyond PoC with some good development practice.

Main track
Main track
14:30
14:30
45min
Attacking Primary Refresh Tokens using their MacOS implementation
Dirk-jan Mollema, Olaf Hartong

While Microsoft Entra Primary Refresh Tokens remain mostly undocumented, on Windows there has been quite some research in how they work and how they can be attacked or protected. Despite several hiccups (read: vulnerabilities) in getting there, the implementation is now mostly secure if you have a Trusted Platform Module (TPM). On other platforms, the Primary Refresh Token is also used but its implementation is undocumented. We decided to investigate how Microsoft implemented Primary Refresh Tokens on MacOS, how they are protected and how hard (or easy) it is for attackers to steal them. During the investigation, we encountered more undocumented protocol features, leading to the discovery of deviceless Primary Refresh Tokens (PRTs). These deviceless PRTs, which as the name implies are only tied to a user and not a device. In some environments this might already be enough for an attacker to achieve their goal, since these PRTs could be obtained during phishing.

In this session, we will talk about the PRT internals, their protection on MacOS, and on the current and new PRT implementation Microsoft introduced using the Platform SSO capabilities.

Main track
Main track
14:30
60min
Finding vulnerabilities with CodeQL
Sylwia Budzynska

It is a truth universally acknowledged, that finding and reporting vulnerabilities in software may be a daunting task. However little known, there are tools and techniques that may assist on this journey.

CodeQL is a static analysis tool that can be used to automatically scan your applications for vulnerabilities and to assist with a manual code review. We can use it to find vulnerabilities in software at scale, in thousands of projects at once.

Join me in this beginner-friendly primer about finding vulnerabilities in software with CodeQL. Perhaps, by the end of this session, you might get inspired and learn how to find your own.

Workshop track 2
Workshop track 2
14:30
30min
How to crack seven billion passwords?
Jeroen van Beek

Free Taylor Swift tickets. DNA data breached. A $150 million fine for Uber. Phone records of nearly all users of a large US telco stolen. What do these incidents have in common? Stolen passwords. Off course all OrangeCon attendees use multi factor authentication and password managers. But most people don’t. Incidents caused by stolen password are (still) on the rise. According to research, stolen password are used in over 80% of recent IT security incidents. Launching a basic attack is within financial and technical reach of school kids. How to protect against account takeover attacks? Do what the bad guys are doing. And do it better! We have recovered over seven billion unique email/password pairs in the past years. In this presentation we dive into the details of password cracking at scale, and how this data can help you to keep your accounts safe.

Track 2
Second track
15:00
15:00
20min
Graph API Mastery - Logs to Real World Attacks
Shiva P, Parthiban R

In this presentation, we will explore the potential of Microsoft Graph API logs, focusing on its use for enhancing security, insights, and real-world attack scenarios within M365 environments. We begin by detailing the process of obtaining logs. We'll talk about fields which are critical for monitoring and analysis, correlatable fields and useful KQL functions that help. A comparison of delegated vs. application permissions to help attendees understand their distinct attack use cases and best practices.

The discussion will move to common attack patterns using Graph API, offering strategies for threat hunting and detection. Real-world stories from the frontlines will illustrate how organizations have successfully utilized Graph API to mitigate security incidents. Additionally, we will also highlight significant contributions from researchers and authors who've done great research in this field. The presentation will conclude with a summary of best practices and actionable insights for leveraging Microsoft Graph API logs to its fullest potential. This session aims to equip security professionals with the knowledge to effectively use Microsoft Graph API logs.

Track 2
Second track
15:15
15:15
30min
Break
Main track
15:30
15:30
15min
Lightning talks!
Second track
15:30
15min
Break
Workshop track 1
15:30
15min
Break
Workshop track 2
15:45
15:45
40min
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
Orange Tsai

Apache HTTP Server, as a cornerstone of the entire World Wide Web, accounts for about one-third of the web server market share worldwide. It's not an overstatement to say that its security is synonymous with the security of the Internet. However, while delving into the source by chance, we discovered that the coding style of this open-source project seemed a little bit... open? This research was thus born!

The Apache Httpd is comprised of dozens of different modules, which are coupled together. When a new HTTP request arrives, all modules uphold and maintain a colossal structure, collaborating in harmony to complete the request. While this cooperation might sound ideal, the reality reveals a significant challenge: the modules are not entirely familiar with each other, especially regarding the implementation details. However, they are asked to collaborate to fulfill the task. If any module has an incorrect understanding of any fields of this huge structure, it could potentially lead to fatal issues.

This observation led us to focus on interactions between modules, and discover this new attack surface. Let's see how a seemingly harmless structure modification can be passed through layers, amplifying the impact and affecting other modules to become vulnerabilities. This novel attack surface unearthed 3 distinct types of Confusion Attacks and 8 vulnerabilities, which allow us to navigate easily between Httpd modules, generating various attacks based on the different functionalities of modules: from the simplest arbitrary source code disclosure to misinterpreting a normal image as malicious scripts, bypassing ACL, and enabling unlimited SSRF. Of course, we won't forget about RCE, we will demonstrate how a long-underestimated bug type can be transformed into code execution by leveraging Httpd's internal features!

By understanding this talk, attendees won't be surprised at how we've managed to teach an old dog new tricks. Developers will understand how to avoid writing problematic Httpd modules. Server Admins can utilize this knowledge to examine their sites for potential vulnerabilities, and security researchers are able to explore more hidden issues along this direction. It's a scenario where everyone wins!

Main track
Main track
16:25
16:25
30min
Closing Keynote: U-matter
Inge Bryan

To be announced/It's gonna be a surprise.

Main track
Main track
16:55
16:55
5min
Closing Ceremony
Main track
17:00
17:00
60min
Drinks/Social
Main track