OrangeCon

Welcome to Orangecon!

Winn’s keynote is a call to action. Winn challenges us with a new goal: Strengthen and defend the human mental immune system. Our brains, sensory nervous systems, and minds are the new attack surface. Will the hacker community rise to the challenge of solving the most existential threat it has ever faced?

During the first Pwn2Own Automotive, organised by ZDI in Tokyo in January 2024, Computest Sector 7 successfully demonstrated exploits for vulnerabilities in three different EV-chargers. All three could be exploited to execute arbitrary code on the charger, with the only prerequisite being close enough to connect to Bluetooth.

In this workshop we will use Ghidra and some famous public samples to identify quick detection engineering wins.

Learn how getting better at cybersecurity can be both fun and educational using CTFs and practice machines!

Penetration testing can vary widely in execution, sometimes providing clear insights, and other times leaving much to be desired. For clients, these tests are essential for ensuring product security and often hold significant audit value. The COVID-19 crisis revealed a powerful opportunity: enhancing client assurance through more transparent and reliable pentests, a necessity increasingly driven by evolving legislation.

This realization sparked the creation of a groundbreaking collaboration. Clients, software developers, pentesters, auditors, and information security researchers now join forces in a unique alliance. Our mission? To empower every knowledgeable professional to contribute, ensuring that every crucial aspect is thoroughly examined.

Welcome to the Methodology for Information Security Research with Audit Value – a comprehensive, participatory approach that elevates the standards of penetration testing. Embrace this innovative methodology and transform how you achieve security and compliance!

This talk is about the hidden devices that connect you, which are not often in the spotlight but frequently in many places: SMB network appliances. Specifically, my research has focused on Cisco Meraki wired routers and wireless access points.

Secure boot is the most widely used technology to ensure the integrity of a device’s boot chain. Adversaries, both criminal and state-sponsored, are moving down the software stack and closer to firmware to gain persistence and evade detection. However, secure boot is only as strong as its weakest link, which is often the vendor implementing it.

Recently, it has become apparent that some vendors have not been adequately securing, or even changing the example keys used to sign their firmware; the so-called PKFail.

The talk will focus on the following:
* The current state of Cisco Meraki’s device security model, spanning multiple devices and product generations
* Mistakes made in implementing secure boot, allowing for execution of unsigned code on devices employing secure boot

Come and find out if the teleworker gateway, or the wireless router used in your child’s school, are really as secure as the manufacturer claims they are. And is the intent behind securing these devices really to prevent adversaries from compromising them, or more to protect the profits of the manufacturer selling them?

When did you last use or analyze a UAC bypass? And did you fully understand its internals?

User Account Control (UAC) is a security feature in Windows that limits the set of privileges available to users. And so, bypassing UAC enables threat actors to utilize privileges otherwise not available. A lot of the publicly available UAC bypasses exist, and most of them abuse functionality in COM objects to achieve their goal. However, COM is a largely undocumented part of Windows, making it difficult to truly understand how this process technically works.

In 30 minutes, I will teach you the basics of UAC and COM. Largely visualized, I explain how UAC works, what COM is, and how you can communicate with COM objects. As we progress, I explain in an easy-to-follow way how you can exploit COM objects to bypass UAC.

Lastly, I demo the exploitation of UAC through COM, and I share the code so you can start experimenting with UAC and COM by yourself.

Thought you knew how the Windows Registry worked? We have some tricks up our sleave to abuse the Remote Registry for extended remote reconnaissance and moving laterally to other systems, even bypassing typical remote UAC restrictions to gain code execution.

In a world where user-mode security is often prioritized, vulnerabilities in kernel drivers pose significant risks and can lead to privilege escalation and other severe system compromises. This presentation offers a thorough guide to identifying and analyzing these vulnerabilities. We will examine the impact of kernel driver vulnerabilities, including their exploitation in real-world attacks and their use by red teams. We will demonstrate methods for building a driver database from diverse sources while filtering for only the most promising drivers.

We will then delve into the most important technical features of kernel drivers such as user-to-kernel communication, driver architecture, and essential functionionality. Finally, we will elaborate on identifying and assessing many common vulnerability types such as heap overflows, handle leaks, and race conditions. Additionally, we will provide some practical advice on setting up research environments, debugging, and automated analysis to get you set up right away. By the end of the presentation, you'll be equipped to start your own kernel driver vulnerability research. Based on our current results, we expect many vulnerabilities are still to be found!

We read regularly in the news that critical infrastructure or OT networks should be better secured. We learn about APTs attacking these networks, or the latest ICS zero day vulnerabilities demonstrated during Pwn2Own. Mostly advanced attacks, which could feel overwhelming and hard to defend against, but is this actually true? If we think a bit longer about this we can come up with the following questions:

• Are these actually the biggest threats to your OT environment you should be focusing on?
• Should we just accept OT networks are insecure and could be easily hacked?
• Or is there something that could be done to improve the security of these environments?

During this talk we will try to answer these question by combining threat intelligence and first hand security testing experience of OT environments and systems. We will share common vulnerabilities or configuration weaknesses and recommendations for improvements. Hopefully, after this talk you have the feeling not all is lost, and there is still a lot of room for improving the security of OT networks and systems.

How many times do we need to kill the NsaRescueAngel? What's up with this messed up python webserver? Why the hell did this command injection get reimplemented?! Those were my words whilst digging into ZyXEL's NAS326 firmware from which I found multiple zeroday vulnerabilities earlier this year, which this talk will use for a case study and discuss the consequences of bad design and subpar patching.

Effective pentesting is labor-intensive, especially when it comes to validation and reporting. Standardization can help, but it may also inadvertently increase the workload. In this workshop, you will receive practical tools and strategies to reduce the workload by making standardization a part of the solution.

Join us and discover how to streamline your pentesting processes, enhance efficiency, and achieve superior results without the added stress.

MIFARE DESFire is the stronger, slightly more expensive sibling of the MIFARE family of smartcards. This workshop aims to cover the basics of the card's functions as well as how the most important crypto works. After a short lecture, it is up to you to analyze captured DESFire traces of vulnerable reader implementations with a Proxmark3 and program your own DESFire card to bypass the reader's security.

Protecting Hundreds of Organizations Against AiTM: Lessons Learned" dives into the evolving threat of AiTM) attacks. Our presentation highlights the transition from basic phishing tactics to sophisticated methods that compromise organizational security. The presentation outlines the journey from oldschool phishing attacks, to phishing framework like UADMIN, and the introduction of tools like Evilginx. And now the SaaS providers allowing anyone to buy access to an AiTM platform.

We’ve introduced a free method of detecting AiTM attacks. Which has allowed us an insight into the scale of AiTM attacks atleast against Microsoft M365 tenants. This prompted the development of a fingerprinting tool to gain an insight into the different actors performing these attacks and typical methods they employ.

We give an insight into a popular AiTM SaaS platform and the revenue stream hosting such software creates. The session ends by outlining common techniques to prevent these types of attacks. Most organizations use M365 and experience attacks using AITM to bypass MFA. At the same time SaaS providers are building AITM services that allow targeteted attacks allowing for supply chain attacks (AITM targeted against admin sites for: pypi, npmjs and rubygems). At the same time used for very specific scams for example against booking.com. Attackers use the booking.com hotel login to extract creditcard information for upcomming hotel guests.

This talk will present details of the TETRA:BURST vulnerabilities - the result of the first public in-depth security analysis of TETRA (Terrestrial Trunked Radio). This European standard for trunked radio is used globally by government agencies, police, military, and critical infrastructure, for applications ranging from voice communications to SCADA telecontrol of energy distribution, oil rigs and train safety systems.

Authentication and encryption within TETRA are handled by proprietary cryptographic cipher-suites, which had previously remained secret for over two decades through the use of restrictive NDAs. Last year, we presented the result of a two-year research project, and disclosed both open-source implementations of the secret primitives as well as a first public security assessment of the technology. Several critical vulnerabilities were identified, including a deliberate backdoor.

As an (offensive) security professional, building tools to support your operations is no longer optional. Not only do you need custom malware to stay undetected on your target, the large scope of modern environments requires many different variants of automation to stay ahead. This talk will discuss what having an "Offensive Development" capability means, how modern languages like Rust or Go can help (or work against you), and how to take your code beyond PoC with some good development practice.

While Microsoft Entra Primary Refresh Tokens remain mostly undocumented, on Windows there has been quite some research in how they work and how they can be attacked or protected. Despite several hiccups (read: vulnerabilities) in getting there, the implementation is now mostly secure if you have a Trusted Platform Module (TPM). On other platforms, the Primary Refresh Token is also used but its implementation is undocumented. We decided to investigate how Microsoft implemented Primary Refresh Tokens on MacOS, how they are protected and how hard (or easy) it is for attackers to steal them. During the investigation, we encountered more undocumented protocol features, leading to the discovery of deviceless Primary Refresh Tokens (PRTs). These deviceless PRTs, which as the name implies are only tied to a user and not a device. In some environments this might already be enough for an attacker to achieve their goal, since these PRTs could be obtained during phishing.

In this session, we will talk about the PRT internals, their protection on MacOS, and on the current and new PRT implementation Microsoft introduced using the Platform SSO capabilities.

It is a truth universally acknowledged, that finding and reporting vulnerabilities in software may be a daunting task. However little known, there are tools and techniques that may assist on this journey.

CodeQL is a static analysis tool that can be used to automatically scan your applications for vulnerabilities and to assist with a manual code review. We can use it to find vulnerabilities in software at scale, in thousands of projects at once.

Join me in this beginner-friendly primer about finding vulnerabilities in software with CodeQL. Perhaps, by the end of this session, you might get inspired and learn how to find your own.

Free Taylor Swift tickets. DNA data breached. A $150 million fine for Uber. Phone records of nearly all users of a large US telco stolen. What do these incidents have in common? Stolen passwords. Off course all OrangeCon attendees use multi factor authentication and password managers. But most people don’t. Incidents caused by stolen password are (still) on the rise. According to research, stolen password are used in over 80% of recent IT security incidents. Launching a basic attack is within financial and technical reach of school kids. How to protect against account takeover attacks? Do what the bad guys are doing. And do it better! We have recovered over seven billion unique email/password pairs in the past years. In this presentation we dive into the details of password cracking at scale, and how this data can help you to keep your accounts safe.

In this presentation, we will explore the potential of Microsoft Graph API logs, focusing on its use for enhancing security, insights, and real-world attack scenarios within M365 environments. We begin by detailing the process of obtaining logs. We'll talk about fields which are critical for monitoring and analysis, correlatable fields and useful KQL functions that help. A comparison of delegated vs. application permissions to help attendees understand their distinct attack use cases and best practices.

The discussion will move to common attack patterns using Graph API, offering strategies for threat hunting and detection. Real-world stories from the frontlines will illustrate how organizations have successfully utilized Graph API to mitigate security incidents. Additionally, we will also highlight significant contributions from researchers and authors who've done great research in this field. The presentation will conclude with a summary of best practices and actionable insights for leveraging Microsoft Graph API logs to its fullest potential. This session aims to equip security professionals with the knowledge to effectively use Microsoft Graph API logs.

Apache HTTP Server, as a cornerstone of the entire World Wide Web, accounts for about one-third of the web server market share worldwide. It's not an overstatement to say that its security is synonymous with the security of the Internet. However, while delving into the source by chance, we discovered that the coding style of this open-source project seemed a little bit... open? This research was thus born!

The Apache Httpd is comprised of dozens of different modules, which are coupled together. When a new HTTP request arrives, all modules uphold and maintain a colossal structure, collaborating in harmony to complete the request. While this cooperation might sound ideal, the reality reveals a significant challenge: the modules are not entirely familiar with each other, especially regarding the implementation details. However, they are asked to collaborate to fulfill the task. If any module has an incorrect understanding of any fields of this huge structure, it could potentially lead to fatal issues.

This observation led us to focus on interactions between modules, and discover this new attack surface. Let's see how a seemingly harmless structure modification can be passed through layers, amplifying the impact and affecting other modules to become vulnerabilities. This novel attack surface unearthed 3 distinct types of Confusion Attacks and 8 vulnerabilities, which allow us to navigate easily between Httpd modules, generating various attacks based on the different functionalities of modules: from the simplest arbitrary source code disclosure to misinterpreting a normal image as malicious scripts, bypassing ACL, and enabling unlimited SSRF. Of course, we won't forget about RCE, we will demonstrate how a long-underestimated bug type can be transformed into code execution by leveraging Httpd's internal features!

By understanding this talk, attendees won't be surprised at how we've managed to teach an old dog new tricks. Developers will understand how to avoid writing problematic Httpd modules. Server Admins can utilize this knowledge to examine their sites for potential vulnerabilities, and security researchers are able to explore more hidden issues along this direction. It's a scenario where everyone wins!

To be announced/It's gonna be a surprise.