David Marcus
Director, Security Research
Dave Marcus currently serves as Director of Security Research for McAfee® Labs, focusing on bringing McAfee’s ...
|
|
Yesterday was a fairly interesting day at CanSecWest, in Vancouver, B.C. I saw many a familiar hacker-face from the game, darn good content overall, and a bit of browser 0wnage thrown in for fun.
Brad Woodberg’s session on application firewalls was pretty compelling, as there was quite a bit about AppId vs. nested applications that I did not know and the cache-poisoning examples opened my eyes to a few interesting possibilities. But the session I found really enlightening was the Black Box Auditing Adobe Shockwave session from Portnoy and Brown.
Putting aside the fairly continual ZDI commercials throughout (which I can forgive them for because I work for a vendor, too), they offered a fascinating insight into their automated vulnerability verification methods. The methods and tools they developed to verify and fuzz Adobe Shockwave (and you could have easily used almost any software vendor) are impressive and the sheer volume of vulnerabilities they found in the application are also telling. Expect a steady flow of alerts, patches, and zero-days in this application for quite some time–as Portnoy and Brown claim to have well over 100 Shockwave vulnerabilities in the queue! I’ll be honest, I skipped several of the other sessions as the mobile SMS-of-Death issue is played out for me, and I got roped into solving the various puzzles I found at the Google table.
Certainly what has gotten the most attention at CanSecWest is PWN2OWN. Let’s be clear: Vulnerability hunting and exploit writing is pretty much a done deal at this point. Any OS, any application, any platform can get 0wned. Period. What makes PWN2OWN interesting is the work put into chaining vulnerabilities together and evading ALSR and DEP–because this is the same process a dedicated attacker would arguably use in a targeted attack. Know your target environment, and stage your attack based on that recon. Some would counter that the PWN2OWN players have weeks to stage their attack and test. Duh, so do the bad guys. Our industry needs to think more in terms of attack scenarios and less in terms of malware and individual technologies. Contests like PWN2OWN are helpful in looking at attacks as whole events and not just as malware. The malware used is, in most cases, the final piece–so by better understanding the attack as a whole the better we can protect users.
On to Day 2 and some mobile, gaming console, and Adobe 0wnage fun.
|
|
Tags: CanSecWest, critical infrastructure, Cybercrime, data breach, Data Protection, Endpoint Protection, enterprise, identity theft, PWN2OWN
Submit your own comments / message for this post