New on PHDays IV: How to Hack Gmail, Spy on TV, Overhear Any Phone Conversation and Drop WordPress

Loud exposures and scandals associated with hacking email of influential users are always accompanied by disputes about the authenticity of correspondence that got into the network. Until now it was believed that the correct signature DKIM clearly indicates the author of correspondence. But is it worth a hundred percent trust this authentication mechanism? On vulnerabilities in the services of Google, Yandex and Mail.Ru, the insecurity of TVs and the shortcomings of devices based on ARM will tell on May 21 and 22 in Moscow at the international forum on practical security Positive Hack Days IV .

Secure protocols are insecurely used.

The aggregate audience of Google, Yandex and Mail.Ru services is approaching a billion users, hundreds of experts from around the world are involved in the analysis of their security, but no one is immune from vulnerabilities. Vladimir Dubrovin, one of the brightest representatives of the Russian “old school”, the founder of securityvulns.ru and the developer of the 3proxy proxy server (known by the nickname 3APA3A), will tell you about errors of using protocols that ensure privacy, integrity and data encryption - as well-known SSL / TLS and Onion Routing), and about very fresh. For dessert, Vladimir will present new vectors of attacks aimed at receiving and replacing information in various services, including e-mail.
')

Smart TV - smart spy in your home

The TV was created to make our life more complete, but no one suspected that the heirs of the KVN-49 receivers, which were filled with distilled water, would turn into computers with their own operating system, camera, microphone, browser and applications. Needless to say that another door to our private life immediately began to break cybercriminals? ..

Donato Ferrante and Luigi Auriemma , the founders of ReVuln and the well-known vulnerability hunters in SCADA systems and multiplayer games, will talk about the weak points of the Smart TV technology that are of interest to intruders, and demonstrate the vulnerabilities found in TVs Smart TV from different manufacturers.

Exploiting ARM vulnerabilities using Android

Armed with laptops, the participants of the master class Aseem Jakhar will plunge into the problems of ARM security. The researcher of Payatu Technologies and one of the founders of the Nullcon conference will lead listeners in all circles of low-level programming hell: from assembly to the ARM architecture, through shell-code writing, past buffer overflow and reverse engineering to code injection.

The emphasis on practical aspects will allow everyone to get used to assembly in ARM and find out what processes are involved in the exploitation of vulnerabilities in Linux-based systems ARM. The choice of the Android platform as a testing ground for experiments will provide an opportunity to get an idea of ​​the principles of development and protective mechanisms in the most popular mobile OS.

How to eavesdrop on a person on the other side of the globe

Recently, records of telephone conversations, obviously received without the knowledge of subscribers, have appeared on the Internet and even on TV channels. Many of us also received very strange SMS - and then huge bills for mobile services.

Sergey Puzankov, an expert at Positive Technologies, which specializes in information security of mobile networks, will consider the possibilities of an attacker who has access to the holy of holy telecom operators - the SS7 signaling system. He will talk about the algorithms of attacks aimed at disclosing confidential data of the subscriber and his geographic location, changing the set of connected services, redirecting calls, unauthorized wedging of a third party into the voice communication channel. All attacks are implemented using documented signaling messages. The report will also describe methods of proactive protection against such attacks and methods of investigating incidents related to vulnerabilities of the signaling network.

Moloch as an investigator

Thousands of years ago, human sacrifices were made in honor of the ancient god Moloch. In the case of an open, highly scalable Moloch packet capture system, things are not so bloodthirsty (although attackers may not agree with this). The system serves as a tool to investigate cases of compromise, as it is able to capture traffic in real time. Moloch is also used to search and interact with large PCAP repositories for research purposes (malware traffic, exploit or scan traffic). The API of the Moloch system facilitates integration with the SEIM system and other tools, which allows for faster analysis.

Andy Wick and Owen Miller (Eoin Miller) are members of the AOL CERT group. Participants in their hands-on lab will be able to install Moloch instances on their own virtual machines and learn how AOL shares Moloch with other intrusion detection systems (Suricata, Snort) by embedding a notification function in the console and SEIM (Sguil, ArcSight) to protect their employees. , users and the Internet in general. The researchers will also demonstrate how Moloch captures the traffic of the PHDays CTF competition network, and will analyze all the incidents in detail.

Protection of industrial and infrastructure facilities in Europe

The events of recent years, starting with the attacks of September 11 and ending with WikiLeaks and Stuxnet, have forced governments of different countries to start developing national cybersecurity strategies to protect vital infrastructures.
Ignacio Paredes, Head of Research at the Spanish Center for Industrial Cyber ​​Security, is confident that hundreds of thousands of production infrastructures in Europe are under threat. He will report on the rapid convergence of industrial and corporate systems, the risks associated with this process and urgent countermeasures to be taken for the security of European countries.

WordPress Security again

One fifth (19%) of all sites in the world work on WordPress, so it is not surprising that the security of this content management system is of paramount importance. However, despite the open source code and regular assistance of researchers in the field of information protection, serious bugs and vulnerabilities are still found in this CMS.

Belgian Tom Van Goethem, a graduate student at the Catholic University of Leuven, on PHDays IV will talk about how MySQL’s unexpected behavior causes the PHP Object Injection vulnerability in the WordPress core and will demonstrate scenarios for using this security error.

We remind you that the announcement of the speeches of the first group of participants is published on the official website. Researchers who wish to present their work at an international forum on practical security need to hurry: the application deadline is March 31. However, there are other ways to get into the number of participants PHDays IV.