1. Router Cmd Injection 2. KeeLoq Rev Engineering 3. Virtualising Your Malware
Details
- A journey to Router Command Injection
- RollBack: KeeLoq Reverse Engineering, Literally
- Virtualising Your Malware: RISC-V VM in the Beacon
Presentation descriptions below. Talk Submissions: ruxmon@proton.me
1. A journey to Router Command Injection
Earlier this year, a CVE dropped relating to a router I happened to own. Naturally, I thought let’s dig into it, recreate the exploit, and get myself an easy shell. Simple, right? As it turned out, the exploit itself was easy. Demonstrating it was not.
This is the story of how my quest for a quick box-pop dopamine hit turned into a journey riddled with unexpected hurdles and gotchas left and right. A low intensity tale for anyone who wants to sit back, enjoy my struggles, take away from my learnings and tap into a little about embedded hardware testing along the way.
And, of course, there’s a command injection at the end.
Jason Tang from Neonix Security. A penetration tester and a hardware hacking enthusiast.
2. RollBack: KeeLoq Reverse Engineering, Literally
KeeLoq is a proprietary hardware block-cipher owned by Microchip, which is used in many rolling-code remote keyless entry systems, such as garage door openers and even some old cars. The encryption is designed to protect the shared secret used by the system, while the rolling codes protect against replay attacks.
But what happens when a remote is used too many times out-of-range of the receiver for that receiver to now recognise the remote? To avoid consumers constantly visiting the support desk, rolling-code systems that implement the KeeLoq protocol also have a mechanism to resynchronise to a remote in this scenario.
The more interesting question is: what happens when a security mechanism designed to adapt to the future, forgives the past? Discover this with me as I present a portable automatic hardware+software PoC!
I'm Juni, a girl in her bedroom playing with tech: an interloper with no qualifications or formal education! I'm not a professional or an expert, but I'm really good at rapid learning and serendipity farming. I do weird things in areas like cybersecurity, networking, site reliability engineering, machine learning, and some other stuff!
3. Virtualising Your Malware: RISC-V VM in the Beacon
A VM runs code that doesn't belong here, giving it a virtualised machine to execute in. What if your malware code runs in a VM? Traditional detection is overwhelmingly focused on native code inspection. VM code is treated as data and its execution is only visible to the VM itself. To an EDR, this is bad news. A RISC-V VM is only a C header file. If you compile your BOF or even the beacon itself into the VM there's little left to detect.
Jimmy Mi is a malware researcher and creator of emp3r0r C2.
Location
Room 080.02.002 at RMIT (Building 80) - 445 Swanston St, Melbourne
Discord
Discord Invite