Agenda:
• 6:00 pm - Social
• 6:30 pm - OWASP update
• 6:35 pm - Presentation 1: autom8on’s infamous stalking talk - Steve WIlson
• 7:35pm - Presentation 2: Exploits with Scratch - Kevin Sheldrake
Presentation 1: autom8on’s infamous stalking talk (aka “Too Hot for MoD”)
Abstract: Whilst employed by his previous company, Steve delivered a presentation at an MoD training event on the techniques of, and threats relating to, open source intelligence gathering and the online footprint that people leave behind whilst using the Internet. As a practical demonstration of the types of information that are available to the persistent investigator, he prepared a non-live live demo, to show what could be found, if one were inclined to look. Starting from a single picture, this talk gives an entertaining (and eye opening) example of just what you can find if you go digging for long enough. Funnily enough, he gets asked to give this talk far more often than any other talk he has ever written. Warning: this talk is rated 15 for mild nudity, adult themes, and strong language. ;-)
Bio: Steve “autom8on” Wilson is a hacker, offensive security consultant and physical security nerd, currently working on the red side of the house for a large British telecommunications firm. A former MoD research scientist, he’s spent the past 20+ years working on a range of roles within the IT security sphere – applied research, software development, systems administration, penetration testing, forensics, incident response, and physical security. A regular face in the lock picking workshops of various UK conferences, he can also often be found supporting local security events across the country. He rambles incoherently on the Internet in various locations, including as @a8n_pub on Twitter.
Presentation2: Exploits With Scratch
Scratch is a programming language and IDE targeted at teaching young children how to code. It is particularly good at developing games not unlike the flash-based games of the 90s/00s. With the offline version of Scratch v2, it is possible to load ‘experimental HTTP extensions’ that can introduce new blocks linked to python functions via a web service API.
Using the experimental extensions, I have implemented a set of blocks that allow access to TCP/IP functions. With these blocks it is possible to fuzz and exploit vulnerable services on a network-accessible victim machine. As a demonstration I have developed a PoC for the web server running on Saumil Shah’s tinysploit (stack smash) plus PoCs for two echo servers I have added to it (stack smash and format string vulnerability).
The aims of the talk are to show that the (supposedly) sandboxed Scratch can be used to send evil packets to the network, and also to show that fuzzing and building exploits doesn’t have to involve coding abilities beyond those required to develop in Scratch. In other words, if you (or your child) wishes to learn how to write your own exploits, then this is all possible with Scratch and my experimental extension.
The talk will cover the intricacies of the Scratch extension API and the limitations that need to be overcome to make it usable, plus how these simple concepts can be strung together to create exploits.
Bio: Kevin Sheldrake is a penetration tester and researcher who started working in the technical security field in 1997. Over the years, Kev has been a developer and systems administrator of ‘secure’ systems, an infosec policy consultant, a penetration tester, a reverse engineer and an entrepreneur who founded and ran his own security consulting company. His current interests (4+ years) are IoT, crypto and RFID; he reverse engineers and hacks devices that his employer intends to sell.
He has a Masters degree, is a Chartered Engineer and, in the past, has been a CHECK Team Leader, a CISSP and held CLAS. He privately mentors others on the Stanford and Maryland crypto courses available on coursera.org.