Una de las facetas del Hacking es la de saltarse los sistemas de protección establecidos en sistemas informáticos. Éste no sólo abarca los ordenadores en sí, sino además dispositivos móviles, vídeo consolas, etc. En realidad, dependiendo de cómo definas “ordenador”, todos estos son básicamente lo mismo: una CPU, memoria y unidad de control (como mínimo) que corren algún tipo software.

La PS4 o Playstation 4 es una consola de vídeo juegos de Sony, que no necesita presentación alguna y una de las más populares del mercado. Así como el resto de consolas, Sony intenta capar el sistema de la misma tanto como puede, para que los usuarios no puedan hacer otra cosa que jugar a los vídeo juegos certificados por dicha empresa. Esto es una práctica común no sólo en el mundo de las consolas y lo tenemos muy presentes en dispositivos como los teléfonos móviles.

En mi afán por aprender y familiarizarme con el entorno de contenedores y más específicamente con Docker, he creado un contenedor con una aplicación web vulnerable diseñada para la práctica de ataques de inyección de SQL.

El código de dicha web no lo he creado yo y está disponible en Github. De hecho, tampoco es algo nuevo, pero cumple con el propósito de “mi práctica”. Las lecciones son perfectamente válidas, porque la inyección de SQL es todavía un factor muy presente en las aplicaciones web.

Por si no tenéis material bastante para leer, aquí tenéis las diapositivas presentadas en DeepSec 2015:

• Agile_Security_The_Good,_The_Bad,_(and_Mostly)_The_Ugly_-_Daniel_Liber.pdf
• Bridging_the_Air-Gap_Data_Exfiltration_from_Air-Gap_ Networks_-_Yisroel_Mirsky.pdf
• Can_societies_manage_ the_SIGINT_monster_-_Duncan_Campbell.pdf
• Chw00t_How_To_Break Out_from_Various_Chroot_Solutions_-_Bucsay_Balazs.pdf
• Continuous_Intrusion_Why_CI_Tools_Are_an_Attacker's_Best_Friends_-_Nikhil_Mittal.pdf
• Cyber_Cyber_Cyber_Warfare___Mistakes_of_the_DoDs_-_Raoul Chiesa.pdf
• Deactivating_Endpoint_Protection_Software_in_an_Unauthorized_ Manner_-_Matthias_Deeg.pdf
• Extending_a_Legacy_ Platform_Providing_a_Minimalistic,_Secure_Single-Sign-On-Library_-_Bernhard_Goeschelberger,_Sebastian_Goettfert.pdf
• File_Format_Fuzzing_in_Android_-Alexandru_Blanda.pdf
• German_Privacy_Law_And_IT_Security_-_Stefan_Schumacher.pdf
• Hacking Cookies in Modern Web Applications_and_Browsers_-_Dawid_Czagan.pdf
• How_To_Break_XML_Encryption_-_Automatically_-_Juraj_Somorovsky.pdf
• Legal_Responses_ Against_Cyber_ Incidents_-_Oscar_Serrano.pdf
• Not_so_Smart_On_ Smart_TV_Apps_-_Marcus_Niemietz.pdf
• OSINT_Barncat___Mining_Malware_for_Intelligence_at_Scale_-_John_Bambenek.pdf
• Revisiting_SOHO_Router_Attacks_-_Jose_Antonio _Rodriguez_Garcia,_Ivan _Sanz_de_Castro,_Álvaro_Folgado_Rueda.pdf
• Yes,_Now_YOU_Can_ Patch_That_Vulnerability_Too!_-_Mitja_Kolsek.pdf
• ZigBee_SmartHomes_A_Hackers_Open_House_-_Tobias_Zillner,_Florian_Eichelberger.pdf

En la misma línea del Advent of Code, HACKvent 2015 consiste en resolver retos de hacking, al estilo de un CTF.

Los retos comenzaron el 1 de diciembre y continuarán hasta el 24. Está organizado por Hacklab y por lo tanto necesitas estar registrado con estos. Los puntos conseguidos también se te sumarán a tu usuario (esto es interesante si te mantienes activo dentro de Hacklab).

Happy hacking!

Finalmente se están publicando los vídeos de DEF CON 23. Ya llevan un tiempo publicándolos en listas agrupadas por temas. Todavía no están todos, pero ya hay bastante material. Iremos actualizando esta entrada a medida que vayan publicando más. Por ahora estos son los que hay:

• Automotive Hacks
  • Marc Rogers and Kevin Mahaffey - How to Hack a Tesla Model S
  • Vehicle Hacking Village - Josh Corman - Safer Sooner Automotive Cyber Safety
  • Vehicle Hacking Village - Eric Evenchick - SocketCAN
  • Samy Kamkar - Drive it like you Hacked it: New Attacks and Tools to Wireles
  • Charlie Miller & Chris Valasek - Remote Exploitation of an Unaltered Passenger Vehicle
  • Vehicle Hacking Village - Nathan Hoch - The Badge and PAWN: Customizing the Badge

• Internet Of Things
  • Runa Sandvik, Michael Auger - Hacking a Linux-Powered Rifle
  • Qing Yang - Im A Newbie Yet I Can Hack ZigBee
  • IoT Village - Wesley Wineberg - Cameras Thermostats and Home Automation Controllers
  • IoT Village - K Reid Wrightman - Vulnerability Inheritance in PLCs
  • IoT Village - Kenneth Shaw - The Grid - A Multiplayer Game of Destruction
  • IoT Village - Daniel Miessler - IoT Attack Surface Mapping
  • IoT Village - Brian Knopf - Yes You Can Walk on Water
  • IoT Village - Aaron Guzman - Security - the IoT World

• Wireless
  • Graham and Maynor - HamSammich – Long Distance Proxying Over Radio
  • DEF CON 23 Conference - Andres Blanco, Andres Gazzoli - 80211 Massive Monitoring
  • Wireless Village - Wireless Warrior - Covert Wireless Practical Hacker LPI LPD
  • Wireless Village - Vivek Ramachandran and Thomas Dotreppe - WPA Enterprise Hacking
  • Wireless Village - V. Ramachandran - Automatic Live WPA WPA2 Attacks and WPA Supplicant
  • Wireless Village - Travis Goodspeed, Sergey Bratus - PSK31 Modulation Polyglots
  • Wireless Village - Tim Oshea - GNU Radio Tools for Radio Wrangling/Spectrum Domination
  • Wireless Village - Michael Calabro - Software Defined Radio Performance Trades & Tweaks
  • Wireless Village - Karl Koscher - DSP for SDR
  • Wireless Village - JoshInGeneral - Meeting People Over WiFi
  • Wireless Village - Kitchen and Kinne - Sniffin WiFi Sippin Pineapple Juice
  • Wireless Village - Cyb3r Assassin - Wireless Pentesting: So Easy a Cave Man Can Do It
  • Wireless Village - Catatonic - Tospo Virus: Weaponizing WiFi Pineapple Vulnerabilities
  • Wireless Village - Balint Seeber - SIGINT & Blind Signal Analysis w/ GNU Radio & SDR

• Crypto
  • Panel - Lets Encrypt Minting Free Certs to Encrypt the Entire Web
  • Justin Engler - Secure Messaging for Normal People
  • Eijah - Crypto for Hackers
  • David Huerta - Alice and Bob are Really Confused
  • Bruce Schneier - Questions and Answers
  • Ryan Castellucci - Cracking CryptoCurrency Brainwallets
  • Jose Selvi - Breaking SSL Using Time Synchronisation Attacks
  • Crypto and Privacy Village - Robert Olson - Teaching Privacy Using Red Team Strategies
  • Crypto and Privacy Village - Nick Sullivan - CFSSL the evolution of a PKI toolkit
  • Crypto and Privacy Village - Carlson and Doherty - Breaking CBC
  • Crypto and Privacy Village - Craig Young - Smart Home Invasion
  • Crypto and Privacy Village - Freddy Martinez - IMSI Catchers
  • Crypto and Privacy Village - Marina - Hacking Quantum Cryptography

• Biohacking
  • Scott Erven and Mark Collao -Medical Devices: Pwnage and Honeypots
  • Richard Thieme - Hacking the Human Body and Brain
  • BioHacking Village - Whitlock and Aganovic - Physiology from the Perspective of Control
  • BioHacking Village - Walter Powell - Parallels in BioSec and InfoSec
  • BioHacking Village - Panel - The Anatomy of DIY Implantable Devices
  • BioHacking Village - Alex Smith - Cloning Access Cards to Implants
  • BioHacking Village - Johan Sosa - Genetic engineering - GMO for fun and profit
  • BioHacking Village - Keoni Gandall - Biohacking at Home
  • BioHacking Village - Michael Goetzman - Social Implications of DNA Acquisition
  • BioHacking Village - Alejandro Hernández - Brain Waves Surfing - (In)security in EEG

• Hardware and Lockpicking
  • Lock Picking Village - Intro to Lockpicking 2
  • Lock Picking Village - Intro to Lockpicking 1
  • DEF CON 23 - Lock Picking Village - Impressioning
  • Hardware Hacking Village - Soldering 101 - Melting metal for fun and profit
  • Hardware Hacking Village - Nikhil Mittal - Hacking with Human Interface Devices
  • Hardware Hacking Village - Matt DuHarte - Introduction to USB and Fuzzing
  • Hardware Hacking Village - Dr. Tran - Introduction to Lockpicking
  • Hardware Hacking Village - Machinist - Mechanical Engineering for Noobs
  • DEF CON 23 - Teddy Reed and Nick Anderson - Hardware and Trust Security ELI5
  • Dan Petro and Oscar Salaza - Hacking Smart Safes: On the Brink of a Robbery
  • Mike Ryan and Richo Healey - Hacking Electric Skateboards
  • AmmonRa - How to Hack Your Way out of Home Detention

• Packet Hacking Village
  • Packet Capture Village - Wayne Crowder - Fishing To Phishing
  • Packet Capture Village - Vivek Ramachandran - 80211 Monitoring with PCAP2XML - SQLite
  • Packet Capture Village - Tony Martin - From XSS to Root on Your NAS
  • Packet Capture Village - Theodora Titonis - How Machine Learning Finds Malware
  • Packet Capture Village - Sam Bowne - Is Your Android App Secure
  • Packet Capture Village - Robert Simmons - The Digital Cockroach Bait Station
  • Packet Capture Village - Ron Taylor - Violating Web Services
  • Packet Capture Village - Paul Vixie - Passive DNS Collection and Analysis
  • Packet Capture Village - Mike Raggo - Remaining Covert in an Overt World
  • Packet Capture Village - Ming Chow - Tools and Techniques Used at the Wall of Sheep
  • Packet Capture Village - Monzy Merza - Real World Automation for Rapid Response
  • Packet Capture Village - Nikhil Mittal - Powershell for Penetraton Testers
  • Packet Capture Village - Jay Beale - Jailing Programs via Docker
  • Packet Capture Village - Joseph Muniz & Aamir Lakhani - Pen Testing with Raspberry Pi
  • Packet Capture Village - Karl Koscher - Sniffing SCADA
  • Packet Capture Village - Leon Ward - The Packets Made Me Do It - Using OpenFPC
  • Packet Capture Village - Lokesh Pidawekar - Hackers Practice Ground
  • Packet Capture Village - Michael Raggo - Mobile Data Loss - Threats and Countermeasures
  • Packet Capture Village - Bob Simpson - MITM 101 - Easy Traffic Interception Techniques
  • Packet Capture Village - Brian Wohlwinder and Andrew Beard - I See You
  • Packet Capture Village - David Schwartzberg - Hacking the Next Generation
  • Packet Capture Village - Elliot Brink - Global Honeypot Trends
  • Packet Capture Village - Grecs - Creating REAL Threat Intelligence With Evernote

• Social Engineering
  • Social Engineering Village - Tim Newberry - Twitter ISIL and Tech
  • Social Engineering Village - Noah Beddome - Yellow Means Proceed with Caution
  • Social Engineering Village - Michele Fincher - I Didn’t Think it was Loaded
  • Social Engineering Village - John Ridpath - Shakespeare and Social Engineering
  • Social Engineering Village - Jayson E. Street - Breaking in Bad
  • Social Engineering Village - Ian Harris - Understanding Social Engineering Attacks
  • Social Engineering Village - Dave Kennedy - Understanding End-User Attacks
  • Social Engineering Village - Chris Hadnagy - A Peek Behind the Blue Mask
  • Social Engineering Village - Adam Compton & Eric Gershman - SpeedPhishing Framework
  • Michael Schrenk - Applied Intelligence: Using Information Thats Not There
  • Marte Loge - Tell me who you are and I will tell you your lock pattern
  • Ken Westin - Confessions of a Professional Cyber Stalker
  • Chris Rock - I Will Kill You

• Panels
  • Panel - WhyMI so Sexy: WMI Attacks - Real Time Defense and Advanced Forensics
  • Panel - ThunderStrike 2: Sith Strike
  • Panel - Switches Get Stitches
  • Panel - Licensed to Pwn: Weaponization and Regulation of Security Research
  • DEF CON - Panel - Guests N Goblins: Exposing Wi Fi Exfiltration Risks and Mitigation
  • DEF CON 23 - Panel - DEF CON Comedy Inception
  • Panel - DEF CON 101: The Panel
  • Panel - Ask the EFF: The Year in Digital Civil Liberties
  • Panel - Abusing Adobe Readers JavaScript APIs

• Attack
  • Ionut Popescu - NetRipper: Smart Traffic Sniffing for Penetration Testers
  • Ian Kline - LTE Recon and Tracking with RTLSDR
  • Fernando Arnabold - Abusing XSLT for Practical Attacks
  • Dr Phil Polstra - One Device to Pwn Them All
  • Dr Phil Polstra - Hacker in the Wires
  • Damon Small - Beyond the Scan The Value Proposition of Vuln Assessment
  • Brent White - Hacking Web Apps
  • Aditya K Sood - Dissecting the Design of SCADA Web HMIs: Hunting Vulns
  • Craig Young - How to Train Your RFID Hacking Tools
  • Francis Brown, Shubham Shah - RFIDiggity: Guide to Hacking HF NFC & UHF RFID
  • Geoff Walton and Dave Kennedy - Pivoting Without Rights: Introducing Pivoter
  • Jeremy Dorrough - USB Attack to Decrypt Wi Fi Communications
  • Mickey Shkatov & Jesse Michael - Scared Poopless – LTE and your laptop
  • Nemus - Hacking SQL Injection for Remote Code Execution on a LAMP Stack
  • Nadeem Douba - BurpKit: Using WebKit to Own the Web
  • Tamas Szakaly - Shall We Play a Game
  • Wesley McGrew - I Hunt Penetration Testers: More Weaknesses in Tools and Procedures

Los que seguís el blog, ya habréis leído sobre varios proyectos que hemos hecho usando Raspberry Pi. Concretamente, con el último proyecto que publicamos, ese del termómetro usando un par térmico, cuando me lo llevé a casa de un amigo para usarlo, nos encontramos con un problema: la alimentación. Este amigo mío tenía la barbacoa en el patio de la casa en el cual no había un enchufe cerca, con lo que tuvimos que hacer malabares, además de encontrar un alargador de corriente para finalmente poder usarlo. En ese momento empecé a masticar la idea de conectarle una batería externa al Raspberry Pi. La pregunta del millón: ¿Cuánta autonomía tendría?

Raspberry Pi, C.H.I.P., Beaglebone, Arduinos… El mercado de los mini ordenadores no para de moverse, nuevos modelos más potentes, menos potentes, pero más pequeños, etc. Cada uno de ellos perfecto para ciertos proyectos, muy asequibles e ideales para juguetear. El objetivo de la mayoría de estos es el acercar la tecnología a todos los rincones del mundo.

Y mi personalmente me encanta Raspberry Pi, pero para ser honestos, no cumple con su objetivo principal, el de ser ordenador muy barato enfocado a la educación. A mi lo que más me atrae es el interfaz GPIO que me permite conectarlo sensores y otros periféricos para poder construir algún tipo de dispositivo “inteligente”, nicho en el que los Arduinos en algunas ocasiones sean una mejor opción.

Pues para que no nos aburramos durante las vacaciones, aquí tenéis material nuevo. En este caso de DefCamp #6.

• A new Hope - CTF stories & IoT Hacking - Slide - Video
• Game of Hacks: Play, Hack & Track - Slide - Video
• (In)Security of Embedded Devices' Firmware – Fast and Furious at Large Scale - Slide - Video
• IoT Security - Slide - Video
• IoT Security - Slide - Video
• From Hype Hangover to Happy Hacking: Shaping the World through Shaping Actions - Slide - Video
• A new Hope - CTF stories & IoT Hacking - Slide - Video
• What's in a name? DNS use for exfiltration, and monitoring for detection - Slide - Video
• Finding media bugs in Android using file format fuzzing - Slide - Video
• White hat hacker bounty program to improve online environment security - Slide - Video
• ELK stack for Hackers - Slide - Video
• When Steganography Stops Being Cool - Slide - Video
• Integrating Mobile Devices into Your Penetration Testing Program - Slide - Video
• Toward large-scale vulnerability discovery using Machine Learning - Slide - Video
• Breaking in Bad (I'm the one who doesn't knock) - Slide - Video
• Modern approaches to Wi-Fi attacks - Slide - Video
• Building a Weaponized Honeybot (part I) - Slide - Video
• Building a Weaponized Honeybot (part II) - Slide - Video
• Why nation-state malwares target Telco Networks: Dissecting technical capabilities of Regin and its counterparts - Slide - Video
• Defending the Enterprise Against Network Infrastructure Threats - Slide - Video
• Challenges on Reversing Layered Malware - Slide - Video
• How to mess with Android Intents - Slide - Video
• Cryptography – our weapon in the 21st century - Slide - Video
• Luke 8:17 – Misleading implementations that compromise the privacy and information security - Slide - Video
• Building a Cyber Security Operations Center - Slide - Video
• Pentesting Android Applications - Workshop - Slide - Video
• What's in a name? DNS use for exfiltration, and monitoring for detection - Slide - Video
• IDS Evasion Techniques - Slide - Video
• Untrusted Mobile Applications. State of Art of Security App-Apocalypse - Slide - Video
• IoT Village Awards - Slide - Video
• Hacking and Securing Network Monitoring Systems: End-to-end walkthrough example on Ganglia - Slide - Video
• Orange about Bug Bounty and Innovation Labs 2016 - Slide - Video
• Abstract Apoc@lypse Technique - Slide - Video

Ya está disponible el material de la conferencia Zero Nights 2015. No sólo las de las charlas, sino también de los talleres!

• “A praise for hackers”
• "Hacking Virtual Appliances"
• "Browser Fuzzing with a Twist (and a Shake)"
• "Warranty Void If Label Removed - Attacking MPLS Networks"
• “Big problems with big data - Hadoop interfaces security”
• “Mathematical theory of input validation vulnerabilities and attacks”
• «Cisco IOS shellcode – all-in-one»
• "Introducing Choronzon: an approach to knowedgebased evolutionary fuzzing"
• "Samsung SmartTV: how-to to creating insecure device in today’s world"
• "Did you get your token?”
• "Fix it yourself: resolving UEFI vulnerabilities single-handedly"
• "Attacking hypervisors using firmware and hardware"
• "Direct X – direct way to Microsoft Windows kernel"
• "Hack like a movie star: Step-bystep guide to crafting SCADA payloads for physical attacks with catastrophic consequences"
• "Modifying the firmwares of industrial switches"
• “Getting The Most Out Of CSP: a Deep Dive”
• "illusoryTLS: Nobody But Us Impersonate, Tamper, and Exploit"
• "How to build your own Echelon system? Attacks at 3G modems"
• "EESIL – universal IL (Intermediate Language) for Radare2"
• "S[c][/c]rum is all around. How to stop continuous integration"
• "KNX security or how to steal a skyscraper"
• "Extracting the painful (blue) tooth"
• “Cross-platform reversing with Frida”
• "Enlarge your Burp, or How to stop fearing Javadocs"
• “Practical exploitation of AVR MC-based devices”
• “On the way to (wrong) anonymity. Basic techniques of digital contraception and private data hygiene”
• “Software vulnerabilities of Yota communication equipment”
• “Distributing the reconstruction of high-level intermediate representation for large scale malware analysis”
• “Hooked browser network based on BeEF and Google Drive”
• “ORM2Pwn: exploiting injections in Hibernate”
• “What should a hacker know about WebDav? Vulnerability review in WebDav implementations”
• “Knowledge based approach for fast Internet resource discovery or Data Mining in the service of nmap”
• “Correlating security events with Esper”
• “Fighting against Flash 0-day: a hunt for a tainted vector”
• “Banking Trojans: a look from the new perspective”
• “Automation of web applications scanning: experience of Yandex”
• “Do-it-yourself banking SDL”
• “Let’s play the game: One more way to perform penetration test”
• Presentation

Como muchos ya sabéis la especificación de la segunda versión del protocolo HTTP, fue publicada en mayo de este mismo año, 2015. El documento oficial dónde se definen la misma, es el RFC 7540.

Sin entrar más en detalles sobre esta nueva versión, ya que el objetivo de esta entrada no es ese, sino la de documentación adicional explicada de forma clara y sencilla para ayudarnos a entender mejor los conceptos técnicos de esta nueva versión.