View
265
Download
0
Category
Preview:
Citation preview
How to Hug a Hacker(Lessons from Manufacturing)
Holly Turner, XeroxInformation Security Manager
CISSP, PMP, Six Sigma Black Belt
"My father taught me many things here — he taught me in this room. He taught me — keep your friends close but your enemies
closer.“
"Michael Corleone" in The Godfather Part II (1974)
• Mike Lynn, age 24, presented vulnerabilities in Cisco IOS at Black Hat in Vegas
https://www.blackhat.com/html/bh-blackpage/bh-blackpage-11092005.htmlhttps://www.schneier.com/blog/archives/2005/07/cisco_harasses.html
• Resigned from ISS, after being asked to ‘edit’ presentation content
• Lawsuit filed by Cisco, ISS
2005 “Ciscogate”
"No one really thought this …was possible, until Wednesday, so no one really looked to defend against it," [Mike]Lynn said. "A router is like any computer in that, when it has a vulnerability, you can hack it.“
Blowback - 1 http://www.securityfocus.com/news/11260
"The whole attempt at security through obscurity is amazing, especially when a big company like Cisco tries to keep a researcher quiet““ People are definitely going to want to find more vulnerabilities ... and now people aren't going to care to report things to Cisco.”Marc Maiffret, chief hacking officer for network protection firm eEye Digital Security
Blowback - 2 http://www.securityfocus.com/news/11260
"You have EULAs that tell people they can't reverse engineer and companies who are ready to levy the most severe penalties for anyone who breaks those agreements,“[Jennifer] Granick said. "It is time to begin to worry about the rights that companies are trying to take away from us.”
Blowback- 3 http://www.securityfocus.com/news/11260
EULA
• Processor• RAM, ROM, SDRAM• HD• NIC• Analog Fax Modem• Linux OS• Apache, Open SSL, Open LDAP, Samba,
Kerberos, PHP, Netsnmp
Say hello to my little friend.
• Brendan O’Connor, undergrad intern, presents “Vulnerabilities in embedded systems”
https://www.blackhat.com/presentations/bh-usa-06/BH-US-06-OConnor.pdf
Black Hat 2006
XRX06-001, XRX06-003
https://www.xerox.com/download/security/security-bulletin/95dc-49fa773808540/cert_XRX06_001.pdfhttps://www.xerox.com/download/security/security-bulletin/390bd-49fa772c96a40/cert_XRX06_007_v1.pdf
• Senior Security Advisor at Leviathan Security Group
• Juris Doctor, Law, University of Wisconsin, MSE Computer Science, Johns Hopkins
• CIPP/US, CIPP/G, CISSP, Certificate of Cloud Security Knowledge https://www.linkedin.com/in/ussjoin
Where is he now?
• Researchers at Columbia School of Engineering and Applied Science reverse engineer printer
• Software updates are not digitally signed and checked for authenticity
• Malware can replace OShttp://www.nbcnews.com/business/consumer/exclusive-millions-printers-open-devastating-hack-attack-researchers-say-f118851
Printers on Fire? 2012
• Dr. Ang Cui, CEO and chief scientist• Dr. Salvatore Stolfo, co-founder• Red Balloon Security
https://www.redballoonsecurity.com/ • Project Symbiote – software to defend
embedded devices, in HP devices
Where are they now?
• Andrei Costin, presentation on “Embedded Devices Security and Firmware Reverse Engineering”
https://www.blackhat.com/us-13/briefings.html#Costin
Black Hat 2013
More Security Bulletins
https://www.xerox.com/download/security/security-bulletin/2e639-4d7bcb40a048e/cert_XRX12-003_v1.13.pdf
• Co-founder at Firmware.RE• PhD from EURECOM/Telecom ParisTech• Google Security Hall of Fame• 12/29/2015 presentation on “(In)Security of
Embedded Devices' Firmware - Fast and Furious at Large Scale “
https://www.youtube.com/watch?v=Rum1e8ZJlys
Where is he now?
• Andrew Auernheimer, Weev, hacktivist claims ‘mass printer trolling’ sending an unauthorized document to printers on open, unsecured Internet connections.
• http://www.nytimes.com/2016/03/29/nyregion/hacker-weev-says-he-printed-anti-semitic-and-racist-fliers-at-colleges-across-us.html?_r=0
Fast forward, March 2016
• Self-Employed• Seeking Crowdfunding on Liberapay• Twitter – “Tons of Soviet bureaucracy. Submitted
my request for a 15 year residency. If you don't travel to Eastern Europe I'll see you when I'm 45”
https://www.linkedin.com/in/rabite
Where is he now?
How hugging works1. Contact
– Dedicated webpage.com/security– Technical Support, phone or email
2. Publication Pause – Negotiated time period for manufacturer to develop
patch, 60 to 90 days3. Acknowledgement
– Public recognition of researcher
Options:• Contest/Challenge• Payment/Bug Bounty
www.xerox.com/security
https://www.google.com/appserve/security-bugs/m2/new?rl=&key=
https://technet.microsoft.com/en-us/security/ff852094.aspx
http://www.cisco.com/c/en/us/about/security-center/security-vulnerability-policy.html#roosfassv
Questions?
Recommended