Recently, I attended Grrcon. Grrcon is an information security and hacking conference based in Grand Rapids Michigan (grrcon.org) It was an interesting conference, because it managed to be small enough to have that close friends feel, but large enough to attract good speakers. Oh and there was free beer. Amongst the free beer, there were some presentations that I felt were worth the price of admission.
SCADA
SCADA is one of those things that should make people squirm, and criminals smile. SCADA, for those who aren’t really aware of it, stands for Supervisory Control And Data Acquisition. SCADA is a type of Industrial Control System (ICS), and these terms are often used interchangeably in common conversation. I’m not really going to go into the differences, but essentially we are talking about all those systems that support our way of life. Some examples are computers that control water or power systems.
What makes SCADA/ICS interesting is that it requires maximum uptime, which often requires quick communication to resolve any potential issues. Maximum uptime can be used as an excuse to reduce security. We often hear, we can’t add that, it will reduce speed, or introduce new equipment which can ‘reduce uptime’. In fairness, information technology has only recently become a big part of these systems. Similar to Voice systems, initially it was all analog, or communication via alternative media like Serial. Yet, just like Voice systems becoming IP based, SCADA/ICS systems are integrating more and more Computer systems into their environment, which if not carefully secured, introduces areas of access and control for criminals.
One presentation that talked about this was by Atlas of Doom. He did a very technical review of accessing local devices (on poles, houses etc.) and the concern that these might be trusted devices, which provide access to the network. It was a great presentation, not an easy way to get into the infrastructure, (talked a lot about analyzing signals) but a very good one for people who are big into hardware hacking.
Malware
Malware is always a topic at these conventions, though not as many presentations as other topics. There were two presentations that really interested me. One was using Zeus as a Command and Control for Support by David Schwartzberg. The way it was setup, I can see how Zeus could be useful to install on devices you support, though I would be concerned that using malware to control friendly computers, would be like using a vulture to clean your teeth. Sure it would work, but when it gets out of control you’re screwed. It’s an interesting idea though.
Another topic was Automated Malware Analysis on the Cheap by James Pleger. This one obviously hit close to home. I agree that tools like cuckoo are great if you have time, and specific needs (for example a few files per day that are pretty suspicious). We’ve addressed cuckoo on a few presentations & whitepapers here.. So I won’t go into specifics, but in general More money = less time (to a point) more time = less money.
Core Linux Security: 0-Day isn’t Everything by Mark Stanislav
I like seeing presentations like this at conferences. Most presentations focus on exploits, or how to break into. Occasionally you get presentations where the idea isn’t how awesome your 0-day is, but how they really only work when you are not using layered security. Most people know about layering, that the best security comes from a planned environment with multiple layers of protection. If you have a 0-day that works on apache for example, one that provides local access, it’s only good if the admin misconfigured apache so the web user has access that they shouldn’t. If worse comes to worst, and a user gets root access to that box, why is it allowed to ssh to another box? Do you really want to allow access to other servers from a web machine? The discussion centered on the idea of holistic security instead of 0-day panic.
Burning the Enterprise with BYOD by Georgia Weidman
I hate BYOD, but for some reason, companies love it. Perhaps they see $$ signs where they should be seeing security risks. Georgia did a great presentation not only on how it’s a risk, but she showed her framework for exploiting mobile devices and how a criminal can bypass all your network security by routing traffic to the internet through the phone. If your company allows BYOD, you should see this presentation and perhaps convince your supervisor to see it.
