The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux...
Transcript of The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux...
![Page 1: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/1.jpg)
The discovery and execu1on ofen1relynewclassesofWeba7acksinordertomeetyourgirlfriend.
[email protected]://samy.plTwi7er:@SamyKamkar
![Page 2: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/2.jpg)
Whoissamy?
• "NarcissisticVulnerabilityPimp" (akaSecurityResearcherforfun)
• CreatorofTheMySpaceWorm
• AuthorofEvercookies• Co‐FounderofFonality,IPPBXcompany
• LadyGagaaficionado
![Page 3: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/3.jpg)
CyberWarrior
• Raided• Computeruselost(Hackers‐style)
• 700hoursofcommunityservice
• Restitution• Probation
![Page 4: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/4.jpg)
Whytheweb?
• It’snew,it’scool,it’sexploitable!• Gopherisn’tusedasmuchanymore• Thewebisacodedistributionchannel• Browserscancommunicateinways
theydon’tknow
• Andmuchmore!
![Page 5: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/5.jpg)
MyHomepage
• It’snew,it’scool,it’sexploitable!• Gopherisn’tusedasmuchanymore• Thewebisacodedistributionchannel• Browserscancommunicateinways
theydon’tknow
• Andmuchmore!
![Page 6: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/6.jpg)
A6ackIndirectly• CertifiedInformationSecuritySpecialist
Professional• ChiefExecutiveOfficerofSecTheory• Co‐Authorof«XSSExploits:CrossSiteScripting
AttacksandDefense»• Authorof«DetectingMalace»• Co‐developerofClickjackingwithJeremiah
Grossman• Runsha.ckers.organdsla.ckers.org• CertifiedASS(ApplicationSecuritySpecialist)
![Page 7: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/7.jpg)
A6ackIndirectly• Robert«Rsnake»Hansen• Howdoweattacksomeonewhosecureshimselfwell?
• Don’t.
![Page 8: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/8.jpg)
A6ackIndirectly• XSS?Probablywon’tfallforit.• CSRF?Same.
![Page 9: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/9.jpg)
PHP:Overview• PHP:extremelycommonweblanguage
• PHPsessions:extremelycommondefaultsessionmanagement
• PHPsessions:usedbydefaultinmostPHPframeworks(e.g.,CakePHP)
• PHPsessions:eitherpassedinURLor…
![Page 10: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/10.jpg)
![Page 11: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/11.jpg)
PHPSessions:Overview• session_start()–initializePHPsession
![Page 12: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/12.jpg)
PHPSessions:Entropy• session_start()’spseudo‐randomdata:
• IPaddress: 32bits
• Epoch: 32bits
• Microseconds: 32bits
• Randomlcg_value()(PRNG): 64bits
• TOTAL: 160bits
• SHA1’d: 160bits
• 160bits=alot=1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976
![Page 13: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/13.jpg)
Howbigisabit?Sometricks
• Forevery10bits,add~3zeros• 10 bits = 1,024 (thousand) • 20 bits = 1,048,576 (mil) • 30 bits = 1,073,741,824 • 25 bits = ~32,000,000
0bits 1bit 2bits 3bits 4bits 5bits 6bits 7bits 8bits 9bits
1 2 4 8 16 32 64 128 256 512
![Page 14: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/14.jpg)
• 160bits=2^160=~10^48• 160bits=
1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976
• At100trillionvaluespersecond,160bitswouldtake…
• (2^160)/(10^14)/(3600*24*365*500000000)=926,878,258,073,885,666=900quadrillioneons
• 1eon=500millionyears
It’s Just Math!
![Page 15: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/15.jpg)
PHPSessions:Entropy• session_start()’spseudo‐randomdata:
• IPaddress: 32bits
• Epoch: 32bits
• Microseconds: 32bits
• Randomlcg_value()(PRNG): 64bits
• TOTAL: 160bits
• SHA1’d: 160bits
• 160bits=alot=1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976
![Page 16: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/16.jpg)
PHPSessions:EntropyRedux
• Notsopseudo‐randomdata:
• IPaddress:32bits• Epoch:32bits• Microseconds:32bits
– only0–999,999…20bits=1,048,576
– <20bits! (REDUCED)‐12bits
• Randomlcg_value()(PRNG):64bits
• TOTAL:148bits(reducedby12bits)
• SHA1’d:160bits
![Page 17: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/17.jpg)
AnExample:Facebook
![Page 18: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/18.jpg)
PHPSessions:EntropyRedux
• Notsopseudo‐randomdata:
• IPaddress:32bits• Epoch:32bits(ACQUIRED)‐32bits
• Microseconds:32bits– only0–999,999…20bits=1,048,576
– <20bits! (REDUCED)‐12bits
• Randomlcg_value()(PRNG):64bits
• TOTAL:116bits(reducedby44bits)
• SHA1’d:160bits
![Page 19: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/19.jpg)
AnExample:Facebook
![Page 20: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/20.jpg)
PHPSessions:EntropyRedux
• Notsopseudo‐randomdata:
• IPaddress:32bits(ACQUIRED)‐32bits
• Epoch:32bits(ACQUIRED)‐32bits
• Microseconds:32bits– only0–999,999…20bits=1,048,576
– <20bits! (REDUCED)‐12bits
• Randomlcg_value()(PRNG):64bits
• TOTAL:84bits(reducedby76bits)
• SHA1’d:160bits
![Page 21: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/21.jpg)
PHPLCG(PRNG):Randomness• php_combined_lcg()/PHPfunclcg_value()
![Page 22: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/22.jpg)
PHPLCG(PRNG):Randomness
• S1WAS32bits,NOW20bits
• SEED(s1+s2):64bits–12bits=52bits
![Page 23: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/23.jpg)
PHPLCG(PRNG):Randomness
• LCG(s2) = (long) getpid();
• S2=32bits• Linuxonlyuses15bitsforPIDs• S2=32bits–17bits=15bits• SEED(s1+s2)=15bits+20bits=35bits• PHPfunction:getmypid()
• Linuxcommand:ps
• LearnPID,reducetheother15bits!• SEED(s1+s2)=0bits+20bits=20bits
![Page 24: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/24.jpg)
PHPSessions:EntropyRedux
• Notsopseudo‐randomdata:
• IPaddress:32bits(ACQUIRED)‐32bits
• Epoch:32bits(ACQUIRED)‐32bits
• Microseconds:32bits– only0–999,999…20bits=1,048,576
– <20bits! (REDUCED)‐12bits
• Randomlcg_value(REDUCED)‐44bits
• TOTAL:40bits(reducedby120bits)
• SHA1’d:160bits
![Page 25: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/25.jpg)
![Page 26: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/26.jpg)
PHPSessions:EntropyRedux
• Microseconds:32bitsdownto20bits
• Randomlcg_valuedownto20bits
• 40bits?No!Wecancalclcg_value()first!
• Withatime‐memorytrade‐off(4MB),wecanlearnthelcg_valueoriginalseedinafewseconds,REDUCINGto20bits!
• 40bits–20bits=20bits
20bits=1,048,576cookies
![Page 27: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/27.jpg)
GREATSUCCESS!
• 500,000requestsonaverage!• Canbecompletedinhours
![Page 28: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/28.jpg)
Youdownwithentropy?Yeahyouknowme!• PHP5.3.2:abitmoreentropy
• Createyourownsessionvalues!
• Attackisdifficulttoexecute!
• PS,FacebookisNOTvulnerable!
• <3Facebook• Pleasehelpmyfarmville* Thanks to Arshan Dabirsiaghi and Amit Klein for pointing me in the right direction
![Page 29: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/29.jpg)
GREATSUCCESS!
• Usingoldvictim’scookie,messageournewvictimwithamaliciouslink!
![Page 30: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/30.jpg)
Thisisyournetwork.
![Page 31: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/31.jpg)
Thisisyournetworkondrugs.
![Page 32: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/32.jpg)
ANAT
![Page 33: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/33.jpg)
Cross‐ProtocolScrip[ng(XPS)
• HTTPserverscanrunonanyport• Ahiddenformcanauto‐submitdatatoanyportviaJSform.submit()
• HTTPisanewline‐basedprotocol
• Soareotherprotocols….hmmmm
![Page 34: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/34.jpg)
Cross‐ProtocolScrip[ng:Examplesintherealworld
• Let’swriteanIRCclientinHTTP!
• ThisusestheCLIENT’scomputertoconnect,thususingtheirIPaddress!
![Page 35: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/35.jpg)
IRCExample
![Page 36: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/36.jpg)
Hos[ngtheXPS
![Page 37: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/37.jpg)
NATPinning:cont.
![Page 38: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/38.jpg)
HTTPPOSTw/IRCcontent
![Page 39: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/39.jpg)
NATPinning:XPS[mesOVER9,000
• Sweet!SowhatisNATPinning?
• NATPinningconfusesnotonlythebrowser,butalsotheROUTERontheapplicationlayer
• E.g.,whencommunicatingwithport6667,browserthinksHTTP,routerthinksIRC
• Wecanexploitthisfactanduserouterconveniencestoattackclient
![Page 40: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/40.jpg)
NATPinning:IRCDCC
• linux/net/netfilter/nf_conntrack_irc.c• DCCchats/filesendsoccuronaseparateportthanchat
• Clientsends:PRIVMSGsamy:DCCCHATsamyIPport
• RouterseesIP(determinedfromHTTP_REMOTE_ADDR)andport,thenFORWARDSporttoclient!
• ANYPORT!
![Page 41: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/41.jpg)
NATPinning:cont.
![Page 42: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/42.jpg)
NATPinning:blockedports
• Ifbrowserdoesn’tallowoutboundconnectionsonspecificports?
• TCP/UDPports=16bits=65536
• Sooverflowtheport!65536+6667
![Page 43: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/43.jpg)
NATPinning:blockedports
• 6667+65536=72203• 6667 = 00001101000001011 • 72203 = 10001101000001011
• Somebrowserscheck:
if port == 6667 … but
72203 != 6667
• Correctcheck:port % 2^16*WebkitintegeroverflowdiscoveredbyGoatseSecurity
![Page 44: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/44.jpg)
![Page 45: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/45.jpg)
NATPinning:preven[on
• Strictfirewall–don’tallowunknownoutboundconnections
• Clientside–runuptodatebrowser
• Clientside–useNoScriptifusingFirefox
• Clientside–runlocalfirewallortoollikeLittleSnitchtoknowifanapplicationisaccessingunknownports
![Page 46: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/46.jpg)
Penetra[on2.0
![Page 47: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/47.jpg)
TRIPLE X!
![Page 48: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/48.jpg)
TRIPLE X!
SS!
![Page 49: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/49.jpg)
Geoloca[onviaXXXSS
![Page 50: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/50.jpg)
Geoloca[onviaXXXSS
• Annavisitsmalicioussite
![Page 51: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/51.jpg)
Geoloca[onviaXXXSS
• Annavisitsmalicioussite
• XXXSSscansherlocalnetworkforthetypeofroutersheuses
![Page 52: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/52.jpg)
Geoloca[onviaXXXSS
• Annavisitsmalicioussite
• XXXSSscansherlocalnetworkforthetypeofroutersheuses
![Page 53: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/53.jpg)
Geoloca[onviaXXXSS
• Annavisitsmalicioussite
• XXXSSscansherlocalnetworkforthetypeofroutersheuses
• Ifnecessary,loginwithdefaultcredentials!
![Page 54: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/54.jpg)
![Page 55: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/55.jpg)
Geoloca[onviaXXXSS
• Annavisitsmalicioussite
• XXXSSscansherlocalnetworkforthetypeofroutersheuses
• XSSroutertoloadremotemaliciousJS
![Page 56: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/56.jpg)
Geoloca[onviaXXXSS
• RemoteJSusesAJAXtoacquireMAC
![Page 57: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/57.jpg)
WhyMACAddress?
• JustBingit!
![Page 58: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/58.jpg)
WhyMACAddress?
• JustBingit!• Typewww.bing.cominyourURLbar
![Page 59: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/59.jpg)
WhyMACAddress?
• JustBingit!• Typewww.bing.cominyourURLbar
• Typein“Google”inthesearchbox
![Page 60: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/60.jpg)
WhyMACAddress?
• JustBingit!• Typewww.bing.cominyourURLbar
• Typein“Google”inthesearchbox• Hitenter!
![Page 61: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/61.jpg)
WhyMACAddress?
![Page 62: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/62.jpg)
Geoloca[onviaXXXSS
• UponMACacquisition,asktheGoogle
• SeeFFsourceforLocationServices
![Page 63: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/63.jpg)
Geoloca[onviaXXXSSlatitude: 36.0920029 longitude: -123.3461946
![Page 64: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/64.jpg)
Geoloca[onviaXXXSS
![Page 65: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/65.jpg)
Geoloca[onviaXXXSS
![Page 66: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/66.jpg)
NATPinning:preven[on
• Strictfirewall–don’tallowunknownoutboundconnections
• Clientside–runuptodatebrowser
• Clientside–useNoScriptifusingFirefox
• Clientside–runlocalfirewallortoollikeLittleSnitchtoknowifanapplicationisaccessingunknownports
PRIVACY IS!DEAD!
![Page 67: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/67.jpg)
Q&A
Agentlemanneverasks.
Aladynevertells.
![Page 68: The discovery and execuon of enrely new classes of Web aacks in … · 2020-01-17 · Entropy Redux • Not so pseudo‐random data: • IP address: 32 bits • Epoch: 32 bits •](https://reader034.fdocuments.in/reader034/viewer/2022050213/5f5fa1c0dd20960eff25f745/html5/thumbnails/68.jpg)
Finphpwn:samy.pl/phpwnNATPinning: samy.pl/natpin
Geoloca1onviaXSS:samy.pl/mapxss
SamyKamkar
www.samy.pl
twi7er.com/SamyKamkar* No IRC channels were trolled in the making of this presentation.!