Recon 2022

Conference opening

Or: How to Reverse Engineer a Giant Pile of Code

Zoom is a video conferencing solution that has gained popularity throughout the pandemic. It is also one of the more interesting targets that I have reverse engineered in some time. This talk describes my security analysis of Zoom's client and server, with a focus on the reverse engineering challenges. It covers understanding large systems, analyzing software and protocols with Frida, fuzzing non-relocatable binaries and much more.

Big control-flow graphs are scary! Imagine opening a target and IDA tells you that the graph is too big to be displayed on screen. A great tool to circumvent this issue is symbolic execution, a technique where you can match binary state with the corresponding input that caused its execution.

You can use symbolic and concolic execution to find constraints in crackme solving, for deobfuscation purposes and even advanced fuzzing of complex binaries.

In this workshop we will take a crackme challenge and learn how to speed up our reverse engineering process via smt solving and symbolic execution. We will get some hands-on experience using the angr framework and learn how to identify and fix common issues that you're dealing with when using it. After this workshop big control-flow graphs won't be as daunting anymore, you will know when and how to apply symbolic execution, gain an edge in ctf solving and have some hands-on experience using the angr framework.

Lunch

Android has the largest install base on the mobile landscape, with it there are a lot of vendors and telecom operators that install system applications on stock images. These are usually background applications running with high privileges, which the user can’t uninstall and in some cases can’t even disable. A reverser can get the source code of these applications and do static analysis, however doing dynamic analysis is a different story. These are applications running on stock images. Which often don’t have an initial activity to actually begin executing their main code. Using Google Play Protect Services has a demo application, I will show how system applications can be instrumented using Frida for analysis on stock images with as little changes to the images as possible. The presentation will show the several approaches tried, what their limitations were and why they ultimately fail in my purpose. The different approaches may work differently depending on the applications and the Android version, as such even though they didn’t work for Google Play Protect Services they still represent some interesting techniques that can be applied to different contexts. The presentation will culminate in the approach which actually made it possible for me to instrument Google Play Protect Services and be able to perform dynamic analysis of the Google Play Protect Services application, which also opens the door for future research around the Google Play Protect Services application itself.

While busy hacking the planet, have you ever encountered an unfamiliar architecture and simply had no idea where to start? You pried the firmware from a reluctant (and almost not smoldering) flash chip, loaded the thing in IDA, but what's next?
We got into this pickle while working on reversing the firmware of a medical device. The mystery architecture turned out to be M32C, and thankfully, IDA Pro added support for it a few months prior.

This talk is not exactly about reversing yet another embedded device. Instead, this is more about the journey and lessons learned so that it could be abstracted away for the next project. Rather than focusing on the specifics of the firmware itself, we will see how it interacts with the micro-controller and the steps taken to approach an unfamiliar embedded architecture.

During this presentation, you can expect digging into low-level micro-controller notions such as interrupt handlers, special purpose registers, how to find flash handling code, and way too much M32C assembly.
If you've ever dabbled in hardware hacking and want to have a look at something that is not Linux-based, this talk will give you some pointers in how to get the ball rolling.
(not talking about the ones we dropped at the reballing station)

Linux kernel bugs are plentiful and also powerful. However, sandboxing limits the amount of kernel code that is reachable from within (like an Android app, for example).

This talk will cover how to discover these reachable code paths and find exploitable bugs in them. This same method can be used for defense - attack surface reduction and hardening! I'll discuss interesting bugs I've found this way and some neat tricks to reach more vulnerable code.

Why does this matter? Targeting exposed code paths yield more valuable bugs. It's also how attackers choose where to closely monitor commits for silent security fixes. For example, anyone can view syzbot bugs, but determining whether it is a usable bug and how to write a simple reproducer is another matter. Attendees of this talk will walk away knowing techniques to do both and how to identify kernel components that are ripe for exploitation.

Coffee Break

For the first time, we looked at the Unisoc baseband as a target for security research. We reverse-engineered and fuzzed the implementation of the NAS protocol to find a way to disrupt the device's radio communication with a malformed packet.

Due to circumstances beyond our control, unfortunately we have had to withdraw this talk.

Our talk first gives an overview of contemporary code obfuscation schemes, where we focus on the design & architecture of virtual machines. Then, we work out the weaknesses of well-established approaches and discuss how modern virtual machines can be broken in a (semi-)automated fashion. Afterward, we present the core design principles behind the next generation of virtual machines and highlight how they abuse inherent weaknesses of the deobfuscation techniques in order to provide long-lasting resilience. We conclude the talk by pointing out that such techniques will shape the landscape of modern obfuscation in the next few years; further, we outline required advances in code deobfuscation research to tackle such virtual machines.

The security of Tesla's cars has been a hot topic in recent months. In addition to being one of the safest cars on the road, it is also well-protected from hacks and attacks. But how does Tesla make sure their vehicles are safe and secure?

In 2021, Project Zero publicly disclosed multiple Chrome exploits they found in the wild. This talk will go in depth into what makes a V8 exploit reliable, including correcting a few incorrect assumptions.

Reverse engineering Golang was considered a nightmare. Over time, our understanding of Go has evolved and it turns out that with the right tooling, Go may be one of the easiest languages to reverse engineer. We released AlphaGolang as a way to tackle reversing Go binaries, recovering as much information as possible and surfacing user generated code. Where do we go from here? How about using the understanding we can glean from Go malware to automate hunting and clustering?

Lunch

Function Overrides is a new technology developed in collaboration with multiple teams in Microsoft and distributed as a part of the new Windows 11 SV2 (Sun Valley 2), also known as 22H2. It started as a Security mitigation and slowly became a fully-fledged performance feature implemented in the entire Windows Kernel. This talk will describe it, giving an introduction about the base problem that the OS Engineers wanted to solve (memory safety bugs) and a detailed description of its implementation and future evolution.

Early Launch Antimalware (ELAM) functionality in Windows offers robust anti-tampering mitigations whereby security vendors declare a Microsoft-approved list of explicitly allowed signers to run as protected (PPL) services. Microsoft makes clear that these mitigations are best-effort attempts to mitigate against security product tampering by labeling ELAM and PPL "defense-in-depth security features." This talk aims to make clear why these mitigations are "best-effort" and ultimately indefensible.

This talk will cover a methodology for assessing ELAM drivers and demonstrate scenarios where overly-permissive rules open up adversary tradecraft opportunities, not through exploiting vulnerabilities but through the abuse of intended functionality. A single, overly-permissive ELAM driver enables an adversary to not only tamper with security products but it also supplies malware with anti-tampering protections, hampering detection and remediation efforts. The talk will conclude with a demo of gaining user-mode code execution through an abusable, signed executable running with an antimalware-light protection level.

Coffee Break

Ransomware, and malware as a whole, does not exist in a vacuum; it is often developed to accomplish a goal, whether to further an espionage campaign or for monetary gain. Ransomware, in particular, is a fast-moving landscape driven by an intricate web of operators, tools and mystery. BlackMatter ransomware emerged in July 2021 as the successor to DarkSide ransomware, only to be shut down a few short months later...or was it? Besides amassing a large portfolio of victims, the BlackMatter operators released several versions of the ransomware. Recorded Future was the first to openly publish technical details on BlackMatter, as well as interview the ransomware operators themselves. In this session, we will take you through our discovery of the BlackMatter ransomware group and its evolution through the shutdown as well as provide a technical deep dive on the Windows, PowerShell and Linux ransomware itself. We will also address how this evolution trend shows up in the larger ransomware operator landscape, especially among sophisticated actors.

In the wide expanse of router manufacturers and models, there is one reverse engineering target that stands out from the rest: MikroTik. Unlike many routers which run a patchwork of services that vary widely across models and firmware versions, MikroTik maintains a uniform, standardized operating system, RouterOS, which runs across all router models. Customized internal frameworks and proprietary communication protocols offer a challenging, but interesting, reverse engineering landscape. However, the reliance on complex, proprietary infrastructure and the lack of easy access to the core system imposes a high barrier to entry for new reverse engineers. As a result, MikroTik security research has largely remained in obscurity. Until now…

In this talk, we will take an exciting adventure into the depths of MikroTik firmware, revealing new insights with RouterOS’s unique IPC protocol, proprietary message format, and custom cryptographic protocols. We will also release a new RouterOS remote jailbreak, the first in three years, which should help accelerate new and ongoing research efforts. Our goal by the end of the talk is to bring an interested reverse engineer from zero knowledge to a working understanding of RouterOS internals and put MikroTik security research back into the limelight.

Advanced Persistent Threat (APT) groups invest in developing their arsenal of exploits and malware to stay below the radar of their victims' security controls and persist on the target machines for as long as possible. We were curious if the same efforts are invested in the operation security of these campaigns.

We started a journey researching active campaigns from the Middle East to the Far East including the Palestinian Authority, Turkey, and Iran, Russia, China, and North Korea. These campaigns were both state-sponsored, surveillance-targeted attacks and large-scale financially-motivated attacks. We looked at almost every technology used and every step taken throughout the attack chain: Windows (Go-lang/.Net/Delphi) and Android malware; both on Windows and Linux-based C2 servers. We found a multitude of unbelievable critical mistakes which open a unique window to understand new advanced TTPs used by attackers, for example: “bypassing iCloud two-factor authentication’’ and large-scale crypto wallet and NFT stealing methods. In many cases, we were able to join the attackers’ internal groups and view their chats, emails, and even bank accounts and crypto wallets. We understood their business models and were surprised to see the scale of sensitive data sharing, such as entire citizen databases, passports, SSN, etc. In some cases, we were able to take down the entire campaign.

We will present our latest breakthroughs from our seven-year mind-game against the sophisticated Infy threat actor who successfully ran a 15-year active campaign using the most secured opSec attack chain we've encountered.

We will explain how they improved their opSec over the years and how we recently managed to monitor their activity in real-time and could even cause a large-scale misinformation counterattack.

We will conclude by explaining how organizations can better defend themselves.

Samsara is a viral metamorphic engine for the JVM. A metamorphic mutation engine is code that will transform a compiled target into a new set of instructions with the same functionality. This makes signature creation and analysis more difficult. Used as an attack tool, Samsara can be used to automatically execute supply chain attacks from inside IDEs as they are running. Samsara also has some anti-debugging features that can be used to make an analyst's life more difficult.

Wslink is a unique loader, linked to the Lazarus group, that we documented at the end of the last year for the first time. Most of the Wslink samples are packed and protected with an advanced virtual machine (VM) obfuscator; the samples contain no clear artifacts, such as specific section names, that easily link them to an already known and publicly described obfuscator. This VM additionally introduces several other obfuscation techniques such as insertion of junk code, encoding of virtual operands, duplication of virtual opcodes, opaque predicates, merging of virtual instructions, and a nested VM.
In our presentation we analyze the internals of the VM and describe our semiautomatic approach to seeing through the obfuscation techniques in reasonable time. We demonstrate the approach on a few chunks of bytecode of a protected sample and compare the results against a non-obfuscated sample to confirm the validity of the method. Our solution is based on a known deobfuscation method that extracts the semantics of the virtual opcodes, using symbolic execution with simplifying rules. We further treat the bytecode chunks and certain internal constructs of the VM as concrete values instead as symbolic ones, which enables the known deobfuscation method to deal with the additional obfuscation techniques automatically.

Lunch

Error handling is often done using exceptions. Because error code paths represent abnormal program behavior, they are an interesting target for reverse engineering.
Try, catch and throw semantics are straight-forward to use when programming, but what’s happening behind the scenes? On a quest to figure this out, we will follow an exception on its journey from the throw statement all the way to it being caught by its handler. On its way it will interact with many different parts of the program’s runtime, which will use DWARF information to unwind the stack, determining the handler using Language-Specific Data Areas (LSDA), personality routines, and more.
Using what we learnt, we’ll introduce a reverse-engineering plugin for Binary Ninja that extracts exception handling information from ELF and Mach-O binaries.

Back in 2018 when Spectre was found, you could exploit its second and most dangerous variant (Spectre-v2) to easily leak arbitrary data across privilege levels. As a result, OS developers initially deployed various stopgap software mitigations—with non-negligible performance overhead. Luckily Intel and Arm released more efficient hardware defenses which now are the de-facto solutions on every modern system.

In this talk, we introduce “Branch History Injection” (BHI): a new attack primitive that bypasses Intel's eIBRS and Arm's CSV2 hardware mitigations against cross-privilege Spectre-v2 attacks. In particular, we will discuss our black-box reverse engineering approach of these complex mitigations, sharing both the successful and failed attempts towards understanding their inner-workings. We will then use BHI to build an end-to-end exploit leaking arbitrary kernel memory on the fully patched Intel 11th gen CPUs. Finally, we will conclude by describing the latest Spectre defense deployed after our BHI disclosure, showing how software and hardware can mitigate these new attacks.

Coffee Break

As firmware threats are becoming more prevalent, security companies are starting to provide UEFI firmware scanners to detect malicious firmware implants. These scanners first acquire a firmware image inside a SPI flash memory on hardware then parse and scan the image with known signatures.

Every software-based firmware acquisition on Intel platforms has a risk of being intercepted by SMM rootkits. This risk has been pointed out by security researchers for years. However, there has been no publicly-available implementation and no one has demonstrated the concept practically.

In this presentation, I'll explain about the firmware acquisition MitM attack PoC that I implemented to assess the risk correctly. I'll also show that the PoC can hide known bootkit components against both open and closed source firmware security tools. I believe that the findings from this research will be helpful for better firmware scanner implementations in the future.

The PoC will be published after the presentation.

The .NET PE file format is one of the most complicated file formats, documented in hundreds of pages of technical spec. Parsing the .NET PE file format without reliance on the .NET framework is a challenging task. In addition, .NET is popular amongst malware authors, offering high-level programming capabilities and useful features for malware development.

During the past few years, a pure-python library to parse .NET PE files has been developed internally within Palo Alto Networks. Now it is time to open-source it and share it with the research community. The library is called "dotnetfile" and provides an easy-to-use interface to access various fields of the .NET file format and extract valuable information.

In this talk, we will publicly share the library for the first time and discuss its usage.
Working in the field of malware research, we will also share a few success stories in which the library helped us to accurately detect .NET based malware families.

After power off, modern iPhones keep their wireless chips on. Find My advertisements are sent by the Bluetooth chip upon user-initiated and automated low-power shutdown since iOS 15. Less noticeable to most users, Apple introduced a Digital Car Key 3.0 express mode, also available after low-power shutdown for up to 5 hours. This is implemented with a Bluetooth GATT service for initial detection, an Ultra-wideband (UWB) module for fine ranging, and an applet in the NFC chip's secure element managing access to cryptographic keys. While these are interesting features for most end-users, this means that high-value targets like journalists can no longer trust their iPhone to be switched off.

In this talk, we show how this is implemented in hardware, revealing that this has been planned at least since designing the iPhone 11 hardware. Then, we dig deeper into the most recent Bluetooth firmware present in the iPhone 12 and 13. We make modifications to the Bluetooth firmware and the InternalBlue framework, allowing analysis, debugging, but also installing stealthy low-power malware. The latest firmware diverges a lot from older firmware with leaked symbols. We demonstrate how to match the most important handlers anyway to learn which features are enabled in Apple's low-power Bluetooth firmware, which parameters can be changed in the stock firmware, and which capabilities could be added by malware.

Conference closing