element 1337 pwnium - hack in the box security conference · chris evans, senior troublemaker,...
TRANSCRIPT
![Page 1: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/1.jpg)
Pwnium: element 1337
Chris Evans, Senior Troublemaker, Google
![Page 2: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/2.jpg)
Surprise rewards time!
● "Last man standing award"● "Specific achievement award"
![Page 3: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/3.jpg)
@miaubiz: $10,000
@miaubiz: @scarybeasts just gave u lots of cash on stage lol lol kittens
Reward :: Last Man Standing
![Page 4: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/4.jpg)
@attekett: $10,000
Reward :: Last Man Standing
![Page 5: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/5.jpg)
@mozdeco: $10,000
Reward :: Specific Achievement (v8)
![Page 6: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/6.jpg)
![Page 7: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/7.jpg)
1. Surprise rewards2. History of reward programs3. History of Pwnium4. Tales from the war room5. $$ and other stats
1337. Pwnium 2: results1338. Q & A
Agenda
![Page 8: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/8.jpg)
History :: Timeline
![Page 9: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/9.jpg)
Recently:● Nov 2011: Secunia● May 2012: Samsung (TV)
○ Empy Hall Of Fame :-( https://samsungtvbounty.com/content/white-hats
● June 2012: PayPal○ "I originally had reservations about the idea of
paying researchers for bug reports, but I am happy to admit that the data has shown me to be wrong"
● Sep 2012: Etsy
History :: Recent Programs
![Page 10: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/10.jpg)
● Jan 2010: Launched, $500 - $1337● July 2010: Top reward increased to
$3133.7● Feb 2012: Scope expanded to Chrome
OS (Linux kernel, Flash, ...) plus bonuses for fixes
● Aug 2012: More bonuses, top reward of $10,000+○ More flexibility to focus on exploitability
History :: Chromium VRP
![Page 11: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/11.jpg)
● Feb 2011: Google sponsors $20,000 top-up reward for Chrome at Pwn2Own 2011
● Feb 2012: Agreed sponsorship of Pwn2Own 2012 with ZDI
● Feb 2012: ZDI misunderstands agreement● Feb 2012: Pwnium announced● Mar 2012: Pwnium surpasses wildest
expectations● Oct 2012: Pwnium 2
History :: Pwnium
![Page 12: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/12.jpg)
● May 2011: VUPEN non-disclosure● Non-disclosed via interpretive dance
YouTube video● Normal security team?
○ Unverifiable claim => ignore○ Hand off to PR team
● Google Security Team?
Tales from the war room
![Page 13: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/13.jpg)
![Page 14: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/14.jpg)
![Page 15: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/15.jpg)
![Page 16: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/16.jpg)
![Page 17: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/17.jpg)
![Page 18: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/18.jpg)
● Flash security rampage○ "Bring out the Tavis"○ 20,000 files; 2,000 CPU cores; ~100 bugs
● Flash sandbox rampage○ Add missing UIPI protections○ Found Flash broker memory corruptions○ Accelerate work on Pepper Flash
● Flash JIT spray protection rampage○ 0xabad1dea
● Invite community to rampage○ Flash vulnerabilities now included in Chromium
Rewards Program!
War room :: VUPEN :: response
![Page 19: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/19.jpg)
● Total rewards issued: 485● Total reward payout?
$$ and other stats
![Page 20: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/20.jpg)
● Total rewards issued: 485● Total reward payout?
2,001,350
$$ and other stats
![Page 21: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/21.jpg)
● Total rewards issued: 485● Total reward payout?
2,001,350
$$ and other stats
![Page 22: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/22.jpg)
● Total rewards issued: 485● Total reward payout?
$650,000 (>> $1M including web program)
$$ and other stats
![Page 23: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/23.jpg)
Stats :: VRP launch 1 :: Chromium
![Page 24: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/24.jpg)
Stats :: VRP launch 2 :: Web
![Page 25: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/25.jpg)
● @NTarakanov non-entry○ Dispels "no-one entered!" myth
● Pinkie Pie entry
Pwnium 2 :: results
![Page 26: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/26.jpg)
● Kernel (driver) vulnerability○ Broadcom wireless driver specific to Pwnium
laptop ○ Buggy ioctl implementation
● Leading to.....
Pwnium 2 :: @NTarakanov
![Page 27: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/27.jpg)
Pwnium 2 :: @NTarakanov
![Page 28: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/28.jpg)
● Shame to waste a powerful bug!○ 0day dropped thanks to Pwnium 2!○ http://pastebin.com/P1nACjxR
● But how to get code execution inside sandbox in the first place?
Pwnium 2 :: @NTarakanov
![Page 29: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/29.jpg)
● Confirmed $60,000 win!!
Pwnium 2 :: Pinkie Pie
![Page 30: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/30.jpg)
● OMG○ Same-day patch (Malaysian time)○ Patched overnight (California time)○ ~12hr turnaround○ Beat our own record
● LOL○ This wasn't a real emergency
■ Not an 0day● Try and use the term correctly
○ Arbitrary and excessive indentation○ Nice to give the engines a test fire though!
Pwnium 2 :: Pinkie Pie :: Patch
![Page 31: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/31.jpg)
Pwnium 2 :: Pinkie Pie
![Page 32: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/32.jpg)
Pwnium 2 :: Pinkie Pie
![Page 33: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/33.jpg)
Pwnium 2 :: Pinkie Pie
![Page 34: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/34.jpg)
![Page 35: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/35.jpg)
![Page 36: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/36.jpg)
● Phase 1a: Find bug inside renderer sandbox○ SVG bug○ Use after free!
■ (Let's be honest, what did you expect?)■ SVG already has a <use> tag, we might as
well have a <free> tag :-/● Meanwhile, in Sep 2010.....
And there was a visionary known only as "ncspz".....
Pwnium 2 :: Pinkie Pie :: Details
![Page 37: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/37.jpg)
Pwnium 2 :: Pinkie Pie :: SVG
![Page 38: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/38.jpg)
● Phase 1b: convert use-after-free into code execution inside sandbox!○ Force garbage collection○ Allocate "ArrayBuffer" objects of same size as
freed object
Pwnium 2 :: Pinkie Pie :: Details
ArrayBuffer
SVGWidget -- FREEDSVGWidgetParent
vptrarray ptr, len
prop
Win7 system obj
![Page 39: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/39.jpg)
● Phase 1b (continued)○ Populate ArrayBuffer with a pointer to a Win7
system object at right offset■ Actually used as a pointer to an array that can
be read via JS■ Win7 system object at predictable location :(
● You don't really have have ASLR● Worst kept well-known secret?● Allegedly fixed in Win8 64-bit
○ Follow pointers to locate heap, executable○ Now have info needed to set up ROP○ Populate beginning of ArrayBuffer with custom
vtable pointer!○ Kick off ROP
Pwnium 2 :: Pinkie Pie :: Details
![Page 40: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/40.jpg)
● Phase 2: escape sandbox○ Attack IPC messages○ Semantics not syntactics○ What fiendish complexity did Pinkie Pie
unleash......?
Pwnium 2 :: Pinkie Pie :: Details
![Page 41: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/41.jpg)
![Page 42: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/42.jpg)
![Page 43: element 1337 Pwnium - Hack In The Box Security Conference · Chris Evans, Senior Troublemaker, Google. Surprise rewards time! "Last man standing award" "Specific achievement award"](https://reader034.vdocument.in/reader034/viewer/2022050518/5fa20227126e460453247c9a/html5/thumbnails/43.jpg)
Q & A