DEFCON 22 Alex Zacharis Nikolaos Tsagkarakis PoS Attacking t

8/10/2019 DEFCON 22 Alex Zacharis Nikolaos Tsagkarakis PoS Attacking t

1/47

!""#$%&'( "*+ ,-#.+/&'( 0#/+12#'34&'"54651#/+ #""#$%1 4' #&-/&'+ "-#.+/+-1789:;< =>?@

!/+A B#$*#-&1


2/47

:4'"+'"1J K*L "#-(+" "-#.+/+-1MJ 34&'"54650#/+ #""#$%1 &' "-#'1G4-"#"&4'J :#1+ 0"DNL

J O#$% "4 "*+ P#EJ 3;0H +AG/4&"&'( N&66+-+'" 24ND/+1J :#2+-#1 +.+-LQ*+-+J 0$#' "*#" RSJ S!T 1$-#GG&'(

J ,0 3;0 T#/Q#-+J !U"+$ S+.+'(+ ,44/


3/47

K*L "#-(+" "-#.+/+-1M

V ,*+ '++N 64- $422D'&$#"&4' &1 (-+#"+- "*#' G-&.#$L #'NI4-1+$D-&"L

V ,*+ !"#"$%" '"()*")( +,,)-- /#'N1$#G+ 64-$+1 L4D "4 "-D1"Q*#" L4D '4-2#//L Q4D/N'W"

J K&9&HJ P4(&' "4 X$4-G4-#"+Y +2#&/ #$$4D'"1J P4(&' "4 14$/ '+"Q4-%1

J :#--L 24E&/+ G*4'+1Z "#E/+"1Z /#G"4G1 ZD1D#//L #// 4' #" "*+

1#2+ "&2+ [YJ


4/47

34&'"54650#/+ #""#$%1 &' ,-#'1G4-"#"&4'

]'/&%+ "-#N&"&4'#/ 3;0 #""#$%1 &' :422+-$+ X+AF,#-(+" \'$&N+'"YHJ :-+N&" $#-N N+"#&/1J K+E $-+N+'"/1

K+ "#-(+" \'"+-'#"&4'#/ ,-#.+/+-1^ &'64-2#"&4'HJ


5/47


6/47

3;0 #""#$% 4D"$42+K*4 E+'+6&"1MJ:LE+- :-&2&'#/1 X\N+'"&"L "*+6"YJ3-&.#"+ \'.+1"&(#"4-1 X1GL&'(YJb4.+-'2+'" !(+'$&+1 X1GL&'(Y

!6"+- # 1D$$+116D/ #""#$% Q+ $#' #$*&+.+HV,-#.+/+-1 cG-46&/&'(d Q&"*4D" #D"*4-&U+N #$$+11 "4 !&-G4-" 7#"#VK&"* +'4D(* N#"# $4//+$"+N Q+ $#' $#"+(4-&U+ "-#.+/+-1 G+-H

V 6%')5.+)57. X+AF K*4 "-#.+//+N 6-42 b-++$+ "4 b+-2#'L &' "*+ /#1"24'"*Y

V 87*/+.( X+AF !// !+(+#' G#11+'(+-1YV 82+'' X+AF K*4 &1 "-#.+//&'( ?-1" $/#11 ;S OD1&'+11YV 925:$);6+)% X+AF !// G#11+'(+-1 46 # 1G+$&6&$ 6/&(*"YV :42E&'#"&4' 46 "*+ #E4.+


7/47

3;0 0L1"+21 3-+1+'"

? ?(')%*' 7@ 5.)%3%')A

5 :*+$%5&' %&41%1

5 =-30$+'%


8/47

:#1+ 0"DNLH !' \'"+-'#"&4'#/ !&-G4-" &' b-++$+

C%)' )+2B .-*4%3' D37-:$ %')5*+)57.EFG')5*+)%1 )3+,%2%3' /%3 (%+3F ?= 2&//&4'

H-'5.%'' =+''%.:%3' DIJKEF aZe 2&//&4'

H-'5.%'' =+''%.:%3' L'5.: =>? D!KEF IMJJJ

N+.-+3(OP+30$ QJ!R Z 3#11+'(+- "-#66&$ -+#$*+N =F@ 2&//&4'


9/47

3D-$*#1+ K&9& "&2+ %&41%1

J ODL +A"-# K&9& "&2+X#$$+G"1 $4&'1 #'N E&//1Z(&.+1 $*#'(+Y

J :*+$% 6/&(*" N+"#&/1XO#-$4N+IRS 1$#''+-Y

J T#%+ \'"+-'+" G*4'+$#//1 Xf;\3Y XK+E$#2#.#&/#E/+Y

J =2+0%*%.)F e &' 'D2E+-/4$#"+N &' *&(*#$$+11&E/+ /4$#"&4'"*-4D(*4D" "*+ #&-G4-"


10/47


11/47

g&41% 0+-.&$+1H f;\3 $#//1


12/47

3D-$*#1+ K&9& "&2+ %&41%1H !""#$%

J 81$#G+ &'"+-6#$+ #'N +AG41+ 2#$*&'+ N+"#&/1HJ ;0H K&'N4Q1 hJ


13/47


14/47

]0O 34-" #$$+11&E/+

L?H /73) %S/7'%1;+0)5,%


15/47

8AG41&'( #N2&'&1"-#"&.+ 24ND/+1

J O#N 1#'&"&U#"&4' 46 D1+- &'GD" 6-42 %+LE4#-N

J O#1&$ K&'N4Q1 $422#'N1 $#' E+ &11D+N 6-42 %+LE4#-N&' 4-N+- "4 1Q&"$* .&+Q "4 #N2&'&1"-#"&.+ &'"+-6#$+

J !N2&'&1"-#"&.+ &'"+-6#$+ +'#E/+N Q&"* 6D// G-&.&/+(+1N&-+$"/L &11D&'( *#-NQ#-+ $422#'N1J P&%+ 64- +A#2G/+ "*+=TU 07**+.1 VEJ >)$%3 87**+.1'F

J ?)+)-'

J ?)+3);?)7/J ?%) >,%3351%


16/47


17/47

!N2&' &'"+-6#$+ l=

#>#TCF WIM G-37' 5. 075.'


18/47

!N2&' &'"+-6#$+ la

=+(5.: >-3'%2,%' #$37-:$ T1*5. P71-2%


19/47

\'64-2&'( "*+ !&-G4-"P+30$X QJ!R

J 3-+1+'"#"&4' 46 "*+ #""#$%1 "4 !N2&'&1"-#"&4'Z \, #'N 0+$D-&"L"+#2 46 "*+ !&-G4-"F

J Y%+2 25@% %S+*/2%F :#1*&'( 4D"T4'+Lk

J T *7.)$ 2+)%3 ,*+ !P,i,!O ED( Q#1 6&A+N #'N "*+

]0O G4-" Q#1 G-4"+$"+NF

HL# "*+ 0L1"+2 Q#1 1"&// .D/'+-#E/+ #6"+- "*+ G#"$*_

L?H /73) ?%0-3%1


20/47


21/47

\'"+-6#$+ ,+1"&'(! 8AG41&'( ,*+ !N2&'&1"-#"&.+ &'"+-6#$+ EL $#D1&'( "*+

#GG "4 "-L "4 $4''+$" "4 "*+ \'"+-'+"F! ! 34G ]G $4''+$"&4' E/4$%+- $#D1+1 "*+ &'"+-6#$+ "4

+AG41+ "*+ 2&'&2&U+N !N2&' \'"+-6#$+ K&'N4QF

8250B 0+-'5.: /7/-/ +0)57.


22/47

!N2&' \'"+-6#$+ 8AG41+N

970-' C7''

GS/7'%1 P5.5*5Z%1


23/47

O#$% "4 "*+ P#E#$% \%%1F6%,%27/ + *+2[+3% )7 5.')+22 5. )$% B57'B )$+)F

J 8AG/4&"1 "*+ K+E:#2 T4ND/+J `#1 S!T 1$-#GG&'( 6D'$"&4'#/&"L

J b+" 1$#''+N +5"&$%+" N+"#&/1J S+$+&.+1 O#- :4N+ :422#'N1

6%,%27/ + )772 )$+)FJ 9DUU+1 "*+ E#-$4N+ 1$#''+- "4 +AG41+ +--4-1FJ 3-4.&N+ $422#'N1 "4 4D- 2#/Q#-+F

>-)07*%FJ ].'/53+)57. @73 )$% #3+,%2%3' ?/( D#?E =>? *+2[+3%J 83%+)57. 7@ )$% TZ)%0 Y%,%.:% #772 DT.13751 P7452% T//E


24/47

:#2+-# T4ND/+ 8AG/4&"#"&4'

K`mM

?F c8L+1d &'1&N+ "*+ !&-G4-"FXTD/"&G/+ 0G4"1Z S+nD&-+1 :4''+$" O#$%Y

=F :#G"D-+ ]1+-1 9#$/ \2#(+ Q&"*4D" $4'1+'"ND-&'( "&$%+" 1$#' +.+'"F Xc6D// G-46&/&'(dY


25/47

O#-$4N+ 0$#''+- i 3-&.#$L\11D+1

J O#-$4N+ 1$#'1 +5"&$%+"1 #'N -+"-&+.+1"-#.+/+-1 N+"#&/1

J 74+1'W" /4( 1$#'1

J 0$#''+N E#-$4N+ &'64 N+$4N+N #'N

G-+1+'" &' S!T

J


26/47

O:O3 :4N+ ,+$*'&$#/ \'64! b+'+-#/ \'64

" H#- 8 4N+N H4#-N&'( = #11 " \!,!Z =>>o "

]1+N EL 24-+ "*#' =>>#&-/&'+1 Xae D1+ 24E&/+Y " \' 3#G+-H =69R!W " 7&(&"#/HTZ)%0 071% Z

7#"#2#"-&A #'N RS $4N+


27/47

379@?h ,+$*'&$#/ \'64! 34-"#E/+ 7#"# 9&/+Z?pp?! \0; 1"#'N#-N ?o@aq! R!W +#$* G#""+-' $4'1&1"1 46 R

E#-1 #'N 1G#$+1Z +#$* G#""+-' &1 !W D'&"1 /4'(F! P&'+#- E#-$4N+! ]1+ &'H

" ,-#'1G4-"#"&4' "

\N+'"&6&$#"&4' $#-N1 " \'.+'"4-L 2#'#(+2+'"


28/47

O:O3 X379@?hY :4N+ 7+$4N+N \'64

YT< 6T#TFP!^T8_TY]?;TCG`T\6Y>? GaUHbMN T#_]>TTI J!MM !IMUJQJ6JJQa !RWcQ!d < H Qe

P!F 94-2#" $4N+ rTW #'N ? /+( 4' "*+ E4#-N&'( G#11F^T8_TY]?;TCG`T\6Y>?F 3#11+'(+- TTI F 9/L&'( 6-42 !,` X!"*+'1Y "4 \;! X\4#''&'#Y 4' !a X!&-G/#'+ :42G#'LH !+(+#'YJ!MM F 9/&(*" 'D2E+- ?eeF!IMF ,*+ sD/' N#"+F

UF :#E&' t 8$4'42L &' "*&1 $#1+F ;"*+-1 &'$/DN&'( 9 X9&-1"Y #'N s XOD1&'+11YFJQJ6F 3#11+'(+-1 1+#"FJJQaF 0+nD+'$+ 'D2E+-F \' "*&1 $#1+ G#11+'(+- Q#1 "*+ =o"* G+-14' "4 $*+$%5&'F!RWF 9&+/N 1&U+ 46 #&-/&'+ 1G+$&6&$ N#"# 2+11#(+FcFO+(&''&'( 46 "*+ .+-1&4' 'D2E+-QF ,*+ .+-1&4' 'D2E+-F!dF 9&+/N 1&U+ 46 #'4"*+- .#-E/+ 6&+/NF< H $*+$%5&' 14D-$+FHF !&-/&'+ N+1&('#"4- 46 E4#-N&'( G#11 &11D+-FQeF !&-/&'+ 1G+$&6&$ N#"#


29/47

!U"+$ :4N+ ,+$*'&$#/ \'64! =7 E#-$4N+Z ?ppo! \0;I\8: =@hhqH=>>q! ?p?@ EL"+1 46 N#"# +'$4N+N! ]1+ &' "-#'1G4-"#"&4'Z +1G+$//L 85

"&$%+"1! 3-+1+'" &' T4E&/+ 3*4'+1Z *#'N*+/N

N+.&$+1F


30/47

O:O3 !U"+$ :4N+ 7+$4N+N \'64

P!^T8_TY]?;TCG`T\6Y>?RTG_H# T#_]>TTI J!MJ !!WUJ!WTJJaQ !JJ

P!F 94-2#" $4N+ rTW #'N ? /+( 4' "*+ E4#-N&'( G#11F^T8_TY]?;TCG`T\6Y>?F 3#11+'(+- TTIF 9/L&'( 6-42 !,` X!"*+'1Y "4 \;! X\4#''&'#Y 4' !a X!&-G/#'+ :42G#'LH !+(+#'YJ!MJF 9/&(*" 'D2E+- ?e>F!!WF ,*+ sD/' N#"+F \' "*&1 $#1+ ??h &1 !G-&/ =hF

UF :#E&' t 8$4'42L &' "*&1 $#1+F ;"*+-1 &'$/DN&'( 9 X9&-1"Y #'N s XOD1&'+11YFJ!WTF 3#11+'(+-1 1+#"FJJaQF 0+nD+'$+ 'D2E+-F \' "*&1 $#1+ G#11+'(+- Q#1 "*+ o="* G+-14' "4 $*+$%5&'F!JJF 9&+/N 1&U+ 46 #&-/&'+ 1G+$&6&$ N#"# 2+11#(+F


31/47

!""#$%H 7DG/&$#"+ 85,&$%+"

>35:5.+2 fY 6-/250+)% fY

P!^T8_TY]?;TCG`T\6Y>?RTG_H# T#_]>TTI J!MJ!!WUJ!WTJJaQ !JJ

6%071%1 ].@7

J K+ '++N # "44/ "4 +A56&/"-#"+ +5"&$%+"1F X,0 3;0 T#/Q#-+YJ K+ '++N # "44/ 64- 6#1" +5"&$%+" NDG/&$#"&4' #6"+- Q+ -+"-&+.+"*+ N#"# 64- "*+ *#$%+N 2#$*&'+ X!U"+$S+.+'(+,44/Y

J ]1+ "*+ $/4'+N +5"&$%+" "4 5*/%3'7.+)% 142+4'+ +/1+ #'N(#&' #$$+11 "4 "*+ ,#A 9-++ #-+# 46 "*+ !&-G4-"F

0$#''+N &'%&41%

3-+1+'" &'%&41%1 S!T

g\;0g

\'1+-" 3;0T#/Q#-+

8A56&/"-#"+

+5"&$%+"


32/47

,0 3;0 T#/Q#-+


33/47

,-#.+/+-1 0GL X,0Y 3;02#/Q#-+

O#1+N 4' 4D- ]1+ :#1+ ,053;0 2#/Q#-+ 1*4D/N 6+#"D-+"*+ 64//4Q&'( $#G#E&/&"&+1H

J SD''&'( 4' E#$%(-4D'N

J 3+-64-2 S#2 0$-#GG&'( "4 &N+'"&6L 85"&$%+"1 !/-+#NL

0$#''+NFJ ;' 85"&$%+" 1$#' +.+'"Z :#G"D-+1 \2#(+ "*-4D(*

K+E$#2

J `44% 4' O#-$4N+ 0$#''+- 3-4$+11 X&6 G411&E/+Y

J S+$+&.+ :422#'N1 "*-4D(* !U"+$ :4N+ &2#(+1Q*+' G-4G+- 64-2#" E&"1 #-+ +'$4N+N &' "*+ &2#(+F

J :4''+$" O#$% &6 \'"+-'+" $4''+$"&.&"L #.#&/#E/+F


34/47


35/47

S!T 0$-#GG&'( &' #$"&4'S!T 0$-#GG&'( 9D'$"&4'#/&"LH?F 8A"-#$" S!T 46 O#-$4N+ 0$#''+- 3-4$

J T#G \'"+-+1"&'( G-4$+11+1Z ,#-(+" "*+ E-4Q1+- 3-4$+11 "44k

J 74 &" G+-&4N&$#//L X+.+-L "Q4 *4D-1Y

J K&'N4Q1 !3\Z Y%+1=370%''P%*73( @-.0)57.

=F 0+#-$*

J 0"-&'( \N+'"&6&+-1 X]'&nD+ 0"#-"Z 0"4G f#/D+1Z 9&A+N 0&U+YZS+(D/#- 8AG-+11&4'1

J :#'N&N#"+ 7#"# X0"4-+ &6 '4" 1D-+Y

aF 8A6&/"-#"+ \'64-2#"&4'

J \1 \'"+-'+" :4''+$"&4' !.#&/#E/+M X\' 4D- $#1+ L+1Y

J \6 '4"M X0"4-+ P4$#//LY


36/47

S!T 0$-#GG&'( +A#2G/+

!" 6-*/5.: /370%'' *%*73( [5)$ ,72+)525)(F

.4/#"&/&"L5=FaF?F1"#'N#/4'+F+A+ 56 v:/+#' wG5Eh?#N6a=F.2+2v 5G pq>2+2ND2G 57 2+24-LI

Q" L'5.: >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>?444444


37/47


38/47

!U"+$ S+.+'(+ ,44/


39/47

!U"+$ $422#'N1 6-42 L4D- G*4'+X!U"+$ S+.+'(+ ,44/Y

=78 T.13751 P7452%

?-//73)'F 379@?hZ !U"+$ :4N+

I P71%' 7@ >/%3+)57.F

J 85"&$%+" 7DG/&$#"4- T4N+J 38


40/47

85"&$%+" 7DG/&$#"4- T4N+! K*L 7DG/&$#"+ # -+"-&+.+N 85"&$%+"H

" \2G+-14'#"&4' " ]1+ &" #1 E#1&1 "4 6DUU G#-#2+"+-1 +AG+$"+N

EL "*+ 1L1"+2F! `4Q &" Q4-%1H

0$#'1 !' &2#(+46 "*+ "&$%+" &' -+#/"&2+ #'N N+$4N+1

"*+ $4'"+'"


41/47

7DG/&$#"&'( &' !$"&4'


42/47


43/47

9DUU&'( &' !$"&4'


44/47

:422#'N T4N+

! ]1+6D/ Q*+' '4&'"+-'+" $4''+$"&.&"L#.#&/#E/+

" 7D2G S!T:#G"D-+1

! \11D&'( :422#'N1X8AF 0GL 4' # 1G+$&6&$"-#.+/+- 4- (-4DGY

! 3+-64-2


45/47

:42E&'+N !""#$%

jCT?# ?8T\\G6 #]8kG#l 87**+.1

#? =>? P+2[+3% Y%)35%,%';=35.)' 6+)+ 7. ?03%%.


46/47

:4'$/D1&4'S+$422+'N#"&4'1H?F ]1+ 1"-4'( G#11Q4-N1 "4 #$$+11 3;0 N+.&$+1=F g++G 3;0 146"Q#-+ DG "4 N#"+aF ]1+ 6&-+Q#//1 "4 &14/#"+ "*+ 3;0 G-4ND$"&4' '+"Q4-% 6-42 4"*+-

'+"Q4-%1 4- "*+ \'"+-'+"

@F 82G/4L #'"&.&-D1 "44/1oF P&2&" #$$+11 "4 "*+ \'"+-'+" 6-42 "*+ G-4ND$"&4' '+"Q4-%eF 7&1#E/+ #// -+24"+ #$$+11 "4 3;0 1L1"+21hF :*+$% 146"Q#-+ #'N *#-NQ#-+ 46 3;0 #1 # Q*4/+Z "4 N&1$4.+- 24-+

ED(1 "*#" $#' E+ D1+N &' "*+ +AG/4&"#"&4' G-4$+11


47/47

RD+1"&4'1M

&'64C$+'1D15/#E1F$42:+'1D1 0F!F

*""GHII$+'1D15/#E1F$42

DEFCON 22 Alex Zacharis Nikolaos Tsagkarakis PoS Attacking t

Documents