Code Property Graphs & joern – simple, precise static code analysis
Claudiu-Vlad Ursache
This talk introduces `kotlin2cpg` – the newest addition to Joern, the platform for robust analysis of source code, byte code and binary code.
First, Code Property Graphs are discussed – what they are, how they look like, why they’re the ideal intermediate representation for cross-language code analysis.
Second, the capabilities of Joern are shown – the interactive shell, its scripting support and the CPGQL query language.
Third, `kotlin2cpg` is put under the microscope – its underlying components are discussed together with the challenges of building a new static analyzer on top of Joern.
There will be a step-by-step guide for building a CPGQL query for a previously-undisclosed bug in a fairly prominent Android application [DISCLOSURE COMING SOON].
Digital Forensics Unchained: Ripping Apart the Old School Rulebook
Emily Wicki
Though she doesn’t want to tell you that you’re doing forensics wrong, you probably are. Emily’s gonna set you straight on a few things, and we can’t wait to hear it.
The Debugging Uncertainty Principle
Jatin Kataria
In this talk, Jatin will be sharing learnings and tools built for investigating low frequency kernel crashes in FreeBSD and discuss how hardware features could be utilized for providing zero-cost triage information in production systems. This Heisenberg bug was initially assumed to be happening due to an interrupt stack corruption but turned out to be a CPU bug. Heisenberg bugs, known for their elusive and unpredictable nature, can be a challenge to identify and fix. Therefore, this bug was difficult to produce and hence remained a mystery for debug invariant FreeBSD builds where integrity checks are enabled throughout the kernel. In order to investigate the bug, Jatin built stack analyzer tools and configured Last Branch Record (LBR) on CPUs and integrated them into the FreeBSD kernel to get CPU control flow information during a page or general protection fault for zero
cost overhead.
Frankly, we’re stunned that this whole thing fits inside of 30 minutes, so listen carefully — it’s gonna go by at light speed!
Hacking the GameCube to Beat Nerds at Smash Bros for Charity
Dan “AltF4” Petro
This is the story of how an AI (SmashBot) can beat professional Melee players on a real Nintendo GameCube (a 22 year old console with no Internet connectivity) in front of an audience of tens of thousands of people who can all interact directly with the game remotely from their browser.
We’ll cover all the technical details behind the Melee speedrun marathon showcase, including gaining arbitrary code execution on the GameCube, all the tooling for writing complex payloads in the dead PowerPC ASM architecture, exfiltrating data off the console, and the custom-built hardware to facilitate it. All so that I can live vicariously through a robot in my fantasies of being a pro Melee player.
Oh, and bring your controller, because you can try to beat SmashBot yourself live on stage too!
Ice Ice Baby: Coppin’ RAM With DIY Cryo-Mechanical Robot
Ang Cui
We present the design and construction of a robot that reliably extracts contents of RAM of modern embedded devices at runtime. We discuss the practical engineering challenges and solutions of adapting the traditional cold-boot attack to non-removable DDR chips commonly found on modern embedded devices. Lastly, we present a practical guide to building your own cryo-mem rig from COTS parts for less than a thousand bucks.
Have you noticed that embedded hardware is getting harder to reverse? BGA chips, massively integrated packages, vertical stackups, encrypted firmware at rest, and a pinch of “no jtag or uart” has become standard fare. While these artifacts do not correlate to material improvements in device security, you can’t prove it because you can’t dump the firmware or debug the hardware. Skip the noise and change up the game. Sometimes it’s easier just to grabbing unencrypted firmware from live RAM. All you have to do is keep the chips at -50C on a running system, pull all the chips off on the same CPU instruction, slap it on an FPGA that sort of respects the DDR state machine without punching a whole in your device, or cause shorts due to condensation, and without freezing your eyebrows off. We’ll show you how to build a robot to do this in an afternoon for about a thousand dollars.
In Memoriam – a Video Presentation
Dear Aloria, we miss you so much. We know you wouldn’t want us to cry, but we can’t promise that we won’t.
Logic for Hackers: the case of incorrectness logic and adversarial reasoning
Julien Vanegue
Typical static analysis for program verification comes with an over-approximate flavor, which considers a superset of program behaviors to guarantee the absence of bugs. This is a problem as spurious behaviors can lead to false positives, the enemy of software developers and security auditors alike. In the last few years, a new kind of formal logic “incorrectness logic” (O’Hearn, POPL’20) introduced under-approximate program analysis, where every bug is guaranteed to be a true positive, at the expense of false negatives, therefore coming as a foundation for the theory of formal bug finding. Such methodology is applied at scale by large software vendors (e.g. Meta) and is more immediately usable in industrial CI/CD pipelines. This talk will introduce under-approximate reasoning to the Summercon crowd, and discuss a recent extension “adversarial logic” (Vanegue, SAS’22) extending incorrectness logic with explicit adversary to formalize the detection of exploit conditions in buggy programs.
Protect Yourself Before You Wreck Yourself
Samantha Davison & Jennifer Leggio
For legal and/or aesthetic reasons, the description of this presentation is not availble. But you won’t want to miss it!
Race Against the Machine: Consumers vs. Bots
Christine Fossaceca
Do you have any beef with online merchants? Maybe you weren’t able to buy a PS5 for months after they were released. Maybe there teardrops on your guitar because Ticketmaster didn’t let you get tickets to Taylor Swift’s Eras Tour. Or maybe you will be too far apart from the Cure because of the latest ticket scandal leaving you empty handed! The common denominator to consumer stress in online sales is directly tied to the uptick in botnets and the scalpers that use them.
Rebecca and Christine are going to shed light on the underground world of online resellers (scalpers) and the botnets they use to gain a competitive advantage when buying merchandise, such as sneakers, concert tickets, GPUs, and even NFTs, edging out legitimate consumers and profiting from the sales of products they didn’t design and music they didn’t create.
This talk will explain what botnets are, how scalpers build them and use them, and then recap some real world examples of botnets being seen in the wild. First we will talk about a cyber attack that no one even knew happened against the Shopify platform, when a scalper botnet broke a popular makeup website during the Shane Dawson and Jeffree Star Conspiracy makeup collection release. No, they didn’t break the internet, a botnet did. Next, Rebecca and Christine will evaluate the veracity of claims that Ticketmaster made in their Senate committee hearing, blaming their ticketing fiascos on “botnet attacks”, and ask the question, “Was the botnet truly scalpers or a just a convenient scapegoat?”
The Ransomware Hunting Team: A Band Of Misfits’ Improbable Crusade To Save The World From Cybercrime
Dan Golden & Renee Dudley
ProPublica journalists Renee Dudley and Daniel Golden, are the authors of “The Ransomware Hunting Team: A Band of Misfits’ Improbable Crusade to Save the World from Cyber-Crime,” published in October 2022 by Farrar Straus, & Giroux to critical acclaim. Among other plaudits, Amazon made it an editor’s choice for non-fiction, and the New York Times called it “brilliant.” In this presentation, Dan and Renee will take us through their narrative, descrive the hunt, talk about some of the moral dilemmas, and share some thoughts about the the future of malware.Book signing to follow; bring your copy or buy one at Summercon! https://us.macmillan.com/books/9780374603304/theransomwarehuntingteam
[REDACTED], a Presentation With an Elaborate Title
Dan Guido and/or [REDACTED}
Dan and the good folks at [REDACTED] have been working on [REDACTED]. and will discuss some of the outcomes of their [REDACTED]. This talk will [REDACTED] your [REDACTED].
Sub 1 Ghz and other radio/side channel attacks
Harri Hursti
Sub 1 GHz attacks are nothing new and SDRs made those a long time ago accessible. Flipper Zero blew this family of attacks into the mainstream consciousness as easy to use and almost no skills required cheap tools. Jailbreaking Quansheng UV-K5 brings in a $20 radio transceiver from 18MHz to 1.3 GHz, so where are we heading?
This Year in Crypto
Nick Sullivan
We swear we have an abstract for this lying around somewhere — but it’s Nick, so you know you’re good.
Tried and True Security Beliefs/Best Practices… Are Wrong
Mudge
Charming, irreverant, and always controversial, Mudge has hot takes. Get ready for a deep cut on so-called “best practices” It’s an honor to welcome him to the Summercon stage.
Why can’t we be friends? Solving the social challenges of application security
Christopher Surage
Application security remains a difficult challenge for organizations to solve. Year after year we are constantly bombarded with new vulnerabilities in products and libraries which we all use. Much of the focus with improving application security revolves around the technical aspects yet the social aspects are widely ignored. This presentation is about the social challenges of application security which security practitioners don’t address, and provide some solutions to those challenges.
Grab Bag with wrappers, cookies, ELFs and injections
John Viega & Brandon Edwards
John and Brandon share a bunch of novel crap they’ve done recently, all of which is either open source, or about to be.
cDc Announcement
Our friends from the Cult of the Dead Cow have a quick announcement. We’re as curious as you are!