Blog: Blackhat USA 2013 Day 2 - Double Fetch 0day, ICS/SCADA, and Remembering Barnaby Jack
Blackhat 2013 day 2 brought 0day, a sad remembrance young researcher Barnaby Jack, and ICS/SCADA security vulnerabilities and review.
Highlights of day 2 included a mind blowing talk from Mateusz "j00ru" Jurczyk and Gynvael Coldwind, further exploring the kernel level double fetch vulnerability research that attracted interest since at least 2008. It is interesting stuff considering buffer overflow code is particularly well audited, but race conditions simply are not. Race conditions like these enable EoP exploitation and other severe potential attacks. The two developed the Bochspwn framework to implement CPU level OS instrumentation to locate double fetch vulnerabilities, and have been cranking out substantial findings in the Windows kernel since. They dropped Windows 8 0day (although, reported to Microsoft) with yet more discoveries, releasing their Bochspwn project code during their talk "Identifying and Exploiting Windows Kernel Race Conditions via Memory Access Patterns". It's interesting that the FreeBSD code they examined has been audited before and thus doesn't maintain these bugs, while Linux and Windows pours out related issues.
They are hoping that folks can port the code to assess interesting and exotic embedded platforms and contribute to the body of work. Unfortunately, a second part of their work, Hyperpwn, presented some unexpected technical challenges in the structure of the memory regions they are most interested in, and it was not ready for primetime. Research is like that, and the talk was fantastic without it. Their work also happened to win a well deserved "Most Innovative Research" Pwnie the night before.
"SCADA Device Exploitation" highlighted a large dependency in attacking ICS environments - "it's all about the pivot". Meaning, ICS environments are best infiltrated from the backoffice and down through the reporting and control ennvironment, historian servers and other Windows resources, potentially to the PLCs themselves.
Source:
Blog: Blackhat USA 2013 Day 2 - Double Fetch 0day, ICS/SCADA, and Remembering Barnaby Jack
