{"id":2214,"date":"2017-08-30T06:43:29","date_gmt":"2017-08-30T06:43:29","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=2214"},"modified":"2017-09-11T03:03:34","modified_gmt":"2017-09-11T03:03:34","slug":"%e3%80%90%e6%b4%bb%e5%8a%a8%e9%a2%84%e5%91%8a%e3%80%91inforsec%e6%b8%85%e5%8d%8e%e5%a4%a7%e5%ad%a6-%e7%bd%91%e7%bb%9c%e4%b8%8e%e7%b3%bb%e7%bb%9f%e5%ae%89%e5%85%a8%e5%92%8c%e4%ba%ba%e5%b7%a5%e6%99%ba","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=2214","title":{"rendered":"\u3010\u6d3b\u52a8\u9884\u544a\u3011 \u7f51\u7edc\u4e0e\u7cfb\u7edf\u5b89\u5168\u548c\u4eba\u5de5\u667a\u80fd\u56fd\u9645\u5b66\u672f\u8bba\u575b9\u670812\u65e5\u6e05\u534e\u5f00\u5e55"},"content":{"rendered":"

\u4e3b\u529e\uff1a\u7f51\u5b89\u56fd\u9645\u8bba<\/b><\/strong>\u575b<\/b><\/strong>\uff08InForSec\uff09<\/b><\/strong><\/p>\n

\u65f6\u95f4\uff1a<\/b><\/strong>9<\/b><\/strong>\u6708<\/b><\/strong>12<\/b><\/strong>\u65e5\u4e0a\u5348<\/b><\/strong>9<\/b><\/strong>:<\/b><\/strong>0<\/b><\/strong>0~1<\/b><\/strong>2<\/b><\/strong>:<\/b><\/strong>15<\/b><\/strong><\/p>\n

\u5730\u70b9\uff1a\u6e05\u534e<\/b><\/strong>\u5927\u5b66<\/b><\/strong>FIT\u697c\u4e8c<\/b><\/strong>\u5c42<\/b><\/strong>\u591a\u529f\u80fd\u62a5\u544a\u5385\uff08<\/b><\/strong>150<\/b><\/strong>\u4eba\uff09<\/b><\/strong><\/p>\n

\u4f1a\u8bae\u8bae\u7a0b<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n\n
\u65f6\u95f4<\/b><\/strong><\/td>\n\u6f14\u8bb2\u5609\u5bbe<\/b><\/strong><\/td>\n\u5de5\u4f5c\u5355\u4f4d<\/b><\/strong><\/td>\n\u6f14\u8bb2\u4e3b\u9898<\/b><\/strong><\/td>\n<\/tr>\n
8:30-9:00<\/td>\n\u7b7e\u5230<\/td>\n<\/tr>\n
9:00-12:15<\/td>\n\u4e3b\u6301\u4eba\uff1a\u6bb5\u6d77\u65b0 \u00a0 \u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662\u6559\u6388<\/td>\n<\/tr>\n
9:00-9:45<\/td>\n\u94b1\u5fd7\u4e91<\/td>\n\u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821\u52a9\u7406\u6559\u6388<\/td>\nAndroid root \u751f\u6001\u7cfb\u7edf\u4ee5\u53ca\u6211\u4eec\u80fd\u505a\u4ec0\u4e48<\/td>\n<\/tr>\n
9:45-10:30<\/td>\n\u9648\u9f50<\/td>\n\u5bc6\u6b47\u6839\u5927\u5b66\u535a\u58eb\u751f<\/td>\n\u65b0\u901a\u7528\u9876\u7ea7\u57df\u540d(new gTLD)\u5bfc\u81f4\u7684\u57df\u540d\u51b2\u7a81\u53ca\u4e00\u7cfb\u5217\u65b0\u7684\u5b89\u5168\u6f0f\u6d1e\u4e0e\u653b\u51fb<\/td>\n<\/tr>\n
10:30-10:45<\/td>\n\u8336\u6b47<\/td>\n<\/tr>\n
10:45-11:30<\/td>\n\u8bb8\u4f1f\u6797<\/td>\n\u5f17\u5409\u5c3c\u4e9a\u5927\u5b66\u535a\u58eb\u751f<\/td>\n\u5bf9\u6297\u5f0f\u673a\u5668\u5b66\u4e60\u4e2d\u7684\u653b\u51fb\u4e0e\u9632\u5fa1<\/td>\n<\/tr>\n
11:30-12:15<\/td>\n\u9c8d\u7531\u4e4b<\/td>\n\u5361\u5185\u57fa\u6885\u9686\u5927\u5b66\u535a\u58eb\u751f<\/td>\n\u4f60\u7684\u5c31\u662f\u6211\u7684\uff1a\u8fdc\u7a0b\u653b\u51fb\u590d\u7528\u548cshellcode\u79fb\u690d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n


\n\u6f14\u8bb2<\/b><\/strong>\u4eba\u53ca\u6f14\u8bb2\u5185\u5bb9\u6458\u8981<\/b><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\uff1a\u94b1<\/b><\/strong>\u5fd7\u4e91<\/b><\/strong>\u52a0<\/b><\/strong>\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821<\/b><\/strong>\u52a9\u7406<\/b><\/strong>\u6559\u6388<\/b><\/strong><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898<\/b><\/strong>\uff1a<\/b>Android root \u751f\u6001\u7cfb\u7edf\u4ee5\u53ca\u6211\u4eec\u80fd\u505a\u4ec0\u4e48<\/strong><\/p>\n

\u5185\u5bb9\u6458\u8981\uff1a<\/b><\/strong><\/p>\n

\u5f88\u5c11\u6709\u4eba\u8ba8\u8bba\uff0cAndroid \u4ee5\u5f00\u653e\u7684\u751f\u6001\u73af\u5883\u62a2\u5f97\u4eca\u5929\u7684\u5e02\u573a\u4efd\u989d\uff0c\u5176\u4e2d\u9690\u6027\u7684\u4ee3\u4ef7\u5176\u5b9e\u662f\u5b89\u5168\u3002\u591a\u6837\u800c\u6742\u4e71\u7684Android\u7cfb\u7edf\u5bfc\u81f4\u4e86\u6f0f\u6d1e\u5c42\u51fa\u4e0d\u7a77\u4ee5\u53ca\u5b89\u5168\u7ef4\u62a4\u7684\u9ad8\u6210\u672c\u3002Android \u4e00\u952e root \u8f6f\u4ef6\u7684\u5e94\u8fd0\u800c\u751f\u5c31\u662f\u4e00\u4e2a\u4f50\u8bc1\uff1b\u8fd9\u4e9b\u8f6f\u4ef6\u5408\u6cd5\u800c\u4e14\u53ef\u4ee5\u6709\u6548\u5229\u7528\u5404\u79cd\u5185\u6838\/\u9a71\u52a8\u6f0f\u6d1e\u800c\u8fbe\u5230\u76ee\u7684\u3002\u8fd9\u6b21\u62a5\u544a\u4e2d\u4f1a\u63ed\u79d8\u8fd9\u4e2a\u9c9c\u4e3a\u4eba\u77e5\u7684Android root\u751f\u6001\u7cfb\u7edf\uff0c\u5df2\u7ecf\u6211\u4eec\u5982\u4f55\u5229\u7528\u8fd9\u4e9b\u77e5\u8bc6\u4e3a\u6076\u610f\u8f6f\u4ef6\u7684\u68c0\u6d4b\u505a\u51fa\u8d21\u732e\u3002<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\u7b80\u4ecb\uff1a<\/b><\/strong><\/p>\n

\u94b1\u5fd7\u4e91\u662f\u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821 (University of California, Riverside) \u7684\u52a9\u7406\u6559\u6388 (Assistant Professor)\u3002\u4ed6\u7684\u7814\u7a76\u5174\u8da3\u6709\u7cfb\u7edf\u7f51\u7edc\u5b89\u5168\u7f51\u7edc\uff0c\u5176\u4e2d\u6d89\u53ca\u5230TCP\/IP\u534f\u8bae\u7684\u8bbe\u8ba1\u4e0e\u5b9e\u73b0\uff0c\u5b89\u5353\u7cfb\u7edf\u7684\u6f0f\u6d1e\u6316\u6398\/\u5206\u6790\u7b49\u3002\u4ed6\u57282016 geekpwn\u4e2d\u51ed\u501fTCP\u8fdc\u7a0b\u52ab\u6301\u83b7\u5f97\u6700\u5927\u8111\u6d1e\u5956\uff0c\u57282017\u5e74\u83b7\u5f97NSF CAREER Award\u3002<\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\uff1a<\/b>\u9648\u9f50 \u00a0 \u7f8e\u56fd\u5bc6\u6b47\u6839\u5927\u5b66\u535a\u58eb\u751f<\/strong><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898:\u00a0<\/b>\u65b0\u901a\u7528\u9876\u7ea7\u57df\u540d(new gTLD)\u5bfc\u81f4\u7684\u57df\u540d\u51b2\u7a81\u53ca\u4e00\u7cfb\u5217\u65b0\u7684\u5b89\u5168\u6f0f\u6d1e\u4e0e\u653b\u51fb<\/strong><\/p>\n

MitM, Code Injection, Cred Theft, and More Found at the Scene of a Name Collision<\/strong><\/p>\n

\u5185\u5bb9\u6458\u8981\uff1a<\/b><\/strong><\/p>\n

The recent unprecedented delegation of new generic top-level domains (gTLDs) has exacerbated an existing, but fallow, problem called name collisions. In this talk, I will first discuss one concrete exploit of this problem, called the WPAD name collsion attack. In this attack, the attacker exploits the leaked service discovery queries for an internal web proxy service called WPAD, and can cause all web traffic of an Internet user to be redirected to an attacker’s proxy automatically right after the launching of a standard browser, making MitM attacks on web browsing easier than ever. Targeting this newly-exposed attack vector, we perform an in-depth study of the problem causes, and then define and quantify a candidate measure of attack surface to systematically characterize its vulnerability status in the wild. Our results show that 10% of the highly-vulnerable domains have already been registered and thus can be exploited at any time, providing a strong and urgent message to deploy proactive protection. We then discuss promising directions for remediation at the DNS ecosystem level with empirical data analysis.<\/p>\n

While we have showed that the name collision problem is a real threat today, our understanding of its impact on the internal services is limited to the WPAD service. In fact, over 600 services are registered to support DNS-based service discovery, and thus the name collision problem may have much broader impact than the WPAD service alone. In the second part of the talk, I will present a follow-up work that performs a systematic study of the affected services under the name collision attack threat model, aiming at understanding the vulnerability status and the defense solution space at the service level. We first perform a measurement study that uncovers the wide spectrum of affected services, and then analyze their client implementations using a dynamic analysis framework. From our analysis, we find that nearly all of the affected services expose vulnerabilities in popular clients. To demonstrate the severity, we construct exploits and report our findings of many new name collision attacks with severe security implications including another MitM attack vector, document leakage, malicious library injection, and credential theft. We analyze the causes and find that the name collision problem broadly breaks common security assumptions made in today\u2019s service software. Leveraging the insights from our analysis, we propose multiple service software level solutions.<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\u7b80\u4ecb<\/b><\/strong>:<\/b><\/strong><\/p>\n

Qi Alfred Chen is a PhD candicate in the EECS department at University of Michigan advised by Professor Z. Morley Mao. His research interest is computer network and systems security, and the major theme of his research is to address security challenges through systematic problem analysis and mitigation. He has been working on discovering and mitigating vulnerabilities in smartphone OSes (Usenix Security’14, FC’16), applications (Euro S&P’17), network protocols (CCS’15), DNS (IEEE S&P’16, CCS’17), and access control systems (NDSS’16, NDSS’17). His current research foci are security problems in smart systems and IoT, e.g., smart home systems, smart transportation systems, and autonomous vehicle systems.<\/p>\n

website:web.eecs.umich.edu\/~alfchen\/<\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\uff1a\u8bb8<\/b><\/strong>\u4f1f\u6797 \u00a0<\/b><\/strong>\u7f8e\u56fd\u5f17<\/b><\/strong>\u5409\u5c3c\u4e9a\u5927\u5b66\u535a\u58eb<\/b><\/strong>\u751f<\/b><\/strong><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898:<\/b>\u00a0\u5bf9\u6297\u5f0f\u673a\u5668\u5b66\u4e60\u4e2d\u7684\u653b\u51fb\u4e0e\u9632\u5fa1 \u00a0<\/strong><\/p>\n

Attack and Defense in Adversarial Machine Learning<\/p>\n

\u5185\u5bb9<\/b><\/strong>\u6458\u8981<\/b><\/strong>\uff1a<\/b><\/strong><\/p>\n

Machine learning has been widely used in many areas. However, the robustness of these methods against motivated adversaries is uncertain. In this talk, I will introduce some practical attacks against the typical machine learning systems and the defense techniques. First, I will demonstrate how to evade state-of-the-art PDF malware classifiers, including the one used in Gmail. The irrelevant features used in a classification model is the root cause of adversarial examples. Therefore, we developed a defense solution named Feature Squeezing that coalesces many similar samples into a single example, which had been implemented for computer vision models. We also created a benchmarking and visualization toolbox named EvadeML-Zoo to help the researchers in this field.<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\u7b80\u4ecb<\/b><\/strong>:<\/b><\/strong><\/p>\n

Weilin Xu is a fifth year PhD student in the Computer Science department at the University of Virginia, co-advised by Prof. David Evans and Prof. Yanjun Qi. He received his bachelor degree in Computer Science and Technology from Beijing University of Posts and Telecommunications in 2012. Before joining UVa, he was an engineer at the Network and Information Security Lab at the Tsinghua University.<\/p>\n

Website: http:\/\/www.cs.virginia.edu\/~wx4ed\/<\/p>\n

<\/p>\n

\"\"<\/a><\/div>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\uff1a\u9c8d\u7531\u4e4b \u5361\u5185\u57fa\u6885\u9686\u5927\u5b66\u535a\u58eb\u751f<\/b><\/strong><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898<\/b><\/strong>\uff1a<\/b>\u4f60\u7684\u5c31\u662f\u6211\u7684\uff1a\u8fdc\u7a0b\u653b\u51fb\u590d\u7528\u548cshellcode\u79fb\u690d<\/strong><\/p>\n

Your Exploit is Mine: Automatic Shellcode Transplant for Remote Exploits<\/strong><\/p>\n

\u5185\u5bb9<\/b><\/strong>\u6458\u8981<\/b><\/strong>\uff1a<\/b><\/strong><\/p>\n

Developing a remote exploit is not easy. It requires a comprehensive understanding of a vulnerability and delicate techniques to bypass defense mechanisms. As a result, attackers may prefer to reuse an existing exploit and make necessary changes over developing a new exploit from scratch. One such adaptation is the replacement of the original shellcode (i.e., the attacker-injected code that is executed as the final step of the exploit) in the original exploit with a replacement shellcode, resulting in a modified exploit that carries out the actions desired by the attacker as opposed to the original exploit author. We call this a shellcode transplant.<\/p>\n

In my talk, I will discuss the shellcode transplant problem and present ShellSwap, a system that uses symbolic tracing, with a combination of shellcode layout remediation and path kneading to achieve shellcode transplant. We show that previous method is insufficient in tackling the shellcode transplant problem, and that ShellSwap has better results in reusing exploits.<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>\u7b80\u4ecb<\/b><\/strong>:<\/b><\/strong><\/p>\n

Tiffany Bao is a Ph.D. student in CyLab\u00a0advised by Professor David Brumley. Her research interest is cyber autonomy, which includes both binary analysis technique and game-theoretic strategy for computer security. She completed her B.S. in Computer Science at Peking University, China.<\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e3b\u529e\uff1a\u7f51\u5b89\u56fd\u9645\u8bba\u575b\uff08InForSec\uff09 \u65f6\u95f4\uff1a9\u670812\u65e5\u4e0a\u53489:00~12:15 \u5730\u70b9\uff1a\u6e05\u534e\u5927\u5b66FI… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2214","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2214"}],"version-history":[{"count":17,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2214\/revisions"}],"predecessor-version":[{"id":2244,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/2214\/revisions\/2244"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2214"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}