SCYTHE and the ICS Village’s inaugural RSAC!

By Anonymous -


SCYTHE and the ICS Village’s inaugural RSAC!

Whew. Who’s still recovering from RSAC 2018? GRIMM has been making appearances at the annual conference since launching in 2012. However, this was the inaugural visit for SCYTHE, GRIMM’s sister product company which launched last October, and the ICS Village, a non-profit the GRIMM and SCYTHE leadership helped launch this spring. And what a splash it was! In case you missed it, we were busy! Here’s a recap:
Howdy Neighbor and CROSSBOW in the RSAC Sandbox
It’s not news that Industrial Control Systems (ICS) are some of the most insecure. We believe that advocacy in securing ICS is the best place we can be putting our (outside of work) free time, so along with some other friends (ICS stalwarts: Tom VanNorman, Larry Vandenaweele, and Beau Woods), we launched the ICS Village non-profit in February. Then, we packed up the ICS range, and took it to the RSAC Sandbox. Interested in learning more about ICS security, or how the ICS village can help provide training or advocacy, please hit us up!


Meanwhile, although Howdy Neighbor, GRIMM’s Internet of Things (IoT) capture the flag (CTF)-like challenge, is no stranger to the conference scene, it did make its first RSAC appearance. Hackers and security researchers from across the globe tested their skills against the 30+ built in IoT security challenges. While Howdy Neighbor has been hitting the conference circuit for more than a year now, to date, iToastr, the flagship “hard” challenge, has yet to be solved! Call to hackers going to DEFCON - make this your top prioritity!

It’s not all fun and games! The SCYTHE team was busy demoing CROSSBOW, a tool that allows you to continuously assess your own risk posture and exposure. Too good to be true? Don’t take our word for it - read about it yourself here. Interested in a demo? Hit us up!

Meanwhile, CEO & Founder of SCYTHE, Bryson Bort, spoke in Sandbox about IoT and why everyone, consumers and vendors alike, need to pay better attention to IoT security challenges. In addition to cybersecurity, IoT implicates private citizens’ safety and privacy.


Party central!
MAYHEM! We co-hosted an epic party at the historic San Francisco Mint with our friends Bugcrowd. Did you try the CROSSBOW punch? Hacker juice at its finest.



And seriously, don’t GRIMM and SCYTHE clean up nicely? It takes a village to provide such a good experience to attendees in something like the RSAC Sandbox. Providing real, hands-on experience is what we’re passionate about - many thanks to these fine folks and RSAC to make that a reality!

Looking forward to RSAC 2019. See you there!

Popular posts from this blog

New Old Bugs in the Linux Kernel

By Anonymous -
Image
  Introduction Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially...
Read more

Automated Struct Identification with Ghidra

By Anonymous -
Image
At GRIMM, we do a lot of vulnerability and binary analysis research. As such, we often seek to automate some of the analysis steps and ease the burden on the individual researcher. One task which can be very mundane and time consuming for certain types of programs (C++, firmware, etc), is identifying structures' fields and applying the structure types to the corresponding functions within the decompiler. Thus, this summer we gave one of our interns,  Alex Lin , the task of developing a Ghidra plugin to automatically identify a binary's structs and mark up the decompilation accordingly. Alex's writeup below describes the results of the project, GEARSHIFT, which automates struct identification of function parameters by symbolically interpreting Ghidra's P-Code to determine how each parameter is accessed. The Ghidra plugin described in this blog can be found in our GEARSHIFT repository . Background Ghidra is a binary reverse engineering tool developed by the National Sec...
Read more

SOHO Device Exploitation

By Anonymous -
Image
Netgear R7000 SOHO Device Exploitation After a long day of hard research, it’s fun to relax, kick back, and do something easy. While modern software development processes have vastly improved the quality of commercial software as compared to 10-15 years ago, consumer network devices have largely been left behind. Thus, when it’s time for some quick fun and a nice confidence boost, I like to analyze Small Office/Home Office (SOHO) devices. This blog describes one such session of auditing the Netgear R7000 router , analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. Initial Analysis The first step when analyzing a SOHO device is to obtain the firmware. Thankfully, Netgear’s support website hosts all of the firmwares for the R7000. The Netgear R7000 version 1.0.9.88 firmware used in this blog post can be downloaded from this web...
Read more