What is RED and why should anyone care?
For an old hardware and IoT developer, one of the most intriguing talks was at the beginning of the conference. It was given by Heikki Juva from Traficom and was about an upcoming update to an EU directive called the Radio Equipment Directive, or RED for short. The RED update takes effect in Q3 of this year, and manufacturers are ready for it. Right?
Turns out—surprise, surprise—that equipment sold today will fail miserably and should become illegal to sell in the EU in just a couple of months. Heikki had tested 22 of the most-sold medical devices, IP cameras, and home automation equipment against the upcoming legislation. Of those devices, 50% of medical devices, 71% of IP cameras, and a staggering 100% of home automation devices failed RED tests.
To put this in perspective, the tests didn’t even consider all the requirements in the legislation—just a subset deemed the most significant. Failing any requirement should make the hardware illegal to sell in the EU. Time will tell what happens to all of this equipment, which is mostly produced by third-party manufacturers and shipped under different brands.
Even though the updated RED is clearly a step in the right direction and actually contains detailed guidance about the requirements, it still has casting defects. For example, it’s still considered acceptable to outsource security “only to be used behind a firewalled network” and to allow “old, broken ciphers” for backward compatibility. However, there’s still some hope that we can scrape at least some of that asbestos off the Internet in the EU market.
– Samu
Dissecting the Cicada – In the shadow of the Black Cat
The late Friday talk was held by Nicklas Keijser and Mattias Wåhlén from Truesec about the possible connections between the recently emerged ransomware group Cicada 3301 and the now-defunct BlackCat/ALPHV. With my interest in threat intelligence and cybercrime investigation, this was a must-see.
The speakers broke down both technical and non-technical evidence linking the two groups. On the technical side, the Cicada 3301 ransomware has striking similarities to BlackCat’s, from being written in Rust to using ChaCha20 for encryption and having nearly identical behaviours when shutting down virtual machines. The analysis also revealed they use the same naming conventions for encrypted files and the same built-in list to terminate processes. There are also ties to a known access broker linked to the Brutus botnet, with infrastructure and forum activity pointing straight back to Russian cybercrime circles. So, while there’s no neon sign saying “Hey, we’re BlackCat 2.0!”, the breadcrumbs are there.
For me, the key takeaway was highlighted in the last slide – how valuable cyber threat intelligence is in disrupting these groups. By combining technical analysis with OSINT, forensic investigation, and threat hunting, researchers can expose these actors, making it harder for them to operate in the shadows. The last point on “The Lessons” slide was highlighted in the presentation: raising awareness, publishing research, and speaking about these threats don’t just inform people, but instead, they can truly aid in disrupting ransomware actors. The more we analyse, publish, and discuss their methods, the harder we make it for them to operate in the dark.
– Stephen
Attacking and defending identities in the modern era
A must talk for everyone wanting to implement a secure token based was the “Exploiting Token Based Authentication: Attacking and Defending Identities in the 2020s” given by Dr. Nestori Syynimaa, who is also known online as DrAzureAD and the creator of AADInternals toolkit. The talk was really well put together and it was split into three main sections, making it really easy to follow and understand. The talk began by explaining the basics of token-based authentication, such as what was meant by the user, service provider and identity provider. After this common authentication schemes were explained by using diagrams to demonstrate what SSO was and how Kerberos, SAML, OAuth and Entra ID authentication flows work. It was emphasised that in token-based authentication that possession of a bearer token allowed access to the associated resources without the need to demonstrate possession of a cryptographic key and in order to prevent misuse, the bearer tokens should be protected in storage and in transport.
After having covered how token-based authentication works, macro-level attack techniques against token-based authentication were introduced. Stealing or impersonating the token allowed access for a limited time to the associated resources, while on the other hand stealing the secret allowed the possibility to forge own tokens, thus granting persistence for a longer time period and possibly access to other resources beyond the original scope. It was highlighted that refresh tokens held higher value to adversaries than access tokens, due to the limited lifetime of access tokens. The talk had two attack demonstrations, in which two adversaries utilised their skills to gain access to target environments and elevate their privileges. In the first demonstration access to the AD FS was used to access the token signing certificate, which was used to forge SAML tokens, thus allowing to impersonate any user in the tenant. In the second demonstration access to the Global Admin laptop was used to gain access to the Primary Refresh Token, which allowed to login to the environment as Global Admin from any machine, despite the environment having multifactor authentication and conditional access policies in use.
In the last section of the talk defensive measures were presented for the audience, starting with showing that service provider and identity provider logs could be used to detect malicious activity in the on-prem environment, hybrid cloud environment and cloud-only environment. It was emphasised that endpoints should be hardened to prevent the stealing of secrets and utilise zero trust to prevent the stealing of tokens, while the cloud environment should always verify tokens to avoid access to the resources by forged or stolen tokens. In addition, token protection should be used to tie the token to the actual user’s device and continuous access evaluation to notice property changes, such as network location, in the communication.
– Teemu
Infostealer – what a menace, man
On Saturday afternoon Shamil Alifov talked about information stealing malware – infostealers. The presentation discussed the data types infostealer malware target, the types of infostealer malwares there are, how the malware are distributed, and where the data is sold. Alifov also presented a small analysis he had conducted on freely available stolen data.
The focus of the presentation was on Malware-as-a-Service (MaaS) and monetisation of the stolen data through marketplaces. Infostealer services are advertised on for example Telegram, and spread through phishing emails, pirated software and fake updates, to name a few. What was interesting, but also quite natural when you think about it, that also MaaS services, as well as the marketplaces where the data can be bought from, offer support and other types of auxiliary services to help out customers. Isn’t it nice that everyone gets help when needed?
The stolen data are advertised by different actors, referred to as “logs aggregators”, in the “Cloud of logs”. Cloud of logs are basically Telegram channels which both sell the data and offer free sample files. These sample files work as proof of the validity of the data that is sold.
Alifov had utilised the free sample files to conduct his own analysis of the stolen data. He had downloaded in total about 4 TB of data from four different Telegram channels. For me, the main takeaway from the test was that after cleaning and deduplicating the data, the actual amount of unique data had decreased to 178 GB, which is quite an extensive decrease.
During the talk, Alifov pointed out, that infostealers and their findings can also be utilised for legitimate purposes, and work as a defensive tool. For examples, Alifov mentioned bug bounties which can result in security reports that provide companies with information on their stolen credentials. This information can then be utilised by companies to monitor the leaked credentials. Also researching infostealers, the data they collect, and the sellers can provide threat intel on threat actors.
– Miina
