Bugged Files: Is Your Doc Telling on You?
Daniel Crowley and Damon Smith reveal techniques for embedding covert web bugs and beacons within common document formats to leak recipient IP and environment data.
Summary
Architecture and Background
Certain file formats, like Microsoft Word and PDF, are known to have features that allow for outbound requests to be made when the file opens. Other file formats allow for similar interactions but are not well-known for allowing such functionality. In this talk, we explore various file formats and their ability to make outbound requests, as well as what that means from a security and privacy perspective. Most interestingly, these techniques are not built on mistakes, but intentional design decisions, meaning that they will not be fixed as bugs.
Vulnerability Analysis
From data loss prevention to de-anonymization to request forgery to NTLM credential capture, this presentation will explore what it means to have files that communicate to various endpoints when opened. Daniel (aka "unicornFurnace") is a Security Consultant for NCC Group. Daniel denies all allegations regarding unicorn smuggling and questions your character for even suggesting it. Daniel has developed configurable testbeds such as SQLol and XMLmao for training and research regarding specific vulnerabilities.
Exploitation and Demonstrations
Daniel enjoys climbing large rocks. Daniel has been working in the information security industry since 2004 and is a frequent speaker at conferences including Black Hat, DEF CON, Shmoocon, and SOURCE. Daniel does his own charcuterie. Daniel also holds the title of Baron in the micronation of Sealand.
Remediation and Defensive Strategies
Damon Smith is an Associate Security Engineer with NCC Group, an information security firm specializing in application, network, and mobile security. Damon specializes in web application assessments, embedded device/point of sale assessments, network penetration testing, and mobile testing. Damon graduated with a BS is Computer Science from the University of Texas, with a focus on Information Security. He has experience working as an IT consultant in the legal and retail industries and further as a security consultant focusing on application assessments.
Related talks
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.
Main Stage·19 min
Willa Cassandra Riggins · abyssknight
Willa Cassandra Riggins and abyssknight demonstrate unconventional data exfiltration methods that bypass strict enterprise egress controls using novel covert channels.
Main Stage·38 min
Etienne Martineau
Etienne Martineau details constructing high-throughput covert communication channels across virtualized x86 cores using CPU cache timing analysis.