In Soviet Russia Smartcard Hacks You
Eric Sesterhenn presents in soviet russia smartcard hacks you: The classic spy movie hacking sequence: The spy inserts a magic smartcard provided by the agency technicians into the enemy's computer, ...the screen un...
Summary
Architecture and Background
The classic spy movie hacking sequence: The spy inserts a magic smartcard provided by the agency technicians into the enemy's computer, ...the screen unlocks... What we all laughed about is possible!
Vulnerability Analysis
Smartcards are secure and trustworthy. This is the idea smartcard driver developers have in mind when developing drivers and smartcard software. The work presented in this talk not only challenges, but crushes this assumption by attacking smartcard drivers using malicious smartcards.
Exploitation and Demonstrations
A fuzzing framework for *nix and Windows is presented along with some interesting bugs found by auditing and fuzzing smartcard drivers and middleware. Among them classic stack and heap buffer overflows, double frees, but also a replay attack against smartcard authentication.
Remediation and Defensive Strategies
Since smartcards are used in the authentication process, a lot of vulnerabilities can be triggered by an unauthenticated user, in code running with high privileges. During the authors research, bugs were discovered in OpenSC (EPass, PIV, OpenPGP, CAC, Cryptoflex,...), YubiKey drivers, pam_p11, pam_pkc11, Apple smartcardservices...
Related talks
Main Stage·38 min
Michal Grygarek · Martin Petr
Physical and electrical analysis techniques to read protected cryptographic keys and debug passwords stored in hardware eFuse memory.
Main Stage·45 min
Matteo Bertocchi · Noah Campbell · Skylar Gibson · Sasha Harris
Four high school researchers reverse engineer Boston's CharlieCard RFID fare system, uncovering cryptographic flaws and building a portable fare machine.
Main Stage·40 min
Tom Pohl
Tom Pohl uncovers hardcoded private keys, certificates, and static AES encryption keys across Netgear, Fortinet, and Dell firmware, enabling universal vCenter compromise.