Pillaging DVCS Repos for Fun and Profit
Adam Baldwin explores pillaging dvcs repos for fun and profit at DEF CON 19, examining dvcs-security and practical defenses.
Summary
Architecture and Background
Adam Baldwin - Pillaging DVCS Repos For Fun And Profit White Paper Here: Distributed Version Control Systems, like git are becoming an increasingly popular way to deploy web applications and web related resources. Our research shows these repositories commonly contain information very useful to an attacker.
Vulnerability Analysis
This talk, which was part of my small contribution to the Penetration Testing Execution Standard (PTES) will demonstrate how to identify these repositories and techniques to pillage just as much information as possible from them. Lastly there will be release of a toolkit to automate the the discussed techniques supporting git, hg and bzr repositories!
Exploitation and Demonstrations
Adam Baldwin has over 10+ years of mostly self taught computer security experience and currently is the co-founder and Chief Pwning Officer at nGenuity focusing on security of web applications. He at one time possessed a GCIA and if his CPE's are up to date should still have a CISSP.
Remediation and Defensive Strategies
Prior to starting nGenuity Adam worked for Symantec. Adam is a minor contributor to the W3AF project and has previously spoke at Toorcamp, Djangcon 2010, and JSconf 2011.
Related talks
Main Stage·42 min
Jason Lang
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.
Main Stage·43 min
Quentin Roland · Wilfried Bécard
Demonstrates how red teams can weaponize Active Directory Group Policy Objects (GPOs) into a stealthy, native command-and-control infrastructure.