Pass the SALT Archives: Recent Episodes
Jérémy Mousset
A talk presenting a way to bypass the “secure admin” feature of Glassfish to access the administration panel and deploy your own webshell. Jérémy Mousset Jérémy is a pentester and a Ron addict. He’s working at Vente-privee.com but this subject comes from his previous life of penetration tester in ...
What is one of the cornerstones of the Internet? Right! Being able to access all kinds of information, without censorship. In some countries this is no longer possible, and this is why technologies such as Tor and Shadowsocks are needed. While the main feature of Tor is the onion routing and the ...
This talk is about using the possibilities given by open hardware during penetration testing. Indeed, open hardware offers new tools for hardware and software penetration testing. The presentation will focus on software hacking. After a brief introduction of my favorite toys and a small review of ...
The concept of “hacking harnesses” was introduced by thegrugq at HITB Kuala Lumpur 2007 (pdf). Ever since, the subject has received virtually no attention and no such tool has been released publicly. Worse, the code that had been made available at the time is no longer online and was lost by its ...
After working on IoT security testing for a few years, we realized that there is a lot of time spent on learning and setting up different tools including hardware, radio and software. As the IoT technology is new there is no standard software to test most of the components and the tools available ...
A year ago, I embarked on the funky journey to gain insights into IoT security. I am particularly interested in medical devices, that is an item that’s connected to the Internet AND can gather some sort of health data. I started off with connected sex toys—it’s fun to tear them down, then tell ...
This presentation will share to the audience the status of IOT attacks from a worldwide distributed honeypot point of view. What are the different protocols, their exposure to the internet and how they are being actively exploited (Modbus, IPMI, S7, Bacnet, Telnet, SNMP etc.)? We have created a Gas ...
At Clever Cloud, we designed our hosting platform around the principles of immutable infrastructure, to allow easier application version management and rollout. But these principles also bring great benefits for the system’s security, by shortening persistence time, reducing the capacity to pivot, ...
Performance is important in many programs: web servers, network applications, intrusion detection systems, etc. In these programs, C is a usual choice as the programming language: it is close to the hardware, and very fast. However, it is very hard to make the program secure, and this results in ...
In this talk we explain the constraints and choices that led to the design of Landlock, a new Linux Security Module (LSM) proposal designed to let unprivileged users enforce their own security policy. Landlock has multiple new properties that can complete those of the current major LSMs (e.g. ...
Ever wanted to do forensics and feel good about it? This talk will introduce you to a suite of open-source tools for all things digital forensics and incident response. You will see how Greendale (a fictitious but very famous university) used this set of tools to articulate an effective response to ...
Designing a successful standard for threat intel sharing is a daunting task, with a host of possible pitfalls. This talk aims to describe the journey, challenges and mistakes the MISP Project made while designing the MISP standard as we know it today. There are several paths that can lead to a ...
Authentication is a major component of security, but is often implemented as a password-based solution even though stronger and more secure alternatives exist. This talk will explain the risks associated with password-based authentication, describe the advantages of two-factor authentication, and ...
Protocol and data format specifications can be ambiguous, insecure or have other problems. Programmers and users bear the brunt of these issues. Using JOSE as a case study, I’ll discuss mistakes for standards authors to avoid, and demonstrate programming techniques for mitigating some kinds of ...
In LemonLDAP::NG 2.0, the second factor authentication is now a built-in feature and allows to rely on FIDO Alliance, TOTP, Yubikey, or any third party device through script call. I will first present how authentication works in LL::NG and how the 2FA was integrated as core functionality. Clément ...
We will present how to use python to make machine learning. We take examples of security data like malware and we explain how to transform data to use algorithms of machine learning. We detail the different algorithms and the different librairies Scikit-learn and Tensorflow. The algorithms help to ...
We are the creators of the VultureProject, an Open Source HTTP reverse-proxy that ensures the security of web applications. Built on top of open-source technologies such as Apache, FreeBSD, HA-Proxy and MongoDB, Vulture’s basic features are: network firewall, TCP and HTTP proxy balancing, user ...
Suhosin is a great php module, but unfortunately, it’s getting old, new ways have been found to compromise php applications, and some aren’t working anymore; and it doesn’t play well with the shiny new php7. As a secure web-hosting company, we needed a reliable and future-proof solution to address ...
We have to admit to ourselves: we do not really like to turn on automatic updates. We do not like relinquishing control. Even if we do not really know what the announced update contains, we like to have one look at it before we hit the “update” button. Right? Often, still, we do not even have an ...
by Philippe Teuwen https://www.thingiverse.com/thing:2968762 https://www.thingiverse.com/thing:2928131 https://www.thingiverse.com/thing:2988836 https://www.thingiverse.com/thing:2985331
When you are facing a security incident, your investigations will depend on the data that you can analyze. If logs are often the first source of evidence, sometimes, it could be interesting to have access to a full packet capture to “dive deeper” in the traffic generated from/to the compromised ...
Pablo Neira Ayuso Among other things, Pablo has been the Netfilter lead for the last ten years.
extended Berkeley Packet Filter (eBPF) and eXtreme Data Path (XDP) technologies are gaining in popularity in the tracing and performance community in Linux for eBPF and among the networking people for XDP. After an introduction to these technologies, this talk proposes to get a look to the usage of ...
WARNING: the introduction part is missing from the recording, we are sorry for that. BPF programs are widely known for packet filtering in libpcap (the underlying capture library used by tcpdump and wireshark). One can also use them for performance analysis (perf uses BPF programs), but also for ...
Radare2 is a free and open-source reverse engineering framework, which is becoming more and more popular. One of its main criticisms is that it is only usable within a terminal (CLI), and that the commands are not intuitive, making the learning curve steep. The Cutter project was created to provide ...
The Spectre attack has had massive coverage, and I assume (nearly) everybody at Pass The Salt will have heard of it. This talk is not yet another explanation of Spectre, nor generic advice of what to do. Rather, this talk is oriented on implementation issues and answering 2 simple questions (which ...
When we need to deeply analyze a binary application (e.g. for malware dissection, vulnerability research, code optimization), static code analysis is what we use most of the time. However, static analysis of machine-code is usually not an easy task. It is actually a tough one in case of malware ...
WARNING: the introduction part is missing from the recording, we are sorry for that. Many instrumentation techniques are based on modifying code or system environment of the target. It can be suitable for scenarios but it could not work under certain circumstance (integrity checking, non-rooted ...
In this talk we will present Frida and Radare as separate and combined tools. Have you ever wanted to enhance your static analysis with live telemetry from a running instance of the software that you’re analyzing? Did you ever want a more visual interface for Frida to type commands instead of ...
This talk will presents the Debian security team: the people, the roles, the workflows. It will also detail the handling of vulnerabilities, both public and private/embargoed ones. Yves-Alexis Perez Yves-Alexis is a Debian developer, member of the security team. He works at ANSSI as head of the ...