1. Hacking Robots Before Skynet (Cesar Cerrudo & Lucas Apa)Robots are gaining more and more privileged places within our society, first in the big factories and now increasingly in the public space or in a surgery room. This means that where there is software and hardware, there are potential vulnerabilities to exploit, which in the case of robots no longer serve only to manipulate a digital system, but can provide the attacker access to the robot arms to act on the physical world and, consequently, against humans. In this talk by Cesar Cerrudo and Lucas Apa, computer security researchers with a long history searching for vulnerabilities and investigating technologies, will bring us closer to the real world of the danger of robot hacking, showing what methodologies can be used, and what consequences they can bring to society , all in order to push for a future with safer robot designs in which this type of vulnerabilities can be prevented from being exploited.
2. Abusing GDI for ring0 exploit primitives: Evolution (por Nicolas Economou)Windows is the most popular operating system on the planet, making it the target of constant attacks, especially from Internet browsers. To work on this problem both Microsoft and the companies or organizations that develop browsers always add new features such as mitigations of exploits in Windows and sandboxed executions in Browsers. But despite these efforts and recent updates like the "creators update" (v1703) for Windows 10, vulnerabilities in GDI objects are still present. In this talk Nicolás Economous will tell us how despite the efforts of the companies to mitigate these attacks, the same problems that appear again and again, how to exploit this vulnerability despite the current patches, and what are the mitigation plans Microsoft's future
3. The Bicho: An Advanced Car Backdoor Maker (por Sheila Berta & Claudio Caracciolo)In 2016 Sheila Berta and Claudio Caracciolo told us how the CAN bus worked in cars and how it was possible to exploit it after an extensive investigation that they did. To prove it, they made a rudimentary backdoor of hardware that connected to a car allowed them to perform some actions by SMS. Now in their new talk invite us to listen to their new discoveries and see their new developments, this time the backdoor is named, The Bicho, and allows a wide range of applications. Have you ever imagined the possibility that your car is automatically attacked based on its GPS coordinates, its current speed or any other set of parameters? The Bicho promises to live up to all these questions.
4. Replay attack y DoS al sistema de alarma para vehículos (por Leandro Ferrari)The alarms of the cars are not without being investigated, and it is there where Leandro Ferrari put the eye, and brings us a presentation on how despite implementing certain levels of safety, the alarms for cars have some possible vectors of attack including taking less than 5 samples of the analog control signal. The conclusions will be demonstrated in this talk in conjunction with explanations about possible scenarios of attack in real life and its consequences, showing that the companies still have work to do in improving the security of this type of devices.
5. 802.11 Protocol Chaos (Andrés Blanco)
6. TOR Exit Nodes en la justicia Argentina (Iván Barrera Oro / Rodrigo Iglesias)
7. SeND IPv6 to Graphical Machine Learning (Nicolás Rivero Corvalán / Jorge Couchet / Eduardo Casanovas)
8. The Java soothsayer: A practical application for insecure randomness vulnerabilities. (Alejo Popovici)Every pentester knows that in his life there will come a labor in which he finds absolutely nothing, and will have to resort to the famous "grab the shovel" and enter the depths of "best practices" and "filler findings", for that it is always better to lose dignity than to deliver an empty report. As we contemplate the finitude of existence and the series of bad decisions that led us to this moment, we may encounter an "Insecure Randomness" and we stack it together with ClickJacking and old versions of TLS. But what would happen if with a basic knowledge of cryptography and mathematics, we could transform this cornucopia of guitarreadas to a critical one?
In this turbo talk of security researcher and pentester Alejo Popovici will take us in a tour-de-force on the pseudo random generator of Java and a specific implementation of apache.commons that will allow to obtain the seed and predict future results, with drastic consequences for the applications that use it.
This is all for now, and soon we will be leaving more synopsis of the talks that will be available at the Ekoparty Security Conference 2017.