Finding security vulnerabilities with modern fuzzing techniques

I presented a talk on the topic of fuzzing at RuhrSec 2018. It describes the basics of fuzzing with AFL and WinAFL.

You can find the Video here: Video

At minute 42:16 you can see a short demo of a fuzzer which I developed at SEC Consult. Since I quit my job at SEC Consult the fuzzer was unfortunately never released to the public.

Cyber Security Challenge Austria CTF Tips & Tricks

The Cyber Security Challenge Austria is a competition where students and interested people can solve challenges to compete with each other. It's a great possibility to learn something new and meet people with similar interests. In 2018 I wrote a short CTF (Capture-the-Flag) guide how to get started for beginners.

You can find it here: Cyber Security Challenge Austria CTF Tips & Tricks

The Art of Fuzzing Workshop & Demos

In 2017 and 2018 I presented workshops on the topic of Fuzzing.

You can find the slides here: Slides

I also recorded some demos before the workshop (this are not the demos from the workshop itself). You can find the demos here: Demos

Please note: The workshop also contains lots of demos which are available on the virtual machine. If you are interested in the virtual machine just drop me a message on twitter.

Hack the Hacker - Fuzzing Mimikatz on Windows with WinAFL & HeatMaps

Since I presented various fuzzing workshops in 2017 I wanted to find a nice example to demonstrate fuzzing with WinAFL if source code is available. So I needed a target where I have access to source code, which would be interesting to study for students and which still have simple bugs to find. That's how I came up with the idea to fuzz mimiaktz.

You can find the the original blogpost here: Link

Bypass application whitelisting with Nvidia's node.js

On my gaming PC I noticed something interesting - Nvidia installed a NodeJS server on my system. Since I did some application whitelisting research some time ago I used it to bypass application whitelisting. Please note: From a technical perspective I could not find a more critical vulnerability in it. However, from end-user perspective I think nobody wants to have a local NodeJS server running just because Nvidia programmers wanted to code in JavaScript. When I reported this to Nvidia they immediatly fixed it.

You can find the the original blogpost here: Link

Controlling Kerio Control - When your firewall turns against you

Kerio Control is a firewall solution for small businesses. In 2016 an ex-college (Raschin Tavakoli) told me he found some interesting behavior in it and we started to dig deeper into it on the weekend. We found all kind of vulnerabilities and ultimately a really cool exploit chain. It allows to get full code execution on the firewall over the internet via a memory corruption and a CSRF bypass if one of the end-users visits a malicious website.

You can find the the original blogpost here: Link

Bypassing McAfee Application Control (Application Whitelisting)

McAfee Application Control is a security solution which implements the protection mechanism "application whitelisting". It basically creates a whitelist of installed and allowed applications and prevents the execution of new (unwanted and possibly malicious) applications afterwards.

I researched bypass techniques already in 2013 for the Kiras project in Austria (smart meter security), but could publish my results just two years later.

My research decribes various ways to bypass McAfee Application Control and Microsoft AppLocker. Most of these techniques can also be used to bypass similar products like AppSense, Microsoft DeviceGuard and so on.

I must also mention that a lot more bypass techniques were found in the last years. Most of these techniques were especially found by Casey Smith (@subTee), Oddvar Moe (@Oddvarmoe) and Matt Graeber (@mattifestation). They did an excellent job! A good summary of all these techniques can be found here: LOLBAS

Slides of my talk

English recorded talk

German recorded talk