Silver bulletvulnerabilities andbackdoor Hunting 30Kvendors using tiny licenseVladimir Dashchenko.
Sergey TemnikovKaspersky Lab The story What are those tokens Strange behavior.
Reaction Conclusion The beginning hasplms exe everywhere USB tokens.
The beginning Gemalto License tokens behaviorUsed for licensingNeeded every time when software in useSpoiler Gathers info about other licenses in.
Gemalto License tokens Worth of it In 2011 SafeNet Setinel owned by Gemalto in 2014 accounted for more than40 percent market share by revenue in North America and more than 60 percent in Europe c Frost and Sullivan Gemalto Euronext NL0000400653 GTO is the global leader in digital security with 2016.
annual revenues of 3 1 billion and customers in over 180 countries We bring trust to anincreasingly connected world c GemaltoApproximately 30 40K Vendors using such solution Gemalto License tokens Research Gemalto License tokens in a nutshell.
Gemalto sHardware SoftwareUSB token itself Driver Service Binaries.
Other stuff Gemalto License tokens behaviorDownloads Opens portPlug in USB Installationdriver 1947.
PC with internetOpens 1947 Adds toManual driverInstallation port firewallInstallation of Adds to.
Main software Main the driver 3rd Opens 1947 firewallpackage Installation party port whitelist Research ProtocolsHTTP Binary GET First 4 bytes .
POST binary size Research HTTP WebAvailable on 0 0 0 0403 by default from outsideBut there s a trick later on the slides .
Research hasplms exeVMProtect or alike packedGood botnetNo common security measures Research Shady features.
Undocumented API features and strange behavior First plug in USB token PC is locked and password protected if there s internet access automatically downloads driver installs opens 1947 TCP UDP portIf there s no internet access manual installation of the driver automaticallydownloads driver installs opens 1947 TCP UDP port port added to Windows Firewall.
white listThere s a hidden API function allowing to turn on turn off admin s web interface allows tochange configs of the Gemalto s SafeNet Sentinel Panel available on localhost by defaultUsing same hidden API it is possible to change configuration and set up malicious proxy server for package updates.
After setting a new malicious proxy it is possible using a strange build in logic to get aNTLM hash of a user who runs the hasplms exe SPOILER SYSTEM Research Total resultsCVE 2017 11496 Remote Code ExecutionCVE 2017 11497 Remote Code Execution.
CVE 2017 11498 Denial of ServiceCVE 2017 12818 Denial of ServiceCVE 2017 12819 NTLM hash capturingCVE 2017 12820 Denial of ServiceCVE 2017 12821 Remote Code Execution.
CVE 2017 12822 Remote manipulations with configuration filesRCE DEMO TIME Gemalto s reaction2016 05 12 Vulnerabilities reported2016 12 12 Reminder to vendor to provide feedback.
2017 03 01 First feedback from vendor2017 16 06 Vendor released private advisory2017 30 06 Vendor notified Kaspersky Lab ICS CERT2017 26 06 Vulnerabilities reported2017 26 06 First feedback from vendor.
2017 21 07 Vendor released security update2017 22 08 Vendor notified Kaspersky Lab ICS CERT Gemalto s reactionGemalto claims they notified all of their customers NotWe ve contacted several HUGE vendors They didn t get anything from Gemalto.
It kinda sucks you know Reaction time Q A TIME Sergey Temnikov Kaspersky comVladimir Dashchenko Kaspersky ... .
Gemalto License tokens in a nutshell . Gemalto’s USB License tokens. Hardware. Software. USB token itself. Driver. Web. Service. Binaries. Other stuff. Gemalto License tokens behavior. Plug-in USB . PC with internet access. Downloads driver. Installation. Opens port 1947. Adds to firewall whitelist . Manual driver download. Installation ...

• Framingham state university
• The argumentative essay dearborn public schools
• Blue border simulkade
• Sexual assault dating violence and stalking an
• Train the trainer professional development for all
• Operating leverage dan financial leverage
• Causes of the civil war henry county public schools
• Literary criticism pdsd org
• Rationa revu
• Direct behavioral observation