Biometric Hacking: Facial Authentication Systems
Gabriel Gonzalez, Director of Hardware Security, and Alejo Moles, Security Consultant, explore various techniques to bypass facial recognition algorithms in this IOActive Labs blog. The use of facial recognition systems has become pervasive and ubiquitous on mobile phones and making significant inroads in other sectors as way to authenticate end users. These technologies rely on models created from an image or facial scan, selecting specific features that will be checked in a live environment against the actual user or an attacker. The algorithms need be accurate enough to detect a…
How We Hacked Your Billion-dollar Company for Forty-two Bucks
Jamie Riden, IOActive Security Consultant/CREST-CHECK Lead, explores the weaknesses in outward-facing services most enterprises employ. Most organizations’ Internet perimeters are permeable. Weaknesses in outward-facing services are rarely independent of one another, and leveraging several together can often result in some sort of user-level access to internal systems. A lot of traffic goes in and out of a normal company’s Internet perimeter: email comes in and goes out, web traffic from customers or potential customers comes in, web traffic for internal users goes out, and lots of necessary services create traffic,…
Cracking the Snapcode
Daniel Moder, IOActive Security Consultant, explores the world of the ever-increasing forms of bar codes, specifically, cracking Snapcodes. Snapcode is a proprietary 2D barcode system that can trigger a variety of actions when scanned in the Snapchat app. Unlike some bar code systems, there is no public documentation about how the Snapcode system works. Daniel delves in to discover the inner workings of Snapcode to answer the following questions: What data do Snapcodes encode? How do Snapcodes encode data? What actions can be triggered when these codes are scanned?
The Risk of Cross-Domain Sharing with Google Cloud’s IAM Policies | Chris Cuevas and Erik Gomez, SADA
We all recognize the importance of the DRS Organization Policy within a GCP Org, now we’d like to discuss Cross-Domain Sharing, or XDS as we are calling it. Do you know where your organization’s identities are being used externally? If not, we want to share details on the risks and how SADA can help assess your GCP org.
Counterproliferation: Doing Our Part
IOActive’s mission is to make the world a safer and more secure place. In the past, we’ve worked to innovate in the responsible disclosure process.
Breaking Protocol (Buffers): Reverse Engineering gRPC Binaries
gRPC is an open-source RPC framework from Google which leverages automatic code generation to allow easy integration to a number of languages. Architecturally, it follows the standard seen in many other RPC frameworks: services are defined which determine the available RPCs. It uses HTTP version 2 as its transport, and supports plain HTTP as well as HTTPS for secure communication. Services and messages, which act as the structures passed to and returned by defined RPCs, are defined as protocol buffers. Protocol buffers are a common serialization solution, also designed by…
Cybersecurity Alert Fatigue: Why It Happens, Why It Sucks, and What We Can Do About It | Andrew Morris, GreyNoise
Alarm fatigue or alert fatigue occurs when one is exposed to a large number of frequent alarms (alerts) and consequently becomes desensitized to them. Desensitization can lead to longer response times or missing important alarms.
Trivial Vulnerabilities, Serious Risks
Introduction The digital transformation brought about by the social distancing and isolation caused by the global COVID-19 pandemic was both extremely rapid and unexpected. From shortening the distance to our loved ones to reengineering entire business models, we’re adopting and scaling new solutions that are as fast-evolving as they are complex. The full impact of the decisions and technological shifts we’ve made in such short a time will take us years to fully comprehend. Unfortunately, there’s a darker side to this rapid innovation and growth which is often performed to…
Watch Your Step: Research Into the Concrete Effects of Fault Injection on Processor State via Single-Step Debugging
Fault injection, also known as glitching, is a technique where some form of interference or invalid state is intentionally introduced into a system in order to alter the behavior of that system. In the context of embedded hardware and electronics generally, there are a number of forms this interference might take. Common methods for fault injection in electronics include: Clock glitching (errant clock edges are forced onto the input clock line of an IC) Voltage fault injection (applying voltages higher or lower than the expected voltage to IC power lines)…
A Practical Approach to Attacking IoT Embedded Designs (II)
In this second and final blog post on this topic, we cover some OTA vulnerabilities we identified in wireless communication protocols, primarily Zigbee and BLE. As in the previous post, the findings described herein are intended to illustrate the type of vulnerabilities a malicious actor could leverage to attack a specified target to achieve DoS, information leakage, or arbitrary code execution. These vulnerabilities affect numerous devices within the IoT ecosystem. IOActive worked with the semiconductor vendors to coordinate the disclosure of these security flaws, but it is worth mentioning that…