Doorways are portals to other places. Many doors lead to the mundane, but others-particularly those contained in software-can lead to very special places indeed. Today's trio of Black Hat Briefings aim to give attendees a new set of keys that can open a variety of doors, both physical and otherwise.
Card-based building access systems have become ubiquitous, granting trusted visitors access to everything from tiny branch offices to huge corporate headquarters. Most people barely even notice-but Brad Antoniewicz does. In Using D-Space to Open Doors, Antoniewicz will detail just how these entry systems work, and more importantly, how to hack them. Despite being rarely targeted, all the system's components are vulnerable to attack, which Antoniewicz will prove with attack demos on all pieces (RFID tags, controllers, backend systems) of a popular deployment.
In PowerShell for Penetration Tests the focus moves from physical doorways to virtual ones. Once they own a box, hackers often turn to "third-party" code-anything that'll evade anti-virus and the like-for post-exploitation. Nikhil Mittal has a better plan: run the show with PowerShell, the Windows shell and scripting language. Mittal's workshop will teach you how to turn PowerShell into an offensive security tool. You'll see how PowerShell can be used for backdoors, keyloggers, dumping password hashes, getting credentials in plain, and much more. Power, indeed.
Then, in the very last programming slot of the conference, Jacob Williams' DropSmack: How Cloud Synchronization Services Render Your Corporate Firewall Worthless will demonstrate how cloud-based services, and Dropbox in specific, can throw doors wide open in otherwise sound IT security environments. Williams will show how services like Dropbox can serve as a vector for delivering malware to an internal network and how specially developed malware can use them as a C2 channel. He'll then demonstrate (and release) functioning malware that uses Dropbox to exfiltrate network data en masse. Is synchronization software appropriate for all corporate environments? Come join the conversation.
Black Hat Europe 2013 will take place March 12-15 at the Grand Hotel Krasnapolsky in Amsterdam. You won't need to hack the doors, assuming you've registered ahead of time. If you're into social media, come say hi on Twitter and Facebook.