Black Hat 2009: Parking meter hacking

>>>> Black Hat 2009: Parking meter hacking

via Hack a Day by Zach Banks on 7/30/09

For day two of Black Hat, we sat in on on [Joe Grand], [Jacob Appelbaum], and [Chris Tarnovsky]'s study of the electronic parking meter industry. They decided to study parking meters because they are available everywhere, but rarely considered from a security perspective.

They focused on the San Francisco's MTA implementation of electronic smart card meters. To start they purchased several meters on eBay just to see the different styles. SF MTA lets you purchase disposable payment cards with values of $20 or $50. They decided to sniff the interaction between the meter and the smartcard using a shim. With that first capture they were able to easily replay the transaction. This didn't require a smartcard reader, just an oscilloscope. They then took the attack a little further.

[Joe] built a smartcard emulator using a PIC16F648A. They used it to capture multiple transactions and then decoded the interactions by hand. Luckily, the card was using the IEC 7816 standard so they had some insight into the protocol. They found that the card has a stored maximum value and only writes how many times the value has been decremented. As a proof of concept, they change the maximum value, which you can see on the meter above. They could also have just changed the acknowledgement so that the card never writes any deductions.

The PIC16F648A was a good choice because it's available in a smart card format called a 'silver card'. You can find the emulator code and slides from the talk on [Joe]'s site about the project.

Breaking SSL with NULL Character

Another interesting post about what's happening at Las Vegas BlackHat event now, SSL.

Moxie Marlinspike and Dan Kaminsky had independently found a problem in most implementations that enables an attacker to create certificates that appear valid for any web site. By cleverly embedding NULL characters to the certificate name field, a browser will incorrectly match a malicious certificate to a valid web site.

Early this year, we see how sslstrip hijacking SSL at BlackHat DC. This time, both the experts make the attack even more effective. See here:

You (evil admin) apply for a certificate. The certificate authority (CA) looks at the common name (CN) on the form and contacts the domain owner. The CA ignores the subdomain.

The trick is to drop in a [NULL] character in the subdomain, such as www.paypal.com[NULL].eviladm.org, the CA will contact the owner of eviladm.org and issue the cert.

When clients use browser to verify the cert, the null character causes them to think the certficate is valid for www.paypal.com because they stop at the null character. Even if the client examines the cert in their browser, it will show www.paypal.com. wildcards work as well. you could get a certificate for *[NULL].eviladm.org and appear as any site you want.

Moxie has released his new code soon, to be part of sslsniff 0.6.

Bootkit Bypasses Hard Disk Encryption

Bootkit = Bootable + Rootkit

This year, at BlackHat security conference, an Austrian IT security specialist Peter Kleissner presented an open development framework for creating rookits that activate early on in the boot process using MBR, aka bootkit.

This bootkit combines a rootkit with the ability to modify a PC's Master Boot Record (MRB), enabling the malware to be activated even before the operating system is started. The bootkit is called Stoned, which is capable of bypassing the TrueCrypt partition and system encryption.

You can access the BH USA 2009 media archives to get a copy of the slides and paper.

BIND 9 Dynamic Update DoS

This time, ISC BIND 9 contains a vulnerability that may allow a remote, unauthenticated attacker to create a DoS attack. Both POC Exploit and patch are available now. Here's the summary:

BIND Dynamic Update DoS

CVE: CVE-2009-0696

CERT: VU#725188

Posting date: 2009-07-28

Program Impacted: BIND

Versions affected: BIND 9 (all versions)

Severity: High

Exploitable: remotely

Summary: BIND denial of service (server crash) caused by receipt of a specific remote dynamic update message.

McAfee did a good job on summarizing how the attack works. You can follow it here if you are interested in the detail.

References:

• BIND Dynamic Update DoS
• ISC BIND 9 vulnerable to denial of service via dynamic update request

POC exploit is available at:

• Milw0rm
• SecurityFocus

Update: I found that there is a workaround that can be applied if case patch isn't available from vendor. Try this on your own risk.

iptables -A INPUT -p udp --dport 53 -j DROP -m u32 --u32 '30>>27&0xF=5'

“make it so that security is not the security team’s problem”

I have not been able to make it for the BlackHat event this year at Las Vegas. I wish I was there to listen to this excellent talk by the keynote speaker, Douglas Merrill.

Read more on Infosecurity Magazine news.