Presented at
May Contain Hackers (MCH2022),
July 25, 2022, 10 p.m.
(50 minutes).
After finding a 0-day in Canon hardware, we went on a hacking trip around the world.
We exploited the hardware in 20 Universities worldwide
We contacted Canon.
Talks broke down.
Our site got taken down.
We learned lessons we didn't expect.
We would like to describe the pleasure we had, the problems we faced, the moral dilemma's, and the solutions we found.
Also we will include lots of screenshots and perhaps a live demo ?
It was a covid-lockdown period, oversight on homework and education of my son was my responsibility now, so i started with the basics:
...we are not the Protocol Police" ;)
https://datatracker.ietf.org/doc/html/rfc8962#section-3.1 "
We took a hacking "fieldtrip" around the world to all major Universities and some gov facilities.
To our surprise we got in,
...and we got root. ... *Evil Grin*
Here's what we learned.
We exploited the hardware in 20 Universities, and published CVE-2021-38154 on https:/protocolpolice.org [offline now]
See https://web.archive.org/web/20210829053914/https://protocolpolice.nl/CVE-2021-38154_Protocol_Police_Catwalk_Alert ( since takedown by Dutch gov. )
Our site got taken down by Dutch government, for some other fun we'll get to. We have learned lessons we didn't expect.
We would like to describe the problems we faced, the moral dilemma's, and the solutions we found.
The gaping hole that Dutch Justice will have to gap, to get to a point where they can start to understand what an RFC means, and how it will overrule Dutch Law any day, ... all year long ;)
( Been there, done that, .... made prosecution eat their paperwork. )
The Dutch gov has got a long road ahead on understanding the internet, where it will have to succeed in 1 of 2 options fast,
...because the Justice Departement is losing the battle:
1. - Make the whole world respect and acknowledge Dutch Law as a worldwide standard.
2. - Adapt it's attitude and start RTFM.
...That's an easy 50% chance, ..right?
...place your bets ;)
Also we will include lots of screenshots and perhaps a live demo ?
1 Discovery of the Exploit: we were fooling around on Shodan and noticed how the server had multiple ports to the same portal.
2 We tried some big Universities and to our surprise we could get in and edit anything.
3 We did some quick research on how to write an advisory, and where to publish it.
4 We contacted Canon and hoped to work with them, ... not happening.
5 We reserved a CVE , and started latteral movement.
6 We tried to warn sys-admins in Universities worldwide.
7 Moving latteral... "remote cascading"
9 We exploited the * out of a lot of stuff, not fully realising the potential harm.
10 We looked at informing NCSC, here's why we could not talk to them:
11 We started emailing Certs of other countries, ... they DID respond and were glad with the heads-up before going live with the exploit
12 Nucleair data,... where to drop that ?
13 The takedown, ...Don't Talk To The Police!!!
14 Lessons learned. ( we never even got the f*ckin t-shirt )
15 Questions?
Presenters:
-
Rob Coleman
Hacker, dad, been there and back again, and did it all.
Now i am wise and can solve world hunger, if only they would listen to me...
Hack the planet, free the animals, feed the people, make love not war.
Sell weapons and abolisch army's, make plows not guns and we all have a ball ;)
Links:
Similar Presentations: