Главная
Study mode:
on
1
Intro
2
Supply chain
3
Why Treck TCP/IP?
4
Ripple20 Research
5
About CVE-2020-11901
6
DNS Primer: The Basics
7
DNS Primer: Record Types
8
Domain Names Encoding
9
DNS Message Compression
10
DNS Parsing Logic Type MX
11
DNS Label Length Calculation
12
Vulnerability #1: Read Out-Of-Bounds
13
Integer Overflow
14
Fixing the Read Out-Of-Bounds
15
Bad RDLENGTH
16
Artifact: Memory Leak
17
CVE-2020-11901: Summary
18
Target Device
19
Vulnerability Recap
20
Exploitation Technique
21
Overflow Target
22
CNAME Processing
23
Controlled Pointer Write
24
Linear Overflow
25
Heap Shaping
26
Pointer Write Limitations
27
Overwriting a Far Call
28
Payload Trigger
Description:
Explore a Black Hat conference talk detailing the discovery and exploitation of Ripple20, a series of critical vulnerabilities affecting millions of IoT devices across various sectors. Delve into the intricacies of supply chain security, DNS protocols, and exploitation techniques used to compromise devices from major vendors. Learn about the far-reaching impact of these vulnerabilities on industrial controllers, power grids, medical equipment, and more. Gain insights into the technical aspects of the research, including DNS parsing logic, integer overflow, memory leaks, and heap shaping. Understand the implications of these security flaws for the IoT ecosystem and the importance of addressing supply chain vulnerabilities in critical infrastructure.

Hacking the Supply Chain - The Ripple20 Vulnerabilities Haunt Tens of Millions of Critical Devices

Black Hat
Add to list
0:00 / 0:00