eXercise in Messaging and Presence Pwnage
Ava Latrope explores exercise in messaging and presence pwnage at DEF CON 17, examining mobile-security and practical defenses.
Summary
Architecture and Background
eXercise in Messaging and Presence Pwnage Ava Latrope Security Consultant, iSEC Partners eXtensible Messaging and Presence Protocol, or XMPP, is a is a set of specialized XML-based protocols that are an increasingly popular choice for a variety of middleware applications. It's a sprawling project implemented differently by many popular projects and services, and is used for purposes ranging from chat rooms and video conferencing to control channels for mobile devices.
Vulnerability Analysis
It combines a myriad of confusing buffet-style design options with all of the traditional weaknesses of XML security. XML parsing is a fragile art and many (if not most) implementations are vulnerable to DOS attacks, such as knocking the other users of a chatroom offline.
Exploitation and Demonstrations
I take a look at how those issues play out in IM clients and open source servers. Ava Latrope is a security consultant for iSEC Partners, with a focus on web application penetration testing.
Remediation and Defensive Strategies
Her areas of interest include source code auditing, embedded device security and network penetration testing. Prior to joining iSEC, Ava worked for several years creating test automation frameworks for web 2.0 companies in the real estate and media industries. Research interests include instant messaging implementation and protocols. For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·1 hr 4 min
Elinor Mills
Elinor Mills presents the l0pht testimony 20 years later and other things: 2018 is the 20th anniversary of the hacker think-tank L0pht Heavy Industries testimony before the US Senate Homeland Security & Governmental...
Main Stage·49 min
Nirenberg · Buchwald
Nirenberg and Buchwald presents reverse engineering hacking documentary series: We will present a sample scene and panel talk on our documentary series Reverse Engineering to the hacking community, which has been in...
Main Stage·20 min
Ming Chow
Ming Chow details abusing NoSQL Databases Ming Chow Lecturer, Tufts University Department of Computer Science The days of selecting from a few SQL database options for an application are over.