14th and 15th February, 2025
Kaapelitehdas, Helsinki Finland
Flipping Bits: Your Credentials Are Certainly Mine
joohoi
STÖK
Did you know that if you change a single bit from 1 to 0 (or vice versa) in the first 'g' of the domain name google.com (which is 01100111 in binary) you will end up with variety of valid "bitflip" domains like coogle.com, oogle.com, & woogle.com
So what happens if you generate and register a bunch of cheap bitfliped versions of popular cloud / Saas provider domains, point them to your VPS, log all incoming requests & then forget about the whole thing for two years?
Well you will in fact receive a stiff bill, generate huge log files and eventually run out of disk space. But on the upside, you will also have collected a treasure trove of legit credentials & interesting stuff like valid OAuth refresh tokens, JWT tokens, bearers, cookies, emails, meeting invites with passwords & truckloads of internet scanner noise.
In this session we will revisit bitflip research from the last decade and weponize it. Showcase 'Certainly' a pioneering offensive / defensive tool that employs Wildcard DNS matching & on-the-fly generated SSL certificates and custom payloads for incoming requests across various protocols. All with the intention to downgrade security, harvest credentials, capture emails and replacing dependencies with custom "malicious" payloads
So what happens if you generate and register a bunch of cheap bitfliped versions of popular cloud / Saas provider domains, point them to your VPS, log all incoming requests & then forget about the whole thing for two years?
Well you will in fact receive a stiff bill, generate huge log files and eventually run out of disk space. But on the upside, you will also have collected a treasure trove of legit credentials & interesting stuff like valid OAuth refresh tokens, JWT tokens, bearers, cookies, emails, meeting invites with passwords & truckloads of internet scanner noise.
In this session we will revisit bitflip research from the last decade and weponize it. Showcase 'Certainly' a pioneering offensive / defensive tool that employs Wildcard DNS matching & on-the-fly generated SSL certificates and custom payloads for incoming requests across various protocols. All with the intention to downgrade security, harvest credentials, capture emails and replacing dependencies with custom "malicious" payloads
joohoi
Joona is a seasoned hacker with over two decades of experience in the fields of software development and information security. He is recognized for his significant contributions to the open-source community, notably his work on acme-dns, ffuf, and certbot.
During days he works to secure hundreds of applications as the Head of Security Testing at Visma
STÖK
Hacker | Creative | Security Researcher | Public Speaker
STÖK is passionate about learning new things and sharing his curiosity with the world. Over the past three decades, he has professionally hacked everything from computers, web technology, and marketing strategies to consultancy, content creation, digital advertising, sustainable fashion, communication, and even the human mind.
His unique ability to ask the right questions and break down technically complex subjects in an entertaining way, combined with his passion for novel security research, attention to detail, curiosity, design and “Good Vibes Only” mentality, has inspired millions of people around the world.
His fast-paced creative presentation style and innovative security research have placed him on the main stages of multiple international security conferences, including Blackhat USA, DEF CON, Securityfest, Ekoparty, Disobey, SEC-T, and many more.
