talk – Patrick Ventuzelo

2019-06-212022-07-16

Talk @ FIRST 2019: Analyze & Detect WebAssembly Cryptominer

2019/06/17 @ FIRST conference 2019

More than one year after the “official” release, it’s heavily used in the wild to perform Cryptojacking (illegitimate in-browser mining) using online services, like Coinhive, that provides simple Javascript API and uses WebAssembly module to make mining even more efficient and profitable than using pure JavaScript.

First, I will introduce WebAssembly concepts and how it is currently used. Secondly, I will analyze some Cryptominer module using static and dynamic analysis (reversing, decompilation, DBI, …) applied on WebAssembly. Finally, I will expose some techniques to detect and mitigate them.

Introduction
WebAssembly Basics
Module dissection
Program analysis
WebAssembly Cryptominers
Analysis (Coinhive & Cryptoloot)
Cryptominers detection
Conclusion

link / slides

2019-03-082019-12-11

Talk @ EthCC 2019: Let’s dig inside Ethereum Smart Contracts compiled to WebAssembly

Ethereum ETHCC Paris reverse webassembly patrick ventuzelo analysis smart contract Parity Kovan mainnet testnet conference talk

2019/02/18 @ EthCC 2019

At Devcon4, Vitalik annonced that WebAssembly (wasm) will be part of Ethereum 2.0 (Serenity). It’s already possible to compile smart contracts to wasm modules and run them in the Kovan network.

Using WebAssembly smart contract doesn’t mean using secure smart contract.

In this talk, I will explain what’s inside a WebAssembly module and illustrate how to analyze wasm Ethereum smart contracts to find vulnerabilities and unoptimization.

Introduction
WebAssembly basics
Program analysis
Parity Helloworld
WASM module Vulnerabilities
Conclusion

link / slides / video

2018-11-062023-11-08

Talk @ Devcon 4 – 2018: Reversing Ethereum Smart Contracts to find out what’s behind EVM bytecode

devcon iv ethereum patrick ventuzelo reverse evm octopus cfg analysis smart contract vulnerability research ocptimization talk

2018/11/01 @ Devcon iv.

Reverse engineering is a common technique used by security researcher to understand and analyze the behavior of closed-source binaries.

If you apply this to Ethereum smart contract (and more specifically on the EVM bytecode), thats allow you to analyze and verify the result of your Solidity source code compilation.

From a developer point of view, it can save you a lot of time and money if you succeed to detect flaws and missing bytecode optimization.

Also, providing the Solidity source code it’s not mandatory during the smart contract creation, that’s why being able to directly reverse the EVM bytecode make even more sense if you want to understand the behavior of external smart contracts.

slides / video

2018-10-052021-01-21

Talk @ ToorCon XX – 2018: Reversing Ethereum Smart Contracts

2018/09/15 @ ToorCon XX – 2018

Ethereum is the reference of smart contract platform due to the possibility to create decentralized applications (Dapps) by writing smart contracts. The Solidity source code of those smart contracts are not always available and can contains flaws (reentrancy, integer overflow/underflow, bad randomness, backdoor, ….).

Some smart contract handle thousand of ETH and can’t be modified once pushed into the blockchain. More than 90% of them doesn’t provide the associated Solidity source code and that’s also why be able to reverse and analyze Ethereum smart contract (only with the EVM bytecode) make even more sense.

link / slides

2018-10-052023-02-15

Talk @ ToorCon XX – 2018: Dissection of WebAssembly module

2018/09/15 @ ToorCon XX – 2018

WebAssembly (WASM) is a new binary format currently developed and supported by all major browsers including Firefox, Chrome, WebKit /Safari and Microsoft Edge through the W3C. This new format have been designed to be “Efficient and fast“, “Debuggable“ and “Safe” that why it is often called as the “game changer for the web“. More than one year after the “official” release, it is not only used “for the web” by web browsers but also in some (huge) other projects like Blockchain Smart Contract platforms (EOS and Ethereum).

I will first introduce WebAssembly concepts and who currently used it in the wild. Secondly, I will show different WebAssembly VM available and explain the security measures implemented into it. Finally, I will show you, throw real life WASM modules, how to do static analysis, using techniques such as reversing, control flow and calls flow analysis, to understand deeper its behaviors. Along the talk, I will used multiple open source tools but mainly the one that I have developed and that is already available on Github (Octopus).

link / slides / video

2018-10-052023-02-15

Talk @ Recon MTL 2018: Reverse Engineering Of Blockchain Smart Contracts

recon montreal reverse ethereum blockchain smart contract neo eos webassembly patrick ventuzelo

2018/06/16 @ RECON Montreal 2018

Many platforms using blockchain technology have emerged in 2017 and take the top 10 position of the cryptocurrencies’s MarketCap. One of the main reasons behind is the possibility to create decentralized applications (dapps) by writing Smart Contracts.

During this presentation, we will analyze the implementation of smart contract mechanism (Virtual Machine, assembly language, instructions sets, …) used by those platforms. We will analyze the assembly languages and instructions sets used by the Virtual Machine of the major blockchain platforms.

We will see how to disassemble and reconstruct the CFG (Control Flow Graph) of those smart contracts and the tools actually available to perform a deeper security analysis.

This talk aims at covering the following platforms:

Ethereum (EVM bytecode)
Neo (AVM)
EOS (WASM – WebAssembly)

link / slides / video (not yet)

2018-10-052019-12-11

Talk @ SSTIC 2017: Subscribers remote geolocation and tracking using 4G VoLTE enabled Android phone

sstic 2017 rennes volte p1security geolocation tracking 4G IMS patrick ventuzelo

2017/06/09 @ SSTIC 2017

VoLTE (Voice over LTE) is a technology implemented by many operators over the world. Unlike previous 2G/3G technologies, VoLTE offers the possibility to use the end-to-end IP network to handle voice communications. This technology uses VoIP (Voice over IP) standards over IMS (IP Multimedia Subsystem) network.

In this paper, we will first introduce the basics of VoLTE technology. We will then, demonstrate how to use an Android phone, to communicate with VoLTE networks and what normal VoLTE communications look like. Finally, we will describe different issues and implementations problems. We will present vulnerabilities, both passive and active, and attacks that can be done using VoLTE Android smartphones to attack subscribers and operators infrastructure.

Some of these vulnerabilities are new and not previously disclosed: they may allow an attacker to silently retrieve private pieces of information on targeted subscribers, such as their geolocation

link / paper

2018-10-052023-11-08