Jonathan Brossard

Last updated
Jonathan Brossard
Jonathan Brossard Defcon.png
Jonathan Brossard at the Defcon Conference in Las Vegas in 2016
Nationality French
Known for Hardware backdoor, Watch Dogs
Scientific career
Fields Computer science
Institutions Conservatoire National des Arts et Metiers
Website endrazine.com

Jonathan Brossard also known under the username endrazine, is a French hacker, Engineer and Professor of computer science at the Conservatoire National des Arts et Metiers [1] . He is best known as a pioneer in firmware cybersecurity, having presented the first public example of a Hardware backdoor [2] . The MIT Technology Review called it "undetectable and uncurable" [3] . He has presented multiple times at conferences such as Defcon [4] and Blackhat [5] , as the Director of Security at Salesforce.

Contents

Security Research

Bitlocker Security

In 2008, Jonathan presented the first public vulnerability affecting full disk encryption software Microsoft Bitlocker. [6] at Defcon. His generic exploit also affected other full disk encryption software such as Truecrypt [7] , and BIOS firmware from Intel [8] [9]

Hardware Backdooring

In 2012, Jonathan presented a Proof of Concept BIOS and PCI firmware malware. [10] named Rakshasa [11] , the first known [12] example of a permanent Hardware backdoor at Defcon and Blackhat [2] [3] [13] . The attack consisted in the inclusion of a Bootkit in firmware [14] either from the BIOS or Network cards [15]

Microsoft Edge, Chrome and Windows 10

In 2015, along with the security team at Salesforce, he presented at Blackhat the first public attacks against Microsoft Edge. [16] and the Windows 10 operating system [17] , allowing credential theft over the internet. Researchers discovered that Google Chrome was vulnerable to the very same Server Message Block vulnerability [18] [19]

Witchcraft Compiler Collection

Jonathan is the main author of the Witchcraft Compiler Collection, a reverse engineering framework presented at major conferences including Defcon, Blackhat and USENIX. [20] . This framework allowing to transform an ELF binary into a shared library is available on Linux distrubutions such as Debian, Ubuntu or the Kali Linux distribution [21]

Other Notable Research

Jonathan served as a security expert for major media outlets, for instance in the XKeyscore program [22] [23] disclosed by Edward Snowden, mass surveillance programs [24] , when the NSA allegedly hacked French President Nicolas Sarkozy's emails [25] , or warning the industry about car hacking [26] [27] as early as 2012.

Hacking Culture

Watch Dogs I Video Game

In 2014 Jonathan was the main cybersecurity consultant to the Watch Dogs by Ubisoft, presenting the game to an international press audience in Chicago, with global coverage including Australia. [26] , Deutschland [28] , France [29] [30] or Spain [31]

Watch Dogs II Video Game

In 2016, Jonathan was also the main consultant of the second opus of the franchise Watch Dogs 2 and presented it to the international press. [32] [33]

Hakin9 bogus nmap article

In 2012, Jonathan, along with other top security researchers including Chris Valasek, Matt Suiche and Jon Oberheide submitted a bogus, computer generated article [34] on Nmap to the Hakin9 security magazine, as a way to protest against the constant spamming of top researchers by the magazine [35] . While the stunt was praised by hackers, the response of Hakin9, legally threatening fellow Nmap author Gordon Lyon was so terrible that it earned the Pwnie Awards for most epic fail in 2013.

Conference Organizer

Jonathan is the co-founder of international cybersecurity conferences Hackito Ergo Sum [36] [37] and NoSuchCon [38] [39] [29] . He also sits on the review boards of the Shakacon (Honolulu, USA) [40] and Nullcon (Goa, India) [41] conferences.

See also

Related Research Articles

<span class="mw-page-title-main">Computer security</span> Protection of computer systems from information disclosure, theft or damage

Computer security is the protection of computer software, systems and networks from threats that may result in unauthorized information disclosure, theft of hardware, software, or data, as well as from the disruption or misdirection of the services they provide.

A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed and often masks its existence or the existence of other software. The term rootkit is a compound of "root" and the word "kit". The term "rootkit" has negative connotations through its association with malware.

<span class="mw-page-title-main">RSA Security</span> American computer security company

RSA Security LLC, formerly RSA Security, Inc. and trade name RSA, is an American computer and network security company with a focus on encryption and encryption standards. RSA was named after the initials of its co-founders, Ron Rivest, Adi Shamir and Leonard Adleman, after whom the RSA public key cryptography algorithm was also named. Among its products is the SecurID authentication token. The BSAFE cryptography libraries were also initially owned by RSA. RSA is known for incorporating backdoors developed by the NSA in its products. It also organizes the annual RSA Conference, an information security conference.

A backdoor is a typically covert method of bypassing normal authentication or encryption in a computer, product, embedded device, or its embodiment. Backdoors are most often used for securing remote access to a computer, or obtaining access to plaintext in cryptosystems. From there it may be used to gain access to privileged information like passwords, corrupt or delete data on hard drives, or transfer information within autoschediastic networks.

<span class="mw-page-title-main">ESET</span> Slovak internet security company

ESET, s.r.o., is a software company specializing in cybersecurity. ESET's security products are made in Europe and provides security software in over 200 countries and territories worldwide. Its software is localized into more than 30 languages.

<span class="mw-page-title-main">Gordon Lyon</span> American network security expert (born 1977)

Gordon Lyon is an American network security expert, creator of Nmap and author of books, websites, and technical papers about network security. He is a founding member of the Honeynet Project and was Vice President of Computer Professionals for Social Responsibility.

In the context of free and open-source software, proprietary software only available as a binary executable is referred to as a blob or binary blob. The term usually refers to a device driver module loaded into the kernel of an open-source operating system, and is sometimes also applied to code running outside the kernel, such as system firmware images, microcode updates, or userland programs. The term blob was first used in database management systems to describe a collection of binary data stored as a single entity.

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

Trellix is a privately held cybersecurity company that was founded in 2022. It has been involved in the detection and prevention of major cybersecurity attacks. It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks.

<span class="mw-page-title-main">Kaspersky Lab</span> Russian multinational cybersecurity and anti-virus provider

Kaspersky Lab is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in the United Kingdom. It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky and Alexey De-Monderik. Kaspersky Lab develops and sells antivirus, internet security, password management, endpoint security, and other cybersecurity products and services.

<span class="mw-page-title-main">Computer security conference</span> Convention for individuals involved in computer security

A computer security conference is a convention for individuals involved in computer security. They generally serve as meeting places for system and network administrators, hackers, and computer security experts. Common activities at hacker conventions may include:

<span class="mw-page-title-main">Matt Suiche</span> French computer scientist (born 1988)

Matthieu Suiche, also known as Matt and under the username msuiche, is a French hacker and entrepreneur. He is widely known as the founder of MoonSols and co-founder of CloudVolumes, which was acquired by VMWare in 2014. In March 2014, Suiche was highlighted as one of the 100 key French developers in a report for French minister Fleur Pellerin.

<span class="mw-page-title-main">Intel Management Engine</span> Autonomous computer subsystem

The Intel Management Engine (ME), also known as the Intel Manageability Engine, is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards.

<span class="mw-page-title-main">Juice jacking</span> Mobile security risk

Juice jacking is a theoretical type of compromise of devices like smartphones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data. As of April 2023 there have been no credible reported cases of juice jacking outside of research efforts.

Lazarus Group is a hacker group made up of an unknown number of individuals, alleged to be run by the government of North Korea. While not much is known about the Lazarus Group, researchers have attributed many cyberattacks to them since 2010. Originally a criminal group, the group has now been designated as an advanced persistent threat due to intended nature, threat, and wide array of methods used when conducting an operation. Names given by cybersecurity organizations include Hidden Cobra and ZINC or Diamond Sleet. According to North Korean defector Kim Kuk-song, the unit is internally known in North Korea as 414 Liaison Office.

Hardware backdoors are backdoors in hardware, such as code inside hardware or firmware of computer chips. The backdoors may be directly implemented as hardware Trojans in the integrated circuit.

<span class="mw-page-title-main">Vault 7</span> CIA files on cyber war and surveillance

Vault 7 is a series of documents that WikiLeaks began to publish on 7 March 2017, detailing the activities and capabilities of the United States Central Intelligence Agency (CIA) to perform electronic surveillance and cyber warfare. The files, dating from 2013 to 2016, include details on the agency's software capabilities, such as the ability to compromise cars, smart TVs, web browsers including Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera, the operating systems of most smartphones including Apple's iOS and Google's Android, and computer operating systems including Microsoft Windows, macOS, and Linux. A CIA internal audit identified 91 malware tools out of more than 500 tools in use in 2016 being compromised by the release. The tools were developed by the Operations Support Branch of the CIA.

<span class="mw-page-title-main">WannaCry ransomware attack</span> 2017 worldwide ransomware cyberattack

The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. It was propagated by using EternalBlue, an exploit developed by the United States National Security Agency (NSA) for Windows systems. EternalBlue was stolen and leaked by a group called The Shadow Brokers a month prior to the attack. While Microsoft had released patches previously to close the exploit, much of WannaCry's spread was from organizations that had not applied these, or were using older Windows systems that were past their end of life. These patches were imperative to cyber security, but many organizations did not apply them, citing a need for 24/7 operation, the risk of formerly working applications breaking because of the changes, lack of personnel or time to install them, or other reasons.

<span class="mw-page-title-main">Ang Cui</span> American computer scientist

Ang Cui is an American cybersecurity researcher and entrepreneur. He is the founder and CEO of Red Balloon Security in New York City, a cybersecurity firm that develops new technologies to defend embedded systems against exploitation.

This is a list of cybersecurity information technology. Cybersecurity is security as it is applied to information technology. This includes all technology that stores, manipulates, or moves data, such as computers, data networks, and all devices connected to or included in networks, such as routers and switches. All information technology devices and facilities need to be secured against intrusion, unauthorized use, and vandalism. Additionally, the users of information technology should be protected from theft of assets, extortion, identity theft, loss of privacy and confidentiality of personal information, malicious mischief, damage to equipment, business process compromise, and the general activity of cybercriminals. The public should be protected against acts of cyberterrorism, such as the compromise or loss of the electric power grid.

References

  1. ↑ "Jonathan Brossard Academic Page". Conservatoire National des Arts et Metiers.
  2. 1 2 "Meet 'Rakshasa,' The Malware Infection Designed To Be Undetectable And Incurable". Forbes.
  3. 1 2 "A Computer Infection that Can Never Be Cured". MIT Technology Review.
  4. ↑ "Defcon 2016". Defcon Conference.
  5. ↑ "Black Hat USA 2015". Blackhat Conference.
  6. ↑ "BitLocker, Brossard's Pre-boot Authentication Research, and the BSI". Microsoft Security. Archived from the original on 2015-07-01. Retrieved 2024-08-14.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
  7. ↑ "Bypassing pre-boot authentiation passwords by instrumenting the BIOS keyboard buffer" (PDF). Defcon Conference.
  8. ↑ "Intel Keyboard Buffer Information Disclosure Vulnerability". Intel Security.
  9. ↑ Thirupathi, Devi (2013). "A Novel Method To Access BIOS Through Client Server Technology". International Journal of Computer Applications. 82 (2). Foundation of Computer Science (FCS), NY, USA: 15–19. Bibcode:2013IJCA...82b..15P. doi:10.5120/14087-1352.
  10. ↑ "Difficult for PC viruses to stay invisible indefinitely". Zdnet.
  11. ↑ "Black Hat: Researcher Demonstrates Hardware Backdoor". Dark Reading.
  12. ↑ Matrosov, Alex (May 2019). Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats. No Starch Press. p. 259. ISBN   978-1593277161.
  13. ↑ "Menace sur la sécurité des PC" (in French). Le Monde. 26 April 2012.
  14. ↑ "Persistent, undetectable malware presented at Black Hat 2012". The Verge. August 2012.
  15. ↑ "Researcher Creates Proof-of-concept Malware That Infects BIOS, Network Cards". PC World.
  16. ↑ "First Vulnerability Found in Microsoft Edge, Affects Other Software as Well". Softopedia.
  17. ↑ "New SMB Relay Attack Steals User Credentials Over Internet". Dark Reading.
  18. ↑ Maryanti, Sayed Achmady (2019-09-15). "Celah Keamanan Kredensial Windows Pada Google Chrome". Jurnal Sains Riset. 9 (3): 18–21. doi:10.47647/jsr.v9i3.204. ISSN   2088-0952.
  19. ↑ "Google Chrome WARNING - This terrifying new HACK leaves Windows PCs open to ATTACK too". Daily Express. 18 May 2017.
  20. ↑ Brossard, Jonathan (2024). Introduction to Procedural Debugging through Binary Libification. USENIX Association. p. 17. ISBN   978-1-939133-43-4.
  21. ↑ "The Witchcraft Compiler Collection Manual Page". Debian.
  22. ↑ "XKEYSCORE". The Intercept. July 2015.
  23. ↑ "NSA's hacking tool is apparently as easy to use as a Google search". Engadget. 2 July 2015.
  24. ↑ Naughton, John (12 October 2013). "US fears back-door routes into the net because it's building them too". The Guardian.
  25. ↑ "NSA: les Américains étaient-ils à l'origine de l'espionnage de l'Elysée en 2012?" (in French). L'Express. 20 November 2012.
  26. 1 2 "Whitehat Jonathan Brossard Warns Cars Can be Hacked on the Road". Sydney Morning Herald. 31 May 2014.
  27. ↑ James, Guy; Greenfield, Mat (9 March 2015). "Can driverless cars be made safe from hackers?". The Guardian.
  28. ↑ "Hier wird gehackt statt geballert" (in German). Focus Deutschland.
  29. 1 2 "" J'étais pas bon en foot, je me suis dit : "Tiens, je vais faire du hacking" "" (in French). Le Nouvel Observateur. 25 December 2014.
  30. ↑ "«Watch Dogs» pour se mettre dans la peau d'un pirate informatique" (in French). 20 Minutes. 25 May 2014.
  31. ↑ Pantaleoni, Ana (19 May 2014). "'Watch Dogs' toma Chicago". El Pais (in Spanish).
  32. ↑ "Watch Dogs 2, il videogioco sui Big Data per i Millennials" (in Italian). Corriere de la Sierra. 14 November 2016.
  33. ↑ "Un jeu qui pourrait devenir réalité" (in French). Le Parisien. 27 May 2014.
  34. ↑ "Nmap: The Internet Considered Harmful - DARPA Inference Cheking Kludge Scanning" (PDF). Hakin9.
  35. ↑ "Experts troll 'biggest security mag in the world' with DICKish submission". The Register.
  36. ↑ "Hackito Ergo Sum Team". Hackito Ergo Sum Conference. 2012.
  37. ↑ Leyden, John (1 February 2011). "Alternative security conferences plot European editions". The Register.
  38. ↑ "Sécurité Informatique : NoSuchCon". Le Monde Informatique (in French).
  39. ↑ Karayan, Raphaële (22 November 2014). "Hacking: 'Tout ce que vous mettez sur Internet pourra être réutilisé à votre insu'". L'Express (in French).
  40. ↑ "Shakacon IT Security Conference To Be Held In Hawaii In June". Dark Reading. 8 May 2013.
  41. ↑ "Nullcon Review Board : Profile of Jonathan Brossard". Nullcon Conference.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.