Chinese security specialists flex muscles at international hackers carnival

Qihoo 360 Vulcan team receives an award from Microsoft Edge bug exploiting and pwning during the POC 2016 held on Nov 10, 2016 in Seoul, South Korea. [Photo provided to chinadaily.com.cn]

White hats from Qihoo 360 Technology Co have showcased the latest bug-fixing improvements at an international hackers conference.

Organized by South Korean hackers and security experts, the Power of Community (POC) was first held in 2006. The conference, which started on Thursday, has become one of the oldest conferences that specializes in security and hacking with a global perspective.

Both malicious hackers known as "black hats" and ethical hackers known as "white hats" are encouraged to participate in sessions to share and discuss the latest hacking and internet security topics.

Yan Ruimin, a security researcher at Qihoo 360's vehicle cyber security lab, dubbed "SkyGo Team", and Yan Chen, a PhD student at the Ubiquitous System Security Laboratory of Zhejiang University, gave a joint presentation: "Can you trust autonomous vehicles? Contactless attacks against sensors of self-driving vehicles."

They introduced the latest development in Advanced Driver Assistance Systems (ADAS) which can sense the driving environment and warn drivers of immediate dangerous situations. They also discussed Tesla Motors' driverless technology.

They explained how sensors provide a vehicle with measurements of its surroundings and how sensory information is used for navigation.

"Although promising and proven safety features, the trustworthiness of the existing driverless cars has to be examined before they can be widely adopted on the road," Yan Chen said.

They investigated sensors whose measurements are used to guide driving, such as millimeter-wave radars, ultrasonic sensors and forward-looking cameras.

Video clips were collected during the contactless attacks on a few popular autonomous cars, including Tesla, Audi and Volkswagon in both the lab and outdoors.

Using off-the-shelf hardware attackers were able to perform jamming and spoofing attacks, which Tesla to become 'blind' and malfunction. This could potentially lead to crashes and greatly impair the safety of self-driving cars.

They also proposed software and hardware countermeasures that will improve sensor resilience against these attacks.

Security experts from Qihoo 360 deliver a keynote speech during the POC 2016 held on Nov 10, 2016 in Seoul, South Korea. [Photo provided to chinadaily.com.cn]

"We've been doing R&D (research and development) in this area since two years ago," Yan Minrui said. "The communication between the auto manufactures and us is going smoothly as we continually exploit vulnerabilities in automated driving systems for autonomous vehicles that can be adopted by the companies as technology improvements."

According to Yan Minrui, the presentation has also been delivered at the PacSec Applied Security Conference held earlier in Tokyo.

Zhang Wanqiao and Huang Lin, team members of another Qihoo360's security team -- Unicorn, also delivered a keynote named "Forcing LTE cellphone into unsafe network".

The team argued that the existing LTE is a more advanced mobile network but not absolutely secure.

In the presentation, they introduced a method which jointly exploits the vulnerabilities in tracking area update procedure, attach procedure, and RRC redirection procedure, and finally can force a targeted LTE cellphone to downgrade into another malicious network, where the attacker can make further attacks.

The report was originally presented earlier this year at the Hack in the Box Security Conference (HITB) held in Amsterdam and one of the world's largest annual conventions -- DEFCON, and received positive feedback, according to the team.

PwnFest, a two-day bug exploiting and pwning contest were also concurrently organized with the POC.

The target of the contest was chosen in a variety of systems that updated recently, including Microsoft Edge, Android 7.0, Microsoft Hyper-V, Google Chrome, Apple iOS 10 and Safari + Mac OS X Sierra, Adobe Flash and VMware Workstation Pro 12.

The overall $1.7 million prize for winning the contest, sponsored by the companies that own the systems, is the highest of similar hackers' pwning matches.

A contestant will get three exploit attempts during his demonstration and each attempt must be finished within four minutes.

Three teams from Qihoo 360, named Vulcan, Marvel and Alpha, participated in pwning bugs on Microsoft Edge, VMware Workstation, Google's Pixel and Adobe Flash Player.

Zheng Wenbin, known as MJ0011, the general manager of 360's core security department, heads the vulnerability research team, which has achieved hundreds of Common Vulnerabilities and Exposures (CVEs) from Microsoft, Apple and Adobe.

Being a regular at POC, Zheng said that although the numbers of attendees and topics of POC were fewer than some of the word's high-profile hackers' events, such as Black Hat, some of the issues on the agenda were about cutting-edge technologies in the security industry.

As of Thursday, the Microsoft Edge and VMware Workstation pwning challenge was beaten by the team, and the latter is an almost perfect virtual system that hasn't been cracked by hackers for seven years.

Since 2009, Microsoft has thanked Qihoo 360 for assisting the company detecting vulnerabilities and bugs.