Foredragsholder
Tarjei Hartmann Skjånes
Senior Ethical Hacker - Telenor Cyberdefence
Tarjei is a neuroscientist turned hacker, trading in pipettes and western blots for shells and exploits. He works as a Red Teamer at Telenor Cyberdefence (TCD), previously Watchcom, and holds the OSCE3 and CRTO certifications. In TCD, Tarjei is responsible for malware development and R&D in addition to hands-on-keyboard activities.
He has conducted TIBER-tests in multiple Nordic countries since 2023. He has also conducted multiple Advanced Adversary Simulation/Red Team tests against a Fortune 500 company, forcing him to develop creative tradecraft to bypass modern defenses.
During this conference, he will share the R&D he had to do when it comes to application control bypass and the tooling that had to be developed when doing adversary simulation against customers with the security posture that you find in Fortune 500 companies.
Om sesjonen
Over the past few years, organizations have significantly raised the bar for attackers by implementing application control solutions like Windows Defender Application Control (WDAC). When configured with strict policies, these controls can effectively shut down traditional attack paths, from running unauthorized executables to abusing living-off-the-land binaries (LOLBINs) and DLL sideloading.
But what happens when the attack doesn't come from an unauthorized application at all, but from within software that's already trusted and approved?
In this talk, I'll demonstrate how JavaScript-based beacons running inside legitimate applications can bypass virtually any application control solution. Starting with the very well-known technique of bringing your own vulnerable Electron app, I'll show its practical limitations, and then present our research into using Visual Studio Code extensions (.vsix) as stage 1 beacons. Because VS Code's extension runtime executes through Node.js within an already-approved application, application control never intervenes. The beacon can then either be upgraded to a full stage 2 implant or the attack can happen from the stage 1 beacon. This approach also demonstrates a realistic supply chain attack vector, an extension that is either taken over and weaponized or a malicious extension placed on the marketplace.
I'll extend this concept to browser extensions running in Chromium-based browsers, exploring what level of access an attacker gains in a browser sandbox instead of node.js.
This talk is aimed at both red teamers looking for techniques against hardened environments and blue teamers who need to understand the blind spots in application control. Attendees will walk away with a concrete understanding of why application control alone is insufficient, what signals to look for when these techniques are used, and how to think about defense in depth when your trusted applications become the attack surface.
As a penetration tester, I've seen firsthand how organizations invest heavily in very strict application control and assume they're protected. This research grew out of needing to demonstrate that the threat model extends beyond executables and DLLs.