Retro Exploitation: Using Vintage Computing Platforms as a Vulnerability Research Playground and Learning Environment
No ratings
Presented at DEFCON 31 by
It can be very difficult for those new to hacking to learn about vulnerability discovery and exploit development on modern operating systems and software. The complexity of a modern computing environment, developer awareness of security risks, and the iterative development of exploit mitigations over the past three decades has put up an intimidating wall in front of those who would be interested in learning about vulnerability research. Vintage computing environments can provide an interesting and fun playground environment for learning and experimenting with reverse engineering, vulnerability discovery, and exploit development. In this talk, Wesley will discuss the setup of a complete environment for hacking software for the Commodore Amiga line of computers, a 16/32 bit computing platform of the late 80s and early 90s (not to mention a dedicated following of users and software today). He will describe the hardware environment, OS architecture, and the practically endless library of software that can be used as interesting targets of research. On-system development and debugging software will be described, as well as using the modern Ghidra disassembler. A case study of identifying and exploiting a vulnerability in a 1994 vintage FTP client will be discussed in technical detail. REFERENCES: - Vintage Computing preservation - https://www.tosecdev.org/ - TOSEC catalogs all known software and documentation for many vintage computing platforms - https://archive.org/ - Hosts tremendous archives of vintage documentation, magazines, software, etc - Books (largely available on archive.org) - The AmigaDOS Manual, 3rd Edition - Lance Leventhal - 68000 Assembly Language Programming, Second Edition - M68000 Programmer's Reference Manual - Amiga ROM Kernel Reference Manual, 3rd Edition, Volumes: - Libraries - Devices - Hardware Reference Manual - Devpac 3 for the Amiga - User Manual - SAS/C Development System User's Guide (vol. 1 & 2) - Development Kit Documentation - Amiga OS NDK 3.2 - https://www.hyperion-entertainment.c...iles&parent=40 - Amiga Developer CD 1.2 (1998, available on archive.org) - Previous talks that involved vintage computing - DC30 - Tristan Miller - Reversing the Original Xbox Live Protocols - DC30 - Cesare Pizzi - Old Malware, New tools: Ghidra and Commodore 64