Events
by Wojtek Przibylla

35C3: Refreshing Memories

Hello fellow Troopers and Happy new Year!

35C3 is over, and the recordings are available so in case you did not have the chance or the time to watch the live streams during the holidays or overwhelmed with the number of talks, see in the following a list of recommended talks to fill your evenings or weekends. Apart from the broad coverage of topics in different areas (Ethics, Society & Politics, Hardware & Making, Resilience, Art and Culture, Security, Science, Resilience), foundation talks were aiming for the very basics following this year’s motto “Refreshing Memories.”

Continue reading “35C3: Refreshing Memories”

Continue reading
Misc
by Julian Suleder

Motivational Aspects and Privacy Concerns on Wearables in the German Running Community

Today I am proud to announce that another paper of my former colleagues from Heilbronn University and me was published in one of the journals with the highest impact factor for Medical Informatics research called JMIR mHealth and uHealth. There is a reason why we published in this journal besides its informatics focus. The journal is an open access journal. That means that readers are not charged on a pay-per-view basis or other business models to access the full text of the paper. In return, the authors need to pay publication fees. In my opinion restricting access to academic research is not a way to go. I think this isn’t a thing we see in the security community often anyway. But this is and was the standard in academia for years.

Continue reading “Motivational Aspects and Privacy Concerns on Wearables in the German Running Community”

Continue reading
Misc
by Enno Rey

ERNW Whitepaper 67: Active Directory Trust Considerations

Last week Will “harmj0y” Schroeder published an excellent technical article titled “Not A Security Boundary: Breaking Forest Trusts” in which he lays out how a highly critical security compromise can be achieved across a forest boundary, resulting from a combination of default AD (security) settings and a novel attack method. His post is a follow-up to the DerbyCon talk “The Unintended Risks of Trusting Active Directory” which he had given together with Lee Christensen and Matt Nelson at DerbyCon (video here). They will also discuss this at the upcoming Troopers Active Directory Security Track (details on some more talks, including Sean Metcalf’s one, can be found in this post or this one).

Continue reading “ERNW Whitepaper 67: Active Directory Trust Considerations”

Continue reading
Building
by Michael Thumann

DirectoryRanger 1.1.0 Introduces Informational Audit Checks

With version 1.1.0 our tool DirectoryRanger introduces a new feature: informational audit checks. These checks do not have a severity rating because they are just “for your information” and the included information might or might not contain security issues, depending on other facts. But these checks can help to reduce your Active Directory attack surface by pointing you to some aspects which need your attention and at least require to be discussed and documented (and they might also imply governance measures like a risk acceptance).

Continue reading “DirectoryRanger 1.1.0 Introduces Informational Audit Checks”

Continue reading
Events
by Rachelle Boissard

First Talks of TROOPERS19 Accepted!

TROOPERS18 was the best year ever (did you check our archives?) and it will be challenging to do better… However, we accept the challenge!

The trainings and talks were from high quality and choices were difficult to make… We hope you will enjoy reading these little teasers!

Follow us on Twitter (@WEareTROOPERS) for more information and do not hesitate to use our hashtag #TR19 when you have questions or remarks about TROOPERS19!

With that being said, we are excited to introduce the first official five talks of TROOPERS19! Continue reading “First Talks of TROOPERS19 Accepted!”

Continue reading
Breaking
by Benjamin Schwendemann

On the insecurity of math.random and it’s siblings

During code reviews we often see developers using weak RNGs like math.random() to generate cryptographic secrets. We think it is commonly known that weak random number generators (RNG) must not be used for any kind of secret and recommend using secure alternatives. I explicitly did not state a specific language yet, because basically every language offers both weak and strong RNGs.

So I asked myself: What if I use a weak RNG to generate a secret? Is it possible to recover the secret from some derived value, like a hash?

Continue reading “On the insecurity of math.random and it’s siblings”

Continue reading
Breaking
by Florian Grunow

Plume Twitter Client URL Spoofing

It is possible to spoof the URLs that Plume will open to arbitrary locations because of how Plume parses URLs. The preview of an URL in a tweet will show the complete (at least the host name and the first few chars of the URL) but shortened URL. However, if the URL contains a semicolon (;) the URL that will be opened is the part after the semicolon. Continue reading “Plume Twitter Client URL Spoofing”

Continue reading