Here’s a number of updates as for upcoming
TROOPERS13.
The preliminary agenda for this year’s TelcoSecDay can be found
here.
Here‘s
the (again: preliminary) agenda of the IPv6 Security Summit.
Last, but not least we’ve included another four talks in the main conference:
======
Sergey Bratus & Travis Goodspeed: You wouldn’t share a syringe. Would you share
a USB port?
Synopsis: Previous work has shown that a USB port left unattended may be subject
to pwnage via insertion of a device that types into your command shell (e.g.
here).
Impressive attack payloads have been delivered over USB to
jailbreak PS3
and a
“smart TV“.
Not surprisingly, USB stacks started incorporating defenses such as device
registration, USB firewalls, and other protective kits. But do these protective
measures go far enough to let you safely plug in a strange thumb drive into your
laptop’s USB port?
We’re very happy to announce the third round of Troopers 2013 talks today (first
round
here,
second
here).
So much quality stuff… it seems to get (ever) better every year ;-).
Here we go:
==================
Michael Ossmann & Dominic Spill: Introducing Daisho – monitoring multiple
communication technologies at the physical layer.
Synopsis: Most communications media can be monitored and debugged at various
levels of the stack, but we believe that it is most important to examine them at
the physical layer. From there, the security of every level can be investigated
and tested. The task of monitoring physical layer communications has become
increasingly difficult as we try to squeeze more and more bandwidth out of our
links. A passive tapping circuit can be used to monitor a 100BASE-TX
connections, but no such circuit exists for 1000BASE-T networks.
We’re very happy to announce the second round of Troopers 2013 talks today
(first round
here).
Some
(well, actually most ;-)) of these talks haven’t been presented before, at any
other occasion, so this is exciting fresh material which was/is prepared
especially for Troopers.
Here we go:
==================
Andreas Wiegenstein & Xu Jia: Ghost in the Shell.FIRST TIME MATERIAL
Synopsis: Security conferences in the past years have made it clear, that
common security vulnerabilities such as SQL Injection, XSS, CSRF, HTTP verb
tampering and many others also exist in SAP software. This talk covers several
vulnerabilities that are unique to SAP systems and shows how these can be used
in order to bypass crucial security mechanisms and at the same time operate
completely below the (forensic) Radar. We uncovered undocumented mechanisms in
the SAP kernel, that allow launching attacks that cannot be traced back to the
attacker by forensic means. These mechanisms allow to *actively* inject
commands at any time into the running backend-session of an arbitrary logged on
user, chosen by the attacker. We named this attack mechanism “Ghost in the
Shell”. We will also demo how to use this attack vector to distribute malware to
the attacked user’s client machine despite mechanisms in the SAP standard that
are designed to prevent this.
at first a happy new year to all our readers!
And, of course, to everybody else, too ;-). May 2013 bring good things for you
all, in particular (but not only) in the infosec space.
At the recent ATSAC 2012 conference a guy from the CERT
Insider Threat Center gave a talk on the exact topic. Given that the
ENISA Cloud Computing Risk Assessment lists
“Cloud Provider Malicious Insider” as one of the top eight risks (out of overall
35 risks evaluated) and we just had some discussion about this in a customer
environment, this might be of interest for some readers.
We’re delighted to provide the first announcement of talks of next year’s
Troopers edition. Looks like it’s going to be a great event again 😉
Here we go:
==================
Peter Kieseberg: Malicious pixels – QR-codes as attack vectors.
**Synopsis: **QR-Codes, a version of two-dimensional barcodes that are able to
store quite large amounts of information, started gaining huge popularity
throughout the last few years, including all sorts of new applications for them.
Originating from the area of logistics, they found their ways into marketing and
since the rise of modern smartphones with their ability to scan them in the
street; they can be found virtually everywhere, often linking to sites on the
internet. Currently even standards for paying using QR-codes were proposed and
standardized. In this talk we will highlight possible attack vectors arising
from the use of QR-Codes. Furthermore we will outline an algorithm for
calculating near-collisions in order to launch phishing attacks and we will
demonstrate the practical utilization of this technique.
As
in 2011
we really liked the conference; there was a number of interesting talks and we
met quite some fellows from the IPv6 security space. Btw: we plan to organize a
dedicated IPv6 security summit in late 2012 (probably on 6th and 7th of
November) in Heidelberg, similar to the
Telco Sec Day
at Troopers. We’ll annouce details as for this one in some weeks.
As I mentioned the Telco Sec Day in the last post… for those who missed Flo’s
announcement: in the interim all slides of the Telco Sec Day are available
online here.
Obviously, given I initiated the event, I’m biased 😉 but to me it provided
great insight from both the talks and the networking with other guys from the
telco security field, and it did actually what it was meant for: fostering the
exchange between different players in that space, for the sake of sustainably
improving its’ overall security posture.
As there has been some public demand for that, here we go with the final agenda
for the Troopers
“TelcoSecDay“. The
workshop is meant to provide a platform for research exchange between operators,
vendors and researchers. The slides of the talks will potentially be made
available as well.
8:30: Opening Remarks & Introduction
9:00: Sebastian Schrittwieser (SBA Research): Guess Who’s Texting You?
Evaluating the Security of Smartphone Messaging Applications.
10:00: Peter Schneider (NSN): How to secure an LTE-Network: Just applying the
3GPP security standards and that’s it?
10:45: Break
11:00: Kevin Redon (T-Labs): Weaponizing Femtocells – The Effect of Rogue
Devices on Mobile Telecommunications
11:45: Christian Kagerhuber (Group IT Security, Deutsche Telekom AG): Security
Compliance Audit Automation (SCA, TeleManagementForum TMF528)
12:30: Lunch
13:45: Philipp Langlois (P1 Security): Assault on the GRX (GPRS Roaming
eXchange) from the Telecom Core Network perspective, from 2.5G to LTE
Advanced.
15:00: Break
15:15: Harald Welte (sysmocom): Structural deficits in telecom security
16:30: Closing Remarks
17:00: End of workshop
19:00: Joint dinner (hosted by ERNW) in Heidelberg Altstadt for those
interested and/or staying for the main conference
if you’re following this blog regularly or if you’ve ever attended an
ERNW-led workshop which included an
“architecture section” you will certainly remember the “Seven Sisters of
Infrastructure Security” stuff (used for example in
this post).
These are a number of (well, more precisely, it’s seven ;-)) fundamental
security principles which can be applied to any complex infrastructure, be that
a network, a building, an airport or the like.
As part of our upcoming
Black Hat
and
Troopers
talks we will apply those principles to some VoIP networks we (security-)
assessed and, given we won’t cover them in detail there, it might be helpful to
perform a quick refresher of them, together with an initial application to VoIP
deployments. Here we go; these are the “Seven Sisters of Infrastructure
Security”:
I’m currently involved in creating an up to date approach to handling external
connections (read: temporary/permanent connections with external parties like
business partners) of a very large enterprise. Currently they have sth along the
lines of: “there’s two types of external connections, trusted and untrusted. the
untrusted ones have to be connected by means of a double staged firewall”.
Which – of course – doesn’t work at all in a
VUCA
world, for a number of reasons (the demarcation between trusted and untrusted is
quite unclear – just think of mergers & acquisitions –; “business doesn’t like
implementing 2-staged firewalls in some part of the world where they just signed
the memorandum for a joint venture to build windmills in the desert”; firewalls
might not be the appropriate control for quite some threats anyway – see for
example slide 46 of
this presentation– and
so on). Not to mention that I personally think that the “double staged firewall”
thing is based on an outdated threat model, in particular when implemented with
two different vendors (for the simple reason that the added operational effort
usually is not worth the added security benefit. see
this post for
some discussion of the concept of “operational feasibility”…).