Niki Vonderwell on Insinuator.net - Bold Statements

Active Directory Security Summit 2018, 13th. of November of 2018

Mon, 03 Sep 2018 00:00:00 +0000

I have the pleasure to announce the Active Directory Security Summit 2018 at 13^(th). of November of 2018. The summit covers current Active Directory security related topics such as challenging tasks of hybrid Active Directory operations as well as new security best practices and some ‘evergreens’ – Admin Tiering implementations (what about Exchange and DNS…??), ESAE operations etc. 😉

The primary objective of the Active Directory Security Summit is to bring experts together:

TROOPERS18 Photos online!

Thu, 03 May 2018 00:00:00 +0000

We are very excited to publish some (more to come!) of our photos from TROOPERS18! Based on feedback from #TR18 we would also like to take a moment for our official TROOPERS photographer to introduce himself and tell you a little about what inspires him.

Peter Walter is a 37 year old photographer based in Germany near Stuttgart. For many years now he is the official TROOPERS photographer and very proud to be part of the Troopers family.

#TR18 Attack & Research Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Attack & Research Track.

Reverse Engineering Blackbox Systems with GreatFET & Facedancer by Kate Temkin and Dominic Spill

USB is everywhere, your phone, gaming consoles, IoT waffle irons, you name it. Due to its’ widespread use in everyday life it is typically trusted by the user. And even if one wanted to find out what’s happening behind the scenes, surely digging into USB communication is too much of a chore to be worth the hassle, right? This talk by Kate Temkin and Dominic Spill are about to prove that very wrong with an impressive display of their tools GreatFET and Facedancer.

#TR18 Defense & Management Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Defense & Management Track.

All Your Cloud Are Belong to Us

The talk “All Your Cloud Belong Are Belong to Us” was held by Nate Warfield, who is a Senior Security Program Manager for the Microsoft Security Response Center (MSRC).
Before Microsoft he worked as a network engineer about 18 years and 10 of this for a large amount of cell phone companies.
Nate gives an overview about the state of the cloud solution provided by Microsoft, Azure, and how he hunts vulnerabilities in this environment.
Finally he concludes that the giving up your infrastructure to the cloud doesn’t mean that you give up your responsibility.

#TR18 Next Generation Internet (NGI) Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Next Generation Internet Event.

NGI Keynote by Graeme Neilson

Before his infosec career Graeme was a street performer, then security researcher, now he calls himself a defender. The talk was built around the following sentence: “The infosec industry and community have completely failed to create meaningful change in the behavior of people”.

The following example is a resume of how hacking worked from 1988 to 2017:

#TR18 SAP Security Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 SAP Security Track.

SAP IGS : The ‘vulnerable’ forgotten component by Yvan Genuer

The Internet Graphics Server (IGS) is used to generate Web Based graphics from the SAP Web AS. Yvan Genuer looked at the security of an ancient component with very few public vulnerabilities available so far. In his talk he gave us insights on the structure of the IGS, its services, and problems he had when looking for documentation of the IGS and its components.

Extracting data from an EMV (Chip-And-Pin) Card with NFC technology

Thu, 15 Feb 2018 00:00:00 +0000

This is a guest blog post by Salvador Mendoza.

During years, many different researches and attacks against digital and physical payment methods have been discussed. New security techniques and methodologies such as tokenization process attempts to reduce or prevent fraudulent transactions.

Extracting or capturing data from a transaction have been studied in different ways, and some of the most common techniques are skimming, wireless skimming, relay attacks, traffic sniffing or modifying a PoS(Point of Sale) system. In our talk, “NFC Payments: The Art of Relay & Replay Attacks” at TROOPERS18, we will discuss a new technique and methodology that malicious individuals could implement to extract data.

Get your hands dirty playing with RFID/NFC

Wed, 14 Feb 2018 00:00:00 +0000

This is a guest blog post by Nahuel Grisolia.

The first time I’ve heard about RFID was at high school, back in 2002, when I was studying Electronics. Back in that time, this technology was like some sort of black magic to me. A few years later in 2011, our government in Argentina decided to implement a “new technology” called NFC, designed as the new and only way of payment for the use of public transport. So, I decided to understand it better, play with it, and try some hacks I heard from the cool people of the CCC.

White Paper on Incident Analysis and Forensics in Docker Environments

Wed, 14 Feb 2018 00:00:00 +0000

In this article, we describe the impact of the increased use of Docker in corporate environments on forensic investigations and incident analysis. Even though Docker is being used more and more (Portworx, Inc., 2017), the implications of the changed runtime environment for forensic processes and tools have barely been considered. We describe the technological basics of Docker and, based on them, outline the differences that occur with respect to digital evidence and previously used methods for evidence acquisition. Specifically, we look at digital evidence within a Docker container which are lost or need to be acquired in different ways compared to a classical virtual machine, and what new traces and opportunities arise from Docker itself.

Announcing the first 5 talks of TROOPERS18!!!!

Wed, 29 Nov 2017 00:00:00 +0000

TROOPERS17 was unlike any TROOPERS we had known before. Everything just seemed bolder, better, and beyond our expectations. From surprise speakers like the grugq (do you have a follow-up talk for #TR18 by the way?) to new speakers who are now TROOPERS family, TROOPERS17 is one for the history books!

If you were there you might be wondering to yourself, how could they possibly top it (and if you were not there check out this video from TR17)? Well, I am not going to lie, it will be a challenge. However, the high quality of talk and training submissions for this year have us feeling pretty positive about making #TR18 the “best year ever”!

TROOPERS for Students!

Thu, 12 Oct 2017 00:00:00 +0000

We are super excited for TROOPERS18 (March 12-16th, 2018) as are many of you! We even have this great saying that “after TROOPERS is before TROOPERS”, which means we spend a lot of time looking through feedback from attendees, speakers/trainers, and our own Crew for ways to not only top what we’ve done in the years before, but also how to simply make it better for everyone involved. Looking around at our Crew we realized how many have either attended TROOPERS or other conferences as students. We heard from them, as well as other students, how life changing it was to be able, as a student, to attend an IT-Security conference. How they got to meet a speaker whose work they’d read about in class. How people felt even more a part of the community they were studying hard to belong to.

Black Hat 20 & DEFCON 25

Wed, 09 Aug 2017 00:00:00 +0000

Some of the ERNW Crew hit up Black Hat USA and DEFCON. Our own Omar Eissa even gave his first BH and DEFCON talks! See which talk we liked and what inspiration we took home.

BlackHat US 20:

ERNW´s Omar Eissa presented on Cisco Autonomic networks showing how
slides: https://www.blackhat.com/docs/us-17/wednesday/us-17-Eissa-Network-Automation-Isn’t-Your-Safe-Haven-Protocol-Analysis-And-Vulnerabilities-Of-Autonomic-Network.pdf
insinuator blogposts:
https://insinuator.net/2017/03/autonomic-network-overview/
https://insinuator.net/2017/03/autonomic-network-analysis/
https://insinuator.net/2017/04/autonomic-network-vulnerabilities/

BoradPWN
– Speaker: Nitay Artenstein
– Slides: https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets.pdf
– Paper: https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets-wp.pdf
– Broadly covered in main stream Media –> Wired article, tons of write-ups…link: https://www.wired.com/story/broadpwn-wi-fi-vulnerability-ios-android/
– Initial Blog Post: https://blog.exodusintel.com/2017/07/26/broadpwn/
– He took a deep dive into the internals of the BCM4354, 4358 and 4359 Wi-Fi chipsets and found an issue that he exploited to an extent where he created the world´s first wifi worm.
– This hits most of the mobiles users pretty hard. Affected devices are for example: Samsung Galaxy from S3 through S8, inclusive All Samsung Notes3. Nexus 5, 6, 6X and 6P, All iPhones after iPhone 5
– An infected device can be used to infect other mobile devices.
– Luckily currently there is no malware that is actively exploiting this issue.

DevOps, Continuous Deployment & Agile Security September 7, 2017

Thu, 08 Jun 2017 00:00:00 +0000

The following post is in German as it is covering an Event with German as the main language.

INSIGHT SUMMIT 2017 präsentiert DevOps, Continuous Deployment & Agile Security

Inspiriert durch die erfolgreichen Round Table Session der TROOPERS freuen wir uns Ihnen heute mit dem AgileSecurity Insight Summit 2017 eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einer Keynote, gefolgt von Fallstudien und Vorträgen durch interne und externe Referenten aus der Industrie. Im Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round-Table Sessions teilnehmen. In den Round-Table Sessions werden unter Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.

Docker Security & (Sec) DevOps Training July 19-20th

Mon, 05 Jun 2017 00:00:00 +0000

The following post is in German as it is covering a Training with German as the main language.

Professionelles Training im Workshop Character:
Docker, Microservices, Kubernetes, DevOps, Continuous
Integration/Deployment/Delivery (CI/CD), Container – moderne
Entwicklungsprozesse kommen nicht mehr ohne diese Begriffe aus. In diesem Kurs
lernen Sie die Security Grundlagen um diese Dinge zu beherschen.

Docker Security & (Sec) DevOps Training:
Im Training werden unter Anderem die folgenden Fragestellungen behandelt:

Wie stark/zuverlässig sind die Isolationsmechanismen hinter Docker/Linux/Betriebssystem-Containern?
Wie beeinflussen Container typische Applikations- und Netzwerk-Landschaften?
Wie beeinflussen die CI/CD/Microservice Paradigmen traditionelle Entwicklungsprozesse?
Wie sieht eine typische CI/CD Pipeline aus?
Was sind potentielle Schnittstellen zwischen „Security“ und diesen Paradigmen?
Welche zusätzlichen Security-Herausforderungen ergeben sich aus der veränderten Entwicklungslandschaft und neuen Tool-Chains?

Voraussetzungen:
Die Teilnehmer sollten grundlegende Kenntnisse der Linux Kommandozeile besitzen
sowie ein System mit einem SSH Client. Teilnehmer die die Demo-VM gerne selbst
betreiben möchten erhalten diese auf einem USB-Stick, müssen sich aber selbst um
Import und Start kümmern.

Active Directory Security & Secure Operations July 18, 2017

Thu, 01 Jun 2017 00:00:00 +0000

The following post is in German as it is covering an Event with German as the main language.

INSIGHT SUMMIT 2017 präsentiert Active Directory Security & Secure Operations

Inspiriert durch die erfolgreichen Round Table Sessions der TROOPERS freuen wir uns Ihnen heute mit dem Active Directory Insight Summit 2017 eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.
Die Veranstaltung beginnt am Morgen mit einer Hinführung zum Thema Active Directory Sicherheit gefolgt von Fallstudien und Vorträgen durch interne und externe Referenten aus Wirtschaft und Industrie. Im Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round Table Sessions teilnehmen (jeder Teilnehmer kann an beiden Sessions teilnehmen). In den Round Table Sessions werden unter Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.

TR17 Training: Crypto attacks and defenses

Tue, 03 Jan 2017 00:00:00 +0000

This is a guest blog written by Jean-Philippe Aumasson & Philipp Jovanovic about their upcoming TROOPERS17 training: Crypto attacks and defenses.

The 1-day training from last TROOPERS has become a 2-day training, featuring even more real-world attacks and defenses as well as new hands-on sessions! We’ll teach you, step by step, how to spot and exploit crypto vulnerabilities, how to use the strongest forms of state-of-the-art cryptography to secure modern systems (like IoT or mobile applications), and bring you up to speed on the latest and greatest developments in the world of cryptography, such as TLS 1.3, blockchains, and post-quantum crypto.

3rd Round of TROOPERS17 Talks

Tue, 20 Dec 2016 00:00:00 +0000

We had to make some tough choices regarding our TROOPERS17 Main Conference Agenda. Thank you again to everyone for submitting! The full agenda will be published later this week, but for now here are the next round of talks!

Ivan Pepelnjak: Securing Network Automation
If you have operational experience in running large networks then you’re probably yearning to replace the traditional way of managing individual network devices via SSH with something better and more reliable. Software Defined Networking (SDN) was touted as the all-encompassing solution, but what we got instead is a heap of academic ideas, several platforms that require as much investment as an SAP deployment, and a bunch of proprietary products focused more on increasing lock-in and vendor revenue than solving operational problems.

TR17 Training: Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer

Thu, 15 Dec 2016 00:00:00 +0000

This is a guest blog written by Hanno Böck who will be running the Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer at TROOPERS17.

Fuzzing is a very old technique to find bugs and vulnerabilities in software. However it has seen a new push in recent years due to vastly improved tools. The compilers gcc and clang have received Sanitizer tools that allow finding a lot of bugs like use after free errors and out of bounds reads that are otherwise very hard to find.

2nd Rounds of TROOPERS17 Talks!

Wed, 14 Dec 2016 00:00:00 +0000

It is the end of the year and we are hoping it is not too hectic of a time for you all! But if it is, hopefully the announcement of our next round of TROOPERS17 talks is enough to get you in the TROOPERS (if not the holiday) spirit 🙂

Francis Alexander & Bharadwaj Machiraju: How we hacked Distributed Configuration Management Systems

With increase in necessity of distributed applications, coordination and configuration management tools for these classes of applications have popped up. These systems might pop-up occasionally during penetration tests. The major focus of this research was to find ways to abuse these systems as well as use them for getting deeper access to other systems.

CCS’16 – Day 2 – 25th October 2016

Wed, 23 Nov 2016 00:00:00 +0000

Hello again.

Andrei Costin (at http://firmware.re project) is here, and this is the second post from a series of guest postings courtesy of ERNW (thanks Niki and Enno!).

Few days ago, the first CCS’16 summarization post went online: https://insinuator.net/2016/11/introduction-ccs16-day-1-24th-october-2016/

It summarized five presentations of the 6th Annual Workshop on Security and Privacy in Smartphones (SPSM’16). In short, it contained presentations on: over-the-top and phone number abuse, smartphone fingerprinting, apps privacy increase and protection/security, and apps privacy ranking.

Introduction & CCS’16 – Day 1 – 24th October 2016

Mon, 21 Nov 2016 00:00:00 +0000

I am Andrei Costin (at http://firmware.re project), and this is the first post from a series of guest postings courtesy of ERNW.

Between 24th and 28th October, I had the pleasure and the great opportunity to attend ACM CCS 2016 in Vienna, Austria, where I also presented at the TrustED’16 workshop my paper titled “Security of CCTV and Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations”.

My attendance throughout the entire ACM CCS 2016 week and my presentation at TrustED was possible thanks to generous support from Enno Rey and ERNW, and I thank them again for this opportunity!

Announcing the first 5 talks of TROOPERS17!!!!

Fri, 04 Nov 2016 00:00:00 +0000

TROOPERS16 was packed with epic talks from around the world, an unknown evil twin brother appearing, hands-on trainings, and a legendary year for our TROOPERS Charity efforts! If you were there you might be wondering to yourself how could they possibly top it? Well, I am going to let you in on a little secret: Next year is the 10th edition of TROOPERS. One DECADE of TROOPERS, and we are pulling out all the stops! Starting with the announcement of the first 5 talks!

IoT Insight Summit November 15, 2016

Wed, 26 Oct 2016 00:00:00 +0000

The newest addition to ERNW, ERNW Insight which now hosts TROOPERS, is launching a new concept this year. Based on the successful TROOPERS Roundtable sessions, ERNW Insight will host a series events every year covering current and relevant topics in the field of IT Security. While the style of the events may vary the in-depth knowledge sharing that you have come to know from TROOPERS will not!

The inaugural event will be our IoT Insight Summit, taking place on November 15, 2016 at the Crowne Plaza Heidelberg. This 1-day event will begin with a keynote and case study from industry experts. Afterwards, all participants will be divided into five groups of 10 persons each to participate in our “Break Out Sessions”. Every participant will get the opportunity to attend all 5 Break Out Sessions, where our IT Security moderators will lead discussions on typical problems and solutions in IoT.

Defense & Management Day 2

Fri, 15 Apr 2016 00:00:00 +0000

TROOPERS16 offered many different speakers from around the globe. Below are three different talks from the afternoon of Day 2’s Defense and Management Track.

===

The TROOPERS16 talk “Attacking & Protecting Big Data Environments” presented the research of Birk Kauer and Matthias Luft, (ERNW) in which they showed how enterprise-grade “big data” environments, based on e.g. HortonWorks or Cloudera, comprising of components such as HDFS, Yarn, Hue, Flume, Hive, Spark, Sentry/Ranger could be attacked. These environments typically process huge amounts of data. The data is either stored in a cluster file system or streamed into clusters. The processing of these datasets are done by jobs, and these jobs can be arbitrary code execution.

Building a secure and reliable IPv6 Guest Wi-Fi Network by Christopher Werny

Fri, 01 Apr 2016 00:00:00 +0000

Christopher Werny leads the network security team for ERNW and since 2005 he is involved in numerous IPv6 projects where he is responsible for planning, implementation and troubleshooting existing projects.

The first topic he approached was “How to build a conference WLAN Network in General”. The very first suggestion was to put it to the 5GHz channel because there could be a lot of interferences in the 2.4 GHz channel. The basic idea here is to disable 802.11b completely if it´s possible in your environment and no-one is using it anyway. Further you should also consider nearby Wi-Fi signals and on which channels they reside. His next recommendation was about setting the inactivity timer to short intervals, this will avoid unnecessary resource spending from the APs when they try to track down moved or shut down devices. His last general recommendation from him was regarding a central DHCP Server. This will enable the roaming from mobile devices without getting a new IP-Address when bridged mode is enabled for the APs.

Caring for file formats

Fri, 01 Apr 2016 00:00:00 +0000

Ange Albertini is a reverse engineer and author of Corkami.

First and foremost he explained what a polyglot file is. A polyglot is a special file that has more than one type in the same file. For example, Ange Albertini demonstrated a polyglot which is a pdf, a pdf reader, a java executable and an html file inside of one file. The second polyglot he demonstrated was a file which had the characteristics that when you encrypted it with AES you get a PNG image and if it´s encrypted with another key you will get a flash video and when you encrypted it with DES you get a PDF document. He pointed out that a file format is not just a sequence of byte it´s rather a computer dialect to communicate between communities. He also highlighted that people don’t really care about what is behind the file format they only what to use it and communicate with other people.

The road to secure Smart Cars: ENISA approach

Fri, 01 Apr 2016 00:00:00 +0000

At TROOPERS16, Dr. Cédric LÉVY-BENCHETON an expert in cyber security at ENISA, the European Union Agency for Network and Information Security. Dr. Cédric LÉVY-BENCHETON holds a presentation about cyber security of IoT (Internet of Things) and smart cars he presents the current threats in IoT and Smart cars. ENISA is an agency of the European Union. ENISA assists the Commission, the Member States and, the business community in meeting the requirements of network and information security.

How easy to grow robust botnet with low hanging fruits (IoT) – for free

Thu, 31 Mar 2016 00:00:00 +0000

Attila Marosi works as a Senior Threat Research at Sophos Labs in Hungary. His talk focused on vulnerable IoT devices that are exposed to the internet. His approach was to look for vulnerable devices with low cost tools and publicly available data.

He started his talk with the spoiler that he is not going to reveal any new attacks nor new techniques. But newer data are more adequate and we can see the current state of vulnerable devices connected to the internet. This means his approach was to test the state of IoT devices like Routers, NAS and so on with publicly available data.

Medical Device Security: Hack or Hype

Wed, 30 Mar 2016 00:00:00 +0000

Kevin Fu is an Associate Professor at the University of Michigan where he directs the Archimedes Center for Medical Device Security and cofounded Virta Labs. At Troopers 16 he held a talk in the field of his research: medical device security.

He started his talk with a brief introduction how he got started with medical device security and how it has changed since he started. Round about ten years ago he started dumpster diving for medical devices to investigate how they are protected and maintained. In 2006 he held his first talk about medical device security at the FDA. In 2008 he presented a wireless replay attack against a pacemaker. In 2013 concerns about medical device security became more and more mainstream when the television series homeland featured an episode where the pacemaker of the American vice president was attacked resulting in his death. Now, instead of dumpster diving for medical devices, he works together with clinicians and has a lab for testing devices. The communication with clinicians is very important for his work, so he visits hospitals with his student so that they can learn how the process works on the inside.

IPv6 Security Summit – Track 2

Tue, 29 Mar 2016 00:00:00 +0000

The Troopers experience will never be the same without the “IPv6 summit”. It is one of kind of two-day special event where different security experts gather to discuss IPv6 current challenges. It addresses different topics ranging from a broad introduction of the IPv6 to how secure the protocol is and what the latest standards are.

The summit is divided into 2 different tracks that run simultaneously. For the first day on the second track, Christopher Werny and Rafael Schaefer have carried out the first three sessions.

SDR and non-SDR tools for reverse engineering wireless systems

Mon, 28 Mar 2016 00:00:00 +0000

Hey there!
The God of frequencies Michael Ossmann visited us again this year at the TROOPERS16 and showed us how to break another device using a specific setup.

Last time he introduced the HackRF One to us (Read here:https://www.insinuator.net/2014/08/hackrf-one-the-story-continues/), but this post is a short summary of his talk about “Rapid Radio Reversing”, he is a wireless security researcher, who makes hardware for hackers. Best known for the HackRF, Ubertooth, and Daisho projects, he founded Great Scott Gadgets in an effort to put exciting, new tools into the hands of innovative people.

The Joy of Sandbox Mitigations

Mon, 28 Mar 2016 00:00:00 +0000

This year at TROOPERS16 in Heidelberg we welcomed James Forshaw for his talk about “The Joy of Sandbox Mitigations“.

He is a security researcher in Google’s Project Zero. He has been involved with computer hardware and software security for over 10 years looking at a range of different platforms and applications. With a great interest in logical vulnerabilities he has numerous disclosures in a wide range of products from web browsers to virtual machine breakouts as well as being a Pwn2Own and Microsoft Mitigation Bypass bounty winner. He has spoken at a number of security conferences including Black Hat USA, CanSecWest, Bluehat, HITB, and Infiltrate.

How to crack a white-box without much effort

Wed, 02 Mar 2016 00:00:00 +0000

By: Philippe Teuwen (@doegox)

White-box cryptography is a relatively new field that aims at enabling safely cryptographic operations in hostile situations.
A typical example is its use in digital-right management (DRM) schemes, but nowadays you also find white-box implementations in mobile applications such as Host Card Emulation (HCE) and the protection of credentials to the cloud.
In all these use-cases the software implementation uses the secret key of a third-party which should remain secret from the owner of the device which is running this executable.

Pentesting with Metasploit #TR16 Training

Tue, 02 Feb 2016 00:00:00 +0000

In this year’s MSF training we will guide you through the typical steps of the pentest cycle: information gathering, attacking and looting your targets. For each step, demos and exercises will help you deepen and test your newly acquired knowledge. In addition to the typical penetration-test scenarios you will also learn several advanced aspects of the framework such as: how writing your own metasploit modules works, how to export payloads and make them undetected. With a final exercise each day you can finally challenge yourself and apply what you have learned!

TROOPERS16 Training Teaser: Dos and Don’ts of Secure Active Directory Administration

Wed, 27 Jan 2016 00:00:00 +0000

In the last few years, attack techniques which fall in the categories of “Credential Theft” or “Credential Reuse” have grown into one of the biggest threats to Microsoft Windows environments. Microsoft has stated more than one time, that nearly almost all of their customers that run Active Directory have experienced “Pass-the-Hash” (PtH) attacks recently.[1] Once an attacker gains an initial foothold on a single system in the environment it takes often less than 48 hours until the entire Active Directory infrastructure is compromised. To defend against this kind of attacks, a well-planned approach is required as part of a comprehensive security architecture and operations program. As breach has to be assumed[2], this includes a preventative mitigating control strategy, where technical and organizational controls are implemented, as well as preparations against insider attacks. This is mainly achieved by partitioning the credential flow in order to firstly limit their exposure and secondly limit their usefulness if an attacker was able to get them. Although we spoke last year at Troopers 15 about “How to Efficiently Protect Active Directory from Credential Theft & Large Scale Compromise”[3], we would like to summarize exemplary later in this post Active Directory pentest findings that we classified in four categories in order to better understand what goes typically wrong and thus has to be addressed. For a better understanding of the overall security goals, we classified the findings as to belonging as a security best practice violation of the following categories:

5th Round of TROOPERS16 Talks Accepted

Thu, 14 Jan 2016 00:00:00 +0000

Happy 2016 everyone! We are exactly 2 months away from the start of TROOPERS16!! Speakers and Trainers across the globe are polishing (or in some cases creating) their PowerPoints to use while delivering their highly technical and entertaining talks. While we here at TR HQ are busy tweaking orders, creating challenges to boggle the mind and test your skills, and of course working on some top secret fun. 😉

#BestWeekEver

Your TROOPERS Team

Another Perspective in Vulnerability Disclosure

Thu, 07 Jan 2016 00:00:00 +0000

As you know we (as in ERNW) are quite involved when it comes to vulnerability disclosure and we’ve tried to contribute to a discussion at several occasions, such as Reflections on Vulnerability Disclosure and ERNW Newsletter 50 Vulnerability Disclosure Reflections Case Study.

In this post I want to add (yet) another perspective, motivated by a disclosure procedure which just happened recently.

todb’s article, R7-2015-23: Comcast XFINITY Home Security System Insecure Fail Open is a well planned public forum vulnerability disclosure. The article itself is very well done: It gives credit to the researcher who discovered the vulnerability and it shows a vulnerability disclosure timeline where Rapid7 reached out to Comcast (the vendor). They even go a step further and publish the link showing the process for discovered vulnerabilities in a Rapid7 product as well as how Rapid7 handles disclosing those vulnerabilities they find in external products. For their internal disclosure process, they make sure to release a patch before “publicly announcing the vulnerability in the release notes of the update”(rapid7 disclosure).

4th Round of TROOPERS16 Talks Accepted

Tue, 22 Dec 2015 00:00:00 +0000

As we come to the end of the year we can’t help but take a moment to thank all of your who made TROOPERS15 special! It just makes us all the more pumped to kick it up a notch for TROOPERS16!! #BestWeekEver

Happy Holiday and much Joy to you in the New Year!

Your TROOPERS Team

===

Aaron Zauner: BetterCrypto: three years in
FIRST TIME TROOPERS SPEAKER

The BetterCrypto Project started out in the fall of 2013 as a collaborative community effort by systems engineers, security engineers, developers and cryptographers to build up a sound set of recommendations for strong cryptography and privacy enhancing technologies catered towards the operations community in the face of overarching wiretapping and data-mining by nation-state actors. The project has since evolved with a lot of positive feedback from the open source and operations community in general with input from various browser vendors, linux distribution security teams and researchers.

3rd Round of TROOPERS16 Talks Accepted

Thu, 17 Dec 2015 00:00:00 +0000

Here at TROOPERS HQ we are well into the Holiday (read TROOPERS) Spirit so we thought we would publish another round of talks! The current agenda can be found here.

Happy Holidays!

Your TROOPERS Team

===

2nd Day Keynote
FIRST TIME TROOPERS SPEAKER

Bio: Ben Zevenbergen joined the Oxford Internet Institute to pursue a DPhil on the intersection of privacy law, technology, social science, and the Internet. He runs a side project that aims to establish ethics guidelines for Internet research, as well as working in multidisciplinary teams such as the EU funded Network of Excellence in Internet Science. He has worked on legal, political and policy aspects of the information society for several years. Most recently he was a policy advisor to an MEP in the European Parliament, working on Europe’s Digital Agenda. Previously Ben worked as an ICT/IP lawyer and policy consultant in the Netherlands. Bendert holds a degree in law, specialising in Information Law.

2nd Rounds of TROOPERS16 Talks

Fri, 11 Dec 2015 00:00:00 +0000

Here’s the second round of TROOPERS16 talks. For more information check out our website: TROOPERS

Happy Holidays and all the best for 2016 to everybody!

Your TROOPERS Team

===

Ivan Pepelnjak: Real-life Software-Defined Security

Vendors, pundits, and industry media love to talk about Software-Defined Everything, but nothing ever changes in the enterprise world, right? Wrong. Some engineers are already solving security problems with a software-defined approach to networking and security, be it microsegmentation in NSX or OpenStack environment, building scale-out IDS clusters, or respond to DoS or intrusion events in real-time… and we’ll cover all these ideas in this fast-paced presentation

First Talks of TROOPERS 2016 Accepted!

Wed, 09 Dec 2015 00:00:00 +0000

Here’s the first round of TROOPERS16 talks. For more information check out our website: TROOPERS

Happy Holidays and all the best for 2016 to everybody!

Your TROOPERS Team

===
Mike Ossmann: Rapid Radio Reversing

Wireless security researchers have an unprecedented array of tools at their disposal today. Although Software Defined Radio (SDR) is the single most valuable tool for reverse engineering wireless signals, it is sometimes faster and easier to use other tools for portions of the reverse engineering process. I’ll discuss how beneficial a hybrid SDR/non-SDR approach has been to security researchers, and I’ll walk through an example of the process.

Blog 5: Beyond the Thunderdome:
A Review of TROOPERS15

Wed, 03 Jun 2015 00:00:00 +0000

The final blog in our series “Beyond the Thunderdome: A Review of TROOPERS15” focuses Exploitation & Attacking. With the last of this series we hope we you are already fired up and inspired for what lays a head during our upcoming TROOPERS16 (March 14-18, 2016)! Can’t wait to see you there!

“The old is new, again. CVE20112461 is back” talk created and given by Luca Carettoni and Mauro Gentile

Blog 4: Beyond the Thunderdome:
A Review of TROOPERS15

Mon, 01 Jun 2015 00:00:00 +0000

We hope you are enjoying the ride as we continue our journey through IPv6. Below we have a great mix of talks, slides, and videos in this area posted below. We look forward to hosting more IPv6 (March 14^(th) & 15^(th)) talks next year at TROOPERS16!

“New Features of the SI6 Networks’IPv6 Toolkit” talk created and given by Fernando Gont

The IPV6 Toolkit was originally developed for UK CPNI in an effort to enhance and be able to test the current state of IPv6 security. The toolkit itself was mainly developed for security analysis and trouble shooting of IPv6 networks and implementations. It is running on a wide range of *nix based systems (this probably is considered painful to support given that low level implementation of network functions) and release under the GPL. You can directly check it out here: https://github.com/fgont/ipv6toolkit.

Blog 3: Beyond the Thunderdome: A Review of TROOPERS15

Fri, 29 May 2015 00:00:00 +0000

Welcome to the third edition of “Beyond the Thunderdome: A Review of TROOPERS15”. The focus today is on IPv6 and Data Center Networks, so kick back and enjoy the following talks and videos. And as always, check out our website www.troopers.de for details on TROOPERS16 March 14-18, 2016.

“Enabling and Securing IPv6 in Service Provider Networks” talk created and given by Tarko Titan

Telekom.ee had no IPv6, 8 moths ago. They deployed IPv6 in about 4 weeks and by now about 6% of all transported traffic is IPv6 traffic. Actually the 4 weeks timeframe is a bit too optimistic but more on that later. Tarko first explains the biggest problems in the network migration, which were the access network and the Customer -Provider Edge (CPE). Also Telekom Estonia doesn’t want to make a tradeoff at security in the IPv6 deployment.

Blog 2: Beyond the Thunderdome:
A Review of TROOPERS15

Wed, 27 May 2015 00:00:00 +0000

Today’s focus in our blog series will cover large-scale environments: Cryptography in Cloud environments and Network Automation. Since these topics will only become more important over time stay tuned for our TROOPERS16’s developing agenda to see what new talks will be available (or submit your own talk during our Call for Papers starting in August via our new CFP Submission tool!)

“Crypto in the Cloud” talk created and given by Frederik Armknecht

Beyond the Thunderdome:
A Review of TROOPERS15

Mon, 25 May 2015 00:00:00 +0000

Here in Heidelberg we are already gearing up for TROOPERS16 (taking place from 14th to 18th March 2016!). While you are preparing for our Call for Papers or waiting eagerly to sign up for your spot in one of our legendary trainings take a look at our newest blog series “Beyond the Thunderdome: A Review of TROOPERS15”. It may offer some inspiration, help you kill time while waiting for next year’s TROOPERS, or for those that are new to our conference, give you a taste for what TROOPERS is all about. See you soon at TROOPERS16!

Niki Vonderwell on Insinuator.net - Bold Statements

Active Directory Security Summit 2018, 13th. of November of 2018

TROOPERS18 Photos online!

#TR18 Attack & Research Summaries

Reverse Engineering Blackbox Systems with GreatFET & Facedancer by Kate Temkin and Dominic Spill

#TR18 Defense & Management Summaries

All Your Cloud Are Belong to Us

#TR18 Next Generation Internet (NGI) Summaries

NGI Keynote by Graeme Neilson

#TR18 SAP Security Summaries

SAP IGS : The ‘vulnerable’ forgotten component by Yvan Genuer

Extracting data from an EMV (Chip-And-Pin) Card with NFC technology

Get your hands dirty playing with RFID/NFC

White Paper on Incident Analysis and Forensics in Docker Environments

Announcing the first 5 talks of TROOPERS18!!!!

TROOPERS for Students!

Black Hat 20 & DEFCON 25

DevOps, Continuous Deployment & Agile Security September 7, 2017

Docker Security & (Sec) DevOps Training July 19-20th

Active Directory Security & Secure Operations July 18, 2017

TR17 Training: Crypto attacks and defenses

3rd Round of TROOPERS17 Talks

TR17 Training: Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer

2nd Rounds of TROOPERS17 Talks!

CCS’16 – Day 2 – 25th October 2016

Introduction & CCS’16 – Day 1 – 24th October 2016

Announcing the first 5 talks of TROOPERS17!!!!

IoT Insight Summit November 15, 2016

Defense & Management Day 2

Building a secure and reliable IPv6 Guest Wi-Fi Network by Christopher Werny

Caring for file formats

The road to secure Smart Cars: ENISA approach

How easy to grow robust botnet with low hanging fruits (IoT) – for free

Medical Device Security: Hack or Hype

IPv6 Security Summit – Track 2

SDR and non-SDR tools for reverse engineering wireless systems

The Joy of Sandbox Mitigations

How to crack a white-box without much effort

Pentesting with Metasploit #TR16 Training

TROOPERS16 Training Teaser: Dos and Don’ts of Secure Active Directory Administration

5th Round of TROOPERS16 Talks Accepted

Another Perspective in Vulnerability Disclosure

4th Round of TROOPERS16 Talks Accepted

3rd Round of TROOPERS16 Talks Accepted

2nd Rounds of TROOPERS16 Talks

First Talks of TROOPERS 2016 Accepted!

Blog 5: Beyond the Thunderdome: A Review of TROOPERS15

Blog 4: Beyond the Thunderdome: A Review of TROOPERS15

Blog 3: Beyond the Thunderdome: A Review of TROOPERS15

Blog 2: Beyond the Thunderdome:A Review of TROOPERS15

Beyond the Thunderdome:A Review of TROOPERS15

Blog 5: Beyond the Thunderdome:
A Review of TROOPERS15

Blog 4: Beyond the Thunderdome:
A Review of TROOPERS15

Blog 2: Beyond the Thunderdome:
A Review of TROOPERS15

Beyond the Thunderdome:
A Review of TROOPERS15