Juan Perez-Etchegoyen
(@jp_pereze) and
Mariano Nunez
(@marianonunezdc)
from Onapsis here, thrilled to be
troopers for the third time! In this post we want to
share with you a glimpse of what you will see regarding SAP security at this
amazing conference.
Last week we released advisories regarding several vulnerabilities affecting SAP
platforms. Some of these vulnerabilities are in fact very critical, and their
exploitation could lead to a full-compromise of the entire SAP
implementation – even by completely anonymous attackers. Following our
responsible disclosure policy, SAP released the relevant SAP Security Notes
(patches) for all these vulnerabilities a long time ago, so if you are an SAP
customer make sure you have properly implemented them!
Reverse engineering is generally thought of as using debuggers, disassemblers
and hex editors. Much as I love hex editors, IDA and staring at opcodes for the
last few years I have been focused on applying my reverse engineering
methodology to larger, composed systems. At
Troopers TelcoSec day
this year I will be presenting
Bluevoxing
which demonstrates how this approach works.
Bluevoxing
is about reverse engineering how web based “audio one time password” systems
work. Simply put audio one time password systems use a short audio file as an
authentication token. When I discovered these systems I was intrigued as
reversing them would involve a range of techniques and tools from web testing,
audio tools, signal analysis, phreaking and cryptanalysis. The disassembler
would be of no use instead I would have to employ audio tools such as audacity
and ruby-processing.
Mobile devices play an important role in the business world. Yet with increased
emphasis on the Bring Your Own Device (BYOD) model, defenses are not where they
need to be to slow the loss of valuable intellectual property.
Corporate defenses have traditionally focused on the network, the endpoints, and
not necessarily on the ecosystem of how these devices interact outside of
network sockets. Smartphones bring unique network connectivity, an array of
sensors, and can be overlooked by resources invested on IDS/IPS not being
effectively leveraged.
IPv6 introduces a lot of new features and consequently, a lot of new
capabilities. Obviously, the most significant of them is the huge address space
that it offers. However, this is not the only one. IPv6 also introduces the use
of the IPv6 Extension Headers. The IPv6 header has been considerably simplified
in comparison with IPv4 one. On the other hand, the IPv6 Extension Headers, not
only do the “job” of most of the fields which were removed from the main header,
but, additionally, they add many more. However, any new “technology” creates new
attack opportunities and a “new” protocol, such as IPv6 could not be an
exception, especially since its design and implementation is more complicated
than it’s predecessor.
It has been a year since fragmentation attacks in IPv6 were last examined
publicly (in
Black Hat Europe 2012).
Issues well known from the IPv4 era appeared again in IPv6. Surprisingly enough,
some of the most popular Operating Systems (OS), included ones considered
“secure”, were proven to be vulnerable to such attacks, although fragmentation
overlapping is strictly forbidden in IPv6 since 2009 (RFC5722). Some other OS,
although in a better shape, still appeared to have some issues in specific
cases.