When we wrote our initial blogpost regarding the
evasion of Cisco ACLs by (Ab)Using IPv6,
where we described
(known to Cisco)
cases of Access Control Lists (ACL) circumvention, we also suggested some
mitigation techniques including the blocking of some (if not all) IPv6 Extension
Headers.
Almost a month later, we got
a comment
from Matej Gregr that, even if the ACLs of certain Cisco Switches are
configured to block IPv6 Extension headers like Hop-by-Hop or Destination
Options headers, this does not actually happen/work as expected. Of course this
made us re-visit the lab in the interim ;-).
Breaking
The patient’s last words: I am not a target!
Last week I gave a short interview for Süddeutsche Zeitung on the security of medical devices. You can find it here. Unfortunately it is in German so I decided to sum up some of my key points that made it into the article and some that didn’t in this blog post.
The medical devices that we have been looking into include patient monitors, syringe pumps, EEGs, home monitoring devices and an MRI. All of these devices had major flaws that look like they came straight out of the 90s. Sometimes, we were able to crash the machines by simply doing a port scan, sometimes we could get around access controls protecting PIN codes of devices, and in most cases we were able to render the machine unusable. All these attacks were performed over the network and no physical access to the device was needed.
Continue reading Continue readingTACACS+ module for loki
There has been, again, some development within the loki domain. Today I’m going to write about the latest module added to the suite, a module for decoding and cracking Cisco’s TACACS+.
TACACS is the Terminal Access Controller Access-Control System, a protocol for handling remote user authentication and central access control. It originated in 1984 and was used in the old Unix world. TACACS+ is a related protocol developed by Cisco Systems and is widely used for AAA (Authentication, Authorization, Accounting) on IOS based devices. It was released as an open standard in 1993 (and expired in 1998 by the way ;-)).
Continue reading Continue readingAnalysis of an Alarm System – Part 2/3
A few days later than planned (sorry about that), but here we go with part 2 (Part1) and the demodulation/analysis part.
Initial Analysis
To analyse a captured signal, the tool baudline seems to be the best way at the
moment. So we open it with the following options and have a closer look
(ContextMenu->Input->Open file):
After using the open button, you should be able to see something similar to this:
Continue reading Continue readingCar Hacking Lab – Work in Progress
We just wanted to share some impressions from our car hacking lab:
https://www.insinuator.net/wp-content/uploads/2015/04/car_lab2.mp4
stay tuned,
The ERNW Car Hacking Team
Continue reading
Analysis of an Alarm System – Part 1/3
Introduction
This and the following two posts should serve as a step-by-step guide through
the whole process of analyzing a radio frequency black box, demodulate and
understand the data transfered and finally modulate our own data in order to
e.g. perform a brute force attacks.
The information provided and the results are immensely inspired by Michael Ossmann and the workshops he has given at our location. Visit him and his great tool HackRF at https://greatscottgadgets.com/hackrf/ !
Continue reading Continue readingGeneral Pr0ken Filesystem – Hacking IBM’s GPFS
This post is a short wrap-up of our Troopers talk about the research we did on IBM’s General Parallel File System. If you are interested in all the technical details take a look at our slides or the video recording. We will also give an updated version of this talk at the PHDays conference in Moscow next month.
The IBM General Parallel File System is a distributed file system used in large scale enterprise environments, high performance clusters as well as some of the worlds largest super computers. It is considered by many in the industry to be the most feature rich and production hardened distributed file system currently available. GPFS has a long and really interesting history, going back to the Tiger Shark file system created by IBM 1993.
Continue reading Continue readingApple iOS PIN Bruteforce
Over the past few weeks, multiple news sites have covered some mystical approach to bruteforce PINs on Apple iOS devices. All articles cover a black box called IP Box, the fact that PINs can be broken and that sometimes the automatic wipe after 10 failed tries can be circumvented. Sadly, as often, the what is described but not the how……
This blog post will give you a simple overview of both the practical attacks and the vulnerabilities behind them. Although the Headings don’t quite give away the content, the post starts with a simple PIN bruteforce against iOS 7.x and then goes over to a more advanced attack on iOS 8.x and a few technical details on the “black box”.
Continue reading Continue readingXML External Entity (XXE) Injection in Apache Batik Library [CVE-2015-0250]
During one of our latest web application code review projects I came across a vulnerability for which I think it is worth to speak about. It is an injection based attack against XML parsers which uses a rarely required feature called external entity expansion. The XML specification allows XML documents to define entities which reference resources external to the document and parsers typically support this feature by default. If an application parses XML input from untrusted sources and the parsing routine is not properly configured this can be exploited by an attacker with a so called XML external entity (XXE) injection. A successful XXE injection attack could allow an attacker to access the file system, cause a DoS attack or inject script code (e.g. Javascript to perform an XSS attack).
Continue reading Continue readingRevisiting Xen’s x86 Emulation: Xen XSA 123
In my last blog post, I gave an overview about recent vulnerabilities discovered in the x86 emulation layer of Xen. While both of the discussed vulnerabilities only allow for guest privilege escalation, the complexity of the involved code seemed to indicate that even more interesting bugs could be discovered. So I spent some time searching for memory corruption issues and discovered a very interesting bug that resulted in XSA 123 . This post gives an overview about the root cause of the bug and a short description of exploitation challenges. A follow-up post will describe possible exploitation strategies in more detail.
Continue reading Continue reading