Events on Insinuator.net - Bold Statements

#TROOPERS26 AD & Entra ID Security Track

Tue, 11 Aug 2026 00:00:00 +0000

The #TROOPERS26 ‘AD & Entra ID Security’ track delivered an incredible experience – much like the entire conference! We were thrilled to host some of the brightest minds in identity research alongside a highly engaged audience who brought valuable insights to the roundtable discussions. While the presentation slides have already been published on the TROOPERS website, several speakers have shared complementary tools, in-depth blog posts, and active social media threads. To make things easy, we’ve compiled a comprehensive list of all these fantastic resources from the track below.

TROOPERS26: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection

Mon, 29 Jun 2026 00:00:00 +0000

Last week I gave a talk at #TROOPERS26: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection. I discussed the challenges of incident analysis, such as increasing storage capacities and the lack of integration between tools. I presented a modular framework that integrates established forensic and analysis tools using a decision-tree-based control mechanism. A workflow was designed to control the execution of 14 integrated analysis tools in order to reproduce the manual analysis process usually performed by analysts. Moreover, the framework is capable of identifying whether a system has been compromised and compiles a analyst-oriented report. Together with the audience we took a look at the report in a live demonstration. The evaluation results of the framework were promising as it was able to identify all compromised systems. However, a significant number of false positive classifications were also observed. To improve the framework possible future extensions include functionality such as recovering already deleted files to detect missed Indicators of Compromise. Additionally, our team want to integrate artificial intelligence in the workflow to help in data processing and make more decisions automatically. The slides will be published next week on the conference website. I will add the link in this blog post when they become available. A more detailed description of the content of the talk can be found in the following sections. Looking forward to #TROOPERS27!

Heads-up: TROOPERS Roundtable – Supply Chain Security

Mon, 22 Jun 2026 00:00:00 +0000

How to strengthen Supply Chain Security: Practical Exchange and Roadmap

Join an open, practitioner-focused roundtable for direct exchange on supply chain security. This session offers a concise overview of core concepts, e.g. SBOM, CSAF, and VEX and digs into the processes behind them: how to obtain, process and apply information to improve security across the supply chain.

We will examine:

How SBOM, CSAF and VEX relate and why version-level detail matters.
The practical value of an SBOM and why it’s increasingly required by law and IT procurement.
How to create and consume SBOMs?
Methods to identify dependencies in the context of vulnerabilities.
Approaches to triage: not all vulnerabilities affect every stakeholder equally.
Techniques to analyze vulnerabilities and identify affected products and product families.
Sources of vulnerability information and how to map data unambiguously to products and specific software versions.
Reporting obligations: where and how to disclose vulnerabilities.
Tools and automation that help manage information volume and complexity.
Technical, organizational and personnel challenges to achieving end-to-end supply chain security.
The role of AI in supply chain security.
How do we protect ourselves from malicious actors / infected dependencies?
The Cyber Resilience Act (CRA): implications for companies, products and consumers, the CRA roadmap, and concrete deadlines and actions.
We will show a live demonstration of the whole process, e.g. covering the consumption of SBOMs, vulnerability identification and assessment, creation of VEX documents.

This roundtable is designed for security practitioners, product owners, compliance officers and decision-makers who want actionable guidance and peer discussion. Expect candid conversation, real-world examples and next steps you can take to strengthen resilience across your supply chains.

MCTTP 2025 / Keynote

Mon, 20 Oct 2025 00:00:00 +0000

Three weeks ago, I attended MCTTP 2025 in Munich, organized by Vogel IT and curated by the fine folks Florian Hansemann, Dr. Marc Maisch, and Florian Oelmaier. Awesome event with some very cool talks, and great conversations over dinner and most notably at the Oktoberfest on Saturday (thanks again for that special trip, Flo!). I had the pleasure and honor to give the keynote on the 2nd day. The goal was to make it a bit entertaining and enlightening for the international audience, so I covered some German literature, too ;-). The slides can be found here, and the transcript here. Looking forward to meeting some folks again next year, maybe even at TROOPERS26 😉

#TROOPERS25 AD & Entra ID Security Track

Thu, 14 Aug 2025 00:00:00 +0000

The #TROOPERS25 ‘AD & Entra ID Security’ track was a blast – as was the whole conference 😉 – bringing together some of the smartest researchers in the field and a great audience of practitioners willing to share their experiences during the roundtable. The slides of the talks have been released in the interim on the TROOPERS website, but since many speakers published additional blogposts or released tools, we provide a compilation of resources from the track in the following.

TROOPERS24 Agenda Preview: Active Directory & Entra ID Security Track

Fri, 14 Jun 2024 00:00:00 +0000

Hi,

are you curious about the agenda of the Active Directory- & Entra ID security track at TROOPERS24? Here’s a sneak peak of the already published tracks:

Wednesday, 2024-06-26:

A Decade of Active Directory Attacks: What We’ve Learned & What’s Next – Sean Metcalf
ADillesHeel: Making the Impossible Possible in AD Attack Path Analysis – SHANG-DE JIANG
So You Performed A Forest Recovery. How Do You Reconnect Your AD Again With Azure AD? – Jorge de Almeida Pinto
Decrypting the Directory: A Journey into a static analysis of the Active Directory NTDS to identify misconfigurations and vulnerabilities – Bastien Cacace (XMCO company)
Say Hello to your new cache flow! – Geoffrey Bertoli, Rémi Jullian
Analyzing and Executing ADCS Attack Paths with BloodHound – by Andy Robbins, Jonas Bülow Knudsen

Thursday, 2024-06-27:

The (almost) complete LDAP guide – Sapir Federovsky
Exploiting Token-Based Authentication: Attacking and Defending Identities in the 2020s – Dr Nestori Syynimaa
Attacking Primary Refresh Tokens using their MacOS implementation – Olaf Hartong, Dirk-jan Mollema
Misconfiguration Manager: Overlooked and Overprivileged – Duane Michael, Chris Thompson
The Registry Rundown – Cedric Van Bockhaven, Max Grim

The full conference agenda including timeslots will be published soon at TROOPERS24. The trainings are already sold out, but a handful of tickets is currently left. Stay tuned & make the world a safer place!

Summary of 'Software-Defined Radio applied to security assessments' at Troopers21

Tue, 20 Apr 2021 00:00:00 +0000

The training Software-Defined Radio applied to security assessments was held by Sébastien Dudek at Troopers21 and was remotely organized – like most other events – due to Covid-19. Once we were all caffeinated, we had an exciting journey through basically all things radio.

We started with the technical and physical basics in radio technology, such as various sorts of antennas, analog to digital coding (and backward), encoding schemes, and general risks and possible vulnerabilities of using radio devices. Commonly found vulnerabilities include the following:

ACM WiSec 2020

Sun, 26 Jul 2020 00:00:00 +0000

Last week I attended ACM WiSec. Of course, only virtually. The first virtual conference I attended. Coincidentally, it was also the first conference I presented at. While the experience was quite different from a “real” conference, the organizers did a great job to make the experience as good as possible with, for example, a mattermost instance to interact with other conference participants.

In the following, I will list a few talks and papers that I either found very interesting or that generally stood out to me:

TROOPERS20 Training Teaser: Attack And Defence In AWS: Chaining Vulnerabilities To Go Beyond The OWASP Top 10

Thu, 27 Feb 2020 00:00:00 +0000

Attackers are everywhere. They are now on the cloud too! Attacking the most popular cloud provider – AWS, requires the knowledge of how different services are setup, what defences do we need to bypass, what service attributes can be abused, where can information be leaked, how do I escalate privileges, what about monitoring solutions that may be present in the environment and so on! We try to answer these questions in our intense, hands-on scenario driven training on attacking and subsequently defending against the attacks on AWS.

TROOPERS20 Training Teaser: Hacking Node.js & Electron apps, shells, injections and fun!

Thu, 06 Feb 2020 00:00:00 +0000

Did you know that in the ever evolving field of Web and Desktop apps, it turns out these can all now be powered with JavaScript? You read that right: JavaScript is now used to power both web apps (Node.js) as well as Desktop apps (Electron). What could possibly go wrong?

So, the burning question is: how does this affect Web and Desktop app security? If you want to find out, come to our training and you will experience this in a 100% hands-on fashion! 🙂

Blackhoodie@Troopers 2020

Mon, 27 Jan 2020 00:00:00 +0000

Once again, we are super excited to announce that Blackhoodie is happening at Troopers 2020. This is the 3rd time that Blackhoodie is joining with Troopers. As always, one of the main motivation for Blackhoodie is bringing more women into reversing and other core security topics. So we would like to see more women apply to the training slots. However, if you are not a woman and still feel really excited about Blackhoodie, you are welcome to apply. The registration is open now. Please hurry up and make your registration now. We will close the registration once the seats are filled up with enough quality submissions. We do have a very limited number of seats at this training site. So we apologize in advance if we can’t accommodate everyone, even though we wish we could!

TROOPERS20 Training Teaser: TLS in the Enterprise – Post Quantum Security

Mon, 09 Dec 2019 00:00:00 +0000

Our workshop “TLS in the enterprise” was held for the first time at Troopers 2018 and was our special contribution to the IT Security world to increase the usage of TLS and point out the pitfalls, when switching to TLS.

But time is changing and TLS is a kind of standard nowadays, at least when looking at HTTPS, but there are still a lot of things to do regarding other protocols like

TROOPERS20 Training Teaser: Swim with the whales – Docker, DevOps & Security in Enterprise Environments

Mon, 02 Dec 2019 00:00:00 +0000

Containerization dominates the market nowadays. Fancy buzzwords like continuous integration/deployment/delivery, microservices, containers, DevOps are floating around, but what do they mean? What benefits do they offer compared to the old dogmas? You’re gonna find out in our training!

We are going to start with the basics of Docker, Containers and DevOps, but soon you’ll end up with your own applications running inside containers with the images residing in your own registry. Of course, following the microservices approach, and the second day hasn’t even started.After the fundamental topics of containerization are understood, you’re going to create and operate your own Kubernetes cluster. A lot of fun and challenging exercises lie ahead, to give you hands-on experience with all the technologies.

BASTA! Autumn 2019 – Security in DevOps

Thu, 28 Nov 2019 00:00:00 +0000

Some time ago I had the pleasure to speak at the BASTA! Autumn 2019 conference. There, I promised to publish my slides such that they can be used as a reference for developers and security guys like me. And with this blog post I would like to hold up to my promise.

Overall, the talk was about the challenges of “How to bring security into modern DevOps processes”. Hence, I demonstrated how security can be integrated more or less seamlessly into the modern agile software development workflow. I proposed some risk-depended recommendations about which measurements should be established, for example, within the CI pipeline.

TROOPERS20 teaser: Hacking mobile apps

Thu, 28 Nov 2019 00:00:00 +0000

“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process our bank transactions, handle our private data and set us up on romantic dates. However, few of us care to wonder,”How (in)secure can these apps be?” Well… at Troopers 20, you can learn how to answer this question yourself!

In our 2 day long “Hacking mobile apps” workshop, we teach how to find security vulnerabilities in mobile apps, exploit them and defend against them. We start from scratch, therefore no prior experience in hacking or developing mobile apps is required. Whether you want to learn how to pentest mobile apps, you are an app developer that fancies to secure his/her apps, or just curios, our workshop is a jumpstart to your goal.

TROOPERS20 Training Teaser: Insight Into Windows Internals

Mon, 25 Nov 2019 00:00:00 +0000

Windows 10 is one of the most commonly deployed operating systems at this time. Knowledge about its components and internal working principles is highly beneficial. Among other things, such a knowledge enables:

in-depth studies of undocumented, or poorly documented, system functionalities;
development of performant and compatible software to monitor or extend the activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.

The “Insight into Windows Internals” training offered at TROOPERS20 delivers knowledge on the core components and inner working principles of Windows 10. For example, the training provides knowledge on how Windows 10 uses virtualization to isolate security-critical functionalities from attackers that have managed to compromise the system. The training includes a variety of practical exercises allowing attendees to observe first-hand the operation of Windows 10.

DevSecCon19 London – How to Secure OpenShift Environments and What Happens If You Don´t

Tue, 19 Nov 2019 00:00:00 +0000

This week I was at DevSecCon in London to present my current research on Red Hat OpenShift. In this talk, I gave a brief introduction to OpenShift, demonstrated some threats that exist for such environments, and dived into different configuration issues that may affect the security of OpenShift environments. The implications of misconfigurations of such an environment have been shown in live demos.

You can find the slides for my talk here.

TROOPERS20 Training Teaser: Hacking 101

Thu, 07 Nov 2019 00:00:00 +0000

Hi there,
like in recent years the popular Hacking 101 workshop will take place on TROOPERS20, too! The workshop will give you an insight into the hacking techniques required for penetration testing. These techniques will cover various topics:

Information gathering
Network scanning
Web application hacking
Low-level exploitation

…and more!

During this workshop you will learn, step by step, a testing methodology that applies to the majority of scenarios. So imagine you have to assess the security of a system running on the Internet. How would you start? First, you need a good understanding of the target, including running services or related systems. Just scanning the target’s IP address will most likely not reveal all relevant information you can get. In the information gathering step, you will learn where you could find more relevant information than just a list of open ports. A brief understanding of the target and it’s related systems/services/applications will make scanning and identifying vulnerabilities a lot easier and more effective. Then, the last step will be the exploitation of the identified vulnerabilities, with the ultimate aim to get access to the target system and pivot to other, probably internal, systems and resources.

TROOPERS20 Training Teaser: Windows & Linux Binary Exploitation

Mon, 04 Nov 2019 00:00:00 +0000

We are happy to announce that TROOPERS20 will feature the 5th anniversary of the popular Windows & Linux Binary Exploitation workshop!

In this workshop, attendees will learn how to exploit those nasty stack-based buffer overflow vulnerabilities by applying the theoretical methods taught in this course to hands-on exercises. Exercises will be performed for real world (32-bit) software such as the Foxit Reader Plugin for Firefox, Wireshark, and nginx.

Each exercise will start with an initially uncontrolled overwrite of the instruction pointer register by a stack-based buffer overflow vulnerability. From there on, we will work our way through many obstacles to finally gain remote code execution. Obstacles that will be encountered during the exercises include modern stack-based buffer overflow defense mechanisms such as stack cookies, data execution prevention (DEP), and address space layout randomization (ASLR). For all of these defense mechanisms, attendees will learn and apply certain methods to bypass the protection.

Medical Device Security Summit 2019, 19th of November of 2019

Wed, 09 Oct 2019 00:00:00 +0000

*This event will be held in German*

Inspiriert durch die erfolgreichen Round-Table-Diskussionen der TROOPERS-Konferenz freuen wir uns, Ihnen heute mit dem Medical Device Security Summit 2019, eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einem Eröffnungsvortrag von Peter Hecko (Leiter der IT-Sicherheit bei HELIOS IT Service GmbH, Podcaster und jahrelanges Mitglied im CCC), gefolgt von Fallstudien und Vorträgen von ERNW Experten und weiteren Referenten aus der Lehre, Industrie und klinischer Praxis.

TelcoSecDay 2020 CFP is open

Mon, 23 Sep 2019 00:00:00 +0000

We are back again with another TelcoSecDay 2020 (TSD20) which is going to happen on March 16th, 2020 as an additional event to TROOPERS. This year, it is going to be on Monday of the TROOPERS week. We are delighted to inform that the event is happening for the 9th year in a row. The CFP is open now. If you have an interesting topic related to the field of Telco Security, please make a submission. The deadline is November 17, 2019. The final notification for TSD submission is December 20, 2019.

Black Hat US 2019 / Some Talks

Tue, 13 Aug 2019 00:00:00 +0000

I’ve been at Black Hat Vegas last week and in the following I’ll shortly discuss some talks I’ve attended and which I found interesting.

Gabriele Fisher & Luke Valenta: Monsters in the Middleboxes. Building Tools for Detecting HTTPS Interception

This talk was about identifying if inbound HTTPS traffic reaching a server had been intercepted by a middlebox (or its software equivalent which is usually called “middleware”, a prominent example being the Lenovo Superfish piece a few years ago) on its path.

Back from PowerShell Conference Europe…

Wed, 12 Jun 2019 00:00:00 +0000

The PowerShell Conference Europe 2019 took place last week in Hannover, and I had the pleasure to attend and speak for the second year in a row. I want to thank @TobiasPSP @Alexandair @sqldbawithbeard and the @PSConfEU crew for putting up this #PowerShell feast. From a RaspberryPi to the Clouds, from PowerShell internals to a dancing Lego robot, if you have anything to do with windows, PowerShell, or a computer, there was some content made for you…[I will update this post with links as soon as the videos are published. Make sure to check it out.]

#TR19 Next Generation Internet (NGI) Summaries

Thu, 02 May 2019 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS19 Active Directory Security Track.

Microsoft IT (Secure) Journey to IPv6-Only

Veronika McKillop, Network Architect, Cloud and Connectivity Engineering (CCE)

The speaker, Veronika McKillop, working at Microsofts network infrastructure services, has given a talk about the process of switching a company network from IPv4 to IPv6-only.

Within the talk the following topics were introduced: Dual Stack, Drivers for IPv6, Status of IPv6 in Networks and Security in IPv6 Networks. The talk covers the reasons why a company would like to switch from IPv4 to IPv6. Technics like NAT64 and DNS64 are introduced. The requirements to software and especially drivers to work in IPv6 environments are described. Also the problems to switch from IPv4 to IPv6-only in heterogeneous networks are addressed.

#TR19 Active Directory Security Summaries

Tue, 30 Apr 2019 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS19 Active Directory Security Track.

From Workstation to Domain Admin: Why Secure Administration Isn’t Secure and How to Fix It by Sean Metcalf

Active Directory is probably used in almost every corporation today to administer all kinds of Authorization, Authentication and Privileges. This means they are valuable targets for attackers, because once compromised they could do whatever they want. This would be the worst case scenario, right? Therefore securing AD is important and this year TROOPERS19 featured a whole track solely for AD Security.

#TR19 Attack & Research Summaries

Mon, 29 Apr 2019 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS19 Attack & Research Track.

VXLAN Security or Injection, and protection

The talk “VXLAN Security or Injection, and protection” was held by Henrik Lund Kramshøj, who is the owner of Zencurity ApS, a small security company located in Denmark.

Henrik gives an overview about lesser known VXLAN insecurities, mostly packet spoofing.

In the end he gives advice how to protect against this attacks.

DMEA 2019: A reunion with the Medical Informatics Community

Mon, 29 Apr 2019 00:00:00 +0000

Earlier this month I attended the Digital Medical Expertise & Applications (DMEA) 2019. The DMEA fair in Berlin (formerly conhIT) is the central platform for digital health care as it brings together companies of health IT, academic institutions, politics and healthcare delivery organizations in several format such as innovation hubs and talks during congress sessions as a part of the industry fair. I participated in a congress session about IT security in healthcare with a talk about medical device security and common security flaws in medical devices. Some of the aspects have also been covered in my talk at #TR19 [1].

Troopers & Chill…

Fri, 26 Apr 2019 00:00:00 +0000

As promised in my previous post, I am back for an overview of the Troopers19 – Active Directory related talks… Videos have been published and it’s popcorn time… So if you are into stories about Kingdoms and Crown Jewels, grab your loved one [or a drink…] and turn the lights down low, ’cause tonight it’s “Troopers & Chill…”

Warning: Don’t watch it all in one go… or you will start to feel some anxiety and pain…
and then the Flying Dutchman will move to the cloud… And at that point we are not insured anymore.

Upcoming ISH Conference

Wed, 03 Apr 2019 00:00:00 +0000

We’re happy to announce that some fine folks of ERNW will be present at the upcoming ISH Conference.

The next generation IT security training facility for all industries and any institution that manages complex infrastructure invites you to join the first ISH Conference about threats, prevention and response in Information Security on May 6th– 9th, 2019.
The event consists of two days of conference and two days of training with insights and shared knowledge by world leading experts at the Information Security Hub (ISH) Munich Airport.
Learn and discuss the newest threats and solutions with world-renowned experts like Eugene Kaspersky, Adam Meyer, Adrian Nish and others.

The “mmm…” in Community

Thu, 28 Mar 2019 00:00:00 +0000

When I got home last weekend after an awesome week at WEareTROOPERS, my 5yr old asked me what actually happened in Heidelberg…
I told him we were meeting with some people from all over the world to talk about computer security, and he asked me if it was “to stop the bad guys, like super-heroes?”. So I told him “yes, kind of…”, and he decided he would take his new Troopers T-Shirt to school on Monday to show his classmates. Kids are truly amazing… [<3 <3 <3]

Binaries, shellcoding, bug hunting, ROP gadgets and more at Blackhoodie@TR19

Fri, 01 Mar 2019 00:00:00 +0000

We have the most amazing trainers this year lined up for Blackhoodie at Troopers 2019. We have Thais, Silvia, Lisa and Ninon going to give workshops on various interesting topics! Below are some of the workshop contents:

64-bit shellcoding and introduction to buffer overflow exploitation on Linux by Silvia Väli

64-bit shellcoding and introduction to buffer overflow exploitation on Linux is a 3 hour workshop which is essentially divided into 3 parts:

Introduction to 64-bit architecture in order to get familiar with registers, stack, calling conventions described in the Intel 64 (x86-64) architecture manual and the most common assembly instructions and syscalls which we will later use to write our shellcodes.
Shellcoding where we try different techniques to write the shellcode and of course you gonna get to greet the shellcoding world with your own Hello World shellcode in addition to reverse shell which we will use later on in part 3
Introduction to buffer overflows, so you can put your newly received know-how about stack into practise right away. Shellcode without being used is a wasted shellcode! Part 3 ends with a buffer overflow challenge where your goal is to use your reverse shellcode to get a connection back to your machine.

Objectives:

Offensivecon 2019

Wed, 20 Feb 2019 00:00:00 +0000

Hi,

Last week I had the pleasure to attend Offensivecon 2019 in Berlin. The conference was organized very well, and I liked the familial atmosphere which allowed to meet lots of different people. Thanks to the organizers, speakers and everyone else involved for this conference! Andreas posted a one tweet tldr of the first day; fuzzing is still the way to go to find bugs, and mitigations make exploitation harder. Here are some short summaries of the talks I enjoyed.

TelcoSecDay 2019 – First talks preview

Tue, 29 Jan 2019 00:00:00 +0000

This year we had some excellent submissions for TelcoSecDay. Here are the first four confirmed speakers who are going to talk about the below mentioned topics:

1. Telecom protocols revisited – Not just a signalling problem – by Fredrik Söderlund

A look at the design of the currently deployed signalling protocols for core networks, both SS7 and Diameter (legacy and LTE). Peculiar quirks and how the design has lead to the industry sometimes failing to adhere to its own standards.

#TR19 Active Directory Security Track

Wed, 23 Jan 2019 00:00:00 +0000

As some of you might recall we’ve introduced a dedicated “Active Directory Security Track” at last year’s Troopers. For Troopers19 we’ve expanded it to two days (as the SAP Security Track was discontinued), and in the following I’ll provide a list of talks in the track.

Vincent Le Toux: You “try” to detect mimikatz

Abstract: This is 2019 and you still “try” to detect mimikatz. “Try”, because after many years, this post exploitation tool continues to be successful.
As a contributor to mimikatz and also a blue team guy, I’m asking myself why antivirus vendors are unable to catch it after many years.
How can a tool be blocked if nobody does not know what this tool is doing? Because surprisingly, it is known only for credential collection but mimikatz is a lot more.
To mitigate the lack of antivirus vendor, should we buy new fancy EDR tool or try a technical approach? Apply a Framework? Rely on Compliance? Use a SIEM to collect logs and apply correlation? In sumarry, can we detect mimikatz?
In this presentation we will try to understand why mimikatz has such power and especially some weakness related to credential gathering and active directory will be exposed.

TROOPERS19 Training Teaser: Hacking mobile applications

Wed, 16 Jan 2019 00:00:00 +0000

“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process our bank transactions, handle our private data and set us up on romantic dates. However, few of us care to wonder,”How (in)secure can these apps be?” Well… at Troopers 19, you can learn how to answer this question yourself!

In our 2 day long “Hacking mobile applications” workshop, we teach how to find security vulnerabilities in mobile apps, exploit them and defend against them. We start from scratch, therefore no prior experience in hacking or developing mobile apps is required. Whether you want to learn how to pentest mobile apps, you are an app developer that fancies to secure his/her apps, or just curios, our workshop is a jumpstart to your goal.

TROOPERS19 Training Teaser: Insight Into Windows Internals

Tue, 15 Jan 2019 00:00:00 +0000

in-depth studies of undocumented, or poorly documented, system functionalities;
development of performant and compatible software to monitor or extend the activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.

The “Insight into Windows Internals” training offered at TROOPERS’19 delivers knowledge on the core components and inner working principles of Windows 10. For example, the training provides knowledge on how Windows 10 uses virtualization to isolate security-critical functionalities from attackers that have managed to compromise the system. The training includes a variety of practical exercises allowing attendees to observe first-hand the operation of Windows 10.

TROOPERS19 Training Teaser: Hacking 101

Mon, 14 Jan 2019 00:00:00 +0000

Hi there,
like in recent years the popular Hacking 101 workshop will take place on TROOPERS19, too! The workshop will give you an insight into the hacking techniques required for penetration testing. These techniques will cover various topics:

Information gathering
Network scanning
Web application hacking
Low-level exploitation

…and more!

TROOPERS19 Training Teaser: Windows & Linux Binary Exploitation

Mon, 14 Jan 2019 00:00:00 +0000

Once again Troopers will have its Windows & Linux Binary Exploitation workshop. Its main focus are the ever-present stack-based buffer overflows still found in software today (e.g. CVE-2018-5002, CVE-2018-1459, and CVE-2018-12897) and their differences with regard to exploitation on Windows and Linux systems. If you ever wanted to know the details of the exploit development process for these systems then this workshop is for you.

After initial exercises involving the exploitation of classic stack-based buffer overflows, modern defense mechanism such as Stack Cookies, DEP, and ASLR are presented and analyzed for weaknesses. The participants will learn how these defense mechanisms can be bypassed and will develop exploits targeting real world applications such as the Foxit Reader Plugin for Firefox, Wireshark, and nginx.

TROOPERS19 Training Teaser: Hardening Microsoft Environments

Fri, 11 Jan 2019 00:00:00 +0000

“Credential Theft” or “Credential Reuse” attack techniques are the biggest known threats to Active Directory environments. This can be attributed to significant advances in and broad distribution of attack and reconnaissance tools such as mimikatz or Bloodhound. This means that after the first system in an environment is compromised it often takes less than 48 hours for a complete compromise of an Active Directory but unfortunately typically 8 to 9 months until the attack is discovered.

Secure CI/CD Pipelines @Troopers ’19

Thu, 10 Jan 2019 00:00:00 +0000

In the last couple of months we participated in an increasing count of customer projects following current trends of agile software development approaches and corresponding toolstacks. Especially the terms Continuous Integration and Continuous Delivery kept (and still keep) popping up on every corner. The frameworks and processes behind those two hypes aid developing software at higher quality in shorter release cycles. This is especially relevant since end consumers nowadays expect fast releases including the newest features. If companies neglect this demand, competitors might take advantage of their better time-to-market which might result in increased market share and -dominance. A lot of changes are happening in the space of CI/CD. Existing tools become more mature, gaining increased attention, and new ones are appearing every month including better ways of integrating them into existing or new processes. Companies benefit from more choices, increased flexibility, and faster integration into existing company policies.

35C3: Refreshing Memories

Mon, 07 Jan 2019 00:00:00 +0000

Hello fellow Troopers and Happy new Year!

35C3 is over, and the recordings are available so in case you did not have the chance or the time to watch the live streams during the holidays or overwhelmed with the number of talks, see in the following a list of recommended talks to fill your evenings or weekends. Apart from the broad coverage of topics in different areas (Ethics, Society & Politics, Hardware & Making, Resilience, Art and Culture, Security, Science, Resilience), foundation talks were aiming for the very basics following this year’s motto “Refreshing Memories.”

Blackhoodie at TROOPERS19

Fri, 04 Jan 2019 00:00:00 +0000

We are going to have a Blackhoodie event at Troopers 2019 on March 18th and 19th in Heidelberg. With a very exciting event last year, we have decided to roll it once again during Troopers.

As always, one of the main motivation for Blackhoodie is bringing more women into reversing and other core security topics. So we would like to see more women apply to the training slots. However, if you are not a women and still feel really excited about Blackhoodie, you are welcome to apply. We do have a very limited number of seats at this training site. So we apologize in advance if we can’t accommodate everyone, even though we wish we could! Please apply before “February 10th” and we will contact you regarding next steps.

Catching fire with Docker, DevOps & Security in Enterprise Environments

Fri, 04 Jan 2019 00:00:00 +0000

Docker has become the go-to technology in enterprise- and DevOps contexts. Yet, before mastering a skill, there is the thumb rule: one must learn the basics to have solid fundament before building a house on top.

Simon and I start from the very beginning. We introduce you to the fundamental concepts of containers starting at process isolation and extending our tour to the whole ecosystem of Docker and further associated technologies. We will cover Docker, microservices, containers, DevOps, continuous integration/deployment/delivery – all those fancy buzzwords that can be read in the context of modern software development methodologies.

And Five Talks More Were Accepted at TROOPERS19!

Mon, 10 Dec 2018 00:00:00 +0000

And five talks more were chosen for TROOPERS19! It sounds like it is going to be the best year ever again…

Follow us on Twitter (@WEareTROOPERS) for more information and do not hesitate to use our hashtag #TR19 when you have questions or remarks about TROOPERS19!

Your TROOPERS Team

——————————–

Not A Security Boundary: Breaking Forest Trusts by Will Schroeder, Lee Christensen

Presenting at the Active Directory Security Track

Abstract:

First Talks of TROOPERS19 Accepted!

Thu, 29 Nov 2018 00:00:00 +0000

TROOPERS18 was the best year ever (did you check our archives?) and it will be challenging to do better… However, we accept the challenge!

The trainings and talks were from high quality and choices were difficult to make… We hope you will enjoy reading these little teasers!

Follow us on Twitter (@WEareTROOPERS) for more information and do not hesitate to use our hashtag #TR19 when you have questions or remarks about TROOPERS19!

The Dog Whisperer’s Handbook

Mon, 19 Nov 2018 00:00:00 +0000

Generally speaking, I’m more of a Cat type of guy, but I have to say I really love BloodHound. And if you do too, you are in for a treat…
Last week, the ERNW Insight Active Directory Security Summit took place in Heidelberg. (More Info)
For this occasion, @Enno_Insinuator asked me if I would like to deliver a BloodHound Workshop, and of course I accepted the challenge…

We had a full class, I had a blast training it, and I hope the trainees enjoyed it as much as I did.
But that’s not all…
Another part of the deal was that I had to write a Training Guide that we would then share with the Community (aka you).
So here it is, fresh from the Heidelberg press and available for download:

Active Directory Security Summit 2018 – Slides Online

Fri, 16 Nov 2018 00:00:00 +0000

on Tuesday, 13.th of November we realized our second AD security summit with the title: “Active Directory Security: On-Prem-Security, Secure Extension into the Cloud & Secure Operations” in Heidelberg. First, we had three talks: the first one about “Active Directory Core Security Principles & Best Practices” covering hybrid AD and AD Trusts as well (by Friedwart Kuhn & Heinrich Wiederkehr from ERNW), the second one a case study about the implementation of an ESAE Forest in a big insurance company (by Fabian Böhm from Teal Technology Consulting) and the third one about a case study with respect to the (security) challenges of a hybrid AD (by Raphael Rojas from STIHL). The afternoon passed quickly with a very fruitful and vivid discussion about implementing and operating securely ESAE environments and hybrid ADs and how to deal with the high number of AD Trusts many organisations suffer from. Today we published the slides. Enjoy and stay tuned!

Hack.lu 2018: Back and forth with the ERNW Crew

Tue, 13 Nov 2018 00:00:00 +0000

If a conference feels like a great vacation, then the organizers are doing it absolutely right! Hack.lu took place for the 14th time in Luxembourg. From the 16th – 18th October, the Alvisse Parc Hotel hosted the Hack.lu conference. Those three days were full of talks, workshops and “discussions about computer security, privacy, information technology and its cultural/technical implication on society“. Some members of the ERNW crew had the chance to attend Hack.lu this year and we all enjoyed it a lot!

Hack.lu 2018: Fuzzing Workshop by René Freingruber

Tue, 06 Nov 2018 00:00:00 +0000

I was at the hack.lu conference in Luxembourg this year and attended the fuzzing workshop, held by René Freingruber from SEC Consult. I have been curious about this topic for some years now, but besides doing some manual fuzzing and web-fuzzing, I never looked into the whole topic that much.

The workshop lasted for around four hours. Before the workshop started each student got two VMs (Linux/Windows) where everything necessary was already set up. The VMs included 23 exercises, with step-by-step explanations, source code and exploits. René started out with an introduction to fuzzing, listing popular fuzzers and showing an example on how to fuzz with afl.

H2HC2018 – Attacking VMware NSX

Fri, 02 Nov 2018 00:00:00 +0000

Matthias and I had the pleasure to give a talk at the H2HC2018 in São Paulo, Brazil about attacking VMware NSX. The talk is an introduction to VMware NSX for security researchers, and it discusses possible attack vectors including the management, controlling, and data exchange planes. We demonstrated how to prepare a fuzzing and debugging setup for the ESXi kernel and the kernel modules. It should be noted that Olli was also supporting the research.
The slides can be found here.

Hack.lu 2018: ARM IoT Firmware Emulation Workshop by Saumil Udayan Shah

Wed, 24 Oct 2018 00:00:00 +0000

First day at hack.lu. Three of us kicked the conference off with the ARM IoT Firmware Emulation workshop by Saumil. The goal of this workshop was not so much to write exploits or to pwn boxes but to learn how to build a beneficial research environment by emulating the hardware of a Linux based IoT device to run its firmware in order to run analysis and tests.

First step is to obtain the firmware. This could be done by dumping it directly from the device or by downloading firmware images from the vendor. In order to dump the firmware from the device one has to obtain access to the underlying system which is usually done by finding the serial console on the hardware since this one often exposes an unauthenticated root shell. I think there is enough documentation online on how to identify and connect to a serial console so I won’t cover the details here. It’s also covered in Saumil’s slides in detail. Having the bootup logs from this console will be helpful later though. While talking about baud rates for the serial console Saumil made a great pun I don’t want to withhold: “Most common is baud rate 115200. If you find a console with baud rate 9600 you are in fact talking to an acoustic coupler. That’s not an IoT device, it rather belongs to a museum.”

Incident Analysis and Digital Forensics Summit 2018, 14th of November of 2018

Mon, 08 Oct 2018 00:00:00 +0000

*This event will be held in German*

Inspiriert durch die erfolgreichen Round-Table-Diskussionen der Troopers-Konferenz freuen wir uns, Ihnen heute mit dem Incident Analysis and Digital Forensics Summit 2018, eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einem Eröffnungsvortrag von Thomas Schreck (Chairman of the Board des internationalen CERT Verbunds FIRST), gefolgt von Fallstudien und Vorträgen durch weitere Referenten aus der Industrie und Strafverfolgung.

Active Directory Security Summit 2018, 13th. of November of 2018

Mon, 03 Sep 2018 00:00:00 +0000

I have the pleasure to announce the Active Directory Security Summit 2018 at 13^(th). of November of 2018. The summit covers current Active Directory security related topics such as challenging tasks of hybrid Active Directory operations as well as new security best practices and some ‘evergreens’ – Admin Tiering implementations (what about Exchange and DNS…??), ESAE operations etc. 😉

The primary objective of the Active Directory Security Summit is to bring experts together:

Diversity, Community, Blackhoodie

Thu, 26 Jul 2018 00:00:00 +0000

Gender equality in the Infosec world as a topic of discussion comes with a lot of heated arguments and differences in opinion.
So let me start with some disclaimers on the target audience for this post. If you are in the category who believes everything about gender is perfect in the infosec world, this post is not for you. If you are in the category who believes gender and bringing diversity is not your area of interest, then this post is not for you either. There are so many interesting problems that the world offers you. Climate change, poverty, diseases, unemployment, addiction, science problems and what not. Everybody has the freedom to choose their area of interest and contribute towards it. If you are in the category who thinks gender equality in infosec needs some attention and would like to explore more on the topic without prejudices, then this post may be interesting to you.

The building IoT 2018 in Cologne

Mon, 18 Jun 2018 00:00:00 +0000

In Mai 2018, Tobias and me were in Cologne at the Building IoT conference. The topics of the talks covered a broad spectrum of the Internet of Things field. There were three tracks covering different topics ranging from the jungle of IoT protocols, secure Linux hypervisors specially developed for IoT modules to machine learning and blockchain.

In “How to secure over the air updates” the speaker showed how to securely deploy updates over the standard communication channel to the target device. Many consumer IoT devices have a short support for updates if they get any updates at all. This leads and in the future will lead to bad news like botnets, bricked devices and exploited IP cameras streaming publicly. Therefore, a patch and vulnerability management is required – especially in industrial Internet of Things devices. Some updates have to be performed over the air due to the physical inaccessibility of some IoT devices in production environments. There are two possibilities to update such systems: First, a rescue OS (Operating System) boots and overwrites the existing production OS. The second option is a redundant OS, which copies the updates to the inactive OS and reboots to that.

Modern Application Stacks & Security

Fri, 15 Jun 2018 00:00:00 +0000

I had the pleasure to give a presentation at the Security Interest Group Switzerland Technology Conference about modern application stacks and how they can be used to improve infrastructure and application security posture – the slides can be found here. Besides seeing a lot of old friends, I particularly enjoyed a round table discussion on security integration into CI/CD pipelines. There was a relevant exchange on approaches that actually work and were tested in environments beyond just recommending some container scanner (product). One participant had an interesting case study on how they enabled developers to maintain WAF policies in configuration files in their code repository including automated deployment to the WAF. He also emphasized that the environments with actual security benefits resulted from a close cooperation between development and security team (were domain knowledge was combined 😉 ).

GI Sicherheit 2018 Conference

Thu, 03 May 2018 00:00:00 +0000

Last week (25^(th) – 27^(th) April), I attended the “Sicherheit 2018” in Konstanz which is the annual meeting of the security community of the Gesellschaft für Informatik e.V. (GI) in Germany. The conference is in equal proportions attended by researchers and people of the industry working in security-related disciplines which lead to lively and pleasant discussions conversations.

The topics discussed were contentual wide-reaching, so there were very technical talks like Sebastian Banescu who was the winner and one of two candidates nominated for the best PhD thesis award presenting about “Characterizing the Strength of Software Obfuscation Against Automated Attacks”, as well as conceptual presentations such as Sabrina Krausz elucidated her bachelor thesis about an integrated procedure model for planning and implementing an ISMS on the example of the pharmaceutical production.

TROOPERS18 Photos online!

Thu, 03 May 2018 00:00:00 +0000

We are very excited to publish some (more to come!) of our photos from TROOPERS18! Based on feedback from #TR18 we would also like to take a moment for our official TROOPERS photographer to introduce himself and tell you a little about what inspires him.

Peter Walter is a 37 year old photographer based in Germany near Stuttgart. For many years now he is the official TROOPERS photographer and very proud to be part of the Troopers family.

Industrial IoT Overview & Case Studies

Wed, 25 Apr 2018 00:00:00 +0000

Stefan and I had the pleasure of joining a one-day closed workshop on Industrial IoT Security. As always, we ended up with plenty of new research ideas and great contacts. We hope of course to post on follow-up research, but in this short post we quickly want to publish our slides which contain our input for the workshop. We mainly presented on IT security challenges for modern IIoT environments and presented some case studies for successful hardening/protection of IIoT environments as well as security in IIoT product development.

#TR18 Attack & Research Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Attack & Research Track.

Reverse Engineering Blackbox Systems with GreatFET & Facedancer by Kate Temkin and Dominic Spill

USB is everywhere, your phone, gaming consoles, IoT waffle irons, you name it. Due to its’ widespread use in everyday life it is typically trusted by the user. And even if one wanted to find out what’s happening behind the scenes, surely digging into USB communication is too much of a chore to be worth the hassle, right? This talk by Kate Temkin and Dominic Spill are about to prove that very wrong with an impressive display of their tools GreatFET and Facedancer.

#TR18 Defense & Management Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Defense & Management Track.

All Your Cloud Are Belong to Us

The talk “All Your Cloud Belong Are Belong to Us” was held by Nate Warfield, who is a Senior Security Program Manager for the Microsoft Security Response Center (MSRC).
Before Microsoft he worked as a network engineer about 18 years and 10 of this for a large amount of cell phone companies.
Nate gives an overview about the state of the cloud solution provided by Microsoft, Azure, and how he hunts vulnerabilities in this environment.
Finally he concludes that the giving up your infrastructure to the cloud doesn’t mean that you give up your responsibility.

#TR18 Next Generation Internet (NGI) Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Next Generation Internet Event.

NGI Keynote by Graeme Neilson

Before his infosec career Graeme was a street performer, then security researcher, now he calls himself a defender. The talk was built around the following sentence: “The infosec industry and community have completely failed to create meaningful change in the behavior of people”.

The following example is a resume of how hacking worked from 1988 to 2017:

#TR18 SAP Security Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 SAP Security Track.

SAP IGS : The ‘vulnerable’ forgotten component by Yvan Genuer

The Internet Graphics Server (IGS) is used to generate Web Based graphics from the SAP Web AS. Yvan Genuer looked at the security of an ancient component with very few public vulnerabilities available so far. In his talk he gave us insights on the structure of the IGS, its services, and problems he had when looking for documentation of the IGS and its components.

#TR18 Active Directory Security Track, Part 1

Thu, 22 Mar 2018 00:00:00 +0000

This is the first post discussing talks of the Active Directory Security Track of this year’s Troopers which took place last week in Heidelberg (like in the last nine years ;-). It featured, amongst others, a new track focused on Microsoft AD and its security properties & implications. This was the agenda.

The idea for this special track was born out of two considerations:

we had noted there’s a lot of stuff going on in the space, both on the offense and on the defense side. And in pretty much every incident analysis & response project we were brought in recently Active Directory played a huge role…
already in the early phase of the CfP several interesting submissions came in (maybe due to the fact that some big guns of the field had voiced very kind words in the past)… and creating an extra track simply relieved us from the burden to make a tough choice between those.

As this was the first Troopers since its creation where I didn’t have any official roles and out of personal interest (in a very distant past I happened to be the co-author of the first German book on Windows NT4 Security) I decided to spend the majority of conference day 2 in the AD track. In hindsight I’m tempted to say that the track was a huge success: brilliant talks, pretty much always a packed room, and quite good discussions after the talks. (yes, of course I’m biased, what makes you think that?).

The Hackers‘ Sanctuary City

Wed, 14 Mar 2018 00:00:00 +0000

https://youtu.be/wCMwTUS3k4c

TROOPERS has a long history of theming the conference every year. Usually we pick a surreal topic, a fun story which we think is worth to pick up on. Some of it starts as a crazy thought, others have been the result of long discussions. Most of them are online, only our master piece from 2016 is securely stored in the company’s vaults.

However, this year was different. Traveling across the globe, speaking at and attending other conferences, connecting with our peers and the community, we felt that 2017 was a particularly tough year for many of us, both professionally and personally. There was this doom and gloom baseline to it.

Auditing AWS Environments

Wed, 07 Mar 2018 00:00:00 +0000

Introduction

Related to our new TROOPERS workshop “Jump-Starting Public Cloud Security”, this post is going to describe some relevant components which need to be taken care of when constructing and auditing an Amazon Web Services (AWS) cloud environment. Those include amongst others the general AWS account structure, Identity and Access Management (IAM), Auditing and Logging (CloudTrail and CloudWatch), Virtual Private Cloud (VPC) networks, as well as S3 buckets.

The AWS IAM service is responsible for identity and access management (surprise!). This includes managing user accounts, defining password policies, and – most importantly – creating, defining, and assigning groups and roles.

TelcoSecDay 2018 – Talks Part2

Mon, 26 Feb 2018 00:00:00 +0000

We have the next set of selected talks being announced here. I am super excited about the variety of applications we had this year. Here are some of the talks we will have.

Title: From LoRa technology to deployment within Orange affiliates

Speakers: Franck L’Hereec and Albert Nguyen

Just deployed, the LoRa technology has already passed into the hands of hackers who have analyzed the LoRaWAN protocol as well as the objects and gateways that implement it. At Orange, Orange Labs’ security experts have therefore looked into those issues, first to understand it better, and also ensure the network’s deployment in optimal security conditions. Demonstration via the example of the treatment of the security of an innovation project by Orange. During the presentation we will present :

TLS in the Enterprise: Is Heartbleed still a Problem?

Fri, 16 Feb 2018 00:00:00 +0000

Our new workshop about TLS/SSL in the enterprise will be held for the 1st time at Troopers 2018. So I would like to take the opportunity and post a short teaser about stuff we will cover in this workshop.

TLS/SSL is a complicated topic especially in enterprise environments due to the fact, that

encrypted traffic should be inspected e.g. for malware
customers/users must be able to use important applications
crypto attacks are complex and sometimes considered to be only a problem in theory
the internal CERT wants to have every issue fixed, if feasible or not 😉
impact of configuration changes can not be foreseen
Software inventory is incomplete (do you want to make a bet that Heartbleed is fixed completely in your environment ;-)? )
… and so forth

In the workshop we will cover all these points, discuss them and share our experience regarding feasibility and useful mitigating controls. We will explain the most common SSL vulnerabilities/attacks, demonstrate tools to test (and sometimes to exploit) them, point out pitfalls and recommend what to do. Let us have a look at one example, Heartbleed:

Get your hands dirty playing with RFID/NFC

Wed, 14 Feb 2018 00:00:00 +0000

This is a guest blog post by Nahuel Grisolia.

The first time I’ve heard about RFID was at high school, back in 2002, when I was studying Electronics. Back in that time, this technology was like some sort of black magic to me. A few years later in 2011, our government in Argentina decided to implement a “new technology” called NFC, designed as the new and only way of payment for the use of public transport. So, I decided to understand it better, play with it, and try some hacks I heard from the cool people of the CCC.

TelcoSecDay 2018 – CFP and First talks

Thu, 08 Feb 2018 00:00:00 +0000

We have a short update from the TelcoSecDay 2018 Agenda. But before that, a short reminder. The CFP for TelcoSecDay 2018 is still open. If you are into telco research, and if you have something interesting to talk, please make a submission here. The deadline is 17th February 2018.

Here are the first two confirmed speakers who are going to talk about the below mentioned topics:

Title: Data Security for 4G Interconnection and 5G Interconnection Risk Areas

Blackhoodie at TROOPERS18

Fri, 02 Feb 2018 00:00:00 +0000

We are thrilled to announce the Blackhoodie event at Troopers 2018 on March 12th and 13th in Heidelberg. This time it is going to be a 2 day workshop with various interesting topics related to reverse engineering. We will make sure that you get some hands on experience with reversing and more.

As always, one of the main motivation for Blackhoodie is bringing more women into reversing.
So we would like to see more women apply to the training slots. However, we are open to everyone who would like to apply. We do have a very limited number of seats at this training site. So we apologize in advance if we can’t accommodate everyone, even though we wish we could! Please apply before “February 20th” and we will contact you regarding next steps.

#TR18 Active Directory Security Track

Fri, 05 Jan 2018 00:00:00 +0000

A happy new year to everybody!

At Troopers18 there will be a new special track on Microsoft Active Directory and its security aspects, similar to the SAP security track which we established some years ago. The AD security track will feature, amongst others, the following talks.

Sean Metcalf: Active Directory Security. The Journey

Abstract: This talk is a journey into the challenges most organizations encounter while trying to secure their ‘castle’. The attacker has to be right only once, right? Not exactly. We will walk through effective security strategies that will stymie and frustrate attackers and better protect the Active Directory environment.

Yet another edition of BlackHoodie – #BlackHoodie17

Mon, 11 Dec 2017 00:00:00 +0000

I am amazed by how this years BlackHoodie unraveled. Three days that included a pre-conference of lightening talks and two parallel tracks with a total of 64 enthusiastic members. The very spirit of BlackHoodie is nothing other than the quest to gain deep knowledge. Reverse engineering is one of the hardest fields in security. It touches on all fields of computing, starting from assembly, programming, file formats, operating systems, networks and what not. This makes it hard but an extremely fulfilling experience to spend time learning it. For me, the very idea of staring at a binary till you understand what it does is a magical feeling.

Let’s talk about RFC 6980

Fri, 01 Dec 2017 00:00:00 +0000

Following my work with the FreeBSD implementation of RFC 6980 I was happy to present my work at last week’s DENOG 9 meeting.
To make it available to anyone who did not meet me there and go into some more detail that would have exceeded the boundaries of the talk, I will cover the topic here.

After the preceding work on Windows Server 2016 and the FreeBSD testing, as a Linux user, lover and administrator, I of course wanted to take a look at how different Linux systems complied with the RFC 6980 standard.

Announcing the first 5 talks of TROOPERS18!!!!

Wed, 29 Nov 2017 00:00:00 +0000

TROOPERS17 was unlike any TROOPERS we had known before. Everything just seemed bolder, better, and beyond our expectations. From surprise speakers like the grugq (do you have a follow-up talk for #TR18 by the way?) to new speakers who are now TROOPERS family, TROOPERS17 is one for the history books!

If you were there you might be wondering to yourself, how could they possibly top it (and if you were not there check out this video from TR17)? Well, I am not going to lie, it will be a challenge. However, the high quality of talk and training submissions for this year have us feeling pretty positive about making #TR18 the “best year ever”!

My Journey to DockerCon Europe 2017

Thu, 09 Nov 2017 00:00:00 +0000

From October 17th – 19th I had the chance to attend my first DockerCon Europe 2017.

The conference was very well organized and attendee focused, which could be seen by the many little details found on the conference. For example you never ran out of coffee or beverages, there was a new Hallway Track where you could meet people from all disciplines, discuss about your favorite topics and there was always a place to sit and take a break between all those interesting presentations. I had the chance to speak to very nice people from different industries, most importantly in my case on the topic security. It was nice to see how the Docker community is growing and the adoption rate is increasing, especially in companies. The main focus of the conference (especially seen in talks held by people from Docker Inc.) was the Docker Enterprise Edition.

TROOPERS for Students!

Thu, 12 Oct 2017 00:00:00 +0000

We are super excited for TROOPERS18 (March 12-16th, 2018) as are many of you! We even have this great saying that “after TROOPERS is before TROOPERS”, which means we spend a lot of time looking through feedback from attendees, speakers/trainers, and our own Crew for ways to not only top what we’ve done in the years before, but also how to simply make it better for everyone involved. Looking around at our Crew we realized how many have either attended TROOPERS or other conferences as students. We heard from them, as well as other students, how life changing it was to be able, as a student, to attend an IT-Security conference. How they got to meet a speaker whose work they’d read about in class. How people felt even more a part of the community they were studying hard to belong to.

Daycon X1

Wed, 04 Oct 2017 00:00:00 +0000

This is my short write up on Daycon X1, 2017. The summit was held at Dayton, the land where Wright brothers were born. Apart from being my first US trip, I also gave my first training on Hacking 101 also called the Bootcamp.

The Daycon X1 bootcamp started on 18th September. Ahmad, my colleague focused on web security, network scanning and metasploit exercises. I mainly handled classes on reversing and binary exploitation along with some pcap anaylsis and network attacks. It was highly fulfilling experience to give a workshop. Teaching is definitely the best way to learn any topic by digging deep into it.The simpler you can explain, the more clarity you have on the topic. But I must say that it was indeed exhausting by the end of three days.

RIPE IoT Roundtable Meeting / Balanced Security for IPv6 CPE Revisited

Fri, 29 Sep 2017 00:00:00 +0000

Last week I had the pleasure to participate at the first RIPE IoT Roundtable Meeting in Leeds (thanks! to Marco Hogewoning for organising it). It was a day with many fruitful discussions. I particularly enjoyed Robert Kisteleki‘s talk on RIPE NCC’s own design & (security) process considerations in the context of RIPE Atlas (at TR17 NGI there was an intro to Atlas, too).
In this post I’d like to quickly lay out the main points of my own contribution on “Balanced Security for IPv6 CPE Revisited” (the slides can be found here).

HITCON CMT 2017

Thu, 28 Sep 2017 00:00:00 +0000

Some of our Troopers had the chance to visit HITCON conference in Taiwan this year. There are two main events: HITCON Pacific, which is aimed more at corporate attendees and HITCON CMT, the community edition, which aims at students and the general Infosec community. HITCON is the biggest security conference in Taiwan.

The venue for the event is the Academia Sinica, one of the most important academic institution in the Republic of China and was founded in 1928 to promote and undertake scholarly research in sciences and humanities. The conference had three usual tracks and one special track that was free to use for the public for demos, presentations and discussions.

DFRWS USA 2017

Wed, 06 Sep 2017 00:00:00 +0000

As mentioned in my last blogpost, I had the pleasure to participate in this years DFRWS USA and present our paper. The paper and presentation can be freely viewed and downloaded here or here. Note that there is also an extended version of the paper, which can be downloaded here.

The keepassx, zsh and heap analysis plugins are now also part of the Rekall release candidate 1.7.0RC1, so it’s easier to get started.

The conference had some great talks and workshops, which I’m going to briefly sum up.

11th USENIX Workshop on Offensive Technologies (WOOT17)

Wed, 16 Aug 2017 00:00:00 +0000

The 11th USENIX Workshop on Offensive Technologies (WOOT17) took place the last two days in Vancouver. Some colleagues and I had the chance to attend and enjoy the presentations of all accepted papers of this rather small, single-track co-located USENIX event. Unfortunately, the talks have not been recorded. However, all the papers should be available on the website. It’s worth taking a look at all of the papers, but these are some presentations that we’ve enjoyed:

Black Hat 20 & DEFCON 25

Wed, 09 Aug 2017 00:00:00 +0000

Some of the ERNW Crew hit up Black Hat USA and DEFCON. Our own Omar Eissa even gave his first BH and DEFCON talks! See which talk we liked and what inspiration we took home.

BlackHat US 20:

ERNW´s Omar Eissa presented on Cisco Autonomic networks showing how
slides: https://www.blackhat.com/docs/us-17/wednesday/us-17-Eissa-Network-Automation-Isn’t-Your-Safe-Haven-Protocol-Analysis-And-Vulnerabilities-Of-Autonomic-Network.pdf
insinuator blogposts:
https://insinuator.net/2017/03/autonomic-network-overview/
https://insinuator.net/2017/03/autonomic-network-analysis/
https://insinuator.net/2017/04/autonomic-network-vulnerabilities/

BoradPWN
– Speaker: Nitay Artenstein
– Slides: https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets.pdf
– Paper: https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets-wp.pdf
– Broadly covered in main stream Media –> Wired article, tons of write-ups…link: https://www.wired.com/story/broadpwn-wi-fi-vulnerability-ios-android/
– Initial Blog Post: https://blog.exodusintel.com/2017/07/26/broadpwn/
– He took a deep dive into the internals of the BCM4354, 4358 and 4359 Wi-Fi chipsets and found an issue that he exploited to an extent where he created the world´s first wifi worm.
– This hits most of the mobiles users pretty hard. Affected devices are for example: Samsung Galaxy from S3 through S8, inclusive All Samsung Notes3. Nexus 5, 6, 6X and 6P, All iPhones after iPhone 5
– An infected device can be used to infect other mobile devices.
– Luckily currently there is no malware that is actively exploiting this issue.

17. Gulaschprogrammiernacht

Wed, 21 Jun 2017 00:00:00 +0000

Over one of the recent long weekends I attended the 17th “Gulaschprogrammiernacht”, or “GPN17” for short, in Karlsruhe, the largest CCC Event after the Chaos Communication Congress with roughly a thousand attendees. The name literally translates to “goulash programming night”, which makes about as much sense as the German version. Despite the name it lasted from Thursday to Sunday, had a much wider scope than just coding and offered various other (incl. vegan) dishes besides goulash. As an active member of the CCC community I planned on attending it anyway, but submitted my talk about Automated Binary Analysis in case there was interest. I didn’t anticipate that much interest given that it was a fairly theoretical IT-Security topic at an event that was not focused on IT-Security, but nonetheless the hall was filled with people from various backgrounds like math, formal verification and software optimization. The talk was an improved version of the one I gave at Bsides Ljubljana, incorporating feedback I received and new things I had learned since then. The English slides are available here, the recording of the talk in German can be found here.

DevOps, Continuous Deployment & Agile Security September 7, 2017

Thu, 08 Jun 2017 00:00:00 +0000

The following post is in German as it is covering an Event with German as the main language.

INSIGHT SUMMIT 2017 präsentiert DevOps, Continuous Deployment & Agile Security

Inspiriert durch die erfolgreichen Round Table Session der TROOPERS freuen wir uns Ihnen heute mit dem AgileSecurity Insight Summit 2017 eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einer Keynote, gefolgt von Fallstudien und Vorträgen durch interne und externe Referenten aus der Industrie. Im Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round-Table Sessions teilnehmen. In den Round-Table Sessions werden unter Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.

Docker Security & (Sec) DevOps Training July 19-20th

Mon, 05 Jun 2017 00:00:00 +0000

The following post is in German as it is covering a Training with German as the main language.

Professionelles Training im Workshop Character:
Docker, Microservices, Kubernetes, DevOps, Continuous
Integration/Deployment/Delivery (CI/CD), Container – moderne
Entwicklungsprozesse kommen nicht mehr ohne diese Begriffe aus. In diesem Kurs
lernen Sie die Security Grundlagen um diese Dinge zu beherschen.

Docker Security & (Sec) DevOps Training:
Im Training werden unter Anderem die folgenden Fragestellungen behandelt:

Wie stark/zuverlässig sind die Isolationsmechanismen hinter Docker/Linux/Betriebssystem-Containern?
Wie beeinflussen Container typische Applikations- und Netzwerk-Landschaften?
Wie beeinflussen die CI/CD/Microservice Paradigmen traditionelle Entwicklungsprozesse?
Wie sieht eine typische CI/CD Pipeline aus?
Was sind potentielle Schnittstellen zwischen „Security“ und diesen Paradigmen?
Welche zusätzlichen Security-Herausforderungen ergeben sich aus der veränderten Entwicklungslandschaft und neuen Tool-Chains?

Voraussetzungen:
Die Teilnehmer sollten grundlegende Kenntnisse der Linux Kommandozeile besitzen
sowie ein System mit einem SSH Client. Teilnehmer die die Demo-VM gerne selbst
betreiben möchten erhalten diese auf einem USB-Stick, müssen sich aber selbst um
Import und Start kümmern.

Active Directory Security & Secure Operations July 18, 2017

Thu, 01 Jun 2017 00:00:00 +0000

The following post is in German as it is covering an Event with German as the main language.

INSIGHT SUMMIT 2017 präsentiert Active Directory Security & Secure Operations

Inspiriert durch die erfolgreichen Round Table Sessions der TROOPERS freuen wir uns Ihnen heute mit dem Active Directory Insight Summit 2017 eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.
Die Veranstaltung beginnt am Morgen mit einer Hinführung zum Thema Active Directory Sicherheit gefolgt von Fallstudien und Vorträgen durch interne und externe Referenten aus Wirtschaft und Industrie. Im Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round Table Sessions teilnehmen (jeder Teilnehmer kann an beiden Sessions teilnehmen). In den Round Table Sessions werden unter Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.

Looking back on RIPE 74

Fri, 19 May 2017 00:00:00 +0000

From May 8th to 12th I was able to attend the 74th RIPE meeting in Budapest, Hungary. Being rather new to the networking community, I enjoyed learning a lot of different things, not only from the various interesting talks but also from inspiring conversations with a variety of people from all areas during the beautiful social events.

As it was the first RIPE meeting for me, I was very thankful for the “Newcomer’s Introduction” on Monday morning, containing a RIPE and RIPE NCC 101. It was quite helpful to get into the mindset and understand the structure of the meeting, like the division into different working groups based on the participants’ interests. After familiarizing myself with the concept, I chose to attend several sessions on Address Policy, IPv6, Routing, Open Source, and DNS working groups besides the general plenary sessions. I’ll be reviewing those sessions here.

Some Quick Tips for Submitting a Talk to Black Hat or TROOPERS

Sat, 01 Apr 2017 00:00:00 +0000

Given the CfP for Black Hat US in Vegas ends in a few days – and as apparently some people have already started to think about their TR18 submissions – I’ll quickly provide some loose recommendations on how to write a submission here. There’s quite some reasonable advice out there already (the BH CfP site lists this and this which you should both read as well) but some of you might find it useful to get (yet) another perspective.

CSA Summit CEE and BSides Ljubljana 2017

Fri, 17 Mar 2017 00:00:00 +0000

At the end of last week I had the pleasure to visit the CSA Summit CEE and the Bsides Event in Ljubljana.

At CSA, I was talking about hypervisors, breakouts and an overview of security measures to protect the host. (Slides)
This ranged from the basic features some hypervisors provide out of the box to advanced features like SELinux, device domain models and XSM-FLASK.

Most of the other talks were more targeted towards management level employees, but even as a fairly technical person I found Mike Bursell’s talk highly interesting. After my talk about securing the host system from a malicious guest, he dealt with the inverse: Technologies to protect a guest from a malicious or compromised host.

31c0n 2017 in Auckland, New Zealand

Fri, 03 Mar 2017 00:00:00 +0000

Last week we gave a talk at the very first 31c0n in Auckland, New Zealand. The talk focused mainly on the methodology that we use to assess security products.

More specifically, this methodology consists of 7 steps

Literature Research
Jailbreak the Target
Identify Components
Understand the Architecture
Map the Attack Surface
Prioritize
Analyze.

Details on these steps as well as general suggestions to viable alternatives for security products can be found here in the slides.

Troopers17 GSM Network – How about your own SMPP Service?

Wed, 01 Mar 2017 00:00:00 +0000

The event of the events is getting closer and again, we are very optimistic to have a lot of awesome trainings, talks, evening events, and discussions. But we again will also have some “features” and gimmicks for those of you who would like to play with new, old, or just interesting technologies. As you might remember, since some years one of these features is and again will be our own GSM Network. As we are improving our setup from year to year, this time we’d like to give you the chance to actively participate with ideas and your own services.

Summary of “Lockpicking in the IoT” at 33C3

Tue, 14 Feb 2017 00:00:00 +0000

“Lockpicking in the IoT, …or why adding BTLE to a device sometimes isn’t smart at all” by Ray was one of my favourite talks, as it beautifully showed many different attack vectors as well as giving a nice guide for getting started in this area.

It impressed me how carefree vendors and startups handled hardware and software security in “smart” devices as it seems that their devices were more or less easy to own. In his talk Ray pointed out physical AND implementational weaknesses that remained even after he reported them to the vendors.
The most prominent sample he gave was when he opened a “Masterlock” by spinning a magnet on the lock itself to open it.

33c3 Talks – What could possibly go wrong with “insert x86 instruction here” ?

Wed, 01 Feb 2017 00:00:00 +0000

This was one of the few technical talks at 33c3 I managed to see, by that I mean live-stream during an access control shift, by Clémentine Maurice and Moritz Lipp.

The talk gave an overview of some already known possible information leaks by abusing certain x86 instructions(the same concept applies to ARM too though) and demonstrating the various ways an attacker could use them. They started off by quickly explaining how the caches on modern CPUs are set up and how they work and how you can exploit the timing differences in memory accesses to leak data without actually knowing the content of the cache. This data leak can then be used to establish a covert channel.

ERNW at 33C3 – Part 1

Thu, 26 Jan 2017 00:00:00 +0000

This is part 1 of our report series on interesting talks of the 33rd Congress of the Chaos Computer Club. Every year the congress attracts hundreds (up to twelve thousand this year) of technical interested people with the opportunity to socialize and exchange knowledge with each other. The congress is organized by the European largest hacker association and speakers give talks about technical and societal issues like surveillance, privacy, freedom of information, data security and various more.

TR17 Training: Hacking 101

Thu, 26 Jan 2017 00:00:00 +0000

Hi there,
Like in recent years the popular Hacking 101 workshop will take place on TROOPERS17, too! The workshop will give attendees an insight into the hacking techniques required for penetration testing. These techniques will cover various topics:

information gathering
network scanning
web application hacking
low-level exploitation

…and more!

During this workshop you will learn, step by step, a testing methodology that is applicable to the majority of scenarios. So imagine you have to assess the security of a system running on the Internet. How would you start? First, you need a good understanding about the target, including running services or related systems. Just scanning an IP will most likely not reveal a lot of information about the system. The gathered information may help you to identify communication relations of services that could include vulnerabilities. A brief understanding of the target and it’s related systems/services/applications will make scanning and identifying vulnerabilities a lot easier and more effective. Then, the last step will be the exploitation of the identified vulnerabilities, with the ultimate aim to get access to the target system and pivot to other, probably internal, systems and resources.

First dedicated Forensic Computing Training at TR17

Wed, 11 Jan 2017 00:00:00 +0000

I am looking forward to our newly introduced dedicated Forensic Computing Training at TR17!
We will start the first day with a detailed background briefing about Forensic Computing as a Forensic Science, Digital Evidence, and the Chain of Custody. The rest of the workshop we will follow the Order of Volatility starting with the analysis of persistent storage using file system internals and carving, as well as RAID reassembly with lots of hands-on case studies using open source tools. As a next step, we will smell the smoking gun in live forensics exercises. Depending on your preferences we will then dig a bit into memory forensics and network forensics.

TelcoSecDay 2017 – 2nd Round of Talks

Tue, 03 Jan 2017 00:00:00 +0000

Hello and a Happy new Year!

There are only two and a half months left, so I’d like to publish the next two talks for TelcoSecDay 2017, taking place at 21st of March in Heidelberg. Both talks are about the security of an upcoming technology which importance will raise in near future: 5G Networks.

One of the talks will be from an attacker’s point of view, highlighting weaknesses of 2G/3G/4G networks and what we have to fix in 5G, and the other one will give us insights into current developments of the 3GPP standardization group.

TR17 Training: Crypto attacks and defenses

Tue, 03 Jan 2017 00:00:00 +0000

This is a guest blog written by Jean-Philippe Aumasson & Philipp Jovanovic about their upcoming TROOPERS17 training: Crypto attacks and defenses.

The 1-day training from last TROOPERS has become a 2-day training, featuring even more real-world attacks and defenses as well as new hands-on sessions! We’ll teach you, step by step, how to spot and exploit crypto vulnerabilities, how to use the strongest forms of state-of-the-art cryptography to secure modern systems (like IoT or mobile applications), and bring you up to speed on the latest and greatest developments in the world of cryptography, such as TLS 1.3, blockchains, and post-quantum crypto.

3rd Round of TROOPERS17 Talks

Tue, 20 Dec 2016 00:00:00 +0000

We had to make some tough choices regarding our TROOPERS17 Main Conference Agenda. Thank you again to everyone for submitting! The full agenda will be published later this week, but for now here are the next round of talks!

Ivan Pepelnjak: Securing Network Automation
If you have operational experience in running large networks then you’re probably yearning to replace the traditional way of managing individual network devices via SSH with something better and more reliable. Software Defined Networking (SDN) was touted as the all-encompassing solution, but what we got instead is a heap of academic ideas, several platforms that require as much investment as an SAP deployment, and a bunch of proprietary products focused more on increasing lock-in and vendor revenue than solving operational problems.

PoC Con Seoul 2016

Thu, 15 Dec 2016 00:00:00 +0000

Recently I had the pleasure to join the PowerOfCommunity conference in Seoul. Florian and Felix attended the conference in the past and enjoyed it a lot, so I took the opportunity to join this year. From what I had heard the conference is highly technical, offensive security and community focused (surprise 😉 ). Boy did they deliver!
Located in a hotel next to a nice park and close to the famous Gangnam district in Seoul we came together to feel the power of community. The conference was planned for two days and offered two tracks per day. Several key talks were presented for everyone.
I really liked the topics a lot. Some contributions I found particularly interesting were:
Petr Švenda with “The Million-Key Question – How RSA Public Key Leaks Its Origin”, where he presented his research of fingerprinting RSA public keys. By analyzing the RSA keys from smartcards and software sources he was able to find similarities between them, which allowed fingerprinting the generating source for some cases. With this information it could be possible gather some potentially important details from simple keys. He is currently expanding his work, please send him an E-Mail if you have RSA keys from an exotic resource. 😉

TR17 Training: Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer

Thu, 15 Dec 2016 00:00:00 +0000

This is a guest blog written by Hanno Böck who will be running the Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer at TROOPERS17.

Fuzzing is a very old technique to find bugs and vulnerabilities in software. However it has seen a new push in recent years due to vastly improved tools. The compilers gcc and clang have received Sanitizer tools that allow finding a lot of bugs like use after free errors and out of bounds reads that are otherwise very hard to find.

2nd Rounds of TROOPERS17 Talks!

Wed, 14 Dec 2016 00:00:00 +0000

It is the end of the year and we are hoping it is not too hectic of a time for you all! But if it is, hopefully the announcement of our next round of TROOPERS17 talks is enough to get you in the TROOPERS (if not the holiday) spirit 🙂

Francis Alexander & Bharadwaj Machiraju: How we hacked Distributed Configuration Management Systems

With increase in necessity of distributed applications, coordination and configuration management tools for these classes of applications have popped up. These systems might pop-up occasionally during penetration tests. The major focus of this research was to find ways to abuse these systems as well as use them for getting deeper access to other systems.

TelcoSecDay 2017 – First Talks Published

Thu, 08 Dec 2016 00:00:00 +0000

Even if the CFP for TelcoSecDay 2017 is officially closed, I am still getting mails in. First of all: thank you for all your great feedback! As the TelcoSecDay is a complimentary and non-public event with highly specialized topics, it only works by sharing knowledge with each other. But please keep in mind that the speaker-slots are limited and I have to make a decision at some point of time.
Anyhow, I am looking forward for a great event and I am proud to publish the first accepted talks:

Defending Democracy

Thu, 24 Nov 2016 00:00:00 +0000

I recently had the pleasure to attend two events organized by the Digital Society Institute, one was a workshop on software vulnerabilities and one was their annual conference. For both events I delivered input on the security of security products and their evaluation (slides can be found here). The DSI did a great job of assembling people from various areas (e.g. industry, academia, politics, and research) so there was a lot of input which is not covered by conferences I usually attend. The workshop I attended also resulted in a short policy recommendation when it comes to the security of security products which can be found here.

CCS’16 – Day 2 – 25th October 2016

Wed, 23 Nov 2016 00:00:00 +0000

Hello again.

Andrei Costin (at http://firmware.re project) is here, and this is the second post from a series of guest postings courtesy of ERNW (thanks Niki and Enno!).

Few days ago, the first CCS’16 summarization post went online: https://insinuator.net/2016/11/introduction-ccs16-day-1-24th-october-2016/

It summarized five presentations of the 6th Annual Workshop on Security and Privacy in Smartphones (SPSM’16). In short, it contained presentations on: over-the-top and phone number abuse, smartphone fingerprinting, apps privacy increase and protection/security, and apps privacy ranking.

BlackHoodie 2016

Mon, 21 Nov 2016 00:00:00 +0000

This year’s BlackHoodie workshop rolled out with 28 amazing women from all parts of the world. It was a very vibrant group with students, professionals, engineers, researchers, physicists and what not. This is the second year that Marion Marschalek is running this reverse engineering workshop exclusively for women. There were a variety of topics that were covered. This includes anti emulation tricks, anti debuggers, packers, obfuscation, encryption/decryption functions, and a lot of fun with IDA.

Introduction & CCS’16 – Day 1 – 24th October 2016

Mon, 21 Nov 2016 00:00:00 +0000

I am Andrei Costin (at http://firmware.re project), and this is the first post from a series of guest postings courtesy of ERNW.

Between 24th and 28th October, I had the pleasure and the great opportunity to attend ACM CCS 2016 in Vienna, Austria, where I also presented at the TrustED’16 workshop my paper titled “Security of CCTV and Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations”.

My attendance throughout the entire ACM CCS 2016 week and my presentation at TrustED was possible thanks to generous support from Enno Rey and ERNW, and I thank them again for this opportunity!

15. Cyber-Sicherheits-Tag

Tue, 08 Nov 2016 00:00:00 +0000

Today Kevin and I had the pleasure to to present at the German 15. Cyber-Sicherheits-Tag in Berlin which is organized by the Alliance for Cyber Security. This iteration covered security aspects of the Internet of Things and we enjoyed some great conversations. The presentations were limited to ten slides and can be found here:

Kevin Schaller – Defense in Depth in IoT

Matthias Luft – Update Management in IoT

Since the slides were supposed to be short and only support the presentation, you still have the chance to get the full content (and even challenge it or ask to dive deeper during the break-out discussions) next week at our own IoT event 😉

ITSeCX 2016: Pulling an all-nighter in Austria

Tue, 08 Nov 2016 00:00:00 +0000

Last Friday I gave a talk at the ITSeCX in St. Pölten, Austria. The conference, hosted by the local University of Applied Sciences, has already taken place ten times. I don’t know how many people attended this time, 2014 there were about 600; I read somewhere on the net. There were four tracks and some workshops from 4pm to the conference’s end at midnight. I enjoyed the community-feeling there very much, even though I arrived late. The only talks I saw, were Adrian Dabrowski speaking about the DARPA Cyber Grand Challenge, the finals took part in Las Vegas this August, and the very entertaining end-of-year review from two UAS guys.

Announcing the first 5 talks of TROOPERS17!!!!

Fri, 04 Nov 2016 00:00:00 +0000

TROOPERS16 was packed with epic talks from around the world, an unknown evil twin brother appearing, hands-on trainings, and a legendary year for our TROOPERS Charity efforts! If you were there you might be wondering to yourself how could they possibly top it? Well, I am going to let you in on a little secret: Next year is the 10th edition of TROOPERS. One DECADE of TROOPERS, and we are pulling out all the stops! Starting with the announcement of the first 5 talks!

TelcoSecDay 2017 – CFP Opens

Sat, 29 Oct 2016 00:00:00 +0000

For the 6th year in a row, the next TelcoSecDay will take place in 2017 on March 21th. Again, it will be held one day before Troopers IT-Security Conference as an invitation-only event. For those of you who don’t know the TSD, it is organized by ERNW and is aimed at bringing researchers and people from the telecommunication industry together to discuss about current security weaknesses, challenges and strategies. To do so, various topics will be presented during the talks and there will surely be enough time to follow-up in extensive discussions.
To give you an idea, here’s the TSD 2016 agenda, and here’s the one of 2015.

Day-Con X Recap

Thu, 27 Oct 2016 00:00:00 +0000

Just a few days ago I had the pleasure of visiting Day-Con X. I listened to some great talks in the closed and public sessions. Since the first day was the security summit (closed session) I will just name a few titles with some brief words.

Captivating Security – Safety versus Passion (Josh More):
Was quite interesting to compare the IT-World with zoos.

Beyond Embedded (Brittany Postnikoff):
Robots are fun soon :).

IoT Insight Summit November 15, 2016

Wed, 26 Oct 2016 00:00:00 +0000

The newest addition to ERNW, ERNW Insight which now hosts TROOPERS, is launching a new concept this year. Based on the successful TROOPERS Roundtable sessions, ERNW Insight will host a series events every year covering current and relevant topics in the field of IT Security. While the style of the events may vary the in-depth knowledge sharing that you have come to know from TROOPERS will not!

The inaugural event will be our IoT Insight Summit, taking place on November 15, 2016 at the Crowne Plaza Heidelberg. This 1-day event will begin with a keynote and case study from industry experts. Afterwards, all participants will be divided into five groups of 10 persons each to participate in our “Break Out Sessions”. Every participant will get the opportunity to attend all 5 Break Out Sessions, where our IT Security moderators will lead discussions on typical problems and solutions in IoT.

Black Hat 2016 Summary Part 2.1

Thu, 06 Oct 2016 00:00:00 +0000

A few months ago I had the opportunity to visit this year’s Black Hat in Las Vegas. Due to a few weeks of vacation following the conference here are my delayed 2 cents (part 1)

—bryant-zadegan-&-ryan-lester)Abusing Bleeding Edge Web Standards For AppSec Glory – Bryant Zadegan & Ryan Lester (Slides)

Bryant and Ryan talked about new web standards which are already implemented in parts of the current browser jungle. Namely these standard were:

Attacking BaseStations @Defcon24

Tue, 20 Sep 2016 00:00:00 +0000

Hello Guys,
back from my vacation I’d like to give you some impressions about Defcon 24 and our talk “Attacking BaseStations”. Defcon itself had a couple of great talks but was a very crowded location. Anyhow, we had a couple of great discussions with the people before and after our talk.

The talk “Attacking BaseStations” focussed on attack vectors we simulated in our lab. Besides attacking a BaseStation via Radio interface, in this talk we focussed on local and remote interfaces as introduced in “LTE vs. Darwin”. As target of evaluation one of our eNodeB’s came into play, which we purchased on the Internet. Anyhow, the talk covered the following attack scenarios:

BSides LV 2016: Recap

Mon, 19 Sep 2016 00:00:00 +0000

Hey everyone,

Just a short recap from my side regarding this year’s BSide in Las Vegas, NV. It was my first time there and I pretty much enjoyed it. After entering the venue on the first con day (Tuesday) I was a little bit shocked, as the staff sent me to the “end of the line just around the corner” – the end being many corners and many floors away 😉 Speaking to some guys while standing in line, time quickly passed by and before finally hitting the registration desk, there were already some people from the staff giving away the conference badges to the waiting folks. The waiting time was no comparison to last year’s DEF CON, where I (and obviously all the other “humans”, how attendees at DEF CON are called) had to wait nearly _four_ hours to get a badge to enter the con. DEF CON staff already calls this the annual “Line Con”. Enough bashing, back to topic 😉

SIGS DC Day

Fri, 16 Sep 2016 00:00:00 +0000

Today I had to give the pleasure to give a keynote at the SIGS DC Day on the need to evaluate Cloud Service Providers in a way that looks behind (or at least tries to) security whitepapers and certification reports. The slides can be found here.

I also particularly enjoyed the following two talks:

Sean O’Tool from Swisscom AG covered challenges of an infrastructure to cloud migration. Even though he only briefly touched the topic, I enjoyed his description of their firewalling model: Seeing that centralized firewall operation (or more precisely, rule design and approval) is limited/challenged by the understanding of the application, they transferred control over firewall rule sets (beyond a basic set of infrastructure/ground rules) to the application teams (using of features like OpenStack’s security groups, where he also talked about limitations of those). They compensated the loss of “centralized enforcement by a security group” with rule reviews — an approach that will become way more relevant (and necessary) in the future.

25th USENIX Security Symposium & WOOT Workshop

Mon, 12 Sep 2016 00:00:00 +0000

Last month the annual USENIX Security Symposium with its co-located workshops (WOOT, CSET, FOCI, ASE, and HotSec) was held in Austin, Texas. The program of the conference together with the published papers can be found here and information on the workshops can be found here.

The research topics were quite diverse and included subjects such as low-level attacks, cryptographic attacks, and vehicle attacks. To give you an impression on the research that has been presented at the conference, let us discuss some of the talks in the following:

MRMCD16 – diagnosis:critical

Sat, 03 Sep 2016 00:00:00 +0000

This year’s MRMCD16 had a topic that immediately let me submit a talk about medical device security: “diagnosis:critical”. Or to quote the official website:

Security issues in soft- and hardware have a low chance of healing, especially in medical IT.

Despite years of therapy using code reviews and programming guidelines, we still face huge amounts of vulnerable software that probably is in need of palliative treatment.

Security vulnerabilities caused by the invasion of IT in the medical sector are becoming real threats. From insulin pumps over analgesic pumps through to pace makers, more and more medical devices have been hacked already. This year’s motto “mrmcd2016 - diagnosis:critical” stands summarizing for the current state of the whole IT sector.

Black Hat 2016 Summary

Tue, 09 Aug 2016 00:00:00 +0000

Just a few days ago I had a blast again at this year’s Black Hat. Some of the talks were really worth listening to, so I wanted to point them out and give a short summary.

USING UNDOCUMENTED CPU BEHAVIOR TO SEE INTO KERNEL MODE AND BREAK KASLR IN THE PROCESS – Anders Fogh & Daniel Gruss

They had the last slot at the last day of Black Hat which resulted in a kind of empty room, but in my opinion it was an awesome talk and I even had the pleasure to meet these two guys at our ERNW dinner.

Not Sure Which Talks to Attend at BHUSA?

Fri, 29 Jul 2016 00:00:00 +0000

Hi,

I won’t be in Vegas for Black Hat this year as there’s a direct conflict with one of my kids’ birthdays, but I thought one or another reader might find it helpful to get some inspiration as for selecting the talks to catch (not least as there’s so many interesting ones). I hence decided to quickly write this post.

Here’s my would-be schedule for the first day (second day to follow, maybe, in another post), under the assumption to attend exactly one talk per slot. I could give a longer rationale per talk than the one below, based on several (mostly technical) factors, but this is just about providing suggestions in a brief form.
Disclaimer: I was on the BH guest review board this year so I might be biased in some cases.

REcon 2016 – A Quick Recap

Mon, 25 Jul 2016 00:00:00 +0000

Some of us had the pleasure to visit this year’s REcon in Montreal, Canada. Unfortunately, work caught us just when we arrived back in Germany, so I haven’t had time to sit down and write down a few words so far. However, we think that what we’ve experienced at REcon is worth writing about.

The overall quality of the speakers and talks were very nice. What really amazed me was the art work of REcon:

SnoopCon Guest Day

Fri, 01 Jul 2016 00:00:00 +0000

This year I had the pleasure to join the guest day of BT’s SnoopCon. There were quite a number of interesting talks throughout the day such as

Saumil Shah‘s presentation on Stegosploit (as well as his rant about the state of information security)
Dr. Grigorios Fragkos‘ talk on airplane security (where he presented some maybe not-so-pleasant but also some good-to-hear facts on the security posture of airplanes)
Dominic Spill‘s demonstration of tools and methods used to reverse engineer RF protocols
Hacker Fantastic‘s talk on how to use the AX.25 protocol to bounce radio signals off the ISS to communicate with systems around the world
Kostas Litovois’ and Vincent Yiu’s presentation on #WePWNise, a tool that can be used to efficiently create malicious VBA macros (by taking EMET configuration details into account)
Bryan Fite‘s talk on how we have to think about Safety, Security, and Privacy in the IoT age.

I really enjoyed the talks and had a great time! Thanks to all the organizers and speakers!

Area41 Conference 2016

Sat, 18 Jun 2016 00:00:00 +0000

Last Friday, Brian and I were at the Area41 Security Conference. The conference is a branch of Defcon conference and is more or less a small conference of the Swiss hacker community. Being in a “rock music club”, the speakers presented on a stage where usually the rock stars are performing – which gives the conference a very special flair and an interesting atmosphere. We’ve been at the conference to present our research about VoLTE technology including some attack scenarios we’ve evaluated in the past. More on this later, let’s first talk about the conference itself.

IPv6 & Threat Intelligence

Fri, 03 Jun 2016 00:00:00 +0000

Tomorrow, I will join a meeting where I’m expected to contribute, amongst others, to a discussion on the impact of IPv6 on threat intelligence. To prepare for that I started putting together some thoughts & ideas on the topic, and I even thought I might share this in a post (the one you read right now ;-), not least to, maybe, stimulate a discussion.

I don’t know much about threat intelligence so it might happen that, at times, I use some misguided terms or I expose a (too) naïve understanding of some concepts. Happy to be corrected in one way or another.

New Methods for Exploiting ORM Injections in Java Applications (HITB16)

Thu, 02 Jun 2016 00:00:00 +0000

The HITBSecConf or “Hack In The Box” in Amsterdam is a well known security conference in Europe. We also attended this year too, and there were quite some interesting talks at the HITBSecConf16 conference. One of the talks was about “New Methods for Exploiting ORM Injections in Java Applications” by the security researchers Mikhail Egorov and Sergey Soldatov.

I. What is Object-Relational Mapping (ORM)?

ORM stands for Object-Relational Mapping, which is a technique that automatically converts data from a relational database management system (RDBMS) into objects. This is often used in business applications of today.

Telescope – Peering Into the Depths of TLS Traffc in Real-Time (HITB16)

Mon, 30 May 2016 00:00:00 +0000

Last week we have visited the HITBSecConf16 – conference in Amsterdam.
There were many interesting talks, and in this post I am going to tell you about a talk held by Radu Caragea – “Telescope: Peering Into the Depths of TLS Traffic in Real-Time”.

While performing a dynamic malware analysis one often needs to analyze network traffic in order to determine malware communication with C&C servers, to observe the malware delivery from sites, or to investigate honeypot traffic under TLS.
There are already existing solutions to help with this task. However in the given talk considering virtual environments the speaker presented a novel technique that works for virtualized machines with a minimal overhead, and is actually OS-agnostic and crypto-library-agnostic.

The Beauty of IPv6 Link-Local Addressing. Not

Sat, 28 May 2016 00:00:00 +0000

In November 2014, after quite some controversy in the IETF OPSEC working group (for those interested look at the archives), the Informational RFC 7404 “Using Only Link-Local Addressing inside an IPv6 Network” was published. It is authored by Michael Behringer and Eric Vyncke and discusses the advantages & disadvantages of an approach using “only link-local addresses on infrastructure links between routers”.

So it’s (merely) about “infrastructure links” which some people call “transit networks” or “point to point” (ptp) links. I’m aware that there might be subtle differences between all these, depending on your specific use of the terms. Still I assume that most readers will have an understanding of what types of links are in focus of the RFC, and subsequently of this post.

Because of Cyber – A Recap

Wed, 11 May 2016 00:00:00 +0000

Troopers16 has been over for quite a while now, but because sharing is caring, we would like to give you some more insight and share some gems that happened over the 2 days of us running a small/medium sized enterprise in mid-west Russia as part of the well received FishBowl side story.

Technology wise the whole infrastructure of FishBowl, as well as the Cyber Emergency Response Team, was hosted on one FreeBSD machine with exception of the challenge scoreboard which was on site only, hence conference network only.
The C.E.R.T. web site was static web site using the jekyll engine. FishBowl on the other hand required some dynamic web magic which is why we choose to use the flask framework. For the FishBowl web design we simply helped ourselves with the styles of the Troopers web site, who of you noticed? 😉
All web related stuff was reverse proxied by an nginx to provide a common layer of technology even though every venture was segregated into its own FreeBSD jail environment.
For mail a simple postfix setup was set up. Having a proper mail server for such »shenanigans« turned out to be very enjoyable, but more on that later.

A Trip to Hannover Messe

Wed, 27 Apr 2016 00:00:00 +0000

Once every few years I decide to head to Hannover and attend Hannover Messe, probably the largest industrial trade fair in Germany and apparently on of the most important in the world. As this year’s main topic was “Industrie 4.0” I simply could not resist to go out on a hunt for new and interesting (secure) smart connected magic! And trust me, I was not disappointed – here’s a few of my impressions.

SAP Security @ Troopers16

Mon, 25 Apr 2016 00:00:00 +0000

When it comes to SAP, Troopers has two events that are about Security in SAP Systems in particular. On the first day of the Troopers16 Trainings the BIZEC workshop takes place. The second event is a dedicated SAP track during the conference. Apart from these events there were of course a lot of nice folks to talk to (about SAP) 🙂 This post is a short overview about SAP security @ TROOPERS16.

Defense & Management Day 2

Fri, 15 Apr 2016 00:00:00 +0000

TROOPERS16 offered many different speakers from around the globe. Below are three different talks from the afternoon of Day 2’s Defense and Management Track.

===

The TROOPERS16 talk “Attacking & Protecting Big Data Environments” presented the research of Birk Kauer and Matthias Luft, (ERNW) in which they showed how enterprise-grade “big data” environments, based on e.g. HortonWorks or Cloudera, comprising of components such as HDFS, Yarn, Hue, Flume, Hive, Spark, Sentry/Ranger could be attacked. These environments typically process huge amounts of data. The data is either stored in a cluster file system or streamed into clusters. The processing of these datasets are done by jobs, and these jobs can be arbitrary code execution.

Infiltrate and Syscan 360

Fri, 15 Apr 2016 00:00:00 +0000

Hi everyone,

I spent the last weeks traveling to Singapore and Miami to present my Xenpwn research about double fetch vulnerabilities in paravirtualized devices at Infiltrate and Syscan360. You can find my slides here. Both conferences had great organization, very technical talks and a cool audience. In the following I want to give a short recap of some of the talks I liked the most:

Sean Heelan – Automatic Root-Cause Identification for Crashing Executions (Infiltrate)

Sean Heelan talked about his work on automated root cause analysis. The goal of this research is to give a human researcher a detailed analysis of the potential root causes (in the form of violated predicates) that triggered a crash during a fuzzing run. Sean summarizes the core idea of his research much better than I would be able to in his blog post, which also contains a link to his slides. I’m always a big fan of his talks because he is one of the few peoples working in the intersection between the academic program verification community and the IT security industry.

Summary GI Sicherheit

Fri, 08 Apr 2016 00:00:00 +0000

This is a short summary of selected talks (i.e. those that I found the most interesting of those I was able to personally attend) of the GI Sicherheit 2016.

First of all, congratulations to Dr. Fabian Yamaguchi, who received an award (the GI Promotionspreis) for his PhD thesis “Pattern-Based Vulnerability Discovery“!
His work presents an “approach for identifying vulnerabilities which combines techniques from static analysis, machine learning, and graph mining to augment the analyst’s abilities rather than trying to replace her” by identifying and highlighting patterns of potential vulnerabilities in source code.

TSD 2016 – Follow Up

Thu, 07 Apr 2016 00:00:00 +0000

Thanks again for all the great talks and fruitful discussions @TSD 2016! I hope everybody had a safe trip home and enjoyed Troopers as we did. In the meantime I contacted all speakers to talk about publication of their slidesets. Some of them agreed (or already published them on their own) so I’d like to share these with you:

Alexandre De Oliveira – Assaulting IPX Diameter roaming network
Siddharth Rao – The known unknowns of SS7 and beyond.
Joao Collier de Mendonca – “rucki zucki” scanning tool
Harald Welte – Open Source Network Elements for Security Analysis of Mobile Networks
Ravi & Altaf Shaik – Don’t connect to my 4G base station: investigating info leaks in 4G basebands

Unpatchable – Living with a vulnerable implanted device

Thu, 07 Apr 2016 00:00:00 +0000

TL;DR: Marie Moe talked about security issues of medical devices, especially implantable devices like pacemakers, but not in overwhelming technological depth. She wanted to point out the necessity of intensified security research in the field of medical devices as vendors and medical personnel seem to be lacking necessary awareness of security of devices, interfaces, services, and even data privacy.”Get involved, join the cavalry” was her core message.

Lub-Dub-Lub-Dub-Lub-Dub
Marie started her talk with the sound of a repeating heartbeat. First she introduced how she came up with the topic of her talk: Marie relies on a pacemaker herself andsince she got it implanted she was curious how secure this little device might be. A minimum education of the auditorium followed including an explanation how a human heart works and what a pacemaker does.

Security Assessment of Microsoft DirectAccess

Wed, 06 Apr 2016 00:00:00 +0000

A talk about DirectAccess (an IPv6-only VPN solution) was given by our colleague Ali Hardudi during IPv6 summit. Ali has recently finished his master thesis on this topic.

The DirectAccess VPN technology was introduced by Microsoft starting from Windows server 2008. It allows users remotely, seamlessly and securely connect to their internal network resources without a need to provide user credentials, which is done using different technologies such as Windows domain group policies.

Anonymization IPv6 in PCAPs – Challenges and Wins

Tue, 05 Apr 2016 00:00:00 +0000

Jasper Bongertz is a Senior Technical Consultant at Airbus Defence and Space CyberSecurity. He is focusing on IT security, Incident Response and Network Forensics.
During the IPv6 summit on Troopers16 he had given a talk on anonymization IPv6 in PCAPs and presented his new tool.

Sometimes you need to share your packet capture files (PCAPs), but distributing them involves a risk of exposing the confidential information. To avoid this, you must sanitize your PCAPs. The goal of sanitization is to remove the critical details but keep enough information for the PCAP to still be useful. The original-to-sanitized ratio is based on your goals.

Passive Intelligence Gathering and Analytics – It’s all Just Metadata!

Tue, 05 Apr 2016 00:00:00 +0000

The first talk after the keynote on day 2 of TROOPERS was from Christopher Truncer about passive intelligence gathering and the analytics of that. Christopher Truncer (@ChrisTruncer) is a red teamer with Mandiant. He is a co-founder and current developer of the Veil-Framework, a project aimed to bridge the gap between advanced red team and penetration testing toolsets.

His talk is mainly about defending a network from different threats by collecting and analyzing metadata from different sources.

The Kings in your Castle

Tue, 05 Apr 2016 00:00:00 +0000

At the second day of the TROOPERS16 conference an interesting talk about Advanced Persistent Threats took place from Marion Marschalek and Raphaël Vinot. Marion Marschalek is a Security Researcher, focusing on the analysis of emerging threats and exploring novel methods of threat detection. Marion started her career within the anti-virus industry and also worked on advanced threat protection systems where she built a thorough understanding of how threats and protection systems work and how both occasionally fail.

Advanced IPv6 Network Reconnaissance

Sun, 03 Apr 2016 00:00:00 +0000

Fernando Gont, who is specializing in the field of communications protocols security, gave a talk during this year’s Troopers IPv6 summit. He spoke about network reconnaissance techniques in IPv6 area and presented a brand new set of tools for this purpose.

Comparing with methods for IPv4, reconnaissance techniques for IPv6 should be different. It offers much larger address space, so such attacks as brute force address scanning are not feasible anymore, because it would take too much time to send one packet to each and every possible address. Fernando has also noted that in general network reconnaissance support in security tools has traditionally been poor. Together these facts prompt that it’s time for something new, and recently a new IETF RFC 7707 was published.

Patch Me If You Can

Sat, 02 Apr 2016 00:00:00 +0000

Right after the Opening Keynote of TROOPERS16, an informative and interesting talk took place at the SAP Security track. This talk was given by three speakers; Damian Poddebniak who is currently a master student at the University of Applied Sciences of Münster, Sebastian Schinzel who works as an IT security Professor at the University of Applied Sciences of Münster and he is also the founder of CycleSEC GmbH and finally the sixth-time speaker at Troopers “Andreas Wiegenstein” who is the CTO of Virtual Forge GmbH and a professional SAP security consultant since 2003.

Tools for Troubleshooting and Monitoring IPv6 Networks

Sat, 02 Apr 2016 00:00:00 +0000

Yet another interesting 180-minute workshop in IPv6 Security Summit of TROOPERS16, which aimed to introduce the IPv6 troubleshooting and monitoring tools, which are essentially needed by users in order to know how to deal with IPv6 in any IPv6-enabled network.

Before we dive into this post, let me introduce you in few words “Gabriel Müller” the speaker and the instructor of this workshop. Gabriel works as a senior consultant at AWK Group by mainly assisting clients in the public and private sectors as a project manager and an expert in the network area.

Caring for file formats

Fri, 01 Apr 2016 00:00:00 +0000

Ange Albertini is a reverse engineer and author of Corkami.

First and foremost he explained what a polyglot file is. A polyglot is a special file that has more than one type in the same file. For example, Ange Albertini demonstrated a polyglot which is a pdf, a pdf reader, a java executable and an html file inside of one file. The second polyglot he demonstrated was a file which had the characteristics that when you encrypted it with AES you get a PNG image and if it´s encrypted with another key you will get a flash video and when you encrypted it with DES you get a PDF document. He pointed out that a file format is not just a sequence of byte it´s rather a computer dialect to communicate between communities. He also highlighted that people don’t really care about what is behind the file format they only what to use it and communicate with other people.

Imma Chargin Mah Lazer-How to protect against (D)DoS attacks

Fri, 01 Apr 2016 00:00:00 +0000

Denial of Service (DoS) attacks aim to make services and systems unavailable to legitimate users . If these attacks are performed by multiple sources at the same time and for the same target, they are called Distributed Denial of Service (DDoS) attacks. This talk “Imma Chargin Mah Lazer” describes different types of (D)DoS attacks that are out in the wild and are seen on a daily basis by different corporations. Furthermore, a multi-layered strategy to mitigate such kinds of attacks has been presented within the talk. The speaker is Dr. Oliver Matula, an IT security researcher at ERNW who holds a PHD degree in physics. He presented the topic in a simple way which eases the delivery of information to audience of different technical levels and backgrounds.

QNX: 99 Problems but a Microkernel ain’t one!

Fri, 01 Apr 2016 00:00:00 +0000

The talk “QNX: 99 Problems but a Microkernel ain’t one!” was part of the Troopers conference in Heidelberg, 16 March 2016. The talk was done by the researchers Alex Plaskett and Georgi Geshev from the MWR Labs. The MWR Labs is the research department of the cyber security consultancy MWR InfoSecurity located in the UK.

The talk provided an overview of the research on the architecture and security systems of the QNX kernel with focus on the Blackberry 10 operating system. The talk was divided into two parts. First Alex Plaskett gave an introduction regarding the general structure of the QNX operation system and introduced the main subsystems. Second Georgi Geshev presented tools and approaches to abuse vulnerabilities in the QNX system.

The road to secure Smart Cars: ENISA approach

Fri, 01 Apr 2016 00:00:00 +0000

At TROOPERS16, Dr. Cédric LÉVY-BENCHETON an expert in cyber security at ENISA, the European Union Agency for Network and Information Security. Dr. Cédric LÉVY-BENCHETON holds a presentation about cyber security of IoT (Internet of Things) and smart cars he presents the current threats in IoT and Smart cars. ENISA is an agency of the European Union. ENISA assists the Commission, the Member States and, the business community in meeting the requirements of network and information security.

unrubby: reversing without reversing

Fri, 01 Apr 2016 00:00:00 +0000

The talk “unrubby: reversing without reversing” was part of the Troopers conference in Heidelberg, 16 March 2016. The talk was done by Richo Healey, who is currently working on the security engineering team at the Irish payment company Stripe. Richo Healey is an experienced conference speaker. Amongst other he has spoken at Kiwicon, DEF CON and 44con.

In his talk Richo Healey spoke about reverse engineering of Ruby software. First he talked about existing tools and techniques to regenerate source code from Ruby bytecode. Then he presented a new concept, which is implemented in his tool “unrubby”.

BMC BladeLogic: CVE-2016-1542 and CVE-2016-1543