Just a few days ago I had a blast again at this year’s Black Hat. Some of the
talks were really worth listening to, so I wanted to point them out and give a
short summary.
They had the last slot at the last day of Black Hat which resulted in a kind of
empty room, but in my opinion it was an awesome talk and I even had the pleasure
to meet these two guys at our ERNW dinner.
I won’t be in Vegas for Black Hat this year as there’s a direct conflict with
one of my kids’ birthdays, but I thought one or another reader might find it
helpful to get some inspiration as for selecting the talks to catch (not least
as there’s so many interesting ones). I hence decided to quickly write this
post.
Here’s my would-be schedule for the first day (second day to follow, maybe, in
another post), under the assumption to attend exactly one talk per slot. I could
give a longer rationale per talk than the one below, based on several (mostly
technical) factors, but this is just about providing suggestions in a brief
form.
Disclaimer: I was on the
BH guest review board this year so
I might be biased in some cases.
Some of us had the pleasure to visit this year’s REcon in
Montreal, Canada. Unfortunately, work caught us just when we arrived back in
Germany, so I haven’t had time to sit down and write down a few words so far.
However, we think that what we’ve experienced at REcon is worth writing about.
The overall quality of the speakers and talks were very nice. What really amazed
me was the art work of REcon:
This year I had the pleasure to join the guest day of BT’s SnoopCon. There were
quite a number of interesting talks throughout the day such as
Saumil Shah‘s presentation on Stegosploit
(as well as his rant about the state of information security)
Dr. Grigorios Fragkos‘ talk on airplane
security (where he presented some maybe not-so-pleasant but also some
good-to-hear facts on the security posture of airplanes)
Dominic Spill‘s demonstration of tools and
methods used to reverse engineer RF protocols
Hacker Fantastic‘s talk on how to use
the AX.25 protocol to bounce radio signals off the ISS to communicate with
systems around the world
Kostas Litovois’ and Vincent Yiu’s presentation on #WePWNise, a tool that can
be used to efficiently create malicious VBA macros (by taking EMET
configuration details into account)
Bryan Fite‘s talk on how we have to think
about Safety, Security, and Privacy in the IoT age.
I really enjoyed the talks and had a great time! Thanks to all the organizers
and speakers!
Last Friday, Brian and I were at the Area41 Security Conference. The conference
is a branch of Defcon conference and is more or less a small conference of the
Swiss hacker community. Being in a “rock music club”, the speakers presented on
a stage where usually the rock stars are performing – which gives the conference
a very special flair and an interesting atmosphere. We’ve been at the
conference to present our research
about VoLTE technology including some attack scenarios we’ve evaluated in the
past.
More on this later, let’s first talk about the conference itself.
Tomorrow, I will join a meeting where I’m expected to contribute, amongst
others, to a discussion on the impact of IPv6 on threat intelligence. To prepare
for that I started putting together some thoughts & ideas on the topic, and I
even thought I might share this in a post (the one you read right now ;-), not
least to, maybe, stimulate a discussion.
I don’t know much about threat intelligence so it might happen that, at times, I
use some misguided terms or I expose a (too) naïve understanding of some
concepts. Happy to be corrected in one way or another.
The HITBSecConf or “Hack In The Box” in Amsterdam is a well known security
conference in Europe. We also attended this year too, and there were quite some
interesting talks at the HITBSecConf16 conference. One of the talks was about
“New Methods for Exploiting ORM Injections in Java Applications” by the security
researchers Mikhail Egorov and Sergey Soldatov.
I. What is Object-Relational Mapping (ORM)?
ORM stands for Object-Relational Mapping, which is a technique that
automatically converts data from a relational database management system (RDBMS)
into objects. This is often used in business applications of today.
Last week we have visited the HITBSecConf16 – conference in Amsterdam.
There were many interesting talks, and in this post I am going to tell you about
a talk held by Radu Caragea – “Telescope: Peering Into the Depths of TLS Traffic
in Real-Time”.
While performing a dynamic malware analysis one often needs to analyze network
traffic in order to determine malware communication with C&C servers, to observe
the malware delivery from sites, or to investigate honeypot traffic under TLS.
There are already existing solutions to help with this task. However in the
given talk considering virtual environments the speaker presented a novel
technique that works for virtualized machines with a minimal overhead, and is
actually OS-agnostic and crypto-library-agnostic.
In November 2014, after quite some controversy in the IETF OPSEC working group
(for those interested look at the
archives),
the InformationalRFC 7404 “Using
Only Link-Local Addressing inside an IPv6 Network” was published. It is authored
by Michael Behringer and
Eric Vyncke and discusses the advantages
& disadvantages of an approach using “only link-local addresses on
infrastructure links between routers”.
So it’s (merely) about “infrastructure links” which some people call “transit
networks” or “point to point” (ptp) links. I’m aware that there might be subtle
differences between all these, depending on your specific use of the terms.
Still I assume that most readers will have an understanding of what types of
links are in focus of the RFC, and subsequently of this post.
Troopers16 has been over for quite a while now, but because sharing is caring,
we would like to give you some more insight and share some gems that happened
over the 2 days of us running a small/medium sized enterprise in mid-west Russia
as part of the well received FishBowl side story.
Technology wise the whole infrastructure of FishBowl, as well as the Cyber
Emergency Response Team, was hosted on one FreeBSD machine with exception of the
challenge scoreboard which was on site only, hence conference network only.
The C.E.R.T. web site was static web site using the jekyll
engine. FishBowl on the other hand required some dynamic web magic which is why
we choose to use the flask framework. For the
FishBowl web design we simply helped ourselves with the styles of the
Troopers web site, who of you noticed? 😉
All web related stuff was reverse proxied by an nginx to
provide a common layer of technology even though every venture was segregated
into its own FreeBSD jail environment.
For mail a simple postfix setup was set up. Having a proper mail server for such
»shenanigans« turned out to be very enjoyable, but more on that later.