This is an German blog post as it is a recap from a German conference.
Sven und ich hatten zwei unglaublich spannende und lehrreiche Tage bei der heise devSec in Marburg.
Besonders hängen geblieben ist bei uns die Keynote von Volodymyr Styran zum Thema “Predictability Is Vulnerability: What Four Years of Cyber War Teach About Software Security”. Eine Erkenntnis daraus deckt sich stark mit unseren Erfahrungen aus zahlreichen Pentests: Angriffe müssen nicht immer aus einer hochkomplexen Exploit Chain bestehen. Oft sind es nicht die Zero-Day Exploit, die zur kritischen Kompromittierung der Umgebung führen würden, sondern banale Konfigurationsprobleme, wie schwache oder geleakte Credentials. Seine Erkenntnis ist, dass durch vorhersehbare Umgebungen, stabile Konfigurationen und kompromittierte Credentials die Angreifer lange unentdeckt und persistent bleiben und sich bewegen können.
A while ago we started researching Bluetooth Auracast security and wrote about
some of our insights. Back then
we released the Auracast Hacker’s
Toolkit that
allowed scanning, listing, and dumping Auracast broadcasts. The main goal was to
be able to capture over-the-air packets in order to brute-force the Broadcast
Code. Along with this blog post we’re releasing an updated version of the
toolkit. This time we implemented proper sniffing capabilities. If you’re
interested in the details, feel free to read on. If not, grab your nRF52840 USB
dongle,
flash the firmware, start sniffing,
and load the captures in our Auracast Packet Visualizer.
This is the first post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. Over the next four posts, we’ll walk through how token-based attacks work, put important Microsoft defenses gaining relevance in this context, Continuous Access Evaluation and Token Protection, through empirical testing, and check where Entra ID still deviates from OAuth 2.0 best practices. This post sets the stage: why token theft matters, and how attackers actually get their hands on a token.
While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.
As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its defense-in-depth strategy actually hold up against this shift? We put it to the test.
With this blog post I am pleased to announce the publication of a new ERNW White
Paper about our incident analysis and digital forensics framework. It is
available on our website.
Due to the increasing number and impact of computer security incidents, it has
become essential to develop and implement efficient measures for their
investigation. However, comprehensive forensic analyses are time-consuming, and
this time is often not available to security analysts during computer security
incidents. As a result, automated tools are increasingly being used. These
tools, however, often cover only a limited scope of the necessary analyses and
typically require deep technical expertise to be used effectively.
While working on an OT project, we looked into TIA Portal1 project files to
extract more information about changes, especially timestamps to be able to
reconstruct a timeline. The TIA Portal (Totally Integrated Automation Portal)
allows to create and upload programs for PLC (Programmable Logic Controller)
devices often used in the OT (Operational Technology) landscape. Some attacks
are able to find the workstation with the TIA Portal and manipulate the project
to reprogram the PLCs. To be able to reconstruct the timeline of these changes
we wanted to be able to read the timestamps of events from the TIA project
files.
In this post I want to talk about a very essential part of my workflow when
dealing with Bluetooth devices, particularly IoT devices with a corresponding
mobile app: Live capture of Android Bluetooth traffic with Wireshark.
Before you stop reading because you think you know how to do this already, the
method does not involve pulling bug reports off your phone, and it does not
require root. And most importantly it gives you a live packet log in
Wireshark.
Yesterday, the BSI (the German Federal Office for Information Security, or
Bundesamt für Sicherheit in der Informationstechnik in German) published the
first result document from the “Windows dissected” (ger.: “Windows seziert”)
project: our analysis of Windows Hello for Business (WHfB). If you have followed
this blog over the past year, you have seen the pieces. The full 170-page report
has now been published. And it can be downloaded from the
project page.
When looking at security measures in Microsoft Entra ID environments, a common
recommendation is to implement Conditional Access policies.
Whether Conditional Access is implemented can be quickly checked, and you can
put a check mark next to it in your best-practice compliance form. However,
simply implementing conditional access will not provide much security. A
phishing attack that we recently analyzed highlights this very well.