In some organizations we work with a certain state of IPv6 deployment has been
reached in the interim which includes, among others, the following aspects:
the network infrastructure is IPv6-enabled (incl. interface addressing,
routing [protocols] and the like).
parts of supporting services (security functions, monitoring, system
management) include IPv6 in a proper way.
3rd party providers have been contractually obliged to deliver their services
in an “IPv6-enabled” mode (as opposed to only being “IPv6-capable” which was
the standard requirement in many RFIs during earlier years).
It might then happen that networking people (who often are the initial
motivators for deploying IPv6) in such organizations are stating, when asked
about IPv6: “it’s [mostly] done”.
Point is that, alas, this does not necessarily mean that a single service or
application is *actually using* IPv6, so while the above certainly constitutes
an achievement it might not even be halfway through.
In this post I’ll cover some properties of the Windows Server 2019 IPv6 stack.
It is an update of a similar post I wrote on the
IPv6 properties of Server 2016
a while ago.
For this reason I will mostly look at the same properties I did at the time
(read: at times without providing too much technical background information;
that can be found in the other post) and I’ve hence performed the same types of
practical tests.
The Windows Insight repository
currently hosts four articles on VSM (Virtual Secure Mode):
Virtual Secure Mode: Architecture Overview (Aleksandar Milenkoski): In
this work, we discuss the architecture of a virtualized Windows environment.
**Virtual Secure Mode: Communication Interfaces **(Aleksandar Milenkoski):
In this work, we discuss the communication interfaces that VSM implements:
Isolated User Mode (IUM) system calls, normal-mode services, secure services,
and hypercalls.
Virtual Secure Mode: Protections of Communication Interfaces (Aleksandar
Milenkoski): This work discusses implemented mechanisms for securing the
above VSM communication interfaces. This includes restrictions on issuing
hypercalls, data marshalling and sanitization, and secure data sharing.
Virtual Secure Mode: Initialization (Dominik Phillips, Aleksandar
Milenkoski): This work describes the process for VSM initialization
activities performed by the Windows loader and the Windows kernel when Windows
10 is booted.
Heise berichtet aktuell öffentlich über die
Emotet-Infektion im eigenen Haus,
bei dessen Aufklärung ERNW unterstützte.
Damit liefert Heise Informationen
zum Verlauf aktueller Angriffe, aber insbesondere auch wertvolle Einsichten zu
Vorbeugung, Erkennung, Analyse und Gegenmaßnahmen aus eigener Erfahrung, wie sie
nur selten der Öffentlichkeit preisgegeben werden.
Ein Team aus Incident-Response Spezialisten der ERNW Research unterstützte Heise
bei der Analyse und Rekonstruktion des Vorfalls und analysierte die
Schadsoftware, um deren Ausbreitungswege nachzuvollziehen und IoCs (Indicators
of Compromise) zu extrahieren. Hierdurch konnten effektive Gegenmaßnahmen
entwickelt und gemeinsam mit Heise erfolgreich umgesetzt werden.
The Windows Insight repository
currently hosts three articles on the TPM (Trusted Platform Module):
The TPM: Communication Interfaces (Aleksandar Milenkoski): In this work,
we discuss how the different components of the Windows 10 operating system
deployed in user-land and in kernel-land, use the TPM. We focus on the
communication interfaces between Windows 10 and the TPM. In addition, we
discuss the construction of TPM usage profiles, that is, information on system
entities communicating with the TPM as well as on communication patterns and
frequencies;
The TPM: Integrity Measurement (Aleksandar Milenkoski): In this work, we
discuss the integrity measurement mechanism of Windows 10 and the role that
the TPM plays
as part of it. This mechanism, among other things, implements the production
of measurement data. This involves calculation of hashes of relevant
executable files or of code sequences at every system startup. It also
involves the storage of these hashes and relevant related data in log files
for later analysis;
This week Chris and I participated in the RIPE 78
meeting in Reykjavík. Being part of the group was fun as always and we had quite
some interesting conversations with peers from (not only) the IPv6 community.
Big thanks to the RIPE NCC team for the smooth
organization and for taking care of us!
In this post I’ll provide some notes on talks I found particularly interesting,
plus links to our own contributions.
We are glad to announce the
Windows Insight repository. The
content of this repository aims to assist efforts on analysing inner working
principles, functionalities, and properties of the Microsoft Windows operating
system. This repository stores relevant documentation as well as executable
files needed for conducting analysis studies.
Some of the content of this repository has been created in the course of a
project named ‘Studie zu Systemaufbau, Protokollierung, Härtung und
Sicherheitsfunktionen in Windows 10 (SiSyPHuS Win10)’ (ger.) – ‘Study of system
design, logging, hardening, and security functions in Windows 10’ (eng.). This
project has been contracted by the
German Federal Office for Information Security
(ger., Bundesamt für Sicherheit in der Informationstechnik – BSI). The work
planned as part of the project is conducted by ERNW GmbH, starting in May 2017.
Chris and I will give a tutorial on the above
topic at next week’s RIPE Meeting in Reykjavík. In
this post (actually this will probably become a small series of posts) I’ll try
to summarize some thoughts on IPv6 security in enterprise environments in 2019.
We’re going to cover three main areas:
Why IPv6 Is Different, Security-wise
Traffic Filtering in IPv6 Networks
IPv6 Security in L2 Networks / First Hop Security et al.
Let’s start with the first item. In real-life scenarios the security of “a
protocol” – IPv6 can rather be considered a “protocol family” which includes
helper protocols like ICMPv6 and MLD (which in turn is implemented by means of
ICMPv6 messages) and potentially others like DHCPv6 – might depend on a number
of factors:
Dominik Phillips and I are taking part in a tour organized by
Heise Security – the
Heise Security Tour. We
give a talk titled “PowerShell: Attack under the radar”. In this talk, we
provide an overview of the architecture of PowerShell and show how attackers may
use PowerShell for malicious purposes. We demonstrate PowerShell
post-exploitation activities implemented as part of publicly available
frameworks, such as Empire. We also discuss
a security concept for defending against such activities.
Yesterday, Cisco released a number of security advisories. Three of the
advisories originated from research performed by us for the Cisco Nexus 9000
Series Fabric Switches / Cisco Application Centric Infrastructure (ACI).
More specifically, these advisories are the following: