Yesterday, Cisco released a number of security advisories. Three of the advisories originated from research performed by us for the Cisco Nexus 9000 Series Fabric Switches / Cisco Application Centric Infrastructure (ACI). Continue reading “Security Advisory for Cisco Nexus 9000 Series Fabric Switches in ACI mode”
Continue readingCategory: Misc
MDMs – The Mobile Device “Magic” Solutions – Expectations and Reality
When you are working in the area of mobile security, you sooner or later receive requests from clients asking you to test specific ‘Mobile Device Management’ (MDM) solutions which they (plan to) use, the corresponding mobile apps, as well as different environment setups and device policy sets.
The expectations are often high, not only for the MDM solutions ability to massively reduce the administrative workload of keeping track, updating and managing the often hundreds or thousands of devices within a company but also regarding the improvements towards the level of security that an MDM solution is regularly advertised to provide.
With this very blog post you are reading and a small series of future blog posts, I would like to provide some insight from my day-to-day practical experience with some of the most often used MDM solutions from a testers perspective.
Continue reading “MDMs – The Mobile Device “Magic” Solutions – Expectations and Reality”
Continue readingIPv6 Address Management / The “External” Flag
We’re regularly asked to review IPv6 address plans from different organizations and I’d like to share some reflections from such a process currently happening. I’ve discussed a few aspects of IPv6 address planning before; those readers interested please see this post which contains some references.
Continue reading “IPv6 Address Management / The “External” Flag”
Continue readingIPv6 Security in an IPv4-only Environment
Starting a post, in 2019, with a mention of sth being “IPv4-only” somewhat hurts ;-), but here we go. Recently Manel Rodero from Barcelona asked me the following question on Twitter:
Continue reading “IPv6 Security in an IPv4-only Environment”
Continue readingSome Notes on the IPv6 Properties of the Wireless Network @ Cisco Live Europe
Some years ago Christopher wrote two posts (2016, 2015) about the IPv6-related characteristics of the WiFi network at Cisco Live Europe. To somewhat continue this tradition and for mere technical interest I had a look at some properties of this year’s setting.
Continue reading “Some Notes on the IPv6 Properties of the Wireless Network @ Cisco Live Europe”
Continue readingIPv6 Talks & Publications
At first a very happy new year to everybody!
While thinking about the agenda of the upcoming Troopers NGI IPv6 Track I realized that quite a lot of IPv6-related topics have been covered in the last years by various IPv6 practitioners (like my colleague Christopher Werny) or researchers (like my friend Antonios Atlasis). In a kind of shameless self plug I then decided to put together of list of IPv6 talks I myself gave at several occasions and of publications I (co-) authored. Please find this list below (sorted by years); you can click on the titles to access the respective documents/sources.
I hope some of this can be of help for one or the other among you in the course of your own IPv6 efforts.
Cheers,
Enno
Continue reading “IPv6 Talks & Publications”
Continue readingmacOS Mojave Hardening Guide
Due to the new release of macOS Mojave in September we updated the El Capitan hardening guide.
Continue reading “macOS Mojave Hardening Guide”
Continue readingMotivational Aspects and Privacy Concerns on Wearables in the German Running Community
Today I am proud to announce that another paper of my former colleagues from Heilbronn University and me was published in one of the journals with the highest impact factor for Medical Informatics research called JMIR mHealth and uHealth. There is a reason why we published in this journal besides its informatics focus. The journal is an open access journal. That means that readers are not charged on a pay-per-view basis or other business models to access the full text of the paper. In return, the authors need to pay publication fees. In my opinion restricting access to academic research is not a way to go. I think this isn’t a thing we see in the security community often anyway. But this is and was the standard in academia for years.
Continue readingERNW Whitepaper 67: Active Directory Trust Considerations
Last week Will “harmj0y” Schroeder published an excellent technical article titled “Not A Security Boundary: Breaking Forest Trusts” in which he lays out how a highly critical security compromise can be achieved across a forest boundary, resulting from a combination of default AD (security) settings and a novel attack method. His post is a follow-up to the DerbyCon talk “The Unintended Risks of Trusting Active Directory” which he had given together with Lee Christensen and Matt Nelson at DerbyCon (video here). They will also discuss this at the upcoming Troopers Active Directory Security Track (details on some more talks, including Sean Metcalf’s one, can be found in this post or this one).
Continue reading “ERNW Whitepaper 67: Active Directory Trust Considerations”
Continue readingComparison of our tool afro (APFS file recovery) with Blackbag Blacklight and Sleuthkit
At this years ARES conference, Jonas Plum (Siemens) and me (Andreas Dewald, ERNW Research GmbH) published a paper about the forensic analysis of APFS, file system internals and presented different methodologies for file recovery. We also publicly released a tool implementing our presented approaches, called afro (APFS file recovery).
Continue reading