Insinuator.net - Bold Statements

ERNW White Paper 79: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection

Wed, 12 Aug 2026 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper about our incident analysis and digital forensics framework. It is available on our website.

Due to the increasing number and impact of computer security incidents, it has become essential to develop and implement efficient measures for their investigation. However, comprehensive forensic analyses are time-consuming, and this time is often not available to security analysts during computer security incidents. As a result, automated tools are increasingly being used. These tools, however, often cover only a limited scope of the necessary analyses and typically require deep technical expertise to be used effectively.

TIA Project Parser

Wed, 12 Aug 2026 00:00:00 +0000

While working on an OT project, we looked into TIA Portal¹ project files to extract more information about changes, especially timestamps to be able to reconstruct a timeline. The TIA Portal (Totally Integrated Automation Portal) allows to create and upload programs for PLC (Programmable Logic Controller) devices often used in the OT (Operational Technology) landscape. Some attacks are able to find the workstation with the TIA Portal and manipulate the project to reprogram the PLCs. To be able to reconstruct the timeline of these changes we wanted to be able to read the timestamps of events from the TIA project files.

#TROOPERS26 AD & Entra ID Security Track

Tue, 11 Aug 2026 00:00:00 +0000

The #TROOPERS26 ‘AD & Entra ID Security’ track delivered an incredible experience – much like the entire conference! We were thrilled to host some of the brightest minds in identity research alongside a highly engaged audience who brought valuable insights to the roundtable discussions. While the presentation slides have already been published on the TROOPERS website, several speakers have shared complementary tools, in-depth blog posts, and active social media threads. To make things easy, we’ve compiled a comprehensive list of all these fantastic resources from the track below.

Your Android Bluetooth Traffic Captures Should Be Live

Mon, 27 Jul 2026 00:00:00 +0000

In this post I want to talk about a very essential part of my workflow when dealing with Bluetooth devices, particularly IoT devices with a corresponding mobile app: Live capture of Android Bluetooth traffic with Wireshark.

Before you stop reading because you think you know how to do this already, the method does not involve pulling bug reports off your phone, and it does not require root. And most importantly it gives you a live packet log in Wireshark.

Windows Hello for Business – Full Report Has Been Released

Thu, 16 Jul 2026 00:00:00 +0000

Yesterday, the BSI (the German Federal Office for Information Security, or Bundesamt für Sicherheit in der Informationstechnik in German) published the first result document from the “Windows dissected” (ger.: “Windows seziert”) project: our analysis of Windows Hello for Business (WHfB). If you have followed this blog over the past year, you have seen the pieces. The full 170-page report has now been published. And it can be downloaded from the project page.

TROOPERS26: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection

Mon, 29 Jun 2026 00:00:00 +0000

Last week I gave a talk at #TROOPERS26: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection. I discussed the challenges of incident analysis, such as increasing storage capacities and the lack of integration between tools. I presented a modular framework that integrates established forensic and analysis tools using a decision-tree-based control mechanism. A workflow was designed to control the execution of 14 integrated analysis tools in order to reproduce the manual analysis process usually performed by analysts. Moreover, the framework is capable of identifying whether a system has been compromised and compiles a analyst-oriented report. Together with the audience we took a look at the report in a live demonstration. The evaluation results of the framework were promising as it was able to identify all compromised systems. However, a significant number of false positive classifications were also observed. To improve the framework possible future extensions include functionality such as recovering already deleted files to detect missed Indicators of Compromise. Additionally, our team want to integrate artificial intelligence in the workflow to help in data processing and make more decisions automatically. The slides will be published next week on the conference website. I will add the link in this blog post when they become available. A more detailed description of the content of the talk can be found in the following sections. Looking forward to #TROOPERS27!

Heads-up: TROOPERS Roundtable – Supply Chain Security

Mon, 22 Jun 2026 00:00:00 +0000

How to strengthen Supply Chain Security: Practical Exchange and Roadmap

Join an open, practitioner-focused roundtable for direct exchange on supply chain security. This session offers a concise overview of core concepts, e.g. SBOM, CSAF, and VEX and digs into the processes behind them: how to obtain, process and apply information to improve security across the supply chain.

We will examine:

How SBOM, CSAF and VEX relate and why version-level detail matters.
The practical value of an SBOM and why it’s increasingly required by law and IT procurement.
How to create and consume SBOMs?
Methods to identify dependencies in the context of vulnerabilities.
Approaches to triage: not all vulnerabilities affect every stakeholder equally.
Techniques to analyze vulnerabilities and identify affected products and product families.
Sources of vulnerability information and how to map data unambiguously to products and specific software versions.
Reporting obligations: where and how to disclose vulnerabilities.
Tools and automation that help manage information volume and complexity.
Technical, organizational and personnel challenges to achieving end-to-end supply chain security.
The role of AI in supply chain security.
How do we protect ourselves from malicious actors / infected dependencies?
The Cyber Resilience Act (CRA): implications for companies, products and consumers, the CRA roadmap, and concrete deadlines and actions.
We will show a live demonstration of the whole process, e.g. covering the consumption of SBOMs, vulnerability identification and assessment, creation of VEX documents.

This roundtable is designed for security practitioners, product owners, compliance officers and decision-makers who want actionable guidance and peer discussion. Expect candid conversation, real-world examples and next steps you can take to strengthen resilience across your supply chains.

Vulnerability Disclosure: Stealing Emails via Firefox’s AI Features

Tue, 16 Jun 2026 00:00:00 +0000

Imagine the following: You visit a webpage with a lot of text you don’t want to read and ask your AI assistant for a summary. A few moments later, the AI assistant has extracted one of your emails and sent it to an attacker without you ever knowing.

In October 2025, we found exactly this vulnerability in Firefox’s AI chatbot integration¹.

Firefox offers a summarization, explaination and proofread AI feature. When a user makes use of one of these features, Firefox pastes a prompt into the sidebar AI chat including the page title, the selected text (or, if the whole page is summarized, a selection is being made by Firefox) and an instruction on how to process the provided text. The sidebar AI chat is essentially an IFrame of a third-party chatbot (Claude, Copilot, …).

Insights into Entra ID’s (Un)Conditional Access

Thu, 21 May 2026 00:00:00 +0000

When looking at security measures in Microsoft Entra ID environments, a common recommendation is to implement Conditional Access policies.

Whether Conditional Access is implemented can be quickly checked, and you can put a check mark next to it in your best-practice compliance form. However, simply implementing conditional access will not provide much security. A phishing attack that we recently analyzed highlights this very well.

CVE-2026-47237 – Overly Permissive Istio Permissions Allow Kubeflow Authorization Token Stealing

Wed, 20 May 2026 00:00:00 +0000

Kubeflow is vulnerable to the theft of authorization tokens by any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker can take over the user’s account and the data that is processed by that user. The attacker needs a valid user with the kubeflow-edit or Contributor role in a random Kubeflow namespace to perform this attack. This is given if Automatic Profile Creation is enabled. A setup based on the official manifests prior to version 1.10, and on most other packaged Kubeflow distributions, is vulnerable.

The Istio edit permissions were removed by Kubeflow in a timely manner. Affected users should update to the latest version to mitigate this issue.

ERNW White Paper 77: Unified Security Hardening with Cross-Platform Native Binaries

Wed, 20 May 2026 00:00:00 +0000

When configuring a new device, achieving an acceptable Lynis hardening score is a challenge most practitioners are familiar with.

ERNW Whitepaper 76: Linux Client Hardening Guide

Tue, 19 May 2026 00:00:00 +0000

Hardening a Linux client system to an acceptable degree is a time-consuming process, one that demands familiarity with a broad set of configuration parameters, framework recommendations, and the reasoning behind each control.

This post introduces our new Linux client hardening guide (MD, PDF), a comprehensive, publicly available hardening reference for Linux systems.

Motivation and Scope

The guide covers the full breadth of controls needed to significantly raise the security posture of a modern Linux installation while preserving operational usability (this will be very subjective, the guide reflects my opinion of “usable”). It has been developed and validated against Ubuntu 24.04 LTS as the primary reference platform, and cross-tested on Fedora, Debian 12, and Arch Linux as well as on traditionally server-oriented distributions like openSUSE Leap 15.6, Debian 12, Rocky Linux 9, and Red Hat Enterprise Linux 9 while not focussing on those as the guide is created for Linux clients.

When paradigms are shifting: InfoSec in the age of AI

Thu, 30 Apr 2026 00:00:00 +0000

Over the last few weeks, I have had a very productive exchange with Christoph Klaassen on the impact of AI on security governance and compliance. In this post, we summarize our thoughts.

Disclosure: Command Injection in Geutebrück Cameras

Thu, 16 Apr 2026 00:00:00 +0000

During a penetration test for a customer, we identified a command injection vulnerability in Geutebrück security cameras that allows authenticated attackers to execute arbitrary commands as root through the web interface. The root cause is unsanitized user input being passed into a sed script (and at least 12 other CGI endpoints). In addition to the injection, we identified an XSS vulnerability, an exposed system menu leaking configuration and log data, and an insecure GET-parameter-to-environment-variable mapping that enables abuse of variables like LD_PRELOAD and LD_DEBUG. We reported the findings to Geutebrück and a patched firmware was provided. This post walks through how we got from a sed error message to a root shell.

Windows Early Boot Configuration: The CmControlVector and PspSystemMitigationOptions

Mon, 13 Apr 2026 00:00:00 +0000

While investigating how process mitigation settings are initialized, I encountered the global variable PspSystemMitigationOptions. Tracing how this value is populated led me to the CmControlVector. In this blog post, we take a look at the Windows kernel land configuration manager, especially its global CmControlVector variable. Quick note: the kernel’s configuration manager is not related to Microsoft Intune’s Configuration Manager. In short, the configuration manager is responsible for managing and implementing the registry. However, it is also responsible for setting up parts of the system during early boot.

KubeCon + CloudNativeCon Europe 2026

Wed, 01 Apr 2026 00:00:00 +0000

Exactly one week ago, Sven and I had the incredible opportunity to give our very first talk at KubeCon + CloudNativeCon 2026: How To Break Multi-Tenancy Again and Again …and What We Can Learn From It. We discussed the challenges of namespace-based multi-tenancy and presented real-world exploits in Kubeflow, Istio, and Traefik that bypass threat boundaries between namespaces and workloads. Based on these problems, we developed a methodology to assess and address them. You can find the methodology discussed in the talk in detail in another blog post or on GitHub. You can also find the slides here.

Methodology for Assessing Kubernetes Namespace-Based Multi-Tenancy Setups

Thu, 26 Mar 2026 00:00:00 +0000

This page introduces our structured methodology for assessing security risks in Kubernetes environments that use Namespace-based Multi-Tenancy. It addresses weaknesses that break Namespace-based isolation that not well studied, yet. We found this issues during our research and presented them together with this methodology in our Talk at KubeCon + CloudNativeCon Europe 2026.

The methodology assumes that industry best practices, such as NetworkPolicies, Role-Based Access Control (RBAC), and Pod Security Standards, are already in place. These measures provide a necessary baseline level of protection against well-known isolation threats. However, they are insufficient to address a class of more subtle attack vectors arising from interactions between tenants and shared components. Such attack vectors may still compromise the confidentiality, integrity, and availability (CIA) of the cluster and its workloads, even in well-hardened environments.

Security Considerations on Istio’s CRDs with Namespace-based Multi-Tenancy

Wed, 25 Mar 2026 00:00:00 +0000

We reported a possible Man-in-the-Middle (MitM) attack scenario in which a VirtualService can redirect or intercept traffic within the service mesh. This affects Namespace-based Multi-Tenancy clusters where tenants have the permissions to deploy Istio resources (networking.istio.io/v1).

In collaboration with Istio, we published a guest submission in Istio’s blog (as well as below), a Security Bulletin, and an update to their Security Model to address this issue.

This blog post highlights the risks of using Istio in multi-tenant clusters and explains how users can mitigate these risks and safely operate Istio in their deployments.

Assessing Endpoint Protection: Our Approach to EDR/XDR and Supplements Evaluation

Thu, 19 Mar 2026 00:00:00 +0000

There is a growing landscape of security products promising to protect an organization’s IT infrastructure from attacks. Solutions referred to as EDR, and sometimes also as XDR, are designed to protect endpoints from all malicious activity. The ever-increasing cases of breaches and the associated costs, especially in the realm of ransomware attacks, raise the question of whether there is more that can be done to add an additional layer to traditional endpoint protection concepts. That is why a customer of ours commissioned us to evaluate whether EDR supplementing solutions provide extended protection against ever-evolving threats, as well as to shine a light on the performance overheads those solutions might introduce.

Vulnerabilities in Broadcom VMware Aria Operations: Privilege Escalation (CVE-2025-41245 / CVE-2026-22721)

Wed, 18 Mar 2026 00:00:00 +0000

During a customer project, we identified privilege escalation vulnerabilities in Broadcom VMware Aria Operations. It is possible to escalate the privileges of an administrative vCenter user to an Aria administrator and take over systems integrated in Aria. Meaning, the vCenter user can gain privileged access to systems they have no access to. While both users might sound similarly privileged, this is not true in most environments – especially not in complex corporate environments: An insignificant vCenter user in a development environment can take over all other vCenters in a complex corporate environment.

Hacking a Bluetooth Printer Server: GATT to UART Adapter?

Thu, 12 Mar 2026 00:00:00 +0000

This blog post describes the journey of how we discovered an interesting Bluetooth SoC within the Datong NP330, a Printer Server IoT device. Our initial goal was to reverse-engineer and analyze the Bluetooth controller that is included in the device. So we wanted to be able to dump the firmware or, if possible, get shell access on the printer server. During that journey we found a few vulnerabilities that ultimately let an attacker fully compromise the device. This is possible over Bluetooth or network via unauthenticated remote code execution with root privileges.

BlackBoxAI: AI Agent can get your computer fully compromised

Tue, 03 Mar 2026 00:00:00 +0000

AI agents are here, there, and everywhere. Smarter, faster, and more skilled, they gain greater autonomy and trust. We trust their capabilities to do many tasks much faster and sometimes better than we can. We trust them as they usually demonstrate their eagerness to please us and fulfill our commands. Isn’t that too good to be true, and we might be dealing with a double-edged sword here? Can attackers use the same capabilities of the AI agents to attack their own users? Can they exploit their eagerness to please their users to fulfill the attackers’ intentions? And most importantly: what’s the worst that could happen if you fully trust some random AI Agent?

Vulnerability Disclosure: JWT Authentication Bypass in OpenID Connect Authenticator for Tomcat

Tue, 17 Feb 2026 00:00:00 +0000

During a customer project we identified an issue with the validation of JWT tokens that allowed us to bypass the authentication by using unsigned tokens with arbitrary payloads. During analysis we found out that this is caused by a vulnerability within the library OpenID Connect Authenticator for Tomcat.

OpenID Connect Authenticator for Tomcat between versions 2.0.0 and 2.5.0, as well as the current state on branch master contain a security flaw (introduced with commit 64e9a99) that allows attackers to bypass JWT signature validation easily.

One More Thing: Introducing the New macOS 26 Tahoe Hardening Guide

Wed, 11 Feb 2026 00:00:00 +0000

After seven years, we’re publishing a new macOS hardening guide. Fully updated, modernized, and now publicly available on GitHub as Markdown and on our website as PDF.

The previous guide, written for macOS Mojave (10.14), reflected a very different macOS security model. At the time, hardening often meant working around the operating system, manually enforcing controls, and compensating for missing platform guarantees. That guide served its purpose, but the platform has fundamentally changed since then.

Capture Bumble Bluetooth Traffic with Wireshark

Wed, 04 Feb 2026 00:00:00 +0000

When conducting pentests of Bluetooth devices or whilst working on Bluetooth related research, we often use Bumble. In this Blogpost I will present a solution to capture a live stream of Bumble Bluetooth traffic in Wireshark.

Bumble is a fully featured Bluetooth stack, written entirely in Python. What makes it extremely powerful for security assessments and research is the level of control it provides. It can simulate certain conditions, including errors, with a level of precision that most Bluetooth stacks don’t offer. However, sometimes you not only need control, you also need visibility.

Incident Response in GCP: Out of Scope – Out of Mind

Tue, 27 Jan 2026 00:00:00 +0000

We are regularly offering a GCP Incident Response and Analysis training. In this training, we analyze resources in GCP cloud together with our trainees that were successfully compromised by attackers, e.g., GCE instances and Cloud Build projects. Therefore, we need tooling that quickly detects misconfiguration of resources that helped the attacker during the compromise. During the analysis of different tools and different kinds of misconfiguration we realized that GCE instance access scopes are a blind spot of many (in fact all that we tested) security audit tools. In this blog post, we want to elaborate on the problems that arise from this behavior.

Bluetooth Headphone Jacking: Full Disclosure of Airoha RACE Vulnerabilities

Sun, 28 Dec 2025 00:00:00 +0000

About six months ago we released a security advisory on this blog about vulnerabilities in Airoha-based Bluetooth headphones and earbuds. Back then, we didn’t release all technical details to give vendors more time to release updates and users time to patch their devices. Around the time of the initial partial disclosure in the beginning of June, Airoha put out an SDK release for their customers that mitigates the vulnerabilities. Now, half a year later, we finally want to publish the technical details and release a tool for researchers and users to continue researching and check whether their devices are vulnerable.

MCTTP 2025 / Keynote

Mon, 20 Oct 2025 00:00:00 +0000

Three weeks ago, I attended MCTTP 2025 in Munich, organized by Vogel IT and curated by the fine folks Florian Hansemann, Dr. Marc Maisch, and Florian Oelmaier. Awesome event with some very cool talks, and great conversations over dinner and most notably at the Oktoberfest on Saturday (thanks again for that special trip, Flo!). I had the pleasure and honor to give the keynote on the 2nd day. The goal was to make it a bit entertaining and enlightening for the international audience, so I covered some German literature, too ;-). The slides can be found here, and the transcript here. Looking forward to meeting some folks again next year, maybe even at TROOPERS26 😉

Release of ERNW White Paper 73: Analyzing WinpMem Driver Vulnerabilities

Thu, 02 Oct 2025 00:00:00 +0000

Today we are releasing a new white paper that delivers a technical analysis of security weaknesses discovered in WinpMem, an open-source Windows memory acquisition driver widely used in digital forensics.

After a concise primer on relevant Windows internals (virtual vs. physical memory, page tables and PTEs, CR3 context switching, and kernel and user memory separation), the report examines how both the fundamental design of WinpMem and specific implementation choices create severe risk.

Disclosure: Authentication Bypass in VERTIV Avocent AutoView (Version 2.10.0.0.4736)

Mon, 08 Sep 2025 00:00:00 +0000

The VERTIV Avocent AutoView switches are analog keyboard, video, and mouse (KVM) switches used in data center servers. They also expose a web server in the network, which allows for some configuration.

During a penetration test for a customer, a device of this type was identified in the infrastructure and analyzed, revealing an authentication bypass in the web application.

The application is written in PHP. To gain access to the PHP scripts, the firmware update was downloaded from the vendor’s download page. From the update, the PHP files can easily be extracted and analyzed.

Vulnerability Disclosure: Stealing Emails via Prompt Injections

Tue, 02 Sep 2025 00:00:00 +0000

With the rise of AI assistance features in an increasing number of products, we have begun to focus some of our research efforts on refining our internal detection and testing guidelines for LLMs by taking a brief look at the new AI integrations we discover.

Alongside the rise of applications with LLM integrations, an increasing number of customers come to ERNW to specifically assess AI applications. Our colleagues Florian Grunow and Hannes Mohr analyzed the novel attack vectors that emerged and presented the results at TROOPERS24 already.

Windows Hello for Business - Faceplant: Planting Biometric Templates

Fri, 29 Aug 2025 00:00:00 +0000

We are back from Black Hat USA, where we presented our research on Windows Hello for Business (Slides) once more. In the last two blog posts, we have discussed the architecture of WHfB and past attacks, as well as how the database works and how to swap identities in the database.

First, a few words regarding my experience at Black Hat: for me, it was the first time attending the conference and then directly as a speaker. I thoroughly enjoyed Black Hat. It took a while to get used to the size of the conference and the vibe of Las Vegas. What was especially interesting for me was connecting with other researchers. One thing that stood out was meeting with the team from MSRC and putting faces to the team itself. It feels way more personal to know who you’re talking to when you know the people handling your cases. During TROOPERS I typically have the chance to connect with many researchers, mainly from Europe. At Black Hat US, on the other hand, it is possible to connect more with the US scene and meet people you haven’t seen in a long time! Seeing familiar faces again is always nice, as opposed to putting them into your biometric template database. One nice detail was that some international researchers are aware of the research BSI (German: “Bundesamt für Sicherheit in der Informationstechnik” – “German federal office for IT security”) is facilitating. The results of our presentation stem from the “Windows Dissected” project we are performing on behalf of the BSI.

#TROOPERS25 AD & Entra ID Security Track

Thu, 14 Aug 2025 00:00:00 +0000

The #TROOPERS25 ‘AD & Entra ID Security’ track was a blast – as was the whole conference 😉 – bringing together some of the smartest researchers in the field and a great audience of practitioners willing to share their experiences during the roundtable. The slides of the talks have been released in the interim on the TROOPERS website, but since many speakers published additional blogposts or released tools, we provide a compilation of resources from the track in the following.

Setting up Secure Boot on Gentoo Linux

Mon, 28 Jul 2025 00:00:00 +0000

The purpose of this blog post is to explain how Secure Boot works. In particular, we will explain where current implementations of Secure Boot by Linux distributors fall short compared to Microsoft Windows and Apple macOS.

Major distributors like Canonical, Debian, openSUSE, and Red Hat place a high priority on making their operating systems work out of the box. Given the current Linux landscape with out-of-tree drivers and incompatible licenses, providing the end user with all the drivers possibly needed to boot the system can be challenging.

Windows Hello for Business - The Face Swap

Tue, 15 Jul 2025 00:00:00 +0000

In the last blog post, we discussed the full authentication flow using Windows Hello for Business (WHfB) with face recognition to authenticate against an Active Directory with Kerberos and showcased existing and new vulnerabilities. In this blog post, we dive into the architectural challenges WHfB faces and explore how we can exploit them.

The majority of the work was conducted in the context of the “Windows Dissected” project. This project, funded by the BSI (German: “Bundesamt für Sicherheit in der Informationstechnik” – the German Federal Office for Information Security), has the goal to perform ” various in-depth security analyses of security-critical components and functions in Windows.” Over the next years we will discuss these results here once they are published.

Insecure Boot: Injecting initramfs from a debug shell

Thu, 03 Jul 2025 00:00:00 +0000

Many Linux hardening guides focus on well-known protections: full-disk encryption, Secure Boot, and password-protected bootloaders. While these measures are critical, they often overlook a subtle but serious attack vector: the ability to drop into a debug shell via the Initial RAM Filesystem (initramfs). This oversight can enable an attacker with brief physical access to bypass conventional boot protections and inject persistent malware into the system.

In this post, it is demonstrated how this attack works on modern Linux distributions, such as Ubuntu and Fedora, and explained why existing guidance often fails to mention it.

Security Advisory: Airoha-based Bluetooth Headphones and Earbuds

Thu, 26 Jun 2025 00:00:00 +0000

Important note: Some media coverage on this topic falsely or inaccurately depicts the attack conditions. To be clear: Any vulnerable device can be compromised if the attacker is in Bluetooth range. That is the only precondition.

During our research on Bluetooth headphones and earbuds, we identified several vulnerabilities in devices that incorporate Airoha Systems on a Chip (SoCs). In this blog post, we briefly want to describe the vulnerabilities, point out their impact and provide some context to currently running patch delivery processes as described at this year’s TROOPERS Conference.

Windows Hello for Business – Past and Present Attacks

Fri, 20 Jun 2025 00:00:00 +0000

Windows Hello for Business is a key component of Microsoft’s passwordless authentication strategy. It enables user authentication not only during system sign-in but also in conjunction with new and advanced features such as Personal Data Encryption, Administrator Protection, and Recall. Rather than depending on traditional passwords, Windows Hello leverages a PIN or biometric methods – such as fingerprint or facial recognition – to unlock cryptographic keys protected by the Trusted Platform Module (TPM).

Disclosure: Multiple Vulnerabilities in X.Org X server prior to 21.1.17 and Xwayland prior to 24.1.7

Tue, 17 Jun 2025 00:00:00 +0000

The X11 Window System has been used since September 1987 for Unix desktop systems, allowing applications to display their windows. Today, one of the server implementations of the protocol is the X.Org X server and XWayland, which both use the same codebase. While reviewing the X server, several legacy security issues were identified. These appear to originate from earlier design stages when security considerations were less prominent. Despite the project’s maturity and widespread use, some of these issues have persisted.

Using the Raspberry Pi Pico W as a Bluetooth Dongle

Fri, 13 Jun 2025 00:00:00 +0000

During our recent research, we experimented with different Bluetooth USB dongles. There are tons of options, and sometimes, it’s challenging to determine what chipset a dongle actually contains, what Bluetooth features it supports, and whether it works on Linux. Inspired by the recent ESP32 Bluetooth research, we wondered whether we could turn our Raspberry Pi Pico Ws into a functioning Bluetooth dongle. We had a few lying around, and the advantage here is that we know exactly which Bluetooth controller it uses – the Infineon CYW43439. It’s also very easy to get one. You can just buy the Pico W for a few bucks, even cheaper than some Bluetooth dongles. You also have a controller family that has been researched quite a bit in the internalblue project. However, there was one disadvantage. We did not find any code that exposes the CYW43439’s HCI interface via USB. So we had to write that on our own.

Disclosure: Input Validation Vulnerabilities in Microsoft Bookings

Thu, 08 May 2025 00:00:00 +0000

In a recent customer project, we discovered vulnerabilities in Microsoft Bookings, an online appointment scheduling tool integrated into Microsoft 365, allowing companies to have customers book meetings in available times themselves. The findings originate from insufficient input validation on the public meeting scheduling endpoint. Although Microsoft has largely mitigated this vulnerability, our analysis provides important insights into potential risks and areas for improvement.

Introduction & Context

Microsoft Bookings is a service that allows organizations to manage appointments and meetings via a web interface. With integration to services such as Microsoft Teams, the security of the booking process is critical. This blog post outlines our technical analysis of the vulnerability, including proof-of-concept details and an overview of the vendor response.

Full Disclosure: Multiple Rundeck Job Command Injections

Mon, 05 May 2025 00:00:00 +0000

During a red-teaming-style customer project, we managed to get access to an Rundeck API token. Rundeck is a job scheduler and runbook automation platform designed to automate routine IT tasks across multiple systems. At first, we were excited about this API token because if we could create new Rundeck jobs, we could execute arbitrary code on the Rundeck nodes and move laterally from there. However, it turned out that with this token we only had permissions to run existing jobs.

Vulnerability Disclosure: Restricted Shell Breakout (CVE-2025-1950) and Privilege Escalation (CVE-2025-1951) in IBM Power Hardware Management Console (HMC)

Fri, 25 Apr 2025 00:00:00 +0000

We discovered a private key for accessing an IBM Hardware Management Console (HMC) during a recent red team engagement. The IBM Hardware Management Console (HMC) is a dedicated management system used to control and manage IBM servers, especially those running on Power Systems (like IBM Power9/Power10) and mainframes (z Systems). After brief research, we identified two security vulnerabilities that can be leveraged to gain root access to the HMC.

Access for most users via SSH is limited through the hmcbash, a restricted shell environment. Using LD_PRELOAD, attackers can break out of the restricted bash and gain access to additional binaries installed on the system. With the restrictions lifted, attackers can use a setuid binary, copysshkey, to elevate privileges to root.

Cookie Prefixes – The Lesser Known Cookie Security Feature

Tue, 08 Apr 2025 00:00:00 +0000

When you’re analyzing web applications as a pentester or reading pentest reports about web applications, you will often see findings regarding cookies missing certain security flags. The Set-Cookie HTTP header and the JavaScript document.cookie API allow to use, for example, the flags Secure, Path, and Domain. Common audit and pentest tools will tell you when your web application does not or just insecurely implements these cookie flags.

However, they do not provide optimal security even when using these flags correctly. However, there are mitigations available that partly solve the issues.

CVE-2024-11035: Minor Security Issues in VMware Carbon Black Cloud

Mon, 31 Mar 2025 00:00:00 +0000

We recently conducted a security assessment of VMware Carbon Black Cloud, a unified SaaS solution that integrates endpoint detection and response (EDR), anti-virus, and vulnerability management capabilities. As part of our evaluation, we tested the solution’s ability to detect and prevent malicious activity on Windows and Linux systems. Our analysis focused on the Carbon Black agents for these platforms, and although we did not identify any critical vulnerabilities, we want to share some of the findings in this blog post.

CVE-2025-20908: Use of insufficiently random values in Samsung's Auracast implementation

Thu, 13 Mar 2025 00:00:00 +0000

As part of our research into the Auracast feature set in Bluetooth, we also started looking into vendor implementations. At the time we started with our research, there weren’t a lot of products on the market yet. But new products are coming out pretty frequently now.

One of the vendors that had Auracast implemented pretty early was Samsung. At the time the Samsung Galaxy S23 and S24 phones were able to broadcast Audio, while the Galaxy Buds were able to join these broadcasts.

When Your Edge Browser Syncs Private Data to Your Employer

Fri, 07 Feb 2025 00:00:00 +0000

Recently, one of our customers contacted us to investigate the extent of some unwanted and unexpected behavior regarding browsing data of employees.

Employees started contacting IT support because private browser bookmarks, private login credentials etc. showed up on their work machines. All affected employees stated that they never created these bookmarks on work systems. And interestingly, the data seemed to have been collected over quite some time.

Our customer wanted to understand how private data ended up in their environment. Obviously, private employee data in the enterprise landscape could cause some data privacy trouble (GDPR).

Jigsaw RDPuzzle: Piecing Attacker Actions Together

Wed, 29 Jan 2025 00:00:00 +0000

In a recent incident response project, we had the chance to virtually look over the attackers’ shoulder and observe their activities. The attackers used the Remote Desktop Protocol (RDP) for lateral movement within the compromized environment and beyond (MITRE techniques T1570, T1021). As a matter of fact, RDP creates cache files that contain tiles of the transferred screen recording data. While this fact is well-known and there are existing tools, we found it worth reporting because of two different aspects:

Part I: Bluetooth Auracast from a Security Researcher’s Perspective

Mon, 27 Jan 2025 00:00:00 +0000

Auracast, the new Bluetooth LE Broadcast Audio feature has gained some publicity in the past months. The Bluetooth SIG has introduced the LE Audio feature-set to the Bluetooth 5.2 Specification in 2019 and vendors are only now starting to implement it. Auracast facilitates broadcasting audio over Bluetooth LE to a potentially unlimited number of devices. It does not require pairing or interaction between the sender and the receivers.

We also presented this topic at 38c3. This blog post will contain similar contents albeit with some more details.

Vulnerability Disclosure: Command Injection in Kemp LoadMaster Load Balancer (CVE-2024-7591)

Wed, 27 Nov 2024 00:00:00 +0000

While conducting security research, I identified a critical vulnerability in Kemp’s LoadMaster Load Balancer. This vulnerability is a Command Injection and allows full system compromise. It requires no authentication and can be exploited remotely by having access to the Web User Interface (WUI). Kemp found that all LoadMaster versions up to and including version 7.2.60.0 and also the multi-tenant hypervisors up to and including version 7.1.35.11 are affected.

Kemp LoadMaster is a widely used Load Balancing Application that can commonly be seen in customer engagements. Therefore, we decided to take a closer look as part of our regular research projects.

Vulnerability Disclosure: Authentication Bypass in Vaultwarden versions < 1.32.5 - CVE-2024-55225

Fri, 22 Nov 2024 00:00:00 +0000

During a penetration test for a customer, we briefly assessed Vaultwarden, an open-source online password safe. In June 2024, the German Federal Office for Information Security (BSI) published results¹ of a static and dynamic test of the Vaultwarden server component. Therefore, only a partial source code audit was performed during our assessment. However, a quick look was needed to find some glaring issues with the authentication.

Vaultwarden

Vaultwarden is an alternative online password safe server to Bitwarden and exposes the same API so that Bitwarden clients can connect to the Vaultwarden server. Since Bitwarden has a Browser client and Mobile clients, they can all connect to Vaultwarden, too.

Announcement: Progress / Kemp LoadMaster CVE-2024-7591

Mon, 09 Sep 2024 00:00:00 +0000

Hey everybody,

during a recent Red Teaming engagement Marius Walter from ERNW found a command injection issue in Progress (Kemp) LoadMaster. It was registered as CVE-2024-7591 and scores a CVSS of 10.0.

The vendor already has patches out, make sure to apply them as this is a high severe issue. You can find the official announcement and the patch references on the official support page.

Marius will follow up with a technical blog post on this issue once we think everybody had a realistic chance of applying the patches.

Disclosure: Potential Limitations of Apple ADE in Corporate Usage Scenarios

Tue, 03 Sep 2024 00:00:00 +0000

Apple Automated Device Enrollment (ADE) is presented as a way to automate and simplify the enrollment process of Apple devices within Mobile Device Management (MDE) solutions. This blog post is aimed at organizations currently planning or even already using this feature and making you, the reader, aware of potential limitations of this process that might otherwise not be clearly addressed in your companies’ device management process.

How Apple ADE Is Presented

Looking at the Apple Support pages today, Automated Device Enrollment is described as a process that

CrowdStrike: What is the worldwide BSOD all about?

Tue, 20 Aug 2024 00:00:00 +0000

This article is about the massive BSOD triggered by CrowdStrike worldwide on July 19. Analysis and information from CrowdStrike or other sources are regularly published, completing what is expressed here. Updates may also be provided in the future.

Friday, July 19, is a day to be remembered in computing history as the day of one of the biggest BSODs (Blue Screens of Death). We have seen air traffic come to a standstill over the USA and people climbing ladders with USB sticks to update giant screens. The impact was still measurable over many days. The question on everyone’s lips is how that all happened. CrowdStrike provided, on a regular basis, an explanation for people to understand what happened. But explanations can be hard to understand, especially for one who would like to read directly within CrowdStrike’s internal wording in their publications and regarding technical driver implementation details. Also, the analysis misses some points we consider relevant for secure software development. This article discusses conclusions from this massive crash, especially the necessity to change our mindset about software. This means we should understand, document, and evaluate independently software provided by vendors to know exactly what we install on our systems and to figure out the risk that may be taken by using the software. The time of naive belief in software magic must end with a third party’s independent review of the software, analysing its reliability, security, and stability. This is an activity we have been doing at ERNW for years, especially for e.g. the German Federal Office for Information Security (BSI)¹.

Disclosure: Apple ADE – Network Based Provisioning Bypass

Fri, 09 Aug 2024 00:00:00 +0000

Mobile Device Management (MDM) solutions are used to centrally manage mobile devices in corporate environments. This includes the monitoring of the device, automatic installation/removal of apps or certificates and restrict the functionality. Even though MDM solutions exist for multiple vendors, we will look specifically on Apple devices enrolled via Intune. When an Apple device is registered for Automated Device Enrollment (ADE), it will automatically download and apply these policies during the initial setup and prior to the first boot.

BMBF UNCOVER – Monitoring von Sicherheitsvorfällen in Fahrzeugen

Fri, 21 Jun 2024 00:00:00 +0000

English Abstract

For the realization and introduction of autonomous vehicles, the safe interaction of functions, systems and services as well as their monitoring over the entire product life cycle is essential. An exclusive security-by-design approach is no longer sufficient and must be continuously supported by feedback obtained from in-the-wild operation. This is where the recently successfully completed joint project BMBF UNCOVER comes into play, which targets the requirements of the standards ISO/SAE 21434 (Road vehicles – Cybersecurity engineering) and ISO 21448 (Road vehicles – Safety of the intended functionality (SOTIF)).

TROOPERS24 Agenda Preview: Active Directory & Entra ID Security Track

Fri, 14 Jun 2024 00:00:00 +0000

Hi,

are you curious about the agenda of the Active Directory- & Entra ID security track at TROOPERS24? Here’s a sneak peak of the already published tracks:

Wednesday, 2024-06-26:

A Decade of Active Directory Attacks: What We’ve Learned & What’s Next – Sean Metcalf
ADillesHeel: Making the Impossible Possible in AD Attack Path Analysis – SHANG-DE JIANG
So You Performed A Forest Recovery. How Do You Reconnect Your AD Again With Azure AD? – Jorge de Almeida Pinto
Decrypting the Directory: A Journey into a static analysis of the Active Directory NTDS to identify misconfigurations and vulnerabilities – Bastien Cacace (XMCO company)
Say Hello to your new cache flow! – Geoffrey Bertoli, Rémi Jullian
Analyzing and Executing ADCS Attack Paths with BloodHound – by Andy Robbins, Jonas Bülow Knudsen

Thursday, 2024-06-27:

The (almost) complete LDAP guide – Sapir Federovsky
Exploiting Token-Based Authentication: Attacking and Defending Identities in the 2020s – Dr Nestori Syynimaa
Attacking Primary Refresh Tokens using their MacOS implementation – Olaf Hartong, Dirk-jan Mollema
Misconfiguration Manager: Overlooked and Overprivileged – Duane Michael, Chris Thompson
The Registry Rundown – Cedric Van Bockhaven, Max Grim

The full conference agenda including timeslots will be published soon at TROOPERS24. The trainings are already sold out, but a handful of tickets is currently left. Stay tuned & make the world a safer place!

Security Advisory: Achieving PHP Code Execution in ILIAS eLearning LMS before v7.30/v8.11/v9.1

Wed, 22 May 2024 00:00:00 +0000

During my Bachelor’s thesis, I identified several XSS vulnerabilities and a PHP Code Execution vulnerability via an insecure file upload in the learning management system (LMS) ILIAS. The XSS vulnerability can be chained with the code execution vulnerability so that attackers with tutor privileges in at least one course can perform this exploit chain.

The Bachelor’s thesis was motivated by the ever-increasing number of compromised universities in Germany¹^(,)²^(,)³^(,)⁴^(,)⁵. The thesis analyzed the importance of LMS systems in that context, as those services are often exposed to the internet.

Linux Character Devices: Exploring systemd-run and pkexec

Tue, 14 May 2024 00:00:00 +0000

In this blog post, we quickly look into issues involving character devices. As is typical for Linux, everything is a file, so character devices are referenced as files, such as pseudo terminals (pts) under /dev/pts/. man pty briefly introduces the topic. Essentially, it is used to connect a program, such as a terminal emulator, to a shell. In the end, a pty can read and write like a regular file. A colleague already brought up the topic of ptys and character devices. But more recently a Twitter post and the accompanying advisory piqued my interest.

Is Google Play Protect a Reliable Malware Detector?

Fri, 03 May 2024 00:00:00 +0000

Google Play Protect is a built-in Android solution that enhances devices’ security. Its main job is to detect and block malware on Android devices. Several malware families were known for bypassing Play Protect checks in recent years. This brings us to an important question: “Is Google Play Protect a Reliable Malware Detector?”. This blog post shows how Play Protect deals with various Android malware in different scenarios. I deal with Play Protect as a black box.

Vulnerability in Jitsi Meet: Meeting Password Disclosure affecting Meetings with Lobbies

Thu, 02 May 2024 00:00:00 +0000

During a customer project, we identified a logic flaw in Jitsi Meet, an open-source video conferencing and messaging platform for secure video conferencing, voice calls, and messaging. The vulnerability affects password protected Jitsi meetings that make use of a lobby. This logic flaw leads to the disclosure of the meeting password when a user is invited to the call after waiting in the lobby.

Jitsi offers two security options to meeting moderators. Firstly, the meeting can be assigned a password that must be entered when joining. Secondly, a lobby mode can be activated, which first adds joining users to a lobby, from where they can then be added to the meeting by a user with moderation permissions.

Breaking GLS Parcel Tracking

Thu, 25 Apr 2024 00:00:00 +0000

Recently, we held a talk at the Winterkongress¹ of the Digitale Gesellschaft Schweiz in Winterthur, Switzerland, about our research project on breaking German parcel tracking sites. We could not name all the parcel services for which we identified vulnerabilities respecting disclosure timelines. Today, we describe our findings at GLS, another player in the German parcel market, and the disclosure process of corresponding vulnerabilities.

Findings

Similar to the vulnerabilities previously disclosed for DHL² and DPD³, and UPS⁴, we identified that the GLS parcel tracking website discloses the recipient’s geographic area by showing the name of the destination parcel center. Furthermore, the recipient’s ZIP code was used to unlock personal information (including the exact coordinates of the address) and features that influence the parcel delivery process. The website did not implement rate-limiting or other techniques to prevent brute-forcing ZIP codes using the API.

BSI Publishes Windows 10 SiSyPHuS Reports: Application Compatibility Infrastructure, Microsoft Defender Antivirus ETW Usage and Device Setup Manager Service

Tue, 16 Apr 2024 00:00:00 +0000

The German Federal Office for Information Security (BSI – Bundesamt für Sicherheit in der Informationstechnik) has published several papers ERNW created as part of the long-term SiSyPHuS Win10-Project. This project focuses on system analysis of selected parts of the Windows 10 operating system performed by ERNW.

Analysis of the Application Compatibility Infrastructure (ACI): In this work we present an overview of the ACI technology along with a technical analysis of the compatibility protocol which is used first to determine if a compatibility solution needs to be applied, and second, to apply said compatibility solution. Furthermore, threats and mitigation in the context of the technology are presented a long with a monitoring approach. Finally, configuration and logging capabilities are discussed.

Breaking UPS Parcel Tracking

Wed, 10 Apr 2024 00:00:00 +0000

Today, we describe our findings at United Parcel Service of America, Inc. (UPS), another German parcel market player, and the corresponding vulnerabilities’ disclosure process.

Findings

Only a valid tracking number is needed to get the personal information of a parcel’s receiver, including the sender’s location, the recipient’s name, and the recipient’s location (city and country). It was possible to enumerate numerous tracking numbers during testing by iterating from known ones. Since the last digit of a tracking number is a checksum, it can be calculated. Also, certain businesses have a predefined prefix in their tracking numbers. This schema allows the enumeration of every parcel sent from a particular business.

I know what you ordered last summer @ Winterkongress 2024

Wed, 03 Apr 2024 00:00:00 +0000

Dennis and I already published blog posts about our research project dealing with vulnerabilities in parcel tracking implementations at DHL and DPD. At the Winterkongress (winter congress) in Winterthur, Switzerland, we had the great opportunity to give a talk about the matter. The talk was recorded and can be watched here.

DigiGes held the Winterkongress, which took place in Winterthur on 01.03. till 02.03.2024. The main topics are ethics, threats, and opportunities of IT. This year, many talks looked at AI in some way.

Considerations on AI-Security – Part I: Introduction and Nondeterminism

Tue, 06 Feb 2024 00:00:00 +0000

Hey there!

This is the first blog post in a series about issues we think are currently relevant in the field of AI-Security. The intention is not to get full coverage of the topic, but to point out things that seem practical and relevant. We will base some of our statements on lab setups and real-life examples. The technology that we will focus on is chat bots based on generative AI, mainly OpenAI’s ChatGPT. Right now, this specific application of AI in the wild seems to be the best way to demonstrate issues and pitfalls when it comes to IT security.

Student Project - Audit Framework

Fri, 20 Oct 2023 00:00:00 +0000

Introduction

In 2021, ERNW collaborated with Hochschule Mannheim for their CEP (Cyber Security Entwicklungsprojekt) to build an auditing framework for testing operating system configurations against security procedures. This project is part of the education program of the university to give the students the chance to utilize the knowledge gained throughout the first semesters in a real world project. ERNW posed as the fictitious customer, providing a requirements document and regular meetings with all project groups for feedback. We planned to process and adapt the results for an open source auditing framework. Unfortunately, we were not able to finish this project yet, but we think the students should get some attention for their work independent from our side. So here is a short summary of what the students created and the corresponding repositories.

c0c0n 2023 – A Short Retrospective

Tue, 17 Oct 2023 00:00:00 +0000

Two weeks ago, I was at the c0c0n conference in Cochin (India). This conference is quite special for at least two considerations. At first, this is – to the best of my knowledge – one of the few conferences which officially brings together hackers, industrials, politics, and security forces. This is not always obvious for all these different persons to talk together, may be due to a lack of mutual understanding ?. But for a couple of days, all of them meet, talk, exchange, and they share mutual needs and appropriate solutions. And this may explain the second consideration, why c0c0n is one of the oldest cyber security conferences in India (more than 15 years). And yes, this is the conference where police forces directly pick you up from the gates of your plane at airport, sitting you at the back of a police car to drive you to your hotel with emergency lights ?

Lua-Resty-JWT Authentication Bypass

Tue, 10 Oct 2023 00:00:00 +0000

I was writing some challenges for PacketWars at TROOPERS22. One was intended to be a JWT key confusion challenge where the public key from an RSA JWT should be recovered and used to sign a symmetric JWT. For that, I was searching for a library vulnerable to JWT key confusion by default and found lua-resty-jwt. The original repository by SkyLothar is not maintained and different from the library that is installed with the LuaRocks package manager. The investigated library is a fork of the original repository, maintained by cdbattags in version 0.2.3 and was downloaded more than 4.8 million times according to LuaRocks.

Breaking DPD Parcel Tracking

Tue, 12 Sep 2023 00:00:00 +0000

This blog post is the continuation of our parcel research. We already reported about how we broke parcel tracking at DHL and the disclosure process of the identified problems. As DHL is not the only parcel service in Germany, we also investigated the other available parcel services. In this blog post, we want to talk about DPD, also called Geopost, which belongs to the French Post Office.

Efficient Guessing of Tracking Numbers

DPD uses the recipient’s ZIP code to unlock detailed shipment information and additional options. After trying some ZIP codes manually, we received CAPTCHA prompts in the web interface (more on this later).

Identification of (malicious) modifications in memory-mapped image files

Wed, 06 Sep 2023 00:00:00 +0000

I’m happy to announce the publication of the paper Windows memory forensics: Identification of (malicious) modifications in memory-mapped image files at this years DFRWS USA, and the release of the corresponding volatility plugin. With this research came also an update to the Ptenum family (affecting especially the ptemalfind plugin), which makes the plugins reliable in identifying modified pages despite memory combining, so make sure to grab the newest version from the Github repository.

Select * from OpenStack - A Steampipe Plugin for OpenStack

Wed, 02 Aug 2023 00:00:00 +0000

Although, more and more companies start to move their IT-Infrastructure from on-premise to public cloud solutions like Amazon Web Services (AWS) and Microsoft Azure, public cloud providers are not an option for every organization. This is where private cloud platforms come into play as they give organizations direct control over their information, can be more energy efficient than other on-premise hosting solutions, and offer companies the possibility to manage their data centers efficiently. OpenStack is a widely deployed, open-source private cloud platform many companies and universities use.

All your parcel are belong to us – Talk at Troopers 2023

Tue, 11 Jul 2023 00:00:00 +0000

At Troopers 2023, we gave a talk on how to attack DHL parcel tracking information based on OSINT. Since we previously had an exemplary disclosure process about this attack with DHL, Mr. Kiehne (from DHL) joined us to provide interesting background information and insights on how they addressed our findings.

We want to thank DHL and especially Mr. Kiehne for sharing those insights with us at Troopers 2023. It is the ideal case, but still not common that organizations talk openly about their actions and views on a disclosure process.

The DRACO Stream Cipher

Wed, 21 Jun 2023 00:00:00 +0000

In symmetric-key cryptography, we typically distinguish two types of encryption schemes: block ciphers and stream ciphers. Block ciphers divide a plaintext into blocks of a fixed size (e.g., 64 or 128 bits) and encrypt one such block of data as a whole. Stream ciphers, on the other hand, consider the plaintext as a continuous stream of data. The stream cipher maintains an internal state and in each step it outputs one bit or several bits and updates its internal state. The output bit stream is then combined with the plaintext, usually using the XOR operation. One advantage of stream ciphers is that their resource requirements are lower than those of block ciphers in many application scenarios. This makes them particularly useful in lightweight cryptography targeting resource constrained devices such as low-cost RFID tags.

Jasper Reports Library Code Injection

Tue, 13 Jun 2023 00:00:00 +0000

During the past year we had several projects where our target application used Jasper Reports in some way. In a few of the cases we found an API that offered to render a template along with some arguments into a PDF file. This was done with the help of the Jasper Reports Java library. Due to the way the library and the expression mechanism works, this endpoint gave us the possibility to inject Java code and gain remote code execution on the target systems.

IMF Conference 2023 in Munich

Thu, 25 May 2023 00:00:00 +0000

The IMF Conference is the International Conference on IT Security Incident Management & IT Forensics. This year it took place from May 23 to 24 in Munich. The schedule lists a lot of interesting talks. One of the talks was my presentation on a paper about Ceph forensics, based on my Master Thesis:

The concept of Software Defined Storage (SDS) has become very popular over the last few years. It is used in public, private, and hybrid clouds to store enterprise, private, and other kinds of data. Ceph is an open-source software that implements an SDS stack.

AD /Azure Security Track on Troopers 23

Fri, 05 May 2023 00:00:00 +0000

Hi!

We’re excited to announce the nearly complete composition of the Active Directory & Azure Security Track on Troopers 23 with fantastic speakers!

Here we go:

“Dumping NTHashes from Azure AD”
(Nestori Syynimaa)

“Hidden Pathways: Exploring the Anatomy of ACL-Based Active Directory Attacks and Building Strong Defenses”
(Jonas Bülow Knudsen, Alexander Schmitt)

“Priority for Effective Action – A Practical Model for quantifying the Risk of Active Directory Attacks”
(Mars Cheng, Dexter Chen)

Hack In The Box Security Conference 2023 @ Amsterdam - Summary

Thu, 04 May 2023 00:00:00 +0000

In this blog post, we are sharing summaries of talks from the Hack in the Box Conference in Amsterdam (HITBSecConf2023), the final HITB conference in Amsterdam. Before we do that, however, we would like to extend a heartfelt thank you to the organizers of the conference for putting together such an insightful and engaging event.

Dr. Bramwell Brizendine – Windows Syscalls in Shellcode: Advanced Techniques for Malicious Functionality

The talk by Bramwell Brizendine covered the topic of syscall usage in shell code. The general idea here is to hide from AV/EDR systems by not using APIs such as CreateProcessA, which may be monitored, but to directly call into the corresponding kernel functions. This can be accomplished for example with the syscall CPU instruction (see ¹, ² and ³ for more information). While this technique is not perfectly stealthy and can still be detected (e.g., with a kernel driver), it circumvents at least inline-hooks in user space. Another downside is the effort of building shell code that directly uses syscalls. Besides more overhead in preparing everything for the syscall (for example manually creating appropriate structs), the correct syscall ID must be gathered, which can change between kernel versions.

Hilarious Buffer Overflow Mitigation and TCL Injection in CheckPoint Gaia Portal

Fri, 16 Dec 2022 00:00:00 +0000

Hey there,

I am going to disclose two bug classes I found a while ago in CheckPoint R77.30: Two buffer overflows in the username (no shit) and HTTP method of a request to the administrative UI pre-auth and some interesting injections into the TCL web interface.

Let’s start with the TCL part. The web interface reacted pretty weird when a payload contained a colon. Diving deeper into this it became clear that a colon would actually cause an error from the TCL interpreter. By going down this rabbit hole and learning some TCL (:D) you could see that injecting a colon breaks some part of the application code, probably because colons are control characters in TCL e.g. preceding a global variable in TCL (::MyVar) or separating namespaces.

Some experiments with Process Hollowing

Thu, 29 Sep 2022 00:00:00 +0000

Process Hollowing is a technique used by various malware families (such as FormBook, TrickBot and Agent Tesla) to hide their malicious code within a benign appearing process. The typical workflow for setting up such a hollowed process is as follows:

Create a new process (victim) using a benign executable, in suspended state.
Unmap the executable from that process.
Allocate memory for the malicious executable at the address of the previously mapped victim executable.
Write the malicious executable to the new memory area and potentially apply relocations.
Adjust the entry point.
Resume process.

We will refer to this as the “normal” Process Hollowing workflow. There are also variants of this technique, one being to not unmap the original executable and to allocate the new memory somewhere else. We will call this one no-unmap. But wait, why does malware not simply overwrite the existing executable but creates a new memory area which stands out due to its characteristics? In this blog post we will have a closer look at this overwrite approach but also on the no-unmap method, their effects on analysis/detection tools and on some tricks to make the detection harder. We are also releasing Proof of Concept implementations of all mentioned tools/plugins (the links are at the end of this post).

Spymax: The android RAT and it works like that

Wed, 07 Sep 2022 00:00:00 +0000

Spymax is a mobile Remote Administration Tool (RAT) that enables an attacker to control victims’ devices through an Android malware. Once the malware is installed on a phone, the attacker can execute many attacks that highly impact the confidentiality and integrity of the victim’s data, as well as the victim’s privacy. It is powerful, widely available, and does not require root privileges on the victim’s device. In this blogpost, I show the capabilities of this RAT and analyze how its Android malware works.

Whitepaper Endpoint Management & Monitoring Solutions Released

Wed, 10 Aug 2022 00:00:00 +0000

Over the course of the last 2 years we performed vulnerability research on several Endpoint Management & Monitoring Solutions. The results were already partially presented in security advisories which were published on this blog during the last two years. The advisories can be found here:

We also recently presented the results on Troopers 2022. Now the results have been published in a more in-depth manner in the form of a technical whitepaper. The whitepaper can be found here.

Security Advisories for Broadcom Automic Automation (UC4)

Thu, 09 Jun 2022 00:00:00 +0000

Updated on 20.06.22 with CVEs and link to Broadcom Security Notice.

In April 2021 we reported seven vulnerabilities in Broadcom Automic Automation (UC4) 12.3.5+hf.3. CVE IDs were assigned on 16.06.22, the corresponding Broadcom Security Notice can be found here.

The vulnerabilities have been found in the course of a research project, in which we analyzed the security of multiple Endpoint Management solutions. Similar vulnerabilities have been found in other solutions as we pointed out in previous posts about the Ivanti DSM Suite, Nagios XI, and Solarwinds N-Central. The outcome of the research project will be published as a whitepaper and a conference talk at Troopers 2022.

Solving client-side controls once and for all

Fri, 01 Apr 2022 00:00:00 +0000

Missing server-side validation consistently scores a place in the OWASP Top 10. Browsers nowadays offer a lot of ways to easily implement client-side controls, increasing the usability by a lot. They automatically detect missing fields or invalid characters in your input fields and may even validate user input against a regular expressions.

However, these controls should only be considered as usability features. When sending data to a back-end system the application must always ensure data integrity by implementing encodings, validations and filters. Even for small applications this is a painful and tedious process. For each possible input, developers together with security experts have to carefully identify the context of each field, how the input is going to be used and what data requirements are present.

A Tale of an OFTP2 Vulnerability

Thu, 24 Mar 2022 00:00:00 +0000

This is a guest post from Thomas Smits.

A long time ago in a galaxy far, far away….

In my ordinary life, I teach computer science at the University of Applied Sciences in Mannheim but for some months, I was an intern at ERNW learning a lot about IT security and penetration testing. One of these learnings is that old protocols can be fun and breaking them even more. But let’s start at the beginning of the story…

Release of PTE Analysis plugins for Volatility 3

Fri, 31 Dec 2021 00:00:00 +0000

I’m happy to announce the release of several plugins for Volatility 3 that allow you to dig deeper into the memory analysis. One of those plugins is PteMalfind, which is essentially an improved version of malfind. Another one is PteResolve which, similarly to the WinDBG command !pte, allows you to inspect Page Table Entry (PTE) information for e.g., a given virtual address. In this blog post we will have a closer look at these and more plugins, and the PteEnumerator base class and what you can do with it. The memory dump used for this blog post is available here. Some of the injection tools used in this blog post can be gathered from here.

Change Your BLE Passkey Like You Change Your Underwear

Thu, 21 Oct 2021 00:00:00 +0000

Using a static passkey for Bluetooth Low Energy pairing is insecure. Recent versions of the Bluetooth specification contain an explicit warning about this. However, in practice, we often see static passkeys being used. Moreover, there are no public implementations of proofs-of-concept that can practically show why using a static passkey is an issue. This is why we implemented one.

In a recent assessment, we were testing a device that offered a Bluetooth interface for data export and configuration. This device uses Bluetooth Low Energy (BLE), and a static passkey (or PIN) is required to pair with it. This passkey is displayed for a few seconds when the device is booted and stays the same on each reboot. In fact, it is derived from static, device-specific data.

ManiMed: Ypsomed AG – mylife YpsoPump System Vulnerabilities

Thu, 29 Jul 2021 00:00:00 +0000

The Federal Office for Information Security (BSI) aims to sensitize manufacturers and the public regarding security risks of networked medical devices in Germany. In response to the often fatal security reports and press releases of networked medical devices, the BSI initiated the project Manipulation of Medical Devices (ManiMed) in 2019. In this project, a security analysis of selected products is carried out through security assessments followed by Coordinated Vulnerability Diclosure (CVD) processes. The project report was published on December 31, 2020, and can be accessed on the BSI website [1].

Analysis of HSTS Caches of Different Browsers

Thu, 06 May 2021 00:00:00 +0000

I recently stumbled upon a strange behavior in my Firefox: I visited an HTTPS-enabled website that I had visited before and saw that my Firefox connected insecurely via HTTP. I found that strange because nowadays, most websites set the HSTS header, which is supposed to force the browser to connect via HTTPS. I checked whether this website set the HSTS header – and it did. This means my Firefox was ignoring/forgetting about the HSTS header right after my visit.

Attack llvmpipe Graphics Driver from Chromium

Tue, 04 May 2021 00:00:00 +0000

In this post, we are discussing a bug we came across in Mesas llvmpipe Gallium3D graphics driver. This bug was accessible through Chromium’s WebGL implementation and can provide control of the program counter (pc) within Chromium’s GPU process if llvmpipe is used. Llvmpipe is a software rasterizer that is used on Linux if no hardware acceleration (graphics card) is available. This is a pretty rare edge case as llvmpipe has no widespread use. An estimate by Google is that approx 0.06% of the Chromium users are affected by this. However, as this is a simple but valid Chromium bug, we want to give you a quick walkthrough. The issue is tracked as CVE-2021-21153 and was fixed in February 2020.

DogWhisperer's SharpHound Cheat Sheet

Tue, 04 May 2021 00:00:00 +0000

BloodHound data collection, aka Sharphound, is quite a complex beast.
When giving BloodHound workshops, the part where I get the most questions is always data collection.
How is the BloodHound data collected? What methods do what? Who am I talking to? How do I fly under the radar?

These are all very relevant questions when you think about it.
After all, the rest is just a gorgeous UI sitting on top of a cool data model, but the only bit of BloodHound code that ever touches the targeted network is SharpHound. And so questions about it should be mandatory.
Now even thought I’ve been working with BloodHound for quite a while, there is always this moment where I have to check before answering… (I feel the older I get, the quicker I understand, but the less I remember… but that’s another story I guess…)

BSI veröffentlicht Hardening Guide, Protokollierungs-Empfehlung und zugehörige GPOs für Windows 10 im Rahmen der SiSyPHuS-Studie

Mon, 03 May 2021 00:00:00 +0000

Wir freuen uns, dass das Bundesamt für Sicherheit in der Informationstechnik (BSI) im Rahmen des gemeinsam mit ERNW durchgeführten SiSyPHuS Win10-Projekts (Studie zu Systemintegrität, Protokollierung, Härtung und Sicherheitsfunktionen in Windows 10) heute (ca. 10 Uhr) die nächsten drei Arbeitspakete veröffentlicht:

Empfehlung zur Härtung von Windows 10 mit Bordmitteln
Empfehlung zur Konfiguration der Protokollierung in Windows 10
Gruppenrichtlinien zu den Konfigurationsempfehlungen für Härtung und Protokollierung für Windows 10

In den Dokumenten finden sich unterschiedliche Empfehlungen für Domänenmitglieder (mit normalem und mit hohem Schutzbedarf) und Einzelplatzrechner. Die Dokumente bauen auf den Empfehlungen von Microsofts Security Baseline und dem CIS Benchmark für Windows 10 auf und ergänzen diese in von Microsoft und CIS nicht betrachteten Bereichen oder modifizieren sie dort, wo es aus Erfahrung von ERNW im Hardening von Windows-Systemen sinnvoll ist.

Of Corona, Buggy Audio Drivers and Industrial Espionage

Fri, 23 Apr 2021 00:00:00 +0000

The Situation

Last year, the CISO of a customer sent me a laptop for analysis. The reason was that he feared the company could have been victim of industrial espionage. Starting in spring 2020, the IT help desk got several employee laptops with full hard drives, caused by a huge amount of audio recordings. The audio files contained recordings even of highly sensitive telephone conferences. An automated scan on all employee computers for such audio recordings showed that about 300 devices were affected.

Summary of 'Software-Defined Radio applied to security assessments' at Troopers21

Tue, 20 Apr 2021 00:00:00 +0000

The training Software-Defined Radio applied to security assessments was held by Sébastien Dudek at Troopers21 and was remotely organized – like most other events – due to Covid-19. Once we were all caffeinated, we had an exciting journey through basically all things radio.

We started with the technical and physical basics in radio technology, such as various sorts of antennas, analog to digital coding (and backward), encoding schemes, and general risks and possible vulnerabilities of using radio devices. Commonly found vulnerabilities include the following:

fpicker: Fuzzing with Frida

Mon, 15 Mar 2021 00:00:00 +0000

Introduction

In this post, I will introduce fpicker. Fpicker is a Frida-based coverage-guided, mostly in-process, blackbox fuzzing suite. Its most significant feature is the AFL++ proxy mode which enables blackbox in-process fuzzing with AFL++ on platforms supported by Frida. In practice, this means that fpicker enables fuzzing binary-only targets with AFL++ on potentially any system that is supported by Frida. For example, it allows fuzzing a user-space application on the iOS operating system, such as the Bluetooth daemon bluetoothd – which was part of the original motivation to implement fpicker.

ManiMed: Hamilton Medical AG – HAMILTON-T1 Ventilator Vulnerabilities

Mon, 22 Feb 2021 00:00:00 +0000

ManiMed: B. Braun Melsungen AG – Space System Vulnerabilities

Mon, 15 Feb 2021 00:00:00 +0000

ManiMed: Innokas Yhtymä Oy - VC150 Patient Monitor Vulnerabilities

Mon, 01 Feb 2021 00:00:00 +0000

ERNW Whitepaper 71: Analysis of Anti-Virus Software Quarantine Files

Wed, 27 Jan 2021 00:00:00 +0000

I am glad to announce the release of the ERNW whitepaper 71 containing information about quarantine file formats of different AV software vendors. It is available here.

Anti-Virus Software

I took quarantine files from real-life incidents and created some in a lab environment. Afterwards I tried to identify metadata, like timestamps, path names, malware names, and the actual malicious file in the quarantine files. One goal was to use this information to support our incident analyses: Using the results, we can now easily create timelines showing information about quarantined files, extract the detected malware, and sometimes even find information about processes that created the malicious files.

ManiMed: Philips Medizin Systeme Böblingen GmbH – IntelliVue System Vulnerabilities

Mon, 25 Jan 2021 00:00:00 +0000

Having Fun with Google MDM Solution

Thu, 21 Jan 2021 00:00:00 +0000

It’s Friday, you managed to escape for a couple of hours from a busy working day to see a doctor. Now you have to wait in a boring waiting room at the clinic until it’s your turn to see her majesty. What would you like to do in this time? Answer pending business emails, get lost in social media, or choose a new theme to make your iPhone look awesome? What about: all of the above? It’s nice to have everything on your iPhone: MDM enrollment to access business data, in addition to jailbreak for device freedom. However, MDM solutions ban jailbroken devices, because they are not secure enough to handle sensitive business data. And so, cat and mouse games of jailbreak detection/bypass between MDM solutions and some users develop.

ManiMed: Market Analysis

Mon, 18 Jan 2021 00:00:00 +0000

Pentesting the ELK Stack

Wed, 13 Jan 2021 00:00:00 +0000

With this blog post, I will provide information on how to proceed when testing ELK Stack landscapes. Information regarding the exploitation of the ELK Stack is very rare on the internet. Therefore, following article aims to provide you with some approaches that can be useful during a penetration test.

Disclaimer:

All information below were collected during a research project and there is no claim for completeness. The guide focuses on ELK Stack deployments for Linux machines. Further, this article does not include information for identifying misconfigurations in a white-box configuration audit.

ERNW White Paper 70 – HL7 FHIR: Preserving Distributed Resource Integrity

Fri, 18 Dec 2020 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper about the HL7 FHIR communication standard.

Introduction

Digital networking is already widespread in many areas of life. More and more medical devices are also being networked in the healthcare industry. This growth makes the development and use of new medical communication standards necessary since existing solutions can only meet the changing requirements with great effort. The HL7 FHIR standard is an example of such a medical communication standard. FHIR is said to have increased the interoperability between different medical contexts,e.g., administration, billing, and clinical care, to enable data exchange of various systems. The FHIR standard addresses the security risks associated with strongly networked communication from a large number of systems across the trust and organizational boundaries only indirectly because FHIR does not define mandatory security controls or requirements.

Root Cause Analysis of a Heap-Based Buffer Overflow in GNU Readline

Thu, 17 Dec 2020 00:00:00 +0000

In the last blog post, we discussed how fuzzers determine the uniqueness of a crash. In this blog post, we discuss how we can manually triage a crash and determine the root cause. As an example, we use a heap-based buffer overflow I found in GNU readline 8.1 rc2, which has been fixed in the newest release. We use GDB and rr for time-travel debugging to determine the root cause of the bug.

Security Advisories for SolarWinds N-Central

Thu, 10 Dec 2020 00:00:00 +0000

In August 2020 we reported six vulnerabilities in SolarWinds N-Central 12.3.0.670 to the vendor.

The following CVE IDs were assigned to the issues :

CVE-2020-25617: RCE in N-Central Administration Console (AdvancedScripts Endpoint)
CVE-2020-25618: Local Privilege Escalation from nable User to root (N-Central Backend Server)
CVE-2020-25619: Access to Internal Services through SSH Port Forwarding (N-Central Backend Server)
CVE-2020-25620: SolarWinds Support Account with Default Credentials
CVE-2020-25621: Local Database does not require Authentication (N-Central Backend Server)
CVE-2020-25622: CSRF in N-Central Administration Console (AdvancedScripts Endpoint)

The vulnerabilities have been found in the course of an extensive research project, in which we analyze the security of multiple Unified Endpoint Management (UEM) solutions. Similar vulnerabilities have been found in other solutions as we pointed out in previous posts about the Ivanti DSM Suite and Nagios XI. The final outcome of the research project will be published as a whitepaper and possibly conference talk as soon as the project including all disclosure processes concludes.

How Fuzzers Decide if a Crash is Unique

Thu, 03 Dec 2020 00:00:00 +0000

This blogpost sheds some light on how fuzzers handle crash deduplication and what a unique crash is for a fuzzer. For this, we take a look at two contrived examples and compare the unique crashes identified by AFL++ and honggfuzz.

Both examples are similar. They read from STDIN, check if the first character of the read data is a digit, then call a vulnerable function. The main difference in test1.c is that the program crashes directly in the vuln function due to a null pointer dereference. In test2.c, a previously allocated buffer is freed; this buffer is again freed at the end of main, resulting in libc identifying the double free and raising a sigabort.

VMware NSX-T MITM Vulnerability (CVE-2020-3993)

Thu, 26 Nov 2020 00:00:00 +0000

NSX-T is a Software-Defined-Networking (SDN) solution of VMware which, as its basic functionality, supports spanning logical networks across VMs on distributed ESXi and KVM hypervisors. The central controller of the SDN is the NSX-T Manager Cluster which is responsible for deploying the network configurations to the hypervisor hosts.

This summer, I looked into the mechanism which is used to add new KVM hypervisor nodes to the SDN via the NSX-T Manager. By tracing what happens on the KVM host, I discovered that the KVM hypervisor got instructed to download the NSX-T software packages from the NSX-T Manager via unencrypted HTTP and install them without any verification. This enables a Man-in-the-Middle (MITM) attacker on the network path to replace the downloaded packages with malicious ones and compromise the KVM hosts.

XSS Vulnerability in Froala WYSIWYG HTML Editor

Wed, 18 Nov 2020 00:00:00 +0000

Recently, I had a brief look at the Froala WYSIWYG HTML Editor (v3.2.0) as there was a post about it on the Full Disclosure mailing list.

When targeting a HTML Editor, I guess one of the first things that everybody does is to check for XSS vulnerabilities. So I tried the usual XSS payloads (a great resource for XSS payloads is the XSS cheat sheet by PortSwigger) within the editor’s code view, but did not have much luck with the common payloads as they were filtered. However, using the HTML object tag, it was possible to trigger an XSS.

Microsoft Office Telemetry: Report Release

Tue, 17 Nov 2020 00:00:00 +0000

The German Federal Office for Information Security (orig., ger., Bundesamt für Sicherheit in der Informationstechnik – BSI) has published our report on Microsoft Office Telemetry.

Microsoft has released a set of privacy settings for Office, one of which enables users to configure the type and amount of diagnostic (i.e., telemetry) data that Office may send to Microsoft. When deployed, it is available in the form of a group policy setting. It allows users to configure one of the following diagnostic data levels: required, optional, or neither. The report we produced:

Forklift <=3.3.9 and <=3.4 Local Privilege Escalations on macOS (CVE-2020-15349/CVE-2020-27192)

Fri, 13 Nov 2020 00:00:00 +0000

I have started to have a look at my local installed helpers on macOS. These helpers are used as an interface for applications to perform privileged operations on the system. Thus, it is quite a nice attack surface to search for Local Privilege Escalations.

Forklift is an advanced dual pane file manager for macOS. It is well known under macOS power users.

As part of my investigation I identified vulnerabilities in Forklift allowing local privilege escalation.

Reversing C++ Without Getting a Heart Attack – DEvirtualize VIrtual Calls With Devi

Thu, 12 Nov 2020 00:00:00 +0000

TLDR: This blogpost presents devi, a tool that can help you devirtualize virtual calls in C++ binaries. It uses Frida to trace the execution of a binary and uncover the call sources and destinations of virtual calls. The collected information can then be viewed in IDA Pro, Binary Ninja, or Ghidra. The plugin adds the respective control-flow edges allowing further analysis (using different plugins) or simply providing more comfort when analyzing C++ binaries.

Apps on Prescription?! – Perspectives on Digital Health Applications (DiGA)

Thu, 05 Nov 2020 00:00:00 +0000

Some time ago, we carried out an evaluation of the Digital Health Applications Ordinance (Digitale-Gesundheitsanwendungen-Verordnung, DiGAV) for the Federal Chamber of Psychotherapists in Germany (Bundespsychotherapeutenkammer, BPtK) focusing on the security of digital health applications, often referred to as apps on prescription.

The audit was intended to determine to which extent security guidelines, security objectives, and best practices are adhered to by the requirements formulated by the ordinance, thus enabling the foundations to securely operate digital health applications. The main subject of the examination is whether requirements, including procedural requirements defined in the ordinance are sufficient to ensure security of digital health applications. The examination has shown that the requirements can be seen as positive. However, in order to be able to make reliable statements about the IT security of digital healthcare applications, further details and mechanisms should be clarified within the ordinance, which I would like to present in the following.

OpenSIS Vulnerabilities

Thu, 15 Oct 2020 00:00:00 +0000

OpenSIS is an open source student information system. Recently, it was affected by several vulnerabilities such as SQL injections, local file inclusions and incorrect access controls (CVE-2020-13380, CVE-2020-13381, CVE-2020-13382, CVE-2020-13383). That is why I got interested and also had a quick look at the application.

As part of this investigation, I discovered two vulnerabilities, an XSS vulnerability (CVE-2020-27409) in the file SideForStudent.php that got quickly fixed after being reported (see commit edca085 for the details; the commit is included in release v7.5) and some incorrect (i.e. non-existent) access controls for the password change functionality (CVE-2020-27408). In this blog post, I would like to focus on the second vulnerability and describe the tedious disclosure process that – in the end – lead to nothing but the implementation of some ineffective obfuscation mechanism.

Vulnerabilities in GNU Readline Fixed

Wed, 07 Oct 2020 00:00:00 +0000

Recently I discovered some vulnerabilities in GNU Readline. These bugs have been fixed in GNU Readline version 8.1.

The case of identifying the vulnerabilities was rather interesting. I wanted to fuzz another program and wrote a quick harness to test if my setup works. This test harness used GNU Readline to read input from stdin and passed the data along to the function under test. I left the fuzzer running while I started to improve the harness (which would also mean getting rid of GNU Readline as it is relatively slow for the use-case at hand). However, AFL showed the first crashes and upon inspection, the vulnerabilities where not in the code I actually wanted to fuzz but in my systems GNU Readline.

Doing it Server-Side with CypherDog 4.0

Thu, 17 Sep 2020 00:00:00 +0000

Arrroooo… Bloodhound Crew!! Heard the news? CypherDog 4.0 is out and it’s full of new features…

Now a couple of you might be thinking “Hey there, wait a minute… didn’t CypherDog 3.0 come out not that long ago..??”, and I am happy to see some of you are paying attention…
Indeed, when Bloodhound 3 came out, I quickly updated CypherDog 2 to CypherDog 3 to be compatible with it.
But Bloodhound 3 is compatible with neo4j 3 and 4, however the neo4j REST API has been deprecated in neo4j 4 and CypherDog 3 relied on it.
Long story short, CypherDog 4.0 is a full rewrite compatible with the new neo4j 4 HTTP API, and since I was refactoring the whole thing, I added some cool new features to the tool.
The idea was to be able to do more with less keystrokes, and to do it server-side…
And so I made a meme.

ERNW White Paper 69 – Safety Impact of Vulnerabilities in Insulin Pumps

Fri, 11 Sep 2020 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper [1]. The paper is about severe vulnerabilities in an insulin pump we assessed during project ManiMed and we are proud to publish this subset of the results today.

Manipulating Medical Devices

The German Federal Office for Information Security (BSI), in its role as the Federal Cyber Security Authority in Germany, aims to sensitize manufacturers and the public regarding security risks of networked medical devices. In response to the often fatal security reports and press releases of networked medical devices, the BSI initiated the project Manipulation of Medical Devices (ManiMed) in 2019. In this project, a security analysis of selected products is carried out through security assessments. In the context of this project, severe vulnerabilities were identified during the assessment of the DANA Diabecare RS system.

How can data from fitness trackers be obtained and analyzed with a forensic approach?

Thu, 10 Sep 2020 00:00:00 +0000

The use of Internet of Things devices is continuously increasing: People buy devices, such as smart assistants, to make their lives more comfortable or fitness trackers to assess sports activities. According to the Pew Research Center [1], every fifth American wears a device to track their fitness. In Germany, the number increases likewise. The increasing number of fitness trackers in use can also be seen in criminal proceedings, as there exist more and more cases where these devices provide evidence.

Puppet Assessment Techniques

Wed, 09 Sep 2020 00:00:00 +0000

Hardening guides for different systems that can be managed by Puppet are easy to find, but not the guides for hardening Puppet itself.

The enterprise software configuration management (SCM) tool Puppet is valued by many SysAdmins and DevOps, e.g. at Google, for scalable, continuous and secure deployment of application server configuration files across large heterogeneous system landscapes and increasingly also as “end-to-end” compliance solution.

Disclaimer:
This blog post does not present anything new about Puppet security, but aims to raise security awareness and summarize useful attack and audit techniques for an internal black and whitebox infrastructure assessment of a Puppet Enterprise landscape.
Most information in this post were collected during and based-on a time-limited graybox Puppet landscape assessment (Puppet Enterprise version 6.4.0, on RHEL7).
Hence, there is no claim for completeness and the post shall not be considered as a fully fledged Puppet hardening guide.

Java Buffer Overflow with ByteBuffer (CVE-2020-2803) and Mutable MethodType (CVE-2020-2805) Sandbox Escapes

Wed, 02 Sep 2020 00:00:00 +0000

Years ago, Java could be used on websites trough applets. To make these applets secure and not let them access files or do other dangerous stuff, Java introduced the SecurityManager. Before some action was performed, the SecurityManager was asked if the code is privileged to perform this action. However, since the SecurityManager lives in the same running program and can be accessed via System.getSecurityManager(), there existed some ways to remove it.

Security Advisories for Nagios XI

Thu, 30 Jul 2020 00:00:00 +0000

In June 2020 we reported three vulnerabilities in Nagios XI 5.7.1 to the vendor.
The following CVE IDs were assigned to the issues :

CVE-2020-15901: Command Injection in Nagios XI web interface (RCE)
CVE-2020-15902: Cross Site Scripting (XSS)
CVE-2020-15903: Reserved, details will be given on vendor fix

CVE-2020-15901 and CVE-2020-15902 have meanwhile been fixed in version 5.7.2 according to the changelog on the Nagios website (https://www.nagios.com/downloads/nagios-xi/change-log/). CVE-2020-15903 is currently being worked on by the vendor and will probably be fixed in the near future.

ACM WiSec 2020

Sun, 26 Jul 2020 00:00:00 +0000

Last week I attended ACM WiSec. Of course, only virtually. The first virtual conference I attended. Coincidentally, it was also the first conference I presented at. While the experience was quite different from a “real” conference, the organizers did a great job to make the experience as good as possible with, for example, a mattermost instance to interact with other conference participants.

In the following, I will list a few talks and papers that I either found very interesting or that generally stood out to me:

QEMU, Unicorn, Zelos, and AFL

Wed, 15 Jul 2020 00:00:00 +0000

I should start by telling you that this post does not contain anything fundamentally new. Hence, if you already know the tools mentioned in the title, this post may probably not be for you. However, if you are not too familiar with these tools and want to understand a little bit more on how they work together, you should keep on reading.

First, let us get a high-level overview of the different tools. We begin with QEMU. QEMU is a piece of software to emulate hardware such as processors. Imagine, for example, that you are running an operating system such as Linux or Windows on a x86-64 machine and that you would like to analyze a binary that has been compiled for an ARM or MIPS processor. Of course, you can use static analysis on the binary, but if you want to find out more about the runtime behavior, well, it would be good to have a corresponding runtime environment.

Security Advisories for Ivanti DSM Suite

Tue, 23 Jun 2020 00:00:00 +0000

From the end of 2019 on, we reported two critical vulnerabilities in the Ivanti DSM Suite to the vendor. The following CVE IDs were assigned to the issues (but note that they have a status of RESERVED, i.e. titles and descriptions may change in the future):

CVE-2020-12441: Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4
CVE-2020-13793: Unsafe storage of AD credentials in Ivanti DSM netinst 5.1

The vulnerabilities have meanwhile been fixed and an updated software version can be downloaded here.

Back from the ATT&CK jungle…

Wed, 06 May 2020 00:00:00 +0000

So there was a pandemic, the whole world was under lockdown, and I got a bit depressed.
I needed something new in my life, so I decided to take my favorite dog out for a walk in the ATT&CK jungle to check out the newly added sub-techniques…

If you’re not familiar with ATT&CK and are wondering what this is all about, no worries…
ATT&CK stands for Adversarial Tactics, Techniques & Common Knowledge.
It’s a treasure trove of information about real-life offensive tradecraft.
I like to see it as an open-source encyclopedia of corporate post-exploitation.
There is a growing community around the project and more info keeps being added to it.
[Check out this post by @LikeTheCoins if you want to know more]

Medical Device Security: HL7v2 Injections in Patient Monitors

Thu, 23 Apr 2020 00:00:00 +0000

Digital networking is already widespread in many areas of life. In the healthcare industry, a clear trend towards networked devices is noticeable, so that the number of high-tech medical devices in hospitals is steadily increasing.

In this blog post, we want to elucidate a vulnerability we identified during the security assessment of a patient monitor. The device sends HL7 v2.x messages, such as observation results to HL7 v2.x capable electronic medical record (EMR) systems. A user with malicious intent can tamper these messages. As HL7 v2.x is a common medical communication standard, we also want to present how this kind of vulnerability may be mitigated. The assessment was part of the BSI project ManiMed, which we would like to present in the following section.

CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click RCE – BlueFrag

Wed, 22 Apr 2020 00:00:00 +0000

Nowadays, Bluetooth is an integral part of mobile devices. Smartphones interconnect with smartwatches and wireless headphones. By default, most devices are configured to accept Bluetooth connections from any
nearby unauthenticated device. Bluetooth packets are processed by the Bluetooth chip (also called a controller), and then passed to the host (Android, Linux, etc.). Both, the firmware on the chip and the host Bluetooth subsystem, are a target for Remote Code Execution (RCE) attacks.

Dog Whisperer Update

Thu, 26 Mar 2020 00:00:00 +0000

With the current situation, it’s not easy to find the right angle to start this blog post, so I won’t even try… but with Troopers cancelled, my Bloodhound workshop went down the drain, and I didn’t get a chance to meet or catch up with all of you and share my latest BloodHound adventures. So I decided to write a quick post to share all this…

As you might have heard, BloodHound 3 was released last month, so I thought it was time to update the Dog Whisperers Handbook.
It’s basically a quick intro to BloodHound and Cypher, with a lot of links to resources for further learning.
You can download the latest version here. Hope you enjoy it.

VMware NSX-T Distributed Firewall can be bypassed by default

Mon, 23 Mar 2020 00:00:00 +0000

We recently came across an issue when playing around with VMware NSX-T which not anyone might be aware of when getting started with it. Because many of our customers start with transitioning to NSX-T, we want to share this with you. In short, the Distributed Firewall (DFW) of NSX-T can be easily bypassed in the default configuration because it only works effectively if at the same time, the SpoofGuard feature is enabled on all logical switch ports which is not the case by default.

DNS exfiltration case study

Wed, 04 Mar 2020 00:00:00 +0000

Lately, we came across a remote code execution in a Tomcat web service by utilizing Expression Language. The vulnerable POST body field expected a number. When sending ${1+2} instead, the web site included a Java error message about a failed conversion to java.lang.Long from java.lang.String with value "3".

From that error message we learned a couple of things:

The application uses Java
We are able to execute EL expressions
Output from the EL engine is always returned as String

Whenever you are able to execute code within a Java Context, the most interesting part is to check whether we can get a Runtime object and execute arbitrary OS commands.

TROOPERS20 Training Teaser: Attack And Defence In AWS: Chaining Vulnerabilities To Go Beyond The OWASP Top 10

Thu, 27 Feb 2020 00:00:00 +0000

Attackers are everywhere. They are now on the cloud too! Attacking the most popular cloud provider – AWS, requires the knowledge of how different services are setup, what defences do we need to bypass, what service attributes can be abused, where can information be leaked, how do I escalate privileges, what about monitoring solutions that may be present in the environment and so on! We try to answer these questions in our intense, hands-on scenario driven training on attacking and subsequently defending against the attacks on AWS.

Critical Bluetooth Vulnerability in Android (CVE-2020-0022) – BlueFrag

Thu, 06 Feb 2020 00:00:00 +0000

On November 3rd, 2019, we have reported a critical vulnerability affecting the Android Bluetooth subsystem. This vulnerability has been assigned CVE-2020-0022 and was now patched in the latest security patch from February 2020. The security impact is as follows:

On Android 8.0 to 9.0, a remote attacker within proximity can silently execute arbitrary code with the privileges of the Bluetooth daemon as long as Bluetooth is enabled. No user interaction is required and only the Bluetooth MAC address of the target devices has to be known. For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address. This vulnerability can lead to theft of personal data and could potentially be used to spread malware (Short-Distance Worm).
On Android 10, this vulnerability is not exploitable for technical reasons and only results in a crash of the Bluetooth daemon.
Android versions even older than 8.0 might also be affected but we have not evaluated the impact.

Users are strongly advised to install the latest available security patch from February 2020. If you have no patch available yet or your device is not supported anymore, you can try to mitigate the impact by some generic behavior rules:

TROOPERS20 Training Teaser: Hacking Node.js & Electron apps, shells, injections and fun!

Thu, 06 Feb 2020 00:00:00 +0000

Did you know that in the ever evolving field of Web and Desktop apps, it turns out these can all now be powered with JavaScript? You read that right: JavaScript is now used to power both web apps (Node.js) as well as Desktop apps (Electron). What could possibly go wrong?

So, the burning question is: how does this affect Web and Desktop app security? If you want to find out, come to our training and you will experience this in a 100% hands-on fashion! 🙂

Blackhoodie@Troopers 2020

Mon, 27 Jan 2020 00:00:00 +0000

Once again, we are super excited to announce that Blackhoodie is happening at Troopers 2020. This is the 3rd time that Blackhoodie is joining with Troopers. As always, one of the main motivation for Blackhoodie is bringing more women into reversing and other core security topics. So we would like to see more women apply to the training slots. However, if you are not a woman and still feel really excited about Blackhoodie, you are welcome to apply. The registration is open now. Please hurry up and make your registration now. We will close the registration once the seats are filled up with enough quality submissions. We do have a very limited number of seats at this training site. So we apologize in advance if we can’t accommodate everyone, even though we wish we could!

Windows Insight: The Windows Telemetry ETW Monitor

Tue, 14 Jan 2020 00:00:00 +0000

The Windows Insight repository now hosts the Windows Telemetry ETW Monitor framework. The framework monitors and reports on Windows Telemetry ETW (Event Tracing for Windows) activities – ETW activities for providing data to Windows Telemetry. It consists of two components:

the Windbg Framework: a set of scripts for monitoring Windows Telemetry ETW activities. The scripts are fed to a running windbg instance, connected to the Windows instance whose Windows Telemetry ETW activities are monitored.
the Telemetry Information Visualization (TIV) framework for visualization of information and statistics. The TIV framework is a set of Python scripts that visualize information and statistics based on the data produced by the Windbg Framework. The output of the TIV framework is a report in the form of a web page.

TROOPERS20 Training Teaser: TLS in the Enterprise – Post Quantum Security

Mon, 09 Dec 2019 00:00:00 +0000

Our workshop “TLS in the enterprise” was held for the first time at Troopers 2018 and was our special contribution to the IT Security world to increase the usage of TLS and point out the pitfalls, when switching to TLS.

But time is changing and TLS is a kind of standard nowadays, at least when looking at HTTPS, but there are still a lot of things to do regarding other protocols like

TROOPERS20 Training Teaser: Swim with the whales – Docker, DevOps & Security in Enterprise Environments

Mon, 02 Dec 2019 00:00:00 +0000

Containerization dominates the market nowadays. Fancy buzzwords like continuous integration/deployment/delivery, microservices, containers, DevOps are floating around, but what do they mean? What benefits do they offer compared to the old dogmas? You’re gonna find out in our training!

We are going to start with the basics of Docker, Containers and DevOps, but soon you’ll end up with your own applications running inside containers with the images residing in your own registry. Of course, following the microservices approach, and the second day hasn’t even started.After the fundamental topics of containerization are understood, you’re going to create and operate your own Kubernetes cluster. A lot of fun and challenging exercises lie ahead, to give you hands-on experience with all the technologies.

BASTA! Autumn 2019 – Security in DevOps

Thu, 28 Nov 2019 00:00:00 +0000

Some time ago I had the pleasure to speak at the BASTA! Autumn 2019 conference. There, I promised to publish my slides such that they can be used as a reference for developers and security guys like me. And with this blog post I would like to hold up to my promise.

Overall, the talk was about the challenges of “How to bring security into modern DevOps processes”. Hence, I demonstrated how security can be integrated more or less seamlessly into the modern agile software development workflow. I proposed some risk-depended recommendations about which measurements should be established, for example, within the CI pipeline.

TROOPERS20 teaser: Hacking mobile apps

Thu, 28 Nov 2019 00:00:00 +0000

“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process our bank transactions, handle our private data and set us up on romantic dates. However, few of us care to wonder,”How (in)secure can these apps be?” Well… at Troopers 20, you can learn how to answer this question yourself!

In our 2 day long “Hacking mobile apps” workshop, we teach how to find security vulnerabilities in mobile apps, exploit them and defend against them. We start from scratch, therefore no prior experience in hacking or developing mobile apps is required. Whether you want to learn how to pentest mobile apps, you are an app developer that fancies to secure his/her apps, or just curios, our workshop is a jumpstart to your goal.

TROOPERS20 Training Teaser: Insight Into Windows Internals

Mon, 25 Nov 2019 00:00:00 +0000

Windows 10 is one of the most commonly deployed operating systems at this time. Knowledge about its components and internal working principles is highly beneficial. Among other things, such a knowledge enables:

in-depth studies of undocumented, or poorly documented, system functionalities;
development of performant and compatible software to monitor or extend the activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.

The “Insight into Windows Internals” training offered at TROOPERS20 delivers knowledge on the core components and inner working principles of Windows 10. For example, the training provides knowledge on how Windows 10 uses virtualization to isolate security-critical functionalities from attackers that have managed to compromise the system. The training includes a variety of practical exercises allowing attendees to observe first-hand the operation of Windows 10.

DevSecCon19 London – How to Secure OpenShift Environments and What Happens If You Don´t

Tue, 19 Nov 2019 00:00:00 +0000

This week I was at DevSecCon in London to present my current research on Red Hat OpenShift. In this talk, I gave a brief introduction to OpenShift, demonstrated some threats that exist for such environments, and dived into different configuration issues that may affect the security of OpenShift environments. The implications of misconfigurations of such an environment have been shown in live demos.

You can find the slides for my talk here.

TROOPERS20 Training Teaser: Hacking 101

Thu, 07 Nov 2019 00:00:00 +0000

Hi there,
like in recent years the popular Hacking 101 workshop will take place on TROOPERS20, too! The workshop will give you an insight into the hacking techniques required for penetration testing. These techniques will cover various topics:

Information gathering
Network scanning
Web application hacking
Low-level exploitation

…and more!

During this workshop you will learn, step by step, a testing methodology that applies to the majority of scenarios. So imagine you have to assess the security of a system running on the Internet. How would you start? First, you need a good understanding of the target, including running services or related systems. Just scanning the target’s IP address will most likely not reveal all relevant information you can get. In the information gathering step, you will learn where you could find more relevant information than just a list of open ports. A brief understanding of the target and it’s related systems/services/applications will make scanning and identifying vulnerabilities a lot easier and more effective. Then, the last step will be the exploitation of the identified vulnerabilities, with the ultimate aim to get access to the target system and pivot to other, probably internal, systems and resources.

TROOPERS20 Training Teaser: Windows & Linux Binary Exploitation

Mon, 04 Nov 2019 00:00:00 +0000

We are happy to announce that TROOPERS20 will feature the 5th anniversary of the popular Windows & Linux Binary Exploitation workshop!

In this workshop, attendees will learn how to exploit those nasty stack-based buffer overflow vulnerabilities by applying the theoretical methods taught in this course to hands-on exercises. Exercises will be performed for real world (32-bit) software such as the Foxit Reader Plugin for Firefox, Wireshark, and nginx.

Each exercise will start with an initially uncontrolled overwrite of the instruction pointer register by a stack-based buffer overflow vulnerability. From there on, we will work our way through many obstacles to finally gain remote code execution. Obstacles that will be encountered during the exercises include modern stack-based buffer overflow defense mechanisms such as stack cookies, data execution prevention (DEP), and address space layout randomization (ASLR). For all of these defense mechanisms, attendees will learn and apply certain methods to bypass the protection.

Dissection of an Incident – Part 2

Wed, 30 Oct 2019 00:00:00 +0000

After our last blogpost regarding Emotet and several other Emotet and Ransomware samples that we encountered, we recently stumbled across a variant belonging to the Gozi, ISFB, Dreambot respectively Ursnif family. In this blogpost, we want to share our insights from the analysis of this malware, whose malware family is mainly known for being a banking trojan that typically tries to infect browser sessions and sniff/redirect data. In particular, we are going to provide details about the first stage Word Document, the embedded JavaScript/XSL document, an in-depth runtime analysis of the downloaded executable, and some details regarding detection.

Windows Insight: Code integrity and WDAC

Wed, 30 Oct 2019 00:00:00 +0000

The Windows Insight repository now hosts three articles on Windows code integrity and WDAC (Windows Defender Application Control):

Device Guard Image Integrity: Architecture Overview (Aleksandar Milenkoski, Dominik Phillips): In this work, we present the high-level architecture of the code integrity mechanism implemented as part of Windows 10.
Windows Defender Application Control: Initialization (Dominik Phillips, Aleksandar Milenkoski): This work describes the process for initializing WDAC performed by the Windows loader and the kernel when Windows 10 is booted.
Windows Defender Application Control: Image verification (Aleksandar Milenkoski): This work discusses the workflow of WDAC for verifying images.

– Aleksandar Milenkoski

Blue Hands On Bloodhound

Fri, 18 Oct 2019 00:00:00 +0000

Hi there,

SadProcessor here, happy to be back on the Insinuator to share with you some of my latest BloodHound adventures and experiments…

TL;DR Well too bad for you…

Before diving into a bit of code and some BloodHound data manipulation,
I would like to thank the BruCon Crew for having me over last week for BruCON0x0B.
I had the pleasure of delivering a 4h BloodHound & Cypher workshop in the lovely city of Gent [in a fantastic training room], and I am pleased with the interaction & feedback I had with the attendees.
I was also very happy to see almost as many Blues as Reds in the room [as well as regular security folks!!], all together having a play with BloodHound & Cypher.

Medical Device Security Summit 2019, 19th of November of 2019

Wed, 09 Oct 2019 00:00:00 +0000

*This event will be held in German*

Inspiriert durch die erfolgreichen Round-Table-Diskussionen der TROOPERS-Konferenz freuen wir uns, Ihnen heute mit dem Medical Device Security Summit 2019, eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einem Eröffnungsvortrag von Peter Hecko (Leiter der IT-Sicherheit bei HELIOS IT Service GmbH, Podcaster und jahrelanges Mitglied im CCC), gefolgt von Fallstudien und Vorträgen von ERNW Experten und weiteren Referenten aus der Lehre, Industrie und klinischer Praxis.

TelcoSecDay 2020 CFP is open

Mon, 23 Sep 2019 00:00:00 +0000

We are back again with another TelcoSecDay 2020 (TSD20) which is going to happen on March 16th, 2020 as an additional event to TROOPERS. This year, it is going to be on Monday of the TROOPERS week. We are delighted to inform that the event is happening for the 9th year in a row. The CFP is open now. If you have an interesting topic related to the field of Telco Security, please make a submission. The deadline is November 17, 2019. The final notification for TSD submission is December 20, 2019.

Jenkins – Groovy Sandbox breakout (SECURITY-1538 / CVE-2019-10393, CVE-2019-10394, CVE-2019-10399, CVE-2019-10400)

Fri, 20 Sep 2019 00:00:00 +0000

Recently, I discovered a sandbox breakout in the Groovy Sandbox used by the Jenkins script-security Plugin in their Pipeline Plugin for build scripts. We responsibly disclosed this vulnerability and in the current version of Jenkins it has been fixed and the according Jenkins Security Advisory 2019-09-12 has been published. In this blogpost I want to report a bit on the technical details of the vulnerability.

Description

The groovy sandbox transforms some AST nodes of the script to add security checks. For example

PSD2 – Mandatory Account Access for Third Party Providers

Thu, 12 Sep 2019 00:00:00 +0000

On September 14th the final deadline of complying with the new Payment Service Directive PSD2 will be reached. Among other things, this directive will bring quite a few technical challenges for credit institutions. These include new requirements on two-factor authentication and API access for third parties. In this blog post we will give a short overview of what this means for banks from a security perspective and outline a few of the security-related issues based on what we have been observing during recent assessments of such APIs.

A Brief History of the IPv4 Address Space

Mon, 26 Aug 2019 00:00:00 +0000

This is meant to be the first part of a 3-part series discussing the space & types of IP addresses, with a particular focus on what has changed between IPv4 and IPv6. In this first post I’ll take the audience through a historical tour of some developments within the IPv4 address space.

In a second part I’ll discuss the properties of different types of addresses from a routing and from a security perspective, both in the IPv4 and in the IPv6 space. In the third part we’ll look at the implications of deploying IPv6 in certain networks based on those differences, e.g. “how to handle ACLs and IP address based log analysis approaches in a dual-stack network where systems have one RFC 1918 IPv4 address and multiple IPv6 GUAs?” (for specific reasons the latter two parts might be published on another medium though). In any case let’s start with a brief history of IPv4. The goal here is to understand how we got to the state that we have today.

Black Hat US 2019 / Some Talks

Tue, 13 Aug 2019 00:00:00 +0000

I’ve been at Black Hat Vegas last week and in the following I’ll shortly discuss some talks I’ve attended and which I found interesting.

Gabriele Fisher & Luke Valenta: Monsters in the Middleboxes. Building Tools for Detecting HTTPS Interception

This talk was about identifying if inbound HTTPS traffic reaching a server had been intercepted by a middlebox (or its software equivalent which is usually called “middleware”, a prominent example being the Lenovo Superfish piece a few years ago) on its path.

A Follow-Up on the Heisec Webinar on Emotet & Some Active Directory Security Sources

Fri, 09 Aug 2019 00:00:00 +0000

Some weeks ago, Heinrich and I had the pleasure to participate in the heisec-Webinar “Emotet bei Heise – Lernen aus unseren Fehlern”. We really enjoyed the webinar and the (alas, due to the format: too short) discussions and we hope we could contribute to understand how to make Active Directory implementations out there a bit safer in the future.

Now, I have the pleasure to announce a continuation of our talk about Active Directory security next week, Wednesday, 14^(th) of August @heisec in the format of a technical talk “Emotet bei Heise – Online-Fachgespräch zum Schutz vor Cybercrime”. Seats are still available 😉

How to break out of restricted shells with tcpdump

Mon, 29 Jul 2019 00:00:00 +0000

During security assessments we sometimes obtain access to a restricted shell on a target system. To advance further and gain complete control of the system, the next step is usually to break out of this shell. If the restricted shell provides access to certain system binaries, these binaries can often be exploited to perform such a break out. Here we would like to show an interesting example of such a break out by using the tcpdump binary.

LibreOffice – A Python Interpreter (code execution vulnerability CVE-2019-9848)

Fri, 26 Jul 2019 00:00:00 +0000

While waiting for a download to complete, I stumbled across an interesting blogpost. The author describes a flaw in LibreOffice that allowed an attacker to execute code. Since this was quite recent, I was interested if my version is vulnerable to this attack and how they fixed it. Thus, I looked at the sources and luckily it was fixed. What I didn’t know before however was, that macros shipped with LibreOffice are executed without prompting the user, even on the highest macro security setting. So, if there would be a system macro from LibreOffice with a bug that allows to execute code, the user would not even get a prompt and the code would be executed right away. Therefor, I started to have a closer look at the source code and found out that exactly this is the case!

Emotet at Heise, Emotet there, Emotet everywhere – Dissection of an Incident

Thu, 18 Jul 2019 00:00:00 +0000

After the Emotet Incident at Heise, where ERNW has been consulted for Incident Response, we decided to start a blogpost series, in which we want to regularly report on current attacks that we observe. In particular we want to provide details about the utilized pieces of malware, different stages, and techniques used for the initial infection and lateral movement. We hope that this information might help you to detect ongoing incidents, apply countermeasures, and in the best case to figure out proactive countermeasures and security controls beforehand.

Troopers 19 – Badge Hardware

Thu, 18 Jul 2019 00:00:00 +0000

This post by Jeff (@jeffmakes) was delayed due to interferences with other projects but nevertheless, enjoy!

This year, it was my great honour to design the hardware for the Troopers19 badge.

We wanted to make a wifi-connected MicroPython-powered badge; something that would be fun to take home and hack on. It was a nice opportunity to use a microcontroller platform that I hadn’t tried before. I also used the project as a chance to finally migrate my PCB workflow from Eagle to Kicad. Inevitably it was a painful transition, which resulted in quite some delay to the project as I floundered around in the new tool, but it does mean the design files are in an open format which I hope will benefit the community of Troopers attendees and future badge designers!

Multiple Vulnerabilities in innovaphone VoIP Products Fixed

Mon, 08 Jul 2019 00:00:00 +0000

Dear all,

innovaphone fixed several vulnerabilities in two VoIP products that we disclosed a while ago. The affected products are the Linux Application Platform and the IPVA. Unfortunately, the release notes are not public (yet?) and the vendor does not include information about the vulnerabilities for the Linux Application Platform. Therefore, we decided to publish some more technical details for the issues.

Multiple Vulnerabilities in Linux Application Platform

The Linux Application Platform was affected by three vulnerabilities that could be chained to get full root access to a target system. However, the initial access vector is only exploitable by authenticated users. The vulnerabilities have been identified on the Linux Application Platform V10 SR41. According to the vendor they have been fixed in V10 SR57.

Security Advisories for Cisco ACI

Thu, 04 Jul 2019 00:00:00 +0000

Again, Cisco released security advisories for their software-defined networking (SDN) solution called Application Centric Infrastructure (ACI). As before (see blog post here), the published advisories originated from research performed in our ACI lab.

The following advisories have been published:

Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-n9kaci-bypass
CVSS Base Score: 7.4

Cisco Application Policy Infrastructure Controller REST API Privilege Escalation Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapi
CVSS Base Score: 7.2

IPv6 Surveys / Application Space

Sun, 30 Jun 2019 00:00:00 +0000

In some organizations we work with a certain state of IPv6 deployment has been reached in the interim which includes, among others, the following aspects:

the network infrastructure is IPv6-enabled (incl. interface addressing, routing [protocols] and the like).
parts of supporting services (security functions, monitoring, system management) include IPv6 in a proper way.
3rd party providers have been contractually obliged to deliver their services in an “IPv6-enabled” mode (as opposed to only being “IPv6-capable” which was the standard requirement in many RFIs during earlier years).

It might then happen that networking people (who often are the initial motivators for deploying IPv6) in such organizations are stating, when asked about IPv6: “it’s [mostly] done”.
Point is that, alas, this does not necessarily mean that a single service or application is *actually using* IPv6, so while the above certainly constitutes an achievement it might not even be halfway through.

DirectoryRanger 1.5.0 Is Available

Thu, 13 Jun 2019 00:00:00 +0000

The next major release of DirectoryRanger is now available for customers, and for everyone who would like to try it ;-). Current attacks show that quite often the topic of Active Directory Security is not on the security agenda, but it should be, and this was the reason for us to build the tool and, of course, to maintain and improve it. So what are the major new features released with DirectoryRanger 1.5.0? Here we go:

Back from PowerShell Conference Europe…

Wed, 12 Jun 2019 00:00:00 +0000

The PowerShell Conference Europe 2019 took place last week in Hannover, and I had the pleasure to attend and speak for the second year in a row. I want to thank @TobiasPSP @Alexandair @sqldbawithbeard and the @PSConfEU crew for putting up this #PowerShell feast. From a RaspberryPi to the Clouds, from PowerShell internals to a dancing Lego robot, if you have anything to do with windows, PowerShell, or a computer, there was some content made for you…[I will update this post with links as soon as the videos are published. Make sure to check it out.]

IPv6 Properties of Windows Server 2019 / Windows 10 (1809)

Wed, 12 Jun 2019 00:00:00 +0000

In this post I’ll cover some properties of the Windows Server 2019 IPv6 stack. It is an update of a similar post I wrote on the IPv6 properties of Server 2016 a while ago.

For this reason I will mostly look at the same properties I did at the time (read: at times without providing too much technical background information; that can be found in the other post) and I’ve hence performed the same types of practical tests.

Windows Insight: Virtual Secure Mode

Wed, 12 Jun 2019 00:00:00 +0000

The Windows Insight repository currently hosts four articles on VSM (Virtual Secure Mode):

Virtual Secure Mode: Architecture Overview (Aleksandar Milenkoski): In this work, we discuss the architecture of a virtualized Windows environment.
**Virtual Secure Mode: Communication Interfaces **(Aleksandar Milenkoski): In this work, we discuss the communication interfaces that VSM implements: Isolated User Mode (IUM) system calls, normal-mode services, secure services, and hypercalls.
Virtual Secure Mode: Protections of Communication Interfaces (Aleksandar Milenkoski): This work discusses implemented mechanisms for securing the above VSM communication interfaces. This includes restrictions on issuing hypercalls, data marshalling and sanitization, and secure data sharing.
Virtual Secure Mode: Initialization (Dominik Phillips, Aleksandar Milenkoski): This work describes the process for VSM initialization activities performed by the Windows loader and the Windows kernel when Windows 10 is booted.

– Aleksandar Milenkoski

Emotet im Active Directory: Es kann jeden treffen – aber Jeder kann es dem Angreifer schwer machen!

Fri, 07 Jun 2019 00:00:00 +0000

Heise berichtet aktuell öffentlich über die Emotet-Infektion im eigenen Haus, bei dessen Aufklärung ERNW unterstützte. Damit liefert Heise Informationen zum Verlauf aktueller Angriffe, aber insbesondere auch wertvolle Einsichten zu Vorbeugung, Erkennung, Analyse und Gegenmaßnahmen aus eigener Erfahrung, wie sie nur selten der Öffentlichkeit preisgegeben werden.

Ein Team aus Incident-Response Spezialisten der ERNW Research unterstützte Heise bei der Analyse und Rekonstruktion des Vorfalls und analysierte die Schadsoftware, um deren Ausbreitungswege nachzuvollziehen und IoCs (Indicators of Compromise) zu extrahieren. Hierdurch konnten effektive Gegenmaßnahmen entwickelt und gemeinsam mit Heise erfolgreich umgesetzt werden.

Windows Insight: The TPM

Mon, 27 May 2019 00:00:00 +0000

The Windows Insight repository currently hosts three articles on the TPM (Trusted Platform Module):

The TPM: Communication Interfaces (Aleksandar Milenkoski): In this work, we discuss how the different components of the Windows 10 operating system deployed in user-land and in kernel-land, use the TPM. We focus on the communication interfaces between Windows 10 and the TPM. In addition, we discuss the construction of TPM usage profiles, that is, information on system entities communicating with the TPM as well as on communication patterns and frequencies;
The TPM: Integrity Measurement (Aleksandar Milenkoski): In this work, we discuss the integrity measurement mechanism of Windows 10 and the role that the TPM plays
as part of it. This mechanism, among other things, implements the production of measurement data. This involves calculation of hashes of relevant executable files or of code sequences at every system startup. It also involves the storage of these hashes and relevant related data in log files for later analysis;

The Week in Review #RIPE78

Sun, 26 May 2019 00:00:00 +0000

This week Chris and I participated in the RIPE 78 meeting in Reykjavík. Being part of the group was fun as always and we had quite some interesting conversations with peers from (not only) the IPv6 community.
Big thanks to the RIPE NCC team for the smooth organization and for taking care of us!

In this post I’ll provide some notes on talks I found particularly interesting, plus links to our own contributions.

Windows Insight: A New ERNW Repository

Thu, 23 May 2019 00:00:00 +0000

We are glad to announce the Windows Insight repository. The content of this repository aims to assist efforts on analysing inner working principles, functionalities, and properties of the Microsoft Windows operating system. This repository stores relevant documentation as well as executable files needed for conducting analysis studies.

Some of the content of this repository has been created in the course of a project named ‘Studie zu Systemaufbau, Protokollierung, Härtung und Sicherheitsfunktionen in Windows 10 (SiSyPHuS Win10)’ (ger.) – ‘Study of system design, logging, hardening, and security functions in Windows 10’ (eng.). This project has been contracted by the German Federal Office for Information Security (ger., Bundesamt für Sicherheit in der Informationstechnik – BSI). The work planned as part of the project is conducted by ERNW GmbH, starting in May 2017.

IPv6 Security for Enterprise Organisations @ #RIPE78

Fri, 17 May 2019 00:00:00 +0000

Chris and I will give a tutorial on the above topic at next week’s RIPE Meeting in Reykjavík. In this post (actually this will probably become a small series of posts) I’ll try to summarize some thoughts on IPv6 security in enterprise environments in 2019.

We’re going to cover three main areas:

Why IPv6 Is Different, Security-wise
Traffic Filtering in IPv6 Networks
IPv6 Security in L2 Networks / First Hop Security et al.

Let’s start with the first item. In real-life scenarios the security of “a protocol” – IPv6 can rather be considered a “protocol family” which includes helper protocols like ICMPv6 and MLD (which in turn is implemented by means of ICMPv6 messages) and potentially others like DHCPv6 – might depend on a number of factors:

Heise Security Tour: Offensive PowerShell

Mon, 13 May 2019 00:00:00 +0000

Dominik Phillips and I are taking part in a tour organized by Heise Security – the Heise Security Tour. We give a talk titled “PowerShell: Attack under the radar”. In this talk, we provide an overview of the architecture of PowerShell and show how attackers may use PowerShell for malicious purposes. We demonstrate PowerShell post-exploitation activities implemented as part of publicly available frameworks, such as Empire. We also discuss a security concept for defending against such activities.

#TR19 Next Generation Internet (NGI) Summaries

Thu, 02 May 2019 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS19 Active Directory Security Track.

Microsoft IT (Secure) Journey to IPv6-Only

Veronika McKillop, Network Architect, Cloud and Connectivity Engineering (CCE)

The speaker, Veronika McKillop, working at Microsofts network infrastructure services, has given a talk about the process of switching a company network from IPv4 to IPv6-only.

Within the talk the following topics were introduced: Dual Stack, Drivers for IPv6, Status of IPv6 in Networks and Security in IPv6 Networks. The talk covers the reasons why a company would like to switch from IPv4 to IPv6. Technics like NAT64 and DNS64 are introduced. The requirements to software and especially drivers to work in IPv6 environments are described. Also the problems to switch from IPv4 to IPv6-only in heterogeneous networks are addressed.

Security Advisory for Cisco Nexus 9000 Series Fabric Switches in ACI mode

Thu, 02 May 2019 00:00:00 +0000

Yesterday, Cisco released a number of security advisories. Three of the advisories originated from research performed by us for the Cisco Nexus 9000 Series Fabric Switches / Cisco Application Centric Infrastructure (ACI).

More specifically, these advisories are the following:

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey
CVSS Base Score: 9.8

Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Root Privilege Escalation Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-rpe
CVSS Base Score: 7.8

#TR19 Active Directory Security Summaries

Tue, 30 Apr 2019 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS19 Active Directory Security Track.

From Workstation to Domain Admin: Why Secure Administration Isn’t Secure and How to Fix It by Sean Metcalf

Active Directory is probably used in almost every corporation today to administer all kinds of Authorization, Authentication and Privileges. This means they are valuable targets for attackers, because once compromised they could do whatever they want. This would be the worst case scenario, right? Therefore securing AD is important and this year TROOPERS19 featured a whole track solely for AD Security.

#TR19 Attack & Research Summaries

Mon, 29 Apr 2019 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS19 Attack & Research Track.

VXLAN Security or Injection, and protection

The talk “VXLAN Security or Injection, and protection” was held by Henrik Lund Kramshøj, who is the owner of Zencurity ApS, a small security company located in Denmark.

Henrik gives an overview about lesser known VXLAN insecurities, mostly packet spoofing.

In the end he gives advice how to protect against this attacks.

DMEA 2019: A reunion with the Medical Informatics Community

Mon, 29 Apr 2019 00:00:00 +0000

Earlier this month I attended the Digital Medical Expertise & Applications (DMEA) 2019. The DMEA fair in Berlin (formerly conhIT) is the central platform for digital health care as it brings together companies of health IT, academic institutions, politics and healthcare delivery organizations in several format such as innovation hubs and talks during congress sessions as a part of the industry fair. I participated in a congress session about IT security in healthcare with a talk about medical device security and common security flaws in medical devices. Some of the aspects have also been covered in my talk at #TR19 [1].

Troopers & Chill…

Fri, 26 Apr 2019 00:00:00 +0000

As promised in my previous post, I am back for an overview of the Troopers19 – Active Directory related talks… Videos have been published and it’s popcorn time… So if you are into stories about Kingdoms and Crown Jewels, grab your loved one [or a drink…] and turn the lights down low, ’cause tonight it’s “Troopers & Chill…”

Warning: Don’t watch it all in one go… or you will start to feel some anxiety and pain…
and then the Flying Dutchman will move to the cloud… And at that point we are not insured anymore.

MDMs – The Mobile Device “Magic” Solutions – Expectations and Reality

Mon, 15 Apr 2019 00:00:00 +0000

When you are working in the area of mobile security, you sooner or later receive requests from clients asking you to test specific ‘Mobile Device Management’ (MDM) solutions which they (plan to) use, the corresponding mobile apps, as well as different environment setups and device policy sets.
The expectations are often high, not only for the MDM solutions ability to massively reduce the administrative workload of keeping track, updating and managing the often hundreds or thousands of devices within a company but also regarding the improvements towards the level of security that an MDM solution is regularly advertised to provide.

Troopers 19 – Hack your badge

Mon, 15 Apr 2019 00:00:00 +0000

Sadly, TROOPERS 19 is already over. I had great fun meeting all of you, helping you with your badge problems and seeing others hacking on their badges for example to get custom images on there.

With this year’s badge we wanted to give you something you can reuse after the conference, learn new things new build something on your own.

As promised in our talk Jeff and I would like to give you a short introduction into the badge internals. Along with this post we will release the source code for the badge firmware, the provisioning server and the schematics for the PCB.

Upcoming ISH Conference

Wed, 03 Apr 2019 00:00:00 +0000

We’re happy to announce that some fine folks of ERNW will be present at the upcoming ISH Conference.

The next generation IT security training facility for all industries and any institution that manages complex infrastructure invites you to join the first ISH Conference about threats, prevention and response in Information Security on May 6th– 9th, 2019.
The event consists of two days of conference and two days of training with insights and shared knowledge by world leading experts at the Information Security Hub (ISH) Munich Airport.
Learn and discuss the newest threats and solutions with world-renowned experts like Eugene Kaspersky, Adam Meyer, Adrian Nish and others.

The “mmm…” in Community

Thu, 28 Mar 2019 00:00:00 +0000

When I got home last weekend after an awesome week at WEareTROOPERS, my 5yr old asked me what actually happened in Heidelberg…
I told him we were meeting with some people from all over the world to talk about computer security, and he asked me if it was “to stop the bad guys, like super-heroes?”. So I told him “yes, kind of…”, and he decided he would take his new Troopers T-Shirt to school on Monday to show his classmates. Kids are truly amazing… [<3 <3 <3]

Binaries, shellcoding, bug hunting, ROP gadgets and more at Blackhoodie@TR19

Fri, 01 Mar 2019 00:00:00 +0000

We have the most amazing trainers this year lined up for Blackhoodie at Troopers 2019. We have Thais, Silvia, Lisa and Ninon going to give workshops on various interesting topics! Below are some of the workshop contents:

64-bit shellcoding and introduction to buffer overflow exploitation on Linux by Silvia Väli

64-bit shellcoding and introduction to buffer overflow exploitation on Linux is a 3 hour workshop which is essentially divided into 3 parts:

Introduction to 64-bit architecture in order to get familiar with registers, stack, calling conventions described in the Intel 64 (x86-64) architecture manual and the most common assembly instructions and syscalls which we will later use to write our shellcodes.
Shellcoding where we try different techniques to write the shellcode and of course you gonna get to greet the shellcoding world with your own Hello World shellcode in addition to reverse shell which we will use later on in part 3
Introduction to buffer overflows, so you can put your newly received know-how about stack into practise right away. Shellcode without being used is a wasted shellcode! Part 3 ends with a buffer overflow challenge where your goal is to use your reverse shellcode to get a connection back to your machine.

Objectives:

IPv6 Address Management / The “External” Flag

Fri, 22 Feb 2019 00:00:00 +0000

We’re regularly asked to review IPv6 address plans from different organizations and I’d like to share some reflections from such a process currently happening. I’ve discussed a few aspects of IPv6 address planning before; those readers interested please see this post which contains some references.

The organization in question is headquartered in Germany, has ~60K employees and a number of subsidiaries in European countries. They belong to a “traditional industry sector” (so they’re not an “Internet company”, even though they – as the majority of large organizations right now – strive to be one in a few years ;-).

IPv6 Security in an IPv4-only Environment

Wed, 20 Feb 2019 00:00:00 +0000

Starting a post, in 2019, with a mention of sth being “IPv4-only” somewhat hurts ;-), but here we go. Recently Manel Rodero from Barcelona asked me the following question on Twitter:

In this post I’ll try to discuss some inherent aspects of that question and ofc I’ll try to provide a response to it, too ;-).

Let’s first think about the main IPv6-related risks (= threats put into a context of relevance) in an “environment [that] is only IPv4”. While some of you might scratch your heads “what IPv6 threats could there be in an IPv4 setting?” I’m tempted to scratch my head: “what could be the reasons to run an university network without IPv6 these days, or to use BIND?” (which I have a strong opinion on, see here or here). But I disgress. More seriously the main reason for the question can be broken down to:

Offensivecon 2019

Wed, 20 Feb 2019 00:00:00 +0000

Hi,

Last week I had the pleasure to attend Offensivecon 2019 in Berlin. The conference was organized very well, and I liked the familial atmosphere which allowed to meet lots of different people. Thanks to the organizers, speakers and everyone else involved for this conference! Andreas posted a one tweet tldr of the first day; fuzzing is still the way to go to find bugs, and mitigations make exploitation harder. Here are some short summaries of the talks I enjoyed.

Some Notes on the IPv6 Properties of the Wireless Network @ Cisco Live Europe

Sun, 03 Feb 2019 00:00:00 +0000

Some years ago Christopher wrote two posts (2016, 2015) about the IPv6-related characteristics of the WiFi network at Cisco Live Europe. To somewhat continue this tradition and for mere technical interest I had a look at some properties of this year’s setting.

There were two SSIDs of interest: a dual-stacked one (“CiscoLive2019”) and one with v6-only plus NAT64 (“CL-NAT64”). For some background on the underlying infrastructure components you might look at this thread by Nicolas Darchis from the NOC or at this tweet from Dominik Pickhardt. Some stats on IPv6 usage at CLEUR can be found here.

TelcoSecDay 2019 – First talks preview

Tue, 29 Jan 2019 00:00:00 +0000

This year we had some excellent submissions for TelcoSecDay. Here are the first four confirmed speakers who are going to talk about the below mentioned topics:

1. Telecom protocols revisited – Not just a signalling problem – by Fredrik Söderlund

A look at the design of the currently deployed signalling protocols for core networks, both SS7 and Diameter (legacy and LTE). Peculiar quirks and how the design has lead to the industry sometimes failing to adhere to its own standards.

2019 – Year Of The Blue Dog…

Mon, 28 Jan 2019 00:00:00 +0000

Back from Holidays, you started the year well motivated to make the world a safer place.
However, sitting at your desk today you realize nothing really changed since last year, and you are surfing the web, feeling a bit blue, trying to avoid that pile of emails waiting for you and wondering how you could gain some visibility on your domain in order to better defend it.
No worries, emails can wait a bit longer. All you need is some fresh air and something cool to keep your defensive mind motivated for the year, and I might have just what you need; so put on your shoes and let me take you on a 15 minute Cypher walk with a cool blue dog…

#TR19 Active Directory Security Track

Wed, 23 Jan 2019 00:00:00 +0000

As some of you might recall we’ve introduced a dedicated “Active Directory Security Track” at last year’s Troopers. For Troopers19 we’ve expanded it to two days (as the SAP Security Track was discontinued), and in the following I’ll provide a list of talks in the track.

Vincent Le Toux: You “try” to detect mimikatz

Abstract: This is 2019 and you still “try” to detect mimikatz. “Try”, because after many years, this post exploitation tool continues to be successful.
As a contributor to mimikatz and also a blue team guy, I’m asking myself why antivirus vendors are unable to catch it after many years.
How can a tool be blocked if nobody does not know what this tool is doing? Because surprisingly, it is known only for credential collection but mimikatz is a lot more.
To mitigate the lack of antivirus vendor, should we buy new fancy EDR tool or try a technical approach? Apply a Framework? Rely on Compliance? Use a SIEM to collect logs and apply correlation? In sumarry, can we detect mimikatz?
In this presentation we will try to understand why mimikatz has such power and especially some weakness related to credential gathering and active directory will be exposed.

TROOPERS19 Training Teaser: Hacking mobile applications

Wed, 16 Jan 2019 00:00:00 +0000

“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process our bank transactions, handle our private data and set us up on romantic dates. However, few of us care to wonder,”How (in)secure can these apps be?” Well… at Troopers 19, you can learn how to answer this question yourself!

In our 2 day long “Hacking mobile applications” workshop, we teach how to find security vulnerabilities in mobile apps, exploit them and defend against them. We start from scratch, therefore no prior experience in hacking or developing mobile apps is required. Whether you want to learn how to pentest mobile apps, you are an app developer that fancies to secure his/her apps, or just curios, our workshop is a jumpstart to your goal.

TROOPERS19 Training Teaser: Insight Into Windows Internals

Tue, 15 Jan 2019 00:00:00 +0000

in-depth studies of undocumented, or poorly documented, system functionalities;
development of performant and compatible software to monitor or extend the activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.

The “Insight into Windows Internals” training offered at TROOPERS’19 delivers knowledge on the core components and inner working principles of Windows 10. For example, the training provides knowledge on how Windows 10 uses virtualization to isolate security-critical functionalities from attackers that have managed to compromise the system. The training includes a variety of practical exercises allowing attendees to observe first-hand the operation of Windows 10.

TROOPERS19 Training Teaser: Hacking 101

Mon, 14 Jan 2019 00:00:00 +0000

Hi there,
like in recent years the popular Hacking 101 workshop will take place on TROOPERS19, too! The workshop will give you an insight into the hacking techniques required for penetration testing. These techniques will cover various topics:

Information gathering
Network scanning
Web application hacking
Low-level exploitation

…and more!

TROOPERS19 Training Teaser: Windows & Linux Binary Exploitation

Mon, 14 Jan 2019 00:00:00 +0000

Once again Troopers will have its Windows & Linux Binary Exploitation workshop. Its main focus are the ever-present stack-based buffer overflows still found in software today (e.g. CVE-2018-5002, CVE-2018-1459, and CVE-2018-12897) and their differences with regard to exploitation on Windows and Linux systems. If you ever wanted to know the details of the exploit development process for these systems then this workshop is for you.

After initial exercises involving the exploitation of classic stack-based buffer overflows, modern defense mechanism such as Stack Cookies, DEP, and ASLR are presented and analyzed for weaknesses. The participants will learn how these defense mechanisms can be bypassed and will develop exploits targeting real world applications such as the Foxit Reader Plugin for Firefox, Wireshark, and nginx.

TROOPERS19 Training Teaser: Hardening Microsoft Environments

Fri, 11 Jan 2019 00:00:00 +0000

“Credential Theft” or “Credential Reuse” attack techniques are the biggest known threats to Active Directory environments. This can be attributed to significant advances in and broad distribution of attack and reconnaissance tools such as mimikatz or Bloodhound. This means that after the first system in an environment is compromised it often takes less than 48 hours for a complete compromise of an Active Directory but unfortunately typically 8 to 9 months until the attack is discovered.

IPv6 Talks & Publications

Thu, 10 Jan 2019 00:00:00 +0000

At first a very happy new year to everybody!

While thinking about the agenda of the upcoming Troopers NGI IPv6 Track I realized that quite a lot of IPv6-related topics have been covered in the last years by various IPv6 practitioners (like my colleague Christopher Werny) or researchers (like my friend Antonios Atlasis). In a kind of shameless self plug I then decided to put together of list of IPv6 talks I myself gave at several occasions and of publications I (co-) authored. Please find this list below (sorted by years); you can click on the titles to access the respective documents/sources.
I hope some of this can be of help for one or the other among you in the course of your own IPv6 efforts.
Cheers,

macOS Mojave Hardening Guide

Thu, 10 Jan 2019 00:00:00 +0000

Due to the new release of macOS Mojave in September we updated the El Capitan hardening guide.

The hardening guide received a little revamp on some chapters which are now obsolete or had to be changed due to the new features of macOS Mojave. Further, the hardening guide got extended for the new privacy features in macOS Mojave.

You can check it out here. We hope some of you might find it helpful.
Cheers,
Birk

Secure CI/CD Pipelines @Troopers ’19

Thu, 10 Jan 2019 00:00:00 +0000

In the last couple of months we participated in an increasing count of customer projects following current trends of agile software development approaches and corresponding toolstacks. Especially the terms Continuous Integration and Continuous Delivery kept (and still keep) popping up on every corner. The frameworks and processes behind those two hypes aid developing software at higher quality in shorter release cycles. This is especially relevant since end consumers nowadays expect fast releases including the newest features. If companies neglect this demand, competitors might take advantage of their better time-to-market which might result in increased market share and -dominance. A lot of changes are happening in the space of CI/CD. Existing tools become more mature, gaining increased attention, and new ones are appearing every month including better ways of integrating them into existing or new processes. Companies benefit from more choices, increased flexibility, and faster integration into existing company policies.

35C3: Refreshing Memories

Mon, 07 Jan 2019 00:00:00 +0000

Hello fellow Troopers and Happy new Year!

35C3 is over, and the recordings are available so in case you did not have the chance or the time to watch the live streams during the holidays or overwhelmed with the number of talks, see in the following a list of recommended talks to fill your evenings or weekends. Apart from the broad coverage of topics in different areas (Ethics, Society & Politics, Hardware & Making, Resilience, Art and Culture, Security, Science, Resilience), foundation talks were aiming for the very basics following this year’s motto “Refreshing Memories.”

Blackhoodie at TROOPERS19

Fri, 04 Jan 2019 00:00:00 +0000

We are going to have a Blackhoodie event at Troopers 2019 on March 18th and 19th in Heidelberg. With a very exciting event last year, we have decided to roll it once again during Troopers.

As always, one of the main motivation for Blackhoodie is bringing more women into reversing and other core security topics. So we would like to see more women apply to the training slots. However, if you are not a women and still feel really excited about Blackhoodie, you are welcome to apply. We do have a very limited number of seats at this training site. So we apologize in advance if we can’t accommodate everyone, even though we wish we could! Please apply before “February 10th” and we will contact you regarding next steps.

Catching fire with Docker, DevOps & Security in Enterprise Environments

Fri, 04 Jan 2019 00:00:00 +0000

Docker has become the go-to technology in enterprise- and DevOps contexts. Yet, before mastering a skill, there is the thumb rule: one must learn the basics to have solid fundament before building a house on top.

Simon and I start from the very beginning. We introduce you to the fundamental concepts of containers starting at process isolation and extending our tour to the whole ecosystem of Docker and further associated technologies. We will cover Docker, microservices, containers, DevOps, continuous integration/deployment/delivery – all those fancy buzzwords that can be read in the context of modern software development methodologies.

Motivational Aspects and Privacy Concerns on Wearables in the German Running Community

Fri, 14 Dec 2018 00:00:00 +0000

Today I am proud to announce that another paper of my former colleagues from Heilbronn University and me was published in one of the journals with the highest impact factor for Medical Informatics research called JMIR mHealth and uHealth. There is a reason why we published in this journal besides its informatics focus. The journal is an open access journal. That means that readers are not charged on a pay-per-view basis or other business models to access the full text of the paper. In return, the authors need to pay publication fees. In my opinion restricting access to academic research is not a way to go. I think this isn’t a thing we see in the security community often anyway. But this is and was the standard in academia for years.

ERNW Whitepaper 67: Active Directory Trust Considerations

Tue, 11 Dec 2018 00:00:00 +0000

Last week Will “harmj0y” Schroeder published an excellent technical article titled “Not A Security Boundary: Breaking Forest Trusts” in which he lays out how a highly critical security compromise can be achieved across a forest boundary, resulting from a combination of default AD (security) settings and a novel attack method. His post is a follow-up to the DerbyCon talk “The Unintended Risks of Trusting Active Directory” which he had given together with Lee Christensen and Matt Nelson at DerbyCon (video here). They will also discuss this at the upcoming Troopers Active Directory Security Track (details on some more talks, including Sean Metcalf’s one, can be found in this post or this one).

And Five Talks More Were Accepted at TROOPERS19!

Mon, 10 Dec 2018 00:00:00 +0000

And five talks more were chosen for TROOPERS19! It sounds like it is going to be the best year ever again…

Follow us on Twitter (@WEareTROOPERS) for more information and do not hesitate to use our hashtag #TR19 when you have questions or remarks about TROOPERS19!

Your TROOPERS Team

——————————–

Not A Security Boundary: Breaking Forest Trusts by Will Schroeder, Lee Christensen

Presenting at the Active Directory Security Track

Abstract:

DirectoryRanger 1.1.0 Introduces Informational Audit Checks

Mon, 03 Dec 2018 00:00:00 +0000

With version 1.1.0 our tool DirectoryRanger introduces a new feature: informational audit checks. These checks do not have a severity rating because they are just “for your information” and the included information might or might not contain security issues, depending on other facts. But these checks can help to reduce your Active Directory attack surface by pointing you to some aspects which need your attention and at least require to be discussed and documented (and they might also imply governance measures like a risk acceptance).

First Talks of TROOPERS19 Accepted!

Thu, 29 Nov 2018 00:00:00 +0000

TROOPERS18 was the best year ever (did you check our archives?) and it will be challenging to do better… However, we accept the challenge!

The trainings and talks were from high quality and choices were difficult to make… We hope you will enjoy reading these little teasers!

Follow us on Twitter (@WEareTROOPERS) for more information and do not hesitate to use our hashtag #TR19 when you have questions or remarks about TROOPERS19!

On the insecurity of math.random and it’s siblings

Thu, 29 Nov 2018 00:00:00 +0000

During code reviews we often see developers using weak RNGs like math.random() to generate cryptographic secrets. We think it is commonly known that weak random number generators (RNG) must not be used for any kind of secret and recommend using secure alternatives. I explicitly did not state a specific language yet, because basically every language offers both weak and strong RNGs.

So I asked myself: What if I use a weak RNG to generate a secret? Is it possible to recover the secret from some derived value, like a hash?

Plume Twitter Client URL Spoofing

Fri, 23 Nov 2018 00:00:00 +0000

It is possible to spoof the URLs that Plume will open to arbitrary locations because of how Plume parses URLs. The preview of an URL in a tweet will show the complete (at least the host name and the first few chars of the URL) but shortened URL. However, if the URL contains a semicolon (;) the URL that will be opened is the part after the semicolon.

An attacker can make use of this behavior by specifying a URL like the following in a Tweet or direct message:

Pidgin, Word Documents, my Clipboard and I

Mon, 19 Nov 2018 00:00:00 +0000

Lately, I’ve experienced some weird Pidgin crashes when I was copy&pasting into chat windows. The strange part was: I didn’t even know what triggered the crash because I actually didn’t know what was in my clipboard at this exact point. This is a quick write-up of how I investigated the issue and some interesting properties I found out about clipboards.

Everything started with a document that I was editing in a Windows VM in Microsoft Word. At some point, I wanted to copy some lines of the document and paste it into a Pidgin chat window on my Linux host system. As I did this, I noticed that when I pasted the data into the chat window it included a lot of white spaces. I thought something went wrong and just tried to delete it by pressing CTRL+A (to mark everything) and press BACKSPACE. But this caused Pidgin (2.13.0-5 on Arch Linux) to close with a segfault and created a core dump.

The Dog Whisperer’s Handbook

Mon, 19 Nov 2018 00:00:00 +0000

Generally speaking, I’m more of a Cat type of guy, but I have to say I really love BloodHound. And if you do too, you are in for a treat…
Last week, the ERNW Insight Active Directory Security Summit took place in Heidelberg. (More Info)
For this occasion, @Enno_Insinuator asked me if I would like to deliver a BloodHound Workshop, and of course I accepted the challenge…

We had a full class, I had a blast training it, and I hope the trainees enjoyed it as much as I did.
But that’s not all…
Another part of the deal was that I had to write a Training Guide that we would then share with the Community (aka you).
So here it is, fresh from the Heidelberg press and available for download:

Active Directory Security Summit 2018 – Slides Online

Fri, 16 Nov 2018 00:00:00 +0000

on Tuesday, 13.th of November we realized our second AD security summit with the title: “Active Directory Security: On-Prem-Security, Secure Extension into the Cloud & Secure Operations” in Heidelberg. First, we had three talks: the first one about “Active Directory Core Security Principles & Best Practices” covering hybrid AD and AD Trusts as well (by Friedwart Kuhn & Heinrich Wiederkehr from ERNW), the second one a case study about the implementation of an ESAE Forest in a big insurance company (by Fabian Böhm from Teal Technology Consulting) and the third one about a case study with respect to the (security) challenges of a hybrid AD (by Raphael Rojas from STIHL). The afternoon passed quickly with a very fruitful and vivid discussion about implementing and operating securely ESAE environments and hybrid ADs and how to deal with the high number of AD Trusts many organisations suffer from. Today we published the slides. Enjoy and stay tuned!

Dumping Decrypted Documents from a North Korean PDF Reader

Fri, 16 Nov 2018 00:00:00 +0000

This is a write-up about how to use Frida to dump documents from a process after they have been loaded and decrypted. It’s a generic and very effective approach demonstrated on a piece of software from North Korea.

Some time ago we received an ISO file which was a dump of a CD-ROM from North Korea. The only information we got was that it included a document viewer and various PDF documents. I started to dump the content of the ISO in order to analyze what the reader was actually doing by mounting it:

Multiple Vulnerabilities in Nexus Repository Manager

Wed, 14 Nov 2018 00:00:00 +0000

Recently, we identified security issues in the Nexus Repository Manager software developed by Sonatype. The tested versions were OSS 3.12.1-01 and OSS 3.13.1-01.

The following issues could be identified:

Multiple Cross-Site Scripting (CVE-2018-16619)
Missing Access Controls (CVE-2018-16620)
Java Expression Language Injection (CVE-2018-16621)

The vulnerabilities are fixed in version 3.14.0. See the release notes and security advisories for further information.

We identified a Java Expression Language Injection in the role and user creation function. In order to exploit this issue, the attacker needs to be authenticated with high privileges, the standard anonymous user is not sufficient.

Hack.lu 2018: Back and forth with the ERNW Crew

Tue, 13 Nov 2018 00:00:00 +0000

If a conference feels like a great vacation, then the organizers are doing it absolutely right! Hack.lu took place for the 14th time in Luxembourg. From the 16th – 18th October, the Alvisse Parc Hotel hosted the Hack.lu conference. Those three days were full of talks, workshops and “discussions about computer security, privacy, information technology and its cultural/technical implication on society“. Some members of the ERNW crew had the chance to attend Hack.lu this year and we all enjoyed it a lot!

Hack.lu 2018: Fuzzing Workshop by René Freingruber

Tue, 06 Nov 2018 00:00:00 +0000

I was at the hack.lu conference in Luxembourg this year and attended the fuzzing workshop, held by René Freingruber from SEC Consult. I have been curious about this topic for some years now, but besides doing some manual fuzzing and web-fuzzing, I never looked into the whole topic that much.

The workshop lasted for around four hours. Before the workshop started each student got two VMs (Linux/Windows) where everything necessary was already set up. The VMs included 23 exercises, with step-by-step explanations, source code and exploits. René started out with an introduction to fuzzing, listing popular fuzzers and showing an example on how to fuzz with afl.

H2HC2018 – Attacking VMware NSX

Fri, 02 Nov 2018 00:00:00 +0000

Matthias and I had the pleasure to give a talk at the H2HC2018 in São Paulo, Brazil about attacking VMware NSX. The talk is an introduction to VMware NSX for security researchers, and it discusses possible attack vectors including the management, controlling, and data exchange planes. We demonstrated how to prepare a fuzzing and debugging setup for the ESXi kernel and the kernel modules. It should be noted that Olli was also supporting the research.
The slides can be found here.

Hack.lu 2018: ARM IoT Firmware Emulation Workshop by Saumil Udayan Shah

Wed, 24 Oct 2018 00:00:00 +0000

First day at hack.lu. Three of us kicked the conference off with the ARM IoT Firmware Emulation workshop by Saumil. The goal of this workshop was not so much to write exploits or to pwn boxes but to learn how to build a beneficial research environment by emulating the hardware of a Linux based IoT device to run its firmware in order to run analysis and tests.

First step is to obtain the firmware. This could be done by dumping it directly from the device or by downloading firmware images from the vendor. In order to dump the firmware from the device one has to obtain access to the underlying system which is usually done by finding the serial console on the hardware since this one often exposes an unauthenticated root shell. I think there is enough documentation online on how to identify and connect to a serial console so I won’t cover the details here. It’s also covered in Saumil’s slides in detail. Having the bootup logs from this console will be helpful later though. While talking about baud rates for the serial console Saumil made a great pun I don’t want to withhold: “Most common is baud rate 115200. If you find a console with baud rate 9600 you are in fact talking to an acoustic coupler. That’s not an IoT device, it rather belongs to a museum.”

Comparison of our tool afro (APFS file recovery) with Blackbag Blacklight and Sleuthkit

Thu, 18 Oct 2018 00:00:00 +0000

At this years ARES conference, Jonas Plum (Siemens) and me (Andreas Dewald, ERNW Research GmbH) published a paper about the forensic analysis of APFS, file system internals and presented different methodologies for file recovery. We also publicly released a tool implementing our presented approaches, called afro (APFS file recovery).

APFS is the file system for Apple devices that is used by default on all current iOS mobile devices, as well as macOS since High Sierra, and is thus currently rolled out on a large number of devices. By using afro, we evaluated and compared the different approaches amongst each other and identified the method that so far delivers the best results and compared it to photorec. This showed that AFRO outperforms photorec on the evaluated APFS dataset. In the presentations of this research we were often asked if other tools like Blackbags Blacklight do not already support this recovery process. So, we decided to compare the file recovery capabilities of BlackLight and afro. We wanted to compare afro to the sleuth kit as well, as at the DFRWS conference it was discussed about adding APFS Support to The Sleuthkit Framework, but no implementations are public yet.

Multiple Vulnerabilities in UNIFY OpenScape Desk Phone CP600

Fri, 12 Oct 2018 00:00:00 +0000

We recently identified security issues in the UNIFY OpenScape Desk Phone CP600 HFA software. We disclosed the vulnerabilities to Unify, as a fix is now provided we want to give a brief overview of the vulnerability affecting the web interface.

We were able to identify the following vulnerabilities in the Web interface of the telephone:

Command Injection in Picture Delete function of OpenScape Desk Phone Webportal
Unauthenticated Arbitrary File Access in the OpenScape Desk Phone Webportal
Memory Corruption in the OpenScape Desk Phone Webservice
Missing Hardening of the OpenScape Desk Phone Webservice Binary
Cross Site Request Forgery Missing in the OpenScape Desk Phone Webservice

Incident Analysis and Digital Forensics Summit 2018, 14th of November of 2018

Mon, 08 Oct 2018 00:00:00 +0000

*This event will be held in German*

Inspiriert durch die erfolgreichen Round-Table-Diskussionen der Troopers-Konferenz freuen wir uns, Ihnen heute mit dem Incident Analysis and Digital Forensics Summit 2018, eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einem Eröffnungsvortrag von Thomas Schreck (Chairman of the Board des internationalen CERT Verbunds FIRST), gefolgt von Fallstudien und Vorträgen durch weitere Referenten aus der Industrie und Strafverfolgung.

Vulnerabilities in Sitefinity WCMS – A Success Story of a Responsible Disclosure Process

Mon, 08 Oct 2018 00:00:00 +0000

Preface

For those who never heard of Sitefinity before, it is an ASP.NET-based Web Content Management System (WCMS), which is used to deploy and manage applications as other CMS‘s do. A bitter quick glance at Sitefinity and its advantages can be found in this overview.

Delving into the core of this blog post, recently I had the opportunity to look at Sitefinity WCMS in which I found two reflected Cross Site Scripting (XSS) (CVE-2018-17053 and CVE-2018-17056), a* stored XSS* (CVE-2018-17054) and an arbitrary file upload (CVE-2018-17055) vulnerabilities.

Spraying arbitrary objects into the non-paged pool

Wed, 03 Oct 2018 00:00:00 +0000

Recently, I had some time to play around with HEVD [1], an extremly vulnerable Windows driver available for 32-bit and 64-bit systems.

Since exploits for all vulnerabilities of the 32-bit variant are publically available, I was wondering why this is not the case for the 64-bit version, especially for the pool corruption and UAF vulnerabilities.

After digging around a bit, it turned out that the reason is the following. HEVD uses a “special” sized object which is improperly handled such that a Use-After-Free vulnerability arises.

Active Directory Security Summit 2018, 13th. of November of 2018

Mon, 03 Sep 2018 00:00:00 +0000

I have the pleasure to announce the Active Directory Security Summit 2018 at 13^(th). of November of 2018. The summit covers current Active Directory security related topics such as challenging tasks of hybrid Active Directory operations as well as new security best practices and some ‘evergreens’ – Admin Tiering implementations (what about Exchange and DNS…??), ESAE operations etc. 😉

The primary objective of the Active Directory Security Summit is to bring experts together:

nmap-parse-output: A tool for analyzing Nmap scans

Fri, 24 Aug 2018 00:00:00 +0000

tl;dr: With the tool nmap-parse-output you can convert, manipulate or extract data from a Nmap/masscan scan output. This allows you to get the information you’re looking for by just entering a straightforward command.

Preamble

A while ago, we had to scan a mass amount of IPs within a project for a customer. While it’s feasible to read the whole output of a Nmap scan if you have just a few alive hosts, this was not possible anymore for this mass amount of systems. We’ve started with a masscan to scan all 2^16 ports of the IP ranges and wanted to perform a more precise analysis of the alive hosts (which had responded to at least one SYN packet) with Nmap. The result of this scan grew to nearly a hundred megabyte and we now had to do an analysis of which ports we had to look deeper into and which are intended to be open.

A few notes on WordPress Security

Wed, 22 Aug 2018 00:00:00 +0000

Taking a look at the CVE List for WordPress, most vulnerabilities aren’t found within the WordPress core but inside of third-party plugins and themes.

Today, let’s talk about WordPress.

Performing a WordPress assessment might seem boring at first as core functionality [tested] and configuration does not allow for extensive security misconfigurations. Luckily, most instances use plugins and themes to add features not offered by the WordPress core.

In this blog post I would like to discuss the findings and how I discovered them. Also, I will describe different vendor responsiveness reaching from not responding at all, to not understanding the issue to fast and professional responses kindly asking for a review of the updated code ready for deployment.

IPython Support for Binary Ninja

Fri, 17 Aug 2018 00:00:00 +0000

This blogpost is about the release of a plugin for Binary Ninja that allows you to run a Python Kernel inside the Binary Ninja GUI environment to which you can attach a Jupyer (QT) console, formerly known as IPython shell. The first section is about why this is useful, the second is about some issues I encountered and how to solve them, and the third contains everything you need to know to set it up.

dizzy version 2.0 released

Fri, 03 Aug 2018 00:00:00 +0000

A new major version of our fuzzing framework dizzy has been released.

This blog post will cover the biggest changes and new features, as well as give you a short introduction into how to use them.

You can find the new version on github.

Installation

There are two supported ways of installing dizzy:

via pypi
$ pip install dizzy
via setup.py
$ git clone https://https://github.com/ernw/dizzy && cd dizzy && python setup.py install

Diversity, Community, Blackhoodie

Thu, 26 Jul 2018 00:00:00 +0000

Gender equality in the Infosec world as a topic of discussion comes with a lot of heated arguments and differences in opinion.
So let me start with some disclaimers on the target audience for this post. If you are in the category who believes everything about gender is perfect in the infosec world, this post is not for you. If you are in the category who believes gender and bringing diversity is not your area of interest, then this post is not for you either. There are so many interesting problems that the world offers you. Climate change, poverty, diseases, unemployment, addiction, science problems and what not. Everybody has the freedom to choose their area of interest and contribute towards it. If you are in the category who thinks gender equality in infosec needs some attention and would like to explore more on the topic without prejudices, then this post may be interesting to you.

A little KeePass Mea Culpa…

Mon, 23 Jul 2018 00:00:00 +0000

Some weeks ago, I tweeted about grabbing clipboard content from KeePass with some PowerShell. From some reactions to this tweet, and after reading it a couple of times again, I realize it was sending the wrong message, and I would like to take a bit more than 280 chars to clarify what I meant when I posted that tweet…

TLDR: Password managers are a must, not using one exposes you to far more risks than using one. Do it.

PoSh_ATTCK – ATT&CK Knowledge at your PowerShell Fingertips…

Sat, 07 Jul 2018 00:00:00 +0000

When I recently joined the Windows Security team at ERNW, Enno asked me if I wanted to write a ‘welcome’ blogpost on a topic of my choosing… Up for the challenge, and since I had been playing with BloodHound & Cypher for the last couple of months, I first thought I would do something on that topic.

However, after gathering my thoughts and some Cypher I had collected here and there, I realized that the topic of Bloodhound Cypher might actually require several blog posts… And so I changed my mind. I will keep the joys of Cypher for later, and in this post, I will talk about a tiny tool I wrote to query the Mitre ATT&CK™ knowledge base from the comfort of a PowerShell prompt.

The building IoT 2018 in Cologne

Mon, 18 Jun 2018 00:00:00 +0000

In Mai 2018, Tobias and me were in Cologne at the Building IoT conference. The topics of the talks covered a broad spectrum of the Internet of Things field. There were three tracks covering different topics ranging from the jungle of IoT protocols, secure Linux hypervisors specially developed for IoT modules to machine learning and blockchain.

In “How to secure over the air updates” the speaker showed how to securely deploy updates over the standard communication channel to the target device. Many consumer IoT devices have a short support for updates if they get any updates at all. This leads and in the future will lead to bad news like botnets, bricked devices and exploited IP cameras streaming publicly. Therefore, a patch and vulnerability management is required – especially in industrial Internet of Things devices. Some updates have to be performed over the air due to the physical inaccessibility of some IoT devices in production environments. There are two possibilities to update such systems: First, a rescue OS (Operating System) boots and overwrites the existing production OS. The second option is a redundant OS, which copies the updates to the inactive OS and reboots to that.

Modern Application Stacks & Security

Fri, 15 Jun 2018 00:00:00 +0000

I had the pleasure to give a presentation at the Security Interest Group Switzerland Technology Conference about modern application stacks and how they can be used to improve infrastructure and application security posture – the slides can be found here. Besides seeing a lot of old friends, I particularly enjoyed a round table discussion on security integration into CI/CD pipelines. There was a relevant exchange on approaches that actually work and were tested in environments beyond just recommending some container scanner (product). One participant had an interesting case study on how they enabled developers to maintain WAF policies in configuration files in their code repository including automated deployment to the WAF. He also emphasized that the environments with actual security benefits resulted from a close cooperation between development and security team (were domain knowledge was combined 😉 ).

New Release of Glibc Heap Analysis Plugins

Wed, 06 Jun 2018 00:00:00 +0000

After quite some time and work, I’m happy to announce the new release of the Linux Heap Analysis Plugins, which are now part of the Rekall project, but not yet part of an official Rekall release, so you have to grab them manually.
This release fixes several bugs and adds the following features:

Support for Glibc version 2.26 (tcache chunks) and 2.27
Heapsearch now includes Rekall’s yara scan functionality
x86 Glibc versions with a modified MALLOC_ALIGNMENT value of 16 (as done in arch’s glibc package 2.26) are now supported
Improved retrieval of main_arena and new automated retrieval of malloc_par struct; so for the majority of cases, the corresponding cmd line options are not necessary anymore and hence no debug information have to be retrieved.
main_arena and malloc_par struct retrieval now also applies for statically linked binaries; there might however be cases, where it is necessary to specify the malloc_par struct offset and the used glibc version number

While Glibc version 2.27 does not really change much for the heap from a forensics point of view, version 2.26 introduced a new feature called tcache (per thread cache). Those caches are essentially just a new type of bin, holding freed chunks, but seem to improve the performance.
Sadly, only two days after its first commit, there was already a blog post explaining the functionality (not so sad 😉 ) and also some discovered vulnerabilities (here we go with the sad part).
Besides introducing a new landscape for attackers, this feature added two new heap management structs and one additional chunk per thread-heap (each thread has its own heap, up until an upper limit). This chunk is located at the beginning of each heap and hence, part of a raw heap dump (so be aware of that, if you are doing a raw analysis without the plugins).
The chunk holds the content of the tcache_perthread_struct, which has to members:

Security of Busch-Jaeger IP Gateway

Wed, 16 May 2018 00:00:00 +0000

IoT is everywhere right now and there are a lot of products out there. I have been looking at an IP Gateway lately and found some serious issues. The Busch-Welcome IP-Gateway from Busch-Jaeger is one of the devices that bridges the gap between sensors and actors in your smart home and the network/Internet. It enables the communication to a door control system that implements various smart home functions. The device itself is offering an HTTP service to configure it, which is protected by a username and password. Some folks even actually expose the device and its login to the Internet. I tried to configure one of these lately and stumbled upon some security issues that I would like to discuss in this blog post.

GI Sicherheit 2018 Conference

Thu, 03 May 2018 00:00:00 +0000

Last week (25^(th) – 27^(th) April), I attended the “Sicherheit 2018” in Konstanz which is the annual meeting of the security community of the Gesellschaft für Informatik e.V. (GI) in Germany. The conference is in equal proportions attended by researchers and people of the industry working in security-related disciplines which lead to lively and pleasant discussions conversations.

The topics discussed were contentual wide-reaching, so there were very technical talks like Sebastian Banescu who was the winner and one of two candidates nominated for the best PhD thesis award presenting about “Characterizing the Strength of Software Obfuscation Against Automated Attacks”, as well as conceptual presentations such as Sabrina Krausz elucidated her bachelor thesis about an integrated procedure model for planning and implementing an ISMS on the example of the pharmaceutical production.

TROOPERS18 Photos online!

Thu, 03 May 2018 00:00:00 +0000

We are very excited to publish some (more to come!) of our photos from TROOPERS18! Based on feedback from #TR18 we would also like to take a moment for our official TROOPERS photographer to introduce himself and tell you a little about what inspires him.

Peter Walter is a 37 year old photographer based in Germany near Stuttgart. For many years now he is the official TROOPERS photographer and very proud to be part of the Troopers family.

printf(“Hello World!”) Part 2

Mon, 30 Apr 2018 00:00:00 +0000

As our journey to the new product continues we are facing the typical challenges of phase 2 in the software development life cycle, the design phase (see part 1 for the overview of the phases):

Design and Components

The new tool will deal with Active Directory security so it has to integrate into large scale Windows based customer environments, which in turn makes the decision about the components quite easy ;-). We have chosen .NET as our primary development platform including key components from Microsoft to run our application, these components include the IIS and Microsoft SQL Express/Server and of course one Windows Server.

Reversing and Patching .NET Binaries with Embedded References

Mon, 30 Apr 2018 00:00:00 +0000

Lately I’ve been analyzing a .NET binary that was quite interesting. It was a portable binary that shipped without any third-party dependencies. I started looking at the .NET assembly with ILSpy and noticed that there was not that much code that ILSpy found and there were a lot of references to classes/methods that were neither in the classes identified by ILSpy nor were they part of the .NET framework.

At some point I was going through everything that ILSpy displayed about the binary, including the resources which were looking very interesting:

Industrial IoT Overview & Case Studies

Wed, 25 Apr 2018 00:00:00 +0000

Stefan and I had the pleasure of joining a one-day closed workshop on Industrial IoT Security. As always, we ended up with plenty of new research ideas and great contacts. We hope of course to post on follow-up research, but in this short post we quickly want to publish our slides which contain our input for the workshop. We mainly presented on IT security challenges for modern IIoT environments and presented some case studies for successful hardening/protection of IIoT environments as well as security in IIoT product development.

Yet Another Information Disclosure?

Tue, 24 Apr 2018 00:00:00 +0000

Hey there, for those of you that roll your eyes when writing the nth Information Disclosure Finding in a report, here is a short story of how such information helped compromising a system.

In a recent penetration we found a hidden debug page which disclosed information about internal parameters. Along with database connection strings and key material there was a username and a user home parameter disclosed on said debug page.

Security Advisory for VMware vRealize Automation Center

Fri, 13 Apr 2018 00:00:00 +0000

During a recent customer project we identified several vulnerabilities in the VMware vRealize Automation Center such as a DOM-based cross-site scripting and a missing renewal of session tokens during the login. The vulnerabilities have been disclosed to VMware on November 20th, 2017. A security advisory for the vulnerabilities has been made available here on April 12th, 2018.

Just a few words regarding the cross-site scripting vulnerability. This vulnerability is present within a GET request to the URL /vcac/gadgets/ifr because of certain URL parameters whose values are directly passed to an eval function call. The vulnerable parameters are gwt:onLoadErrorFn and gwt:onPropertyErrorFn. It seems that these parameters are actually never used by the application and we only found them by looking at the source code.

#TR18 Attack & Research Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Attack & Research Track.

Reverse Engineering Blackbox Systems with GreatFET & Facedancer by Kate Temkin and Dominic Spill

USB is everywhere, your phone, gaming consoles, IoT waffle irons, you name it. Due to its’ widespread use in everyday life it is typically trusted by the user. And even if one wanted to find out what’s happening behind the scenes, surely digging into USB communication is too much of a chore to be worth the hassle, right? This talk by Kate Temkin and Dominic Spill are about to prove that very wrong with an impressive display of their tools GreatFET and Facedancer.

#TR18 Defense & Management Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Defense & Management Track.

All Your Cloud Are Belong to Us

The talk “All Your Cloud Belong Are Belong to Us” was held by Nate Warfield, who is a Senior Security Program Manager for the Microsoft Security Response Center (MSRC).
Before Microsoft he worked as a network engineer about 18 years and 10 of this for a large amount of cell phone companies.
Nate gives an overview about the state of the cloud solution provided by Microsoft, Azure, and how he hunts vulnerabilities in this environment.
Finally he concludes that the giving up your infrastructure to the cloud doesn’t mean that you give up your responsibility.

#TR18 Next Generation Internet (NGI) Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 Next Generation Internet Event.

NGI Keynote by Graeme Neilson

Before his infosec career Graeme was a street performer, then security researcher, now he calls himself a defender. The talk was built around the following sentence: “The infosec industry and community have completely failed to create meaningful change in the behavior of people”.

The following example is a resume of how hacking worked from 1988 to 2017:

#TR18 SAP Security Summaries

Fri, 23 Mar 2018 00:00:00 +0000

This blogpost contains summaries of talks from this year’s TROOPERS18 SAP Security Track.

SAP IGS : The ‘vulnerable’ forgotten component by Yvan Genuer

The Internet Graphics Server (IGS) is used to generate Web Based graphics from the SAP Web AS. Yvan Genuer looked at the security of an ancient component with very few public vulnerabilities available so far. In his talk he gave us insights on the structure of the IGS, its services, and problems he had when looking for documentation of the IGS and its components.

#TR18 Active Directory Security Track, Part 1

Thu, 22 Mar 2018 00:00:00 +0000

This is the first post discussing talks of the Active Directory Security Track of this year’s Troopers which took place last week in Heidelberg (like in the last nine years ;-). It featured, amongst others, a new track focused on Microsoft AD and its security properties & implications. This was the agenda.

The idea for this special track was born out of two considerations:

we had noted there’s a lot of stuff going on in the space, both on the offense and on the defense side. And in pretty much every incident analysis & response project we were brought in recently Active Directory played a huge role…
already in the early phase of the CfP several interesting submissions came in (maybe due to the fact that some big guns of the field had voiced very kind words in the past)… and creating an extra track simply relieved us from the burden to make a tough choice between those.

As this was the first Troopers since its creation where I didn’t have any official roles and out of personal interest (in a very distant past I happened to be the co-author of the first German book on Windows NT4 Security) I decided to spend the majority of conference day 2 in the AD track. In hindsight I’m tempted to say that the track was a huge success: brilliant talks, pretty much always a packed room, and quite good discussions after the talks. (yes, of course I’m biased, what makes you think that?).

Squirrelmail Full Disclosure – TROOPERS18

Thu, 15 Mar 2018 00:00:00 +0000

Birk an me basically fully disclosed a 0day in Squirrelmail yesterday. This is a short Q&A to answer the most common questions about the issue to calm you all down a little bit. 😉

What is the punchline, what do I need to know?

An attacker able to exploit this vulnerability can extract files of the server the application is running on. This may include configuration files, log files and additionally all files that are readable for all users on the system. This issue is post-authentication. That means an attacker would need valid credentials for the application to log in or needs to exploit an additional vulnerability of which we are not aware of at this point of time.

The Hackers‘ Sanctuary City

Wed, 14 Mar 2018 00:00:00 +0000

https://youtu.be/wCMwTUS3k4c

TROOPERS has a long history of theming the conference every year. Usually we pick a surreal topic, a fun story which we think is worth to pick up on. Some of it starts as a crazy thought, others have been the result of long discussions. Most of them are online, only our master piece from 2016 is securely stored in the company’s vaults.

However, this year was different. Traveling across the globe, speaking at and attending other conferences, connecting with our peers and the community, we felt that 2017 was a particularly tough year for many of us, both professionally and personally. There was this doom and gloom baseline to it.

Auditing AWS Environments

Wed, 07 Mar 2018 00:00:00 +0000

Introduction

Related to our new TROOPERS workshop “Jump-Starting Public Cloud Security”, this post is going to describe some relevant components which need to be taken care of when constructing and auditing an Amazon Web Services (AWS) cloud environment. Those include amongst others the general AWS account structure, Identity and Access Management (IAM), Auditing and Logging (CloudTrail and CloudWatch), Virtual Private Cloud (VPC) networks, as well as S3 buckets.

The AWS IAM service is responsible for identity and access management (surprise!). This includes managing user accounts, defining password policies, and – most importantly – creating, defining, and assigning groups and roles.

TelcoSecDay 2018 – Talks Part2

Mon, 26 Feb 2018 00:00:00 +0000

We have the next set of selected talks being announced here. I am super excited about the variety of applications we had this year. Here are some of the talks we will have.

Title: From LoRa technology to deployment within Orange affiliates

Speakers: Franck L’Hereec and Albert Nguyen

Just deployed, the LoRa technology has already passed into the hands of hackers who have analyzed the LoRaWAN protocol as well as the objects and gateways that implement it. At Orange, Orange Labs’ security experts have therefore looked into those issues, first to understand it better, and also ensure the network’s deployment in optimal security conditions. Demonstration via the example of the treatment of the security of an innovation project by Orange. During the presentation we will present :

Creating Static Binaries for Nmap, Socat and other Tools

Fri, 23 Feb 2018 00:00:00 +0000

In various scenarios it might be helpful or even required to have a statically compiled version of Nmap available. This applies to e.g. scenarios where only limited user privileges are available and installing anything to the system might not be desirable.

For such cases I’ve started to create recipes to build such binaries. Similar projects are already available on GitHub, but there are several reasons why I chose to create my own tools:

printf(“Hello World!”)

Fri, 23 Feb 2018 00:00:00 +0000

ERNW has a new baby, so please say “hello” to the new ERNW SecTools GmbH ;-).
But why another ERNW company? Short answer: Because we want to contribute to changing the way how software is built today: insecure, focused on profit and sometimes made by people who ignore lessons from history. So how can we contribute in this space? Start changing it ;-).

Confucius said: “The man who moves a mountain begins by carrying away small stones” and that’s our way to go. It is not about building error free or unbreakable software, it is about changing the way how software is built today, about improving security and about raising the bar.

TLS in the Enterprise: Is Heartbleed still a Problem?

Fri, 16 Feb 2018 00:00:00 +0000

Our new workshop about TLS/SSL in the enterprise will be held for the 1st time at Troopers 2018. So I would like to take the opportunity and post a short teaser about stuff we will cover in this workshop.

TLS/SSL is a complicated topic especially in enterprise environments due to the fact, that

encrypted traffic should be inspected e.g. for malware
customers/users must be able to use important applications
crypto attacks are complex and sometimes considered to be only a problem in theory
the internal CERT wants to have every issue fixed, if feasible or not 😉
impact of configuration changes can not be foreseen
Software inventory is incomplete (do you want to make a bet that Heartbleed is fixed completely in your environment ;-)? )
… and so forth

In the workshop we will cover all these points, discuss them and share our experience regarding feasibility and useful mitigating controls. We will explain the most common SSL vulnerabilities/attacks, demonstrate tools to test (and sometimes to exploit) them, point out pitfalls and recommend what to do. Let us have a look at one example, Heartbleed:

Extracting data from an EMV (Chip-And-Pin) Card with NFC technology

Thu, 15 Feb 2018 00:00:00 +0000

This is a guest blog post by Salvador Mendoza.

During years, many different researches and attacks against digital and physical payment methods have been discussed. New security techniques and methodologies such as tokenization process attempts to reduce or prevent fraudulent transactions.

Extracting or capturing data from a transaction have been studied in different ways, and some of the most common techniques are skimming, wireless skimming, relay attacks, traffic sniffing or modifying a PoS(Point of Sale) system. In our talk, “NFC Payments: The Art of Relay & Replay Attacks” at TROOPERS18, we will discuss a new technique and methodology that malicious individuals could implement to extract data.

Get your hands dirty playing with RFID/NFC

Wed, 14 Feb 2018 00:00:00 +0000

This is a guest blog post by Nahuel Grisolia.

The first time I’ve heard about RFID was at high school, back in 2002, when I was studying Electronics. Back in that time, this technology was like some sort of black magic to me. A few years later in 2011, our government in Argentina decided to implement a “new technology” called NFC, designed as the new and only way of payment for the use of public transport. So, I decided to understand it better, play with it, and try some hacks I heard from the cool people of the CCC.

White Paper on Incident Analysis and Forensics in Docker Environments

Wed, 14 Feb 2018 00:00:00 +0000

In this article, we describe the impact of the increased use of Docker in corporate environments on forensic investigations and incident analysis. Even though Docker is being used more and more (Portworx, Inc., 2017), the implications of the changed runtime environment for forensic processes and tools have barely been considered. We describe the technological basics of Docker and, based on them, outline the differences that occur with respect to digital evidence and previously used methods for evidence acquisition. Specifically, we look at digital evidence within a Docker container which are lost or need to be acquired in different ways compared to a classical virtual machine, and what new traces and opportunities arise from Docker itself.

AndroTickler: Tickling Vulnerabilities out of Android Apps

Sat, 10 Feb 2018 00:00:00 +0000

If you attack someone, they will defend themselves, but if you tickle them, they will eventually crack open. This surprisingly applies to Android apps as well! Therefore, I created AndroTickler, not to test apps against certain attacks or examine them for specific vulnerabilities, which developers would learn to avoid. However, it helps pentesters to analyze and test apps in their own style, but in a faster, easier and more flexible way. AndroTickler is a Swiss-Army-Knife pentesting tool for Android apps. It provides information gathering, static and dynamic analysis features, and also automates actions that pentesters frequently do and highly need during their pentests. In addition, it makes use of the powerful Frida to hook to the app and manipulate it in real-time.

TelcoSecDay 2018 – CFP and First talks

Thu, 08 Feb 2018 00:00:00 +0000

We have a short update from the TelcoSecDay 2018 Agenda. But before that, a short reminder. The CFP for TelcoSecDay 2018 is still open. If you are into telco research, and if you have something interesting to talk, please make a submission here. The deadline is 17th February 2018.

Here are the first two confirmed speakers who are going to talk about the below mentioned topics:

Title: Data Security for 4G Interconnection and 5G Interconnection Risk Areas

Hacking 101 to mobile data

Tue, 06 Feb 2018 00:00:00 +0000

Here is a short blog post that explains how you can make your own Man-in-the-Middle (MitM) setup for sniffing the traffic between a SIM card and the backend server. This is** NOT a new research** but I hope this will help anyone who doesn’t have a telco background to get started to play with mobile data sniffing and fake base stations. This is applicable to many scenarios today as we have so many IoT devices with SIM cards in it that connects to the backend.
In this particular case, I am explaining the simplest scenario where the SIM card is working with 2G and GPRS. You can probably expect me with more articles with 3G, 4G MitM in future. But lets stick to 2G and GPRS for now.

Blackhoodie at TROOPERS18

Fri, 02 Feb 2018 00:00:00 +0000

We are thrilled to announce the Blackhoodie event at Troopers 2018 on March 12th and 13th in Heidelberg. This time it is going to be a 2 day workshop with various interesting topics related to reverse engineering. We will make sure that you get some hands on experience with reversing and more.

As always, one of the main motivation for Blackhoodie is bringing more women into reversing.
So we would like to see more women apply to the training slots. However, we are open to everyone who would like to apply. We do have a very limited number of seats at this training site. So we apologize in advance if we can’t accommodate everyone, even though we wish we could! Please apply before “February 20th” and we will contact you regarding next steps.

Virtualized Training Environment with Ansible

Fri, 02 Feb 2018 00:00:00 +0000

As Kai and I will be holding a TROOPERS workshop on automation with ansible, we needed a setup for the attendees to use ansible against virtual machines we set up with the necessary environment. The idea was, that every attendee has their own VMs to run ansible against, ideally including one to run ansible from, as we want to avoid setup or version incompatibilities if they set up their own ansible environment on their laptop. Also they should only be able to talk to their own machines, thus avoiding conflicts because of accidental usage of wrong IPs or host names but also simplify the setup for the users.

White Paper on Multi-Factor Authentication in Microsoft Windows Environments

Mon, 29 Jan 2018 00:00:00 +0000

A new ERNW whitepaper was just published. I wrote this whitepaper in the course of my bachelor thesis and it examines multi-factor authentication in Microsoft Windows environments:

Credential theft and the subsequent reuse of stolen credentials are a significant problem in today’s information security. To counter the associated risks, a planned approach is required as part of a comprehensive security architecture program. This includes the implementation of multi-factor authentication as an important building block. This whitepaper covers the relevant steps of implementing a multi-factor authentication system in an enterprise environment and closes with a security evaluation.

#TR18 Active Directory Security Track

Fri, 05 Jan 2018 00:00:00 +0000

A happy new year to everybody!

At Troopers18 there will be a new special track on Microsoft Active Directory and its security aspects, similar to the SAP security track which we established some years ago. The AD security track will feature, amongst others, the following talks.

Sean Metcalf: Active Directory Security. The Journey

Abstract: This talk is a journey into the challenges most organizations encounter while trying to secure their ‘castle’. The attacker has to be right only once, right? Not exactly. We will walk through effective security strategies that will stymie and frustrate attackers and better protect the Active Directory environment.

Yet another edition of BlackHoodie – #BlackHoodie17

Mon, 11 Dec 2017 00:00:00 +0000

I am amazed by how this years BlackHoodie unraveled. Three days that included a pre-conference of lightening talks and two parallel tracks with a total of 64 enthusiastic members. The very spirit of BlackHoodie is nothing other than the quest to gain deep knowledge. Reverse engineering is one of the hardest fields in security. It touches on all fields of computing, starting from assembly, programming, file formats, operating systems, networks and what not. This makes it hard but an extremely fulfilling experience to spend time learning it. For me, the very idea of staring at a binary till you understand what it does is a magical feeling.

Let’s talk about RFC 6980

Fri, 01 Dec 2017 00:00:00 +0000

Following my work with the FreeBSD implementation of RFC 6980 I was happy to present my work at last week’s DENOG 9 meeting.
To make it available to anyone who did not meet me there and go into some more detail that would have exceeded the boundaries of the talk, I will cover the topic here.

After the preceding work on Windows Server 2016 and the FreeBSD testing, as a Linux user, lover and administrator, I of course wanted to take a look at how different Linux systems complied with the RFC 6980 standard.

Announcing the first 5 talks of TROOPERS18!!!!

Wed, 29 Nov 2017 00:00:00 +0000

TROOPERS17 was unlike any TROOPERS we had known before. Everything just seemed bolder, better, and beyond our expectations. From surprise speakers like the grugq (do you have a follow-up talk for #TR18 by the way?) to new speakers who are now TROOPERS family, TROOPERS17 is one for the history books!

If you were there you might be wondering to yourself, how could they possibly top it (and if you were not there check out this video from TR17)? Well, I am not going to lie, it will be a challenge. However, the high quality of talk and training submissions for this year have us feeling pretty positive about making #TR18 the “best year ever”!

Why It Might Make Sense to Use IPv6 in Enterprise Infrastructure Projects

Fri, 10 Nov 2017 00:00:00 +0000

Looking at IPv6 deployment graphs like this one it becomes clear that IPv6 still is not widely deployed in enterprise space (the reason for the apparent oscillation in that curve is the difference between working days – where people use their office computers – and weekend where they preferably use their smartphones or their home equipment connected by means of broadband networks).

There’s a number of good reasons for this (in a nutshell: the overall IPv6 architecture is oriented around, and benefits, the decoupling of mostly autonomous, self-organized endpoints from a well-managed/provider-managed network infrastructure which isn’t exactly the operations model many large enterprise organizations have in mind for their networks. also you might have a look at these slides from RIPE74 to understand some of the reluctance to deploy IPv6 in certain companies).

My Journey to DockerCon Europe 2017

Thu, 09 Nov 2017 00:00:00 +0000

From October 17th – 19th I had the chance to attend my first DockerCon Europe 2017.

The conference was very well organized and attendee focused, which could be seen by the many little details found on the conference. For example you never ran out of coffee or beverages, there was a new Hallway Track where you could meet people from all disciplines, discuss about your favorite topics and there was always a place to sit and take a break between all those interesting presentations. I had the chance to speak to very nice people from different industries, most importantly in my case on the topic security. It was nice to see how the Docker community is growing and the adoption rate is increasing, especially in companies. The main focus of the conference (especially seen in talks held by people from Docker Inc.) was the Docker Enterprise Edition.

Interacting with the BlueCoat Filesystem

Thu, 26 Oct 2017 00:00:00 +0000

the last post was about a fuse filesystem which provides a read-only access to the proprietary bluecoat filesystem. After some further investigations based on the possibilities this offered us, I started to implement a tool which allows to modify parts of the filesystem.

Protection Mechanisms

Since last time, the discovered filesystem structures still had unknown fields. Some of those fields could be reconstructed and their purpose in the whole construct. The format of the Partition-Header for example could now be described as

Extract Non-Exportable Certificates and Evade Anti-Virus with Mimikatz and Powersploit

Fri, 20 Oct 2017 00:00:00 +0000

Some time ago, one of our customers contacted us with a special request. For some legitimate reason, they needed to centrally collect certain certificates including their private keys which were distributed across many client systems running Windows and stored in the corresponding user stores. Unfortunately (only in this case, but actually good from a security perspective), the particular private keys were marked non-exportable making a native export in the context of the user impossible. As if this wasn’t enough, the extraction was supposed to be executed in the context of the current user (i.e. without administrative privileges) while not triggering the existing Anti Virus solution at all. Also, the certificates needed to be transferred to some trusted system where they could not be accessed in an unauthorized way. So let’s have a look how we tackled these problems:

TROOPERS for Students!

Thu, 12 Oct 2017 00:00:00 +0000

We are super excited for TROOPERS18 (March 12-16th, 2018) as are many of you! We even have this great saying that “after TROOPERS is before TROOPERS”, which means we spend a lot of time looking through feedback from attendees, speakers/trainers, and our own Crew for ways to not only top what we’ve done in the years before, but also how to simply make it better for everyone involved. Looking around at our Crew we realized how many have either attended TROOPERS or other conferences as students. We heard from them, as well as other students, how life changing it was to be able, as a student, to attend an IT-Security conference. How they got to meet a speaker whose work they’d read about in class. How people felt even more a part of the community they were studying hard to belong to.

Position Paper on an Enterprise Organization’s IPv6 Address Strategy

Mon, 09 Oct 2017 00:00:00 +0000

A while ago I wrote a short paper laying out options for an enterprise organization to get global IPv6 address space from the RIPE NCC, discussing the advantages and disadvantages of different approaches. As I think the topic may be of interest for others, too, I’ve distilled an anonymized version. It can be found here. I hope some of you find it useful.

Cheers, Enno

Erlang distribution RCE and a cookie bruteforcer

Thu, 05 Oct 2017 00:00:00 +0000

In one of the last pentests we’ve found an epmd (Erlang port mapper daemon) listening on a target system (tcp/4369). It is used to coordinate distributed erlang instances, but also can lead to a RCE, given one knows the so called “authentication cookie”. Usually, this cookie is located in ~/.erlang.cookie and is generated by erlang at the first start. If not modified or set manually it is a random string [A:Z] with a length of 20 characters. If an attacker gains this cookie, a RCE is quite easy – as I like to describe below.

Reading the BlueCoat FileSystem

Thu, 05 Oct 2017 00:00:00 +0000

You may remember our last post regarding the SGOS system and the proprietary file system. Since then, we got access to a newer version of the system (6.6.4.2). Still not the most current one (which seems to be 6.7.1.1) nor of the 6.6.x branch (which seems to be 6.6.5.1) though. As this system version also used the same proprietary filesystem (although it initially booted from a FAT32 partition), I decided to take a deeper look into this.

Daycon X1

Wed, 04 Oct 2017 00:00:00 +0000

This is my short write up on Daycon X1, 2017. The summit was held at Dayton, the land where Wright brothers were born. Apart from being my first US trip, I also gave my first training on Hacking 101 also called the Bootcamp.

The Daycon X1 bootcamp started on 18th September. Ahmad, my colleague focused on web security, network scanning and metasploit exercises. I mainly handled classes on reversing and binary exploitation along with some pcap anaylsis and network attacks. It was highly fulfilling experience to give a workshop. Teaching is definitely the best way to learn any topic by digging deep into it.The simpler you can explain, the more clarity you have on the topic. But I must say that it was indeed exhausting by the end of three days.

RIPE IoT Roundtable Meeting / Balanced Security for IPv6 CPE Revisited

Fri, 29 Sep 2017 00:00:00 +0000

Last week I had the pleasure to participate at the first RIPE IoT Roundtable Meeting in Leeds (thanks! to Marco Hogewoning for organising it). It was a day with many fruitful discussions. I particularly enjoyed Robert Kisteleki‘s talk on RIPE NCC’s own design & (security) process considerations in the context of RIPE Atlas (at TR17 NGI there was an intro to Atlas, too).
In this post I’d like to quickly lay out the main points of my own contribution on “Balanced Security for IPv6 CPE Revisited” (the slides can be found here).

HITCON CMT 2017

Thu, 28 Sep 2017 00:00:00 +0000

Some of our Troopers had the chance to visit HITCON conference in Taiwan this year. There are two main events: HITCON Pacific, which is aimed more at corporate attendees and HITCON CMT, the community edition, which aims at students and the general Infosec community. HITCON is the biggest security conference in Taiwan.

The venue for the event is the Academia Sinica, one of the most important academic institution in the Republic of China and was founded in 1928 to promote and undertake scholarly research in sciences and humanities. The conference had three usual tracks and one special track that was free to use for the public for demos, presentations and discussions.

An Update of PenTesting Tools that (do not) Support IPv6

Tue, 19 Sep 2017 00:00:00 +0000

As you may remember, back in 2014 we published a whitepaper (compiled by Antonis Atlasis) on the support of IPv6 in different pentesting tools. This is almost three years ago and we thought it is time for an update. In short not much has changed. Most of the tools which didn’t support IPv6 are still not supporting it or haven’t got any update since then.
This post will cover the tools where we could identify some progress on supporting IPv6.

FireEye Security Bug: Connection to physical host and adjacent network possible during analysis in Live-Mode

Wed, 13 Sep 2017 00:00:00 +0000

We recently identified a security issue in FireEye AX 5400, that also affected other products. We responsibly disclosed the bug to FireEye and a fix that addresses the issue has been released with version 7.7.7. The fix was also merged into the common core and is available as 8.0.1 for other products (i.e. FireEye EX).

The related release notes can be found here:

FireEye announced to post a 2017 Q3 notice with credit to us, too.

DFRWS USA 2017

Wed, 06 Sep 2017 00:00:00 +0000

As mentioned in my last blogpost, I had the pleasure to participate in this years DFRWS USA and present our paper. The paper and presentation can be freely viewed and downloaded here or here. Note that there is also an extended version of the paper, which can be downloaded here.

The keepassx, zsh and heap analysis plugins are now also part of the Rekall release candidate 1.7.0RC1, so it’s easier to get started.

The conference had some great talks and workshops, which I’m going to briefly sum up.

11th USENIX Workshop on Offensive Technologies (WOOT17)

Wed, 16 Aug 2017 00:00:00 +0000

The 11th USENIX Workshop on Offensive Technologies (WOOT17) took place the last two days in Vancouver. Some colleagues and I had the chance to attend and enjoy the presentations of all accepted papers of this rather small, single-track co-located USENIX event. Unfortunately, the talks have not been recorded. However, all the papers should be available on the website. It’s worth taking a look at all of the papers, but these are some presentations that we’ve enjoyed:

Black Hat 20 & DEFCON 25

Wed, 09 Aug 2017 00:00:00 +0000

Some of the ERNW Crew hit up Black Hat USA and DEFCON. Our own Omar Eissa even gave his first BH and DEFCON talks! See which talk we liked and what inspiration we took home.

BlackHat US 20:

ERNW´s Omar Eissa presented on Cisco Autonomic networks showing how
slides: https://www.blackhat.com/docs/us-17/wednesday/us-17-Eissa-Network-Automation-Isn’t-Your-Safe-Haven-Protocol-Analysis-And-Vulnerabilities-Of-Autonomic-Network.pdf
insinuator blogposts:
https://insinuator.net/2017/03/autonomic-network-overview/
https://insinuator.net/2017/03/autonomic-network-analysis/
https://insinuator.net/2017/04/autonomic-network-vulnerabilities/

BoradPWN
– Speaker: Nitay Artenstein
– Slides: https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets.pdf
– Paper: https://www.blackhat.com/docs/us-17/thursday/us-17-Artenstein-Broadpwn-Remotely-Compromising-Android-And-iOS-Via-A-Bug-In-Broadcoms-Wifi-Chipsets-wp.pdf
– Broadly covered in main stream Media –> Wired article, tons of write-ups…link: https://www.wired.com/story/broadpwn-wi-fi-vulnerability-ios-android/
– Initial Blog Post: https://blog.exodusintel.com/2017/07/26/broadpwn/
– He took a deep dive into the internals of the BCM4354, 4358 and 4359 Wi-Fi chipsets and found an issue that he exploited to an extent where he created the world´s first wifi worm.
– This hits most of the mobiles users pretty hard. Affected devices are for example: Samsung Galaxy from S3 through S8, inclusive All Samsung Notes3. Nexus 5, 6, 6X and 6P, All iPhones after iPhone 5
– An infected device can be used to infect other mobile devices.
– Luckily currently there is no malware that is actively exploiting this issue.

A Life Without Vendors Binary Blobs

Mon, 07 Aug 2017 00:00:00 +0000

This blogpost will be about my first steps with coreboot and libreboot and a life with as few proprietary firmware blobs as possible. My main motivation were the latest headlines about fancy firmware things like Intel ME, Computrace and UEFI backdoors. This post is not intended to be about a as much as possible hardened system or about coreboot/libreboot being more secure, but rather to be able to look into every part of software running on that system if you want to.

IPv6 RA Flags, RDNSS and DHCPv6 Conflicting Configurations Revisited

Mon, 17 Jul 2017 00:00:00 +0000

As you may know, we published a whitepaper discussing the behavior of different operating systems once they receive IPv6 configuration parameters from different sources two years ago. At that time, the results were quite a mess. We were curious whether the situation is still so “dire” like two years ago. We fired up the lab, updated the tested operating systems and performed the tests again.

To summarize, at least in scenarios were only one router is involved, the results look way more consistent (even cross operating system) then two years ago. So we made progress on this front. Unfortunately, as soon as a second router is introduced into the segment it gets messy and the operating systems do show inconsistent behavior.

Release of Glibc Heap Analysis Plugins for Rekall

Thu, 13 Jul 2017 00:00:00 +0000

I’m happy to announce the release of several Glibc heap analysis plugins (for Linux), resp. plugins to gather information from keepassx and zsh, which are now included in the Rekall Memory Forensic Framework. This blogpost will demonstrate these plugins and explain how they can be used. More detailed information, including real world scenarios, will be released after the talk at this years DFRWS USA.

Before being able to reliably analyze the heap of a process, a profile, for the Glibc version being used, must be provided. However, this step should for most cases be fairly simple and only consist of gathering the offset for the mp_ and main_arena variables:

Local Packet Filtering with IPv6

Thu, 06 Jul 2017 00:00:00 +0000

Just recently we discussed IPv6 filter rules for NIC-level firewalls (in a virtualized data center) with a customer. I’d like to take this as an opportunity to lay out potential approaches for local packet filtering of IPv6, which in turn might somewhat depend on the address configuration strategy chosen for the respective systems (for the latter you may refer to this post or to this talk from the Troopers NGI event).

Some of this has already been discussed in RFC 4890 Recommendations for Filtering ICMPv6 Messages in Firewalls but that document is from 2007 and things may have changed in the interim.
Let’s start with a quick look at the traffic which might be of interest. We will take a server perspective here, read: which types of IPv6 traffic might have to be accepted by a host/NIC firewall in order to support proper operations? I will discuss the following, with a focus on the implications of filtering them locally:

Testing RFC 6980 Implementations of FreeBSD

Fri, 23 Jun 2017 00:00:00 +0000

Following Enno’s research on “Testing RFC 6980 Implementations with Chiron“, we decided to redo the experiment with FreeBSD targets.

The lab setup was very similar:

A Cisco Catalyst 3560 switch running the software “C3560c405ex-UNIVERSALK9-M” version 15.2(2)E4 connecting
A Linux based attacker system running Chiron and
A FreeBSD target system, running different OS versions and configurations and
A Linux based laptop running a control script that remotely performed the necessary tasks on the two machines mentioned above

The main question was: Would the impact on the target system and the possible attacks that were observed with the Windows Server 2016 victim be reproducible on other operating systems? Or would those behave totally differently?

17. Gulaschprogrammiernacht

Wed, 21 Jun 2017 00:00:00 +0000

Over one of the recent long weekends I attended the 17th “Gulaschprogrammiernacht”, or “GPN17” for short, in Karlsruhe, the largest CCC Event after the Chaos Communication Congress with roughly a thousand attendees. The name literally translates to “goulash programming night”, which makes about as much sense as the German version. Despite the name it lasted from Thursday to Sunday, had a much wider scope than just coding and offered various other (incl. vegan) dishes besides goulash. As an active member of the CCC community I planned on attending it anyway, but submitted my talk about Automated Binary Analysis in case there was interest. I didn’t anticipate that much interest given that it was a fairly theoretical IT-Security topic at an event that was not focused on IT-Security, but nonetheless the hall was filled with people from various backgrounds like math, formal verification and software optimization. The talk was an improved version of the one I gave at Bsides Ljubljana, incorporating feedback I received and new things I had learned since then. The English slides are available here, the recording of the talk in German can be found here.

GDPR and Pseudonymisation – Easing the Pain of Regulation

Wed, 21 Jun 2017 00:00:00 +0000

27 April 2016 marked a turning point for a lot of countries as well as a lot businesses worldwide: EU regulation 2016/679 (going by it’s more widely known name General Data Protection Regulation and abbreviated GDPR) was adopted by the European Parliament, the Council as well as the Commission [1]. Especially readers from countries outside of the EU might ask “Why should this be of interest for me?”.

The point is: if your business is dealing with data of EU citizens (e.g. because you are having an online shop selling goods in the EU, or you operate a social network platform with customers that are EU citizens) you are liable under GDPR – this is regulated in Article 3, section 2 of the regulation: “This Regulation applies to the processing of personal data of data subjects residing in the Union by a controller not established in the Union, where the processing activities are related to:
(a) the offering of goods or services to such data subjects in the Union; or
(b) the monitoring of their behaviour.”
I’d guess that if you are reading these lines you become aware (if not have been so before) that your business might most probably be affected by GDPR as well. Now, the purpose of this blog post is not to enlighten you on the basics of GDPR but to discuss one special, interesting aspect of this regulation: pseudonymisation and how it might support your way to become compliant with GDPR.

DevOps, Continuous Deployment & Agile Security September 7, 2017

Thu, 08 Jun 2017 00:00:00 +0000

The following post is in German as it is covering an Event with German as the main language.

INSIGHT SUMMIT 2017 präsentiert DevOps, Continuous Deployment & Agile Security

Inspiriert durch die erfolgreichen Round Table Session der TROOPERS freuen wir uns Ihnen heute mit dem AgileSecurity Insight Summit 2017 eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.

Die Veranstaltung beginnt am Morgen mit einer Keynote, gefolgt von Fallstudien und Vorträgen durch interne und externe Referenten aus der Industrie. Im Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round-Table Sessions teilnehmen. In den Round-Table Sessions werden unter Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.

Docker Security & (Sec) DevOps Training July 19-20th

Mon, 05 Jun 2017 00:00:00 +0000

The following post is in German as it is covering a Training with German as the main language.

Professionelles Training im Workshop Character:
Docker, Microservices, Kubernetes, DevOps, Continuous
Integration/Deployment/Delivery (CI/CD), Container – moderne
Entwicklungsprozesse kommen nicht mehr ohne diese Begriffe aus. In diesem Kurs
lernen Sie die Security Grundlagen um diese Dinge zu beherschen.

Docker Security & (Sec) DevOps Training:
Im Training werden unter Anderem die folgenden Fragestellungen behandelt:

Wie stark/zuverlässig sind die Isolationsmechanismen hinter Docker/Linux/Betriebssystem-Containern?
Wie beeinflussen Container typische Applikations- und Netzwerk-Landschaften?
Wie beeinflussen die CI/CD/Microservice Paradigmen traditionelle Entwicklungsprozesse?
Wie sieht eine typische CI/CD Pipeline aus?
Was sind potentielle Schnittstellen zwischen „Security“ und diesen Paradigmen?
Welche zusätzlichen Security-Herausforderungen ergeben sich aus der veränderten Entwicklungslandschaft und neuen Tool-Chains?

Voraussetzungen:
Die Teilnehmer sollten grundlegende Kenntnisse der Linux Kommandozeile besitzen
sowie ein System mit einem SSH Client. Teilnehmer die die Demo-VM gerne selbst
betreiben möchten erhalten diese auf einem USB-Stick, müssen sich aber selbst um
Import und Start kümmern.

Active Directory Security & Secure Operations July 18, 2017

Thu, 01 Jun 2017 00:00:00 +0000

The following post is in German as it is covering an Event with German as the main language.

INSIGHT SUMMIT 2017 präsentiert Active Directory Security & Secure Operations

Inspiriert durch die erfolgreichen Round Table Sessions der TROOPERS freuen wir uns Ihnen heute mit dem Active Directory Insight Summit 2017 eine weitere Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit vorzustellen.
Die Veranstaltung beginnt am Morgen mit einer Hinführung zum Thema Active Directory Sicherheit gefolgt von Fallstudien und Vorträgen durch interne und externe Referenten aus Wirtschaft und Industrie. Im Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round Table Sessions teilnehmen (jeder Teilnehmer kann an beiden Sessions teilnehmen). In den Round Table Sessions werden unter Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.

6th No-Spy Conference

Mon, 22 May 2017 00:00:00 +0000

Last friday Florian and me attended the 6th No-Spy Conference in Stuttgart, Germany. We gave a talk about surveillance and censorship on modern devices in North Korea and discussed various aspects with the attendees. The atmosphere was very welcoming and we had some nice discussions about various topics which allowed us to better clarify some things. The slides are available here.

Thanks to the organizers for having us!

Looking back on RIPE 74

Fri, 19 May 2017 00:00:00 +0000

From May 8th to 12th I was able to attend the 74th RIPE meeting in Budapest, Hungary. Being rather new to the networking community, I enjoyed learning a lot of different things, not only from the various interesting talks but also from inspiring conversations with a variety of people from all areas during the beautiful social events.

As it was the first RIPE meeting for me, I was very thankful for the “Newcomer’s Introduction” on Monday morning, containing a RIPE and RIPE NCC 101. It was quite helpful to get into the mindset and understand the structure of the meeting, like the division into different working groups based on the participants’ interests. After familiarizing myself with the concept, I chose to attend several sessions on Address Policy, IPv6, Routing, Open Source, and DNS working groups besides the general plenary sessions. I’ll be reviewing those sessions here.

RIPE74 / Why IPv6 Security Is So Hard

Fri, 12 May 2017 00:00:00 +0000

I’m on my way back from the RIPE74 meeting in Budapest. It was a great event: quite a few nice technical talks in the plenary, productive working group meetings and some really good hallway discussions.
Big thanks to the RIPE NCC team for the smooth organization and for taking care of us!

Here’s some stuff I found particularly interesting:

Andrew Alston’s take on “Anti-Shutdown Policies” (slides and video incl. extensive mic discussion)
Philip & Maximilian from Freifunk Rheinland on their efforts (slides, video)
Friso Feenstra on “That’s Why Rabobank Implemented IPv6” (slides, video) plus some insight into their address planning (slides, video)
BCOP work on “IPv6 Prefix Assignments/Prefix Delegation” and “IPv6 Assignments for Hosting Providers“
Jerry Lundström‘s DNS Replay Tool (slides, video, code)
Jan Žorž (supported by Sander Steffann) on NAT64 testing (slides, video, code)

These were my own contributions:

Git Shell Bypass By Abusing Less (CVE-2017-8386)

Wed, 10 May 2017 00:00:00 +0000

The git-shell is a restricted shell maintained by the git developers and is meant to be used as the upstream peer in a git remote session over a ssh tunnel. The basic idea behind this shell is to restrict the allowed commands in a ssh session to the ones required by git which are as follows:

git-receive-pack
- Receives repository updates from the client.
git-upload-pack
- Pushes repository updates to the client.
git-upload-archive
- Pushes a repository archive to the client.

Besides those built-in commands, an administrator can also provide it’s own commands via shell scripts or other executable files. As those are typically completely custom, this post will concentrate on the built-in ones.

One Step Closer – RDNSS (RFC 8106) Support in Windows 10 Creators Update

Mon, 08 May 2017 00:00:00 +0000

Good Afternoon,

It is a pleasant surprise for many (us included) that Microsoft implemented support for the RDNSS (RFC 8106) option in Router Advertisements beginning with the Windows 10 Creators Update. Interestingly, I wasn’t able to find any official documents from Microsoft stating this. As we are involved in a lot of IPv6 related projects for our customers, the lack of RDNSS support for Windows and DHCPv6 for Android is a major pain point when implementing IPv6 in mixed client segments, as you need to implement both mechanisms to ensure that all clients do get the relevant network parameters. I won’t beat on the dead horse, but Microsoft’s decision is a huge step in the right direction and one can hope that one day Google finds a “compelling use case” to implement at least stateless DHCPv6 for Android.

Autonomic Network Part 3: Vulnerabilities

Thu, 13 Apr 2017 00:00:00 +0000

This is the 3rd post in the series of Autonomic Network (AN), it will dedicated for discussing the vulnerabilities. I recommend reading the first 2 parts (part one, part two) to be familiar with the technology and how the proprietary protocol is constructed.

Initially we will discuss 2 of the reported CVEs, but later there is more CVEs to come 😉

Here is a quick overview on how our network looks like for 2 CVEs

(Mostly) New, Interesting, and Security-focused Open Source Projects

Mon, 03 Apr 2017 00:00:00 +0000

Troopers ’17 – the 10th edition – madness is over and hopefully all of you are well rested and recovered after this special week. Of course the rest of the world did not stand still and thus Google lifted the curtains on a new public portal collecting and promoting the Open Source Software projects developed by employees of Google: opensource.google.com. There are a lot of interesting projects that might incubate new interesting developments. And even security oriented tools and projects (51 at the time of writing to be precise) are publically available [1].

Some Quick Tips for Submitting a Talk to Black Hat or TROOPERS

Sat, 01 Apr 2017 00:00:00 +0000

Given the CfP for Black Hat US in Vegas ends in a few days – and as apparently some people have already started to think about their TR18 submissions – I’ll quickly provide some loose recommendations on how to write a submission here. There’s quite some reasonable advice out there already (the BH CfP site lists this and this which you should both read as well) but some of you might find it useful to get (yet) another perspective.

Autonomic Networking – Part 2: Analysis

Mon, 20 Mar 2017 00:00:00 +0000

This is the second part in the Autonomic Network series. We have introduced previously in our first part the Autonomic Network (AN), took a look about the needed configuration to run it on Cisco gear and what is the expected communication flow. In this post, we will dive deeper to have a closer look on the packets and how they are composed. Cisco’s AN protocol is a proprietary one and as far as I know, the analysis provided here for the protocol is the first of its kind.

This is Why Your Wireless Mouse Should Have a Tail and Your Presenter is a Fail

Mon, 20 Mar 2017 00:00:00 +0000

Puh…it’s been a long time since my last post, huh?
However, let’s get straight back to topic. Today, I want to issue a warning, especially in face of upcoming Troopers 2017 (less than two days to go, wooo! 10th anniversary!): be careful when using wireless equipment (presenters, mouses, keyboards,…), especially during Troopers, but also in daily use.

TL;DR Please take into account that you put your laptop at risk of being hacked by using wireless equipment during Troopers. This could lead to a full system compromise. Wirelessly. Attacks like keystroke injection or sniffing of latter and mouse movements are possible. This, e.g. applies to speakers, using wireless presenters (like Logitech R400/R800, old and new models), as also to any attendee or crew member who might use wireless mouses or keyboards. Be aware of this!

Autonomic Networking – Part 1: Overview

Sun, 19 Mar 2017 00:00:00 +0000

This is a 3-part series which introduces and analyzes Cisco’s implementation for Autonomic Network. In the 1st part, the technology is introduced and we have an overview about communication flow. In the 2nd part, Cisco’s proprietary protocol is reverse engineered ? then finally in the 3rd part, multiple vulnerabilities will be disclosed for the first time. If you’re aware of the technology, you can skip directly to part 2 where the action begins!

CSA Summit CEE and BSides Ljubljana 2017

Fri, 17 Mar 2017 00:00:00 +0000

At the end of last week I had the pleasure to visit the CSA Summit CEE and the Bsides Event in Ljubljana.

At CSA, I was talking about hypervisors, breakouts and an overview of security measures to protect the host. (Slides)
This ranged from the basic features some hypervisors provide out of the box to advanced features like SELinux, device domain models and XSM-FLASK.

Most of the other talks were more targeted towards management level employees, but even as a fairly technical person I found Mike Bursell’s talk highly interesting. After my talk about securing the host system from a malicious guest, he dealt with the inverse: Technologies to protect a guest from a malicious or compromised host.

Information About SAP Security Note 2336795

Tue, 14 Mar 2017 00:00:00 +0000

Last year I encountered a slight variation of an internal port scan vulnerability for the CrystalReports component of SAP Business Objects. The original vulnerability was presented and disclosed by rapid7 in the talk “Hacking SAP Business Objects”. The corresponding slides can be found here.

Basically, the original vulnerability allowed port scanning of (internal) systems via the URL http://hostname/CrystalReports/viewrpt.cwr?id=$ID&wid=$WID&apstoken=ip:port@$TOKEN. By accessing this URL, different responses were received depending on if the port (parameter port in the URL) of the system (parameter ip in the URL) was in the state “open” or “closed”. The original vulnerability has been fixed a long time ago (SAP security note 1432881), but the fix did allow for a slight variation to make the attack work again.

Testing RFC 6980 Implementations with Chiron

Sat, 11 Mar 2017 00:00:00 +0000

In the recent post on the IPv6 properties of the latest MS Windows versions I announced another one providing details on the RFC 6980 related testing I had performed. So here we go.

When doing IPv6 security testing there’s mainly four toolkits which can be used:

Antonios Atlasis‘ Chiron
Marc Heuse’s THC-IPV6
Fernando Gont‘s IPv6 Toolkit
Scapy (whose IPv6 capabilities are, afaik, mainly maintained by Guillaume Valadon. some tutorial on IPv6 packet crafting with scapy can be found here).

Each of them has specific strenghts & limits, which will not be discussed here. For the testing I performed I chose Chiron as it has the most powerful options when it comes to IPv6 extension headers and fragmentation.

31c0n 2017 in Auckland, New Zealand

Fri, 03 Mar 2017 00:00:00 +0000

Last week we gave a talk at the very first 31c0n in Auckland, New Zealand. The talk focused mainly on the methodology that we use to assess security products.

More specifically, this methodology consists of 7 steps

Literature Research
Jailbreak the Target
Identify Components
Understand the Architecture
Map the Attack Surface
Prioritize
Analyze.

Details on these steps as well as general suggestions to viable alternatives for security products can be found here in the slides.

Troopers17 GSM Network – How about your own SMPP Service?

Wed, 01 Mar 2017 00:00:00 +0000

The event of the events is getting closer and again, we are very optimistic to have a lot of awesome trainings, talks, evening events, and discussions. But we again will also have some “features” and gimmicks for those of you who would like to play with new, old, or just interesting technologies. As you might remember, since some years one of these features is and again will be our own GSM Network. As we are improving our setup from year to year, this time we’d like to give you the chance to actively participate with ideas and your own services.

Agile Development & Security

Sun, 26 Feb 2017 00:00:00 +0000

I’m a big fan of Chris Gates’ publications on DevOops and From Low to Pwned. The content reflects a lot of issues that we also experience in many assessments in general and assessments in agile environments in particular. In addition, we were supporting several projects recently that were organized in an agile way. In this post, I want to summarize some thoughts on how security work can/should be integrated into agile projects. The post was also a result from the preparation of our upcoming Troopers workshop on Docker Security & Devops, which of course also covers organizational aspects, but not to the degree this post describes them.

Cloudflare Incident #Cloudbleed

Fri, 24 Feb 2017 00:00:00 +0000

Exactly one week ago I noticed an “urgent” tweet from Tavis Ormandy to get in contact with the Cloudflare team.
Normally when a tweet like this appears from Tavis, something is horribly broken. Well, today we know the background of this tweet as the bug tracker issue went public and it exposed quite a bug from Cloudflare.

While there is some background story how Tavis found the bug, because he wasn´t actively looking into the Cloudflare infrastructure and it was rather discovered by accident when odd data appeared in his fuzzing corpus. When he looked closely he found data that was not in any mean related to the expected data from various websites.

Exploitation of IMS in absence of confidentiality and integrity protection

Fri, 17 Feb 2017 00:00:00 +0000

IP Multimedia Subsystem (IMS) offers many multimedia services to any IP-based access network, such as LTE or DSL. In addition to VoLTE, IMS adds service provider flexibility, better QoS and charging control to the 4th generation of mobile networks. IMS exchanges SIP messages with its users or other IMS and usually these communications are secured by TLS or IPSec. But if an attacker manages to break the confidentiality and the integrity with IMS, he would find it vulnerable to several attacks.

Summary of “Lockpicking in the IoT” at 33C3

Tue, 14 Feb 2017 00:00:00 +0000

“Lockpicking in the IoT, …or why adding BTLE to a device sometimes isn’t smart at all” by Ray was one of my favourite talks, as it beautifully showed many different attack vectors as well as giving a nice guide for getting started in this area.

It impressed me how carefree vendors and startups handled hardware and software security in “smart” devices as it seems that their devices were more or less easy to own. In his talk Ray pointed out physical AND implementational weaknesses that remained even after he reported them to the vendors.
The most prominent sample he gave was when he opened a “Masterlock” by spinning a magnet on the lock itself to open it.

33c3 Talks – What could possibly go wrong with “insert x86 instruction here” ?

Wed, 01 Feb 2017 00:00:00 +0000

This was one of the few technical talks at 33c3 I managed to see, by that I mean live-stream during an access control shift, by Clémentine Maurice and Moritz Lipp.

The talk gave an overview of some already known possible information leaks by abusing certain x86 instructions(the same concept applies to ARM too though) and demonstrating the various ways an attacker could use them. They started off by quickly explaining how the caches on modern CPUs are set up and how they work and how you can exploit the timing differences in memory accesses to leak data without actually knowing the content of the cache. This data leak can then be used to establish a covert channel.

White Paper on Incident Handling First Steps, Preparation Plans, and Process Models

Wed, 01 Feb 2017 00:00:00 +0000

We just published my Whitepaper about First Steps, Preparation Plans, and Process Models for Incident Handling, that I wrote to pass the time between Christmas and New Year. The whitepaper sums up information that I consider to be useful to prepare for IT security incidents as a conclusion from the incidents in which we supported over the past year.

Have you for example thought about classes of incidents that are most likely to affect you and formulated Incident Handling Preparation Plans for those incidents?

IPv6 Properties of Windows Server 2016 / Windows 10

Mon, 30 Jan 2017 00:00:00 +0000

In this post we’ll take a detailed look at the properties of the Windows Server 2016 IPv6 stack.
I perform(ed) this exercise for several reasons:

Server 2016 is the latest OS released by Microsoft so this might give an indication as for their plans & strategy when it comes to supporting certain specifications.
(here you may keep in mind that the ~50 IETF meetings having passed since the publication of RFC 2460 provided ample opportunity for creative minds to come up with ever new ideas for “enhancing” IPv6, without too much real-life feedback/reality checks from enterprise space though, as simply not many of such organizations have deployed it at scale… or are incentivized to send their employees to week-long meetings in expensive hotels on other continents twice a year…).
as I laid out in this post the configuration approach an organization takes for their servers might depend on the support of specific features.
obviously for both IPv6 planning and operations it might be helpful to understand the respective behavior of individual operating systems (which is why we researched stuff like this or this in the past).
many years ago Microsoft published white papers with details as for the TCP/IP parameters of their OSs (incl. stuff like registry parameters to control it etc.) but I’m not aware of such a document for Server 2016 or Windows 10. I hence hope this post can somewhat contribute to public knowledge of the intricacies of their latest IPv6 stack.

Version

ERNW at 33C3 – Part 1

Thu, 26 Jan 2017 00:00:00 +0000

This is part 1 of our report series on interesting talks of the 33rd Congress of the Chaos Computer Club. Every year the congress attracts hundreds (up to twelve thousand this year) of technical interested people with the opportunity to socialize and exchange knowledge with each other. The congress is organized by the European largest hacker association and speakers give talks about technical and societal issues like surveillance, privacy, freedom of information, data security and various more.

TR17 Training: Hacking 101

Thu, 26 Jan 2017 00:00:00 +0000

Hi there,
Like in recent years the popular Hacking 101 workshop will take place on TROOPERS17, too! The workshop will give attendees an insight into the hacking techniques required for penetration testing. These techniques will cover various topics:

information gathering
network scanning
web application hacking
low-level exploitation

…and more!

During this workshop you will learn, step by step, a testing methodology that is applicable to the majority of scenarios. So imagine you have to assess the security of a system running on the Internet. How would you start? First, you need a good understanding about the target, including running services or related systems. Just scanning an IP will most likely not reveal a lot of information about the system. The gathered information may help you to identify communication relations of services that could include vulnerabilities. A brief understanding of the target and it’s related systems/services/applications will make scanning and identifying vulnerabilities a lot easier and more effective. Then, the last step will be the exploitation of the identified vulnerabilities, with the ultimate aim to get access to the target system and pivot to other, probably internal, systems and resources.

Cisco: Magic WebEx URL Allows Arbitrary Remote Command Execution – Project Zero

Tue, 24 Jan 2017 00:00:00 +0000

Tavis did it again[1]. As stated in the title it is possible to remotely execute commands via the Chrome extension for the popular meeting software Cisco WebEx. This post summarizes the most relevant information for you.

A test page with working demo code is available to check for the issue on Windows systems [2]. From our point of view the Chrome extension is affected by this issue as well as the Firefox extension as both extension APIs are quite similar. However, Mozilla blocked the FireFox plugin to protect users from the risk of being exploited through the plugin[3][4]. IE seems to be fine thanks to Cisco’s decision to invoke the WebEx Meeting Center via e.g. ActiveX.

Insomni’hack pwn50 write-up

Tue, 24 Jan 2017 00:00:00 +0000

Hi all,

i´ve looked a bit at the Insomni’hack CTF which took place on the 21st January and lasted for 36 hours.
For the sake of warming up a bit for our Troopers workshop Windows and Linux Exploitation,
I decided to create a write-up of the first pwn50 challenge.

To grab your own copy of the presented files you can also find it in our Github repository:

When downloading the first binary, we are presented with 2 files:

First dedicated Forensic Computing Training at TR17

Wed, 11 Jan 2017 00:00:00 +0000

I am looking forward to our newly introduced dedicated Forensic Computing Training at TR17!
We will start the first day with a detailed background briefing about Forensic Computing as a Forensic Science, Digital Evidence, and the Chain of Custody. The rest of the workshop we will follow the Order of Volatility starting with the analysis of persistent storage using file system internals and carving, as well as RAID reassembly with lots of hands-on case studies using open source tools. As a next step, we will smell the smoking gun in live forensics exercises. Depending on your preferences we will then dig a bit into memory forensics and network forensics.

TelcoSecDay 2017 – 2nd Round of Talks

Tue, 03 Jan 2017 00:00:00 +0000

Hello and a Happy new Year!

There are only two and a half months left, so I’d like to publish the next two talks for TelcoSecDay 2017, taking place at 21st of March in Heidelberg. Both talks are about the security of an upcoming technology which importance will raise in near future: 5G Networks.

One of the talks will be from an attacker’s point of view, highlighting weaknesses of 2G/3G/4G networks and what we have to fix in 5G, and the other one will give us insights into current developments of the 3GPP standardization group.

TR17 Training: Crypto attacks and defenses

Tue, 03 Jan 2017 00:00:00 +0000

This is a guest blog written by Jean-Philippe Aumasson & Philipp Jovanovic about their upcoming TROOPERS17 training: Crypto attacks and defenses.

The 1-day training from last TROOPERS has become a 2-day training, featuring even more real-world attacks and defenses as well as new hands-on sessions! We’ll teach you, step by step, how to spot and exploit crypto vulnerabilities, how to use the strongest forms of state-of-the-art cryptography to secure modern systems (like IoT or mobile applications), and bring you up to speed on the latest and greatest developments in the world of cryptography, such as TLS 1.3, blockchains, and post-quantum crypto.

Woolim – Lifting the Fog on DPRK’s Latest Tablet PC

Wed, 28 Dec 2016 00:00:00 +0000

Niklaus, Manuel and me had a great time speaking about one of the latest Tablet PCs from DPRK at 33C3 this year. Our work on RedStar OS from last year revealed a nasty watermarking mechanism that can be used to track the origin and distribution path of media files in North Korea. We have seen some interesting dead code in some of RedStar’s binaries that indicated a more sophisticated mechanism to control the distribution of media files. We got hands on a Tablet PC called “Ul-lim” that implemented this advanced control mechanism.

IPv6 Configuration Approaches for Servers

Wed, 21 Dec 2016 00:00:00 +0000

In this post I’ll discuss configuration approaches for systems which usually have been configured with “static” IP parameters in the IPv4 age/context (like servers in data centers). When it comes to IPv6 there are more options and we’ll have a look at their implications and potential advantages/disadvantages.

From my perspective there’s mainly four possible approaches which we see being implemented or considered in our (predominantly enterprise) customer space. Before we have a closer look at those let’s quickly write down requirements that the involved planners or sysadmins might have in mind when it comes to provisioning the systems in question. Some of those requirements might seem obvious but it could still make sense to note them for the discussion to follow. These might include:

3rd Round of TROOPERS17 Talks

Tue, 20 Dec 2016 00:00:00 +0000

We had to make some tough choices regarding our TROOPERS17 Main Conference Agenda. Thank you again to everyone for submitting! The full agenda will be published later this week, but for now here are the next round of talks!

Ivan Pepelnjak: Securing Network Automation
If you have operational experience in running large networks then you’re probably yearning to replace the traditional way of managing individual network devices via SSH with something better and more reliable. Software Defined Networking (SDN) was touted as the all-encompassing solution, but what we got instead is a heap of academic ideas, several platforms that require as much investment as an SAP deployment, and a bunch of proprietary products focused more on increasing lock-in and vendor revenue than solving operational problems.

PoC Con Seoul 2016

Thu, 15 Dec 2016 00:00:00 +0000

Recently I had the pleasure to join the PowerOfCommunity conference in Seoul. Florian and Felix attended the conference in the past and enjoyed it a lot, so I took the opportunity to join this year. From what I had heard the conference is highly technical, offensive security and community focused (surprise 😉 ). Boy did they deliver!
Located in a hotel next to a nice park and close to the famous Gangnam district in Seoul we came together to feel the power of community. The conference was planned for two days and offered two tracks per day. Several key talks were presented for everyone.
I really liked the topics a lot. Some contributions I found particularly interesting were:
Petr Švenda with “The Million-Key Question – How RSA Public Key Leaks Its Origin”, where he presented his research of fingerprinting RSA public keys. By analyzing the RSA keys from smartcards and software sources he was able to find similarities between them, which allowed fingerprinting the generating source for some cases. With this information it could be possible gather some potentially important details from simple keys. He is currently expanding his work, please send him an E-Mail if you have RSA keys from an exotic resource. 😉

TR17 Training: Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer

Thu, 15 Dec 2016 00:00:00 +0000

This is a guest blog written by Hanno Böck who will be running the Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer at TROOPERS17.

Fuzzing is a very old technique to find bugs and vulnerabilities in software. However it has seen a new push in recent years due to vastly improved tools. The compilers gcc and clang have received Sanitizer tools that allow finding a lot of bugs like use after free errors and out of bounds reads that are otherwise very hard to find.

2nd Rounds of TROOPERS17 Talks!

Wed, 14 Dec 2016 00:00:00 +0000

It is the end of the year and we are hoping it is not too hectic of a time for you all! But if it is, hopefully the announcement of our next round of TROOPERS17 talks is enough to get you in the TROOPERS (if not the holiday) spirit 🙂

Francis Alexander & Bharadwaj Machiraju: How we hacked Distributed Configuration Management Systems

With increase in necessity of distributed applications, coordination and configuration management tools for these classes of applications have popped up. These systems might pop-up occasionally during penetration tests. The major focus of this research was to find ways to abuse these systems as well as use them for getting deeper access to other systems.

A short Addendum on the Mirai Botnet Blog Post

Thu, 08 Dec 2016 00:00:00 +0000

While doing heap research on Linux processes (results are going to be published soon), I came across the bot from the Mirai Botnet. As already mentioned in the blog post by Brian, the Mirai bot uses obfuscated configuration data which contains e.g. the CnC server. When now confronted only with a bot (e.g. in the context of a running task or the ELF binary), but without the according source code, the decryption of this configuration data for e.g. incident analysis purposes might not be easily possible (with the python script from the blog post), if the key has been changed.
But in this case that is not a problem at all, because

TelcoSecDay 2017 – First Talks Published

Thu, 08 Dec 2016 00:00:00 +0000

Even if the CFP for TelcoSecDay 2017 is officially closed, I am still getting mails in. First of all: thank you for all your great feedback! As the TelcoSecDay is a complimentary and non-public event with highly specialized topics, it only works by sharing knowledge with each other. But please keep in mind that the speaker-slots are limited and I have to make a decision at some point of time.
Anyhow, I am looking forward for a great event and I am proud to publish the first accepted talks:

Research Diary: Bluetooth. Part 2

Wed, 07 Dec 2016 00:00:00 +0000

Recently we posted first part of our Bluetooth research diary. Today, we want to continue on that topic and tell you about Bluetooth proxying and packet replay with a new tool.

This time we had a new gadget to play with: our colleague Florian Grunow shared with us a curious IoT device – Bluetooth socks… real socks that you control with an app to heat your feet. The future is here… 😉

Analyzing yet another Smart Home device

Mon, 05 Dec 2016 00:00:00 +0000

As you have probably already recognized, some of us here at ERNW are doing research in the area of smart home technologies e.g. KNX. Recently, we took a deeper look into a device which is used to control a smart home system produced by the vendor BAB TECHNOLOGIE GmbH called “eibPort”. This device can be used to control smart home systems based on different technologies e.g. EnoCean or KNX depending on the version of the device. The eibPort comes with a visualization running on a webserver to control the whole system e.g. open or close windows, changing the temperature in different rooms or turning the alarm system on or off by simply clicking on symbols. The following screenshots illustrate an example of such a visualization:

Research Diary: Blue Coat

Mon, 05 Dec 2016 00:00:00 +0000

As a part of our research time here at ERNW, last week we had an interesting time looking at one of the widespread and commonly adopted proxy appliance by many organizations Blue Coat Secure Gateway.

Introduction

The Blue Coat proxy Secure Gateway (SG) has been already in the market since 2001 [1]. The main aim of introducing the appliance was to achieve the following goals [2]:
• High performance optimization.
• Increasing the security measurements, by introducing malware/spyware protections, web based filtering, virus scanning and more.
• Flexible Access Control capabilities.

Some Notes from the Lab – BlackNurse in the IPv6 Era

Mon, 05 Dec 2016 00:00:00 +0000

Since BlackNurse was released on 10th of November, we asked ourselves whether this problem does also apply to ICMPv6 traffic. To answer this question, Christian Tanck (one of our students) build a lab with several firewall appliances. Kudos to him for testing and the following blog post.

Intro

On 10^(th) of November, 2016 the TDC Security Operations Center in Denmark published the BlackNurse Denial of Service Attack Report as an PDF download on their website and a blog post written by Erik Hjelmvik from NETRESEC. He was involved in the project by helping with the analysis of packet dumps, testing different systems, with ideas for test scenarios and at least inspired me with his blog post on how to build a test lab described later in this post. The attack on its own was discovered by the TDC analysts Kenneth B. Jørgensen and Lenny Hansson.

Research Diary: IP-Cameras Part 2

Wed, 30 Nov 2016 00:00:00 +0000

Hi everybody,
This is the second entry in our research diary on IP cameras. If you haven’t done so yet, you should read the first entry in advance. This time we focused more on analysis and exploitation.

Another entry vector

After running a vulnerability scan on both devices, it was revealed that the M1033 has multiple buffer overflow vulnerabilities (CVE-2012-5958 to CVE-2012-5965), which are readily exploitable via Metasploit. This gave us another shell (in addition to the root shell mentioned in the last post), though this time it was not a root shell. By using the find command, we searched for executables having the setuid or setgid bit set. We hoped to use one of those to escalate privileges. To do so yourself add the parameter -perm -4000 to find and it will search for files having the setuid bit set. If you try that on your own unix-like device, for example it should yield /bin/passwd which is perfectly reasonable as you’re able to change your password without being root.

Defending Democracy

Thu, 24 Nov 2016 00:00:00 +0000

I recently had the pleasure to attend two events organized by the Digital Society Institute, one was a workshop on software vulnerabilities and one was their annual conference. For both events I delivered input on the security of security products and their evaluation (slides can be found here). The DSI did a great job of assembling people from various areas (e.g. industry, academia, politics, and research) so there was a lot of input which is not covered by conferences I usually attend. The workshop I attended also resulted in a short policy recommendation when it comes to the security of security products which can be found here.

CCS’16 – Day 2 – 25th October 2016

Wed, 23 Nov 2016 00:00:00 +0000

Hello again.

Andrei Costin (at http://firmware.re project) is here, and this is the second post from a series of guest postings courtesy of ERNW (thanks Niki and Enno!).

Few days ago, the first CCS’16 summarization post went online: https://insinuator.net/2016/11/introduction-ccs16-day-1-24th-october-2016/

It summarized five presentations of the 6th Annual Workshop on Security and Privacy in Smartphones (SPSM’16). In short, it contained presentations on: over-the-top and phone number abuse, smartphone fingerprinting, apps privacy increase and protection/security, and apps privacy ranking.

Research Diary: Bluetooth

Tue, 22 Nov 2016 00:00:00 +0000

As you probably know we perform research on a regular base at ERNW.

We – Olga and Rafael – started with a research project about Bluetooth. Our first goal was to gain some knowledge about the tools used by most Linux systems to communicate with Bluetooth hardware, such as BlueZ. A good help for that was the amazing Bluetooth hacking workshop we had before (check the link in our blog!)

To get a better understanding of the tools you need some Bluetooth hardware to interact with.
The hardware we used for our research so far are the very cool TexasInstruments SimpleLink™ Bluetooth low energy/Multi-standard SensorTag (CC2650STK) and a Fitness Wristband found at home.

Research Diary: IP-Cameras

Tue, 22 Nov 2016 00:00:00 +0000

As you probably know we perform research on a regular basis at ERNW. This post is the first entry on our – Benjamin’s and Pascal’s – research diary. You might already have seen Oliver’s post on setting up an research environment or Brian’s posts on IoT botnets (here and here). With that in mind we want to take a look at one of the market leaders for network camera equipment: AXIS.

At first we’d like to give a quick overview of our research objects. We bought two cameras, an AXIS M1033-W and an AXIS M3005-V. The M1033’s description states that it is for “small business, hotels, residences and more”. The M3005 has a typical dome design and was actually seen in some customer environments during projects this year.

BlackHoodie 2016

Mon, 21 Nov 2016 00:00:00 +0000

This year’s BlackHoodie workshop rolled out with 28 amazing women from all parts of the world. It was a very vibrant group with students, professionals, engineers, researchers, physicists and what not. This is the second year that Marion Marschalek is running this reverse engineering workshop exclusively for women. There were a variety of topics that were covered. This includes anti emulation tricks, anti debuggers, packers, obfuscation, encryption/decryption functions, and a lot of fun with IDA.

Considerations on DMZ Design in 2016, Part 3: Some Notes on Firewall Rule Management

Mon, 21 Nov 2016 00:00:00 +0000

This is the 3rd part of this loose series on considerations of (operating) DMZs in 2016 (part 1 on the role of a DMZ is can be found here, part 2 on reverse proxies here).
Again, I dare to deviate a bit from the plan & order I initially had in mind – today I will cover one process whose maturity may significantly influence the overall security posture of a DMZ environment: firewall rule management.

Introduction & CCS’16 – Day 1 – 24th October 2016

Mon, 21 Nov 2016 00:00:00 +0000

I am Andrei Costin (at http://firmware.re project), and this is the first post from a series of guest postings courtesy of ERNW.

Between 24th and 28th October, I had the pleasure and the great opportunity to attend ACM CCS 2016 in Vienna, Austria, where I also presented at the TrustED’16 workshop my paper titled “Security of CCTV and Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations”.

My attendance throughout the entire ACM CCS 2016 week and my presentation at TrustED was possible thanks to generous support from Enno Rey and ERNW, and I thank them again for this opportunity!

IoT the S is for Secure – Unknown Administration Interface in Wireless Plug

Mon, 21 Nov 2016 00:00:00 +0000

Dear Readers,

just recently i bought a wireless plug on Amazon with the main use of controlling my coffee machine with an app. The installation of the wireless plug was quite easy and only requires me to set my Wifi SSID and my passphrase – that’s it. But what happened behind the scenes? I visited the control interface of my router and saw that along with the other devices there was a new one with the network name HF-LPB100 and a local IP address in my case 192.168.0.235. First of all i wondered about the name itself, but ignored that and kept on looking for open ports.

(Securely) Updating Smart Devices / Some Considerations

Tue, 15 Nov 2016 00:00:00 +0000

How to provide updates to IoT devices – yes, I’m aware this might be a overly broad generalization for many different devices – has been the topic of many discussions in the last years (for those interested the papers from the “Internet of Things Software Update Workshop (IoTSU)” might be a good starting point).
Given Matthias and I will moderate the respective session at tomorrow’s IoT Insight Summit I started writing down some points that we consider relevant in this context.

15. Cyber-Sicherheits-Tag

Tue, 08 Nov 2016 00:00:00 +0000

Today Kevin and I had the pleasure to to present at the German 15. Cyber-Sicherheits-Tag in Berlin which is organized by the Alliance for Cyber Security. This iteration covered security aspects of the Internet of Things and we enjoyed some great conversations. The presentations were limited to ten slides and can be found here:

Kevin Schaller – Defense in Depth in IoT

Matthias Luft – Update Management in IoT

Since the slides were supposed to be short and only support the presentation, you still have the chance to get the full content (and even challenge it or ask to dive deeper during the break-out discussions) next week at our own IoT event 😉

ITSeCX 2016: Pulling an all-nighter in Austria

Tue, 08 Nov 2016 00:00:00 +0000

Last Friday I gave a talk at the ITSeCX in St. Pölten, Austria. The conference, hosted by the local University of Applied Sciences, has already taken place ten times. I don’t know how many people attended this time, 2014 there were about 600; I read somewhere on the net. There were four tracks and some workshops from 4pm to the conference’s end at midnight. I enjoyed the community-feeling there very much, even though I arrived late. The only talks I saw, were Adrian Dabrowski speaking about the DARPA Cyber Grand Challenge, the finals took part in Las Vegas this August, and the very entertaining end-of-year review from two UAS guys.

Announcing the first 5 talks of TROOPERS17!!!!

Fri, 04 Nov 2016 00:00:00 +0000

TROOPERS16 was packed with epic talks from around the world, an unknown evil twin brother appearing, hands-on trainings, and a legendary year for our TROOPERS Charity efforts! If you were there you might be wondering to yourself how could they possibly top it? Well, I am going to let you in on a little secret: Next year is the 10th edition of TROOPERS. One DECADE of TROOPERS, and we are pulling out all the stops! Starting with the announcement of the first 5 talks!

IPv6 Source Address Selection

Wed, 02 Nov 2016 00:00:00 +0000

As we all know an IPv6 enabled host can have multiple addresses. In order to select a source address for a to-be established outbound connection, operating systems implement a source address selection mechanism that evaluates multiple source address candidates and selects the (potentially) best candidate. Criteria for this selection are defined in RFC6724 (which obsoletes RFC 3484).

To find out if there are differences as for the way various OSs implement this mechanism we performed a little study whose results can be found in this whitepaper. Those differences might be particularly relevant for data center environments or enterprise networks with a variety of heterogeneous client operating systems. If interested in IPv6 in enterprise networks this training that I’ll give in some weeks might be worth attending for some of you, too.

TelcoSecDay 2017 – CFP Opens

Sat, 29 Oct 2016 00:00:00 +0000

For the 6th year in a row, the next TelcoSecDay will take place in 2017 on March 21th. Again, it will be held one day before Troopers IT-Security Conference as an invitation-only event. For those of you who don’t know the TSD, it is organized by ERNW and is aimed at bringing researchers and people from the telecommunication industry together to discuss about current security weaknesses, challenges and strategies. To do so, various topics will be presented during the talks and there will surely be enough time to follow-up in extensive discussions.
To give you an idea, here’s the TSD 2016 agenda, and here’s the one of 2015.

Day-Con X Recap

Thu, 27 Oct 2016 00:00:00 +0000

Just a few days ago I had the pleasure of visiting Day-Con X. I listened to some great talks in the closed and public sessions. Since the first day was the security summit (closed session) I will just name a few titles with some brief words.

Captivating Security – Safety versus Passion (Josh More):
Was quite interesting to compare the IT-World with zoos.

Beyond Embedded (Brittany Postnikoff):
Robots are fun soon :).

IoT Insight Summit November 15, 2016

Wed, 26 Oct 2016 00:00:00 +0000

The newest addition to ERNW, ERNW Insight which now hosts TROOPERS, is launching a new concept this year. Based on the successful TROOPERS Roundtable sessions, ERNW Insight will host a series events every year covering current and relevant topics in the field of IT Security. While the style of the events may vary the in-depth knowledge sharing that you have come to know from TROOPERS will not!

The inaugural event will be our IoT Insight Summit, taking place on November 15, 2016 at the Crowne Plaza Heidelberg. This 1-day event will begin with a keynote and case study from industry experts. Afterwards, all participants will be divided into five groups of 10 persons each to participate in our “Break Out Sessions”. Every participant will get the opportunity to attend all 5 Break Out Sessions, where our IT Security moderators will lead discussions on typical problems and solutions in IoT.

Reverse Engineering With Radare2 – Part 3

Mon, 24 Oct 2016 00:00:00 +0000

Sorry about the larger delay between the previous post and this one, but I was very busy the last weeks.
(And the technology I wanted to show wasn’t completely implemented in radare2, which means that I had to implement it on my own 😉 ). In case you’re new to this series, you’ll find the previous posts here.

As you may already know, we’ll deal with the third challenge today. The purpose for this one is to introduce
some constructs which are often used in real programs.

A Journey Into the Depths of VoWiFi Security

Thu, 20 Oct 2016 00:00:00 +0000

T-mobile pioneered with the native seamless support for WiFi calling technology embedded within the smartphones. This integrated WiFi calling feature is adopted by most major providers as well as many smartphones today. T-mobile introduced VoWiFi in Germany in May 2016. You can make voice calls that allows to switch between LTE and WiFi networks seamlessly. This post is going to be about security analysis of Voice over WiFi (VoWiFi), another name for WiFi calling, from the user end. Before we get started, let me warn you in advance. If you are not familiar with telecommunication network protocols, then you might get lost in the heavy usage of acronyms and abbreviations. I am sorry about that. But trust me, after a while, you get used to it 🙂 .

A Quick Insight Into the Mirai Botnet

Thu, 20 Oct 2016 00:00:00 +0000

As you might have read, I recently had a closer look at how easy it actually is to become part of an IoT Botnet. To start a further discussion and share some of my findings I gave a quick overview at the recent Dayton Security Summit. The Mirai Botnet was supposed to be one of the case studies here. But the way things go if one starts diving into code…I eventually gave an overview of how the Mirai Bot actually works and what it does. As such: Here a quick summary of the Mirai Botnet bot.
As described in my previous post, KrebsonSecurity.com was attacked by a major DDoS attack. Reaching between 620Gbps and 660Gbps it was the largest documented DDoS attack so far. The attack seemingly resulted from a Botnet called Mirai. Shortly after the attack, a post on hackforums claimed to contain the actual source code of just this botnet.
The source code consists of three projects: The bot itself with its CnC server and a loader component.

Linq Injection – From Attacking Filters to Code Execution

Mon, 17 Oct 2016 00:00:00 +0000

Some of you (especially the .Net guys) might have heard of the query language Linq (Language Integrated Query) used by Microsoft .Net applications and web sites. It’s used to access data from various sources like databases, files and internal lists. It can internally transform the accessed data in application objects and provides filter mechanisms similar to SQL. As it is used directly inside the application source code, it will be processed at compile time and not interpreted at runtime. While this provides a great type safety and almost no attack surface for injection attacks (except from possible handling problems in the different backends), it is extremely difficult to implement a dynamic filter system (e.g. for datatables which should allow users to select the column to filter on). That’s probably the reason why Scott Guthrie (Executive Vice President of the Cloud and Enterprise group in Microsoft, also one of the founders of the .Net project) presented the System.Linq.Dynamic package as part of the VS-2008 samples in 2008. This library allows to build Linq queries at runtime and therefore simplify dynamic filters. But as you may know, dynamic interpretation of languages based on user input is most of the time not the best option….

Setting up a Research Environment for IP Cameras

Mon, 17 Oct 2016 00:00:00 +0000

Embedded devices often serve as an entry point for an attack on a private or corporate network. The infamous attack on HackingTeam, for example, followed exactly this path as was revealed here. Although the attack may have been for the greater good (refer also to this great keynote), such incidents demonstrate that it is important to properly secure your embedded devices. In a recent blog post, Niklaus presented how he analyzed the security posture of a MAX! Cube LAN Gateway. Moreover, Brian reported a few weeks ago on the security posture of IoT devices (and in particular on one of his cameras). With this post I would like to share my experiences with analyzing another embedded device: the IC-3116W IP camera by Edimax.

Welcome to Insinuator.net 2.0

Fri, 14 Oct 2016 00:00:00 +0000

It’s almost exactly seven years since Enno published the very first blog post on Insinuator.net. Meanwhile, quite a few things changed. It’s not only the ERNW Universe which grew significantly, but also Insinuator’s place within this universe was slightly adjusted. What started as an almost independent IT-Security blog became more and more the major publication medium of ERNW.

Therefore, we thought it would be a good time to reflect these changes. Today we release the 2.0 version of Insinuator.net. 2.0 introduces a new look & feel as well as major redesign from a technical point of view while also reflecting Insinuator’s place between the four major players in the ERNW universe:

Black Hat 2016 Summary Part 2.1

Thu, 06 Oct 2016 00:00:00 +0000

A few months ago I had the opportunity to visit this year’s Black Hat in Las Vegas. Due to a few weeks of vacation following the conference here are my delayed 2 cents (part 1)

—bryant-zadegan-&-ryan-lester)Abusing Bleeding Edge Web Standards For AppSec Glory – Bryant Zadegan & Ryan Lester (Slides)

Bryant and Ryan talked about new web standards which are already implemented in parts of the current browser jungle. Namely these standard were:

DameWare Vulnerability

Wed, 05 Oct 2016 00:00:00 +0000

In course of a recent research project, I had a look at SolarWinds DameWare, which is a commercial Remote Access Software product running on Windows Server. I identified a remote file download vulnerability in the download function for the client software that can be exploited remotely and unauthenticated and that allows to download arbitrary files from the server that is running the software.

A very simple proof of concept HTTP request to download the C:\Windows\win.ini file of the target machine is the following:

How to Become Part of an IoT Botnet

Sat, 01 Oct 2016 00:00:00 +0000

I suppose there are many people out there who want to achieve a greater good, fight evil corp and “show those guys”. So why not set a statement and become part of a botnet? #Irony!!! Of course I suppose (hope) that none of you actually want to be part of something like an IoT botnet, but joining could in theory be dead easy. So quite a while back I bought a dead cheap WiFi camera for use at home. It was kind of just as insecure as I had expected, so it got it’s own VLAN and stuff and here is why….

Diving into EMET

Mon, 26 Sep 2016 00:00:00 +0000

Last week, we decided to take a look onto the EMET library provided by Microsoft. This library is intended to introduce several security features to applications which are not explicitly compiled to use them.

It also adds an additional layer to protect against typical exploiting techniques by filtering library calls, preventing usage of dangerous functions/components and inserting mitigation technologies.

As EMET is already a target for many researchers, we currently only started to get an overview of it’s structure and how the different components are interacting with each other. Today we would like to share some of our results with you.

Attacking BaseStations @Defcon24

Tue, 20 Sep 2016 00:00:00 +0000

Hello Guys,
back from my vacation I’d like to give you some impressions about Defcon 24 and our talk “Attacking BaseStations”. Defcon itself had a couple of great talks but was a very crowded location. Anyhow, we had a couple of great discussions with the people before and after our talk.

The talk “Attacking BaseStations” focussed on attack vectors we simulated in our lab. Besides attacking a BaseStation via Radio interface, in this talk we focussed on local and remote interfaces as introduced in “LTE vs. Darwin”. As target of evaluation one of our eNodeB’s came into play, which we purchased on the Internet. Anyhow, the talk covered the following attack scenarios:

Introducing the Kernel Space Invaders

Tue, 20 Sep 2016 00:00:00 +0000

Today it is my pleasure to shortly introduce ERNW’s Capture the Flag team, the Kernel Space Invaders. As a long-time CTF enthusiast, I’m really amazed how many of us make the time to tackle IT security challenges also on the weekends or evenings. Even if we cannot participate in all CTFs out there (which would be challenging anyways given the large number of CTF events happening nowadays), we started to compile a repository of some of our write-ups — I hope some of you will enjoy!

BSides LV 2016: Recap

Mon, 19 Sep 2016 00:00:00 +0000

Hey everyone,

Just a short recap from my side regarding this year’s BSide in Las Vegas, NV. It was my first time there and I pretty much enjoyed it. After entering the venue on the first con day (Tuesday) I was a little bit shocked, as the staff sent me to the “end of the line just around the corner” – the end being many corners and many floors away 😉 Speaking to some guys while standing in line, time quickly passed by and before finally hitting the registration desk, there were already some people from the staff giving away the conference badges to the waiting folks. The waiting time was no comparison to last year’s DEF CON, where I (and obviously all the other “humans”, how attendees at DEF CON are called) had to wait nearly _four_ hours to get a badge to enter the con. DEF CON staff already calls this the annual “Line Con”. Enough bashing, back to topic 😉

Files Your Webserver Shouldn’t Deliver

Sun, 18 Sep 2016 00:00:00 +0000

During penetration tests, we often find interesting files on web servers. Almost as often, those files enable us to carry out further attacks with much higher impact. Inspired by Chris Gate’s great series From Low to Pwned, we decided to share the following small piece.

The web server under test did not deliver directory listings. However, the directory contained a .DS_Store file (one of macOS’ many — lets say special — traits). While .DS_Store files store various information, a simple cat shows one relevant characteristic:

SIGS DC Day

Fri, 16 Sep 2016 00:00:00 +0000

Today I had to give the pleasure to give a keynote at the SIGS DC Day on the need to evaluate Cloud Service Providers in a way that looks behind (or at least tries to) security whitepapers and certification reports. The slides can be found here.

I also particularly enjoyed the following two talks:

Sean O’Tool from Swisscom AG covered challenges of an infrastructure to cloud migration. Even though he only briefly touched the topic, I enjoyed his description of their firewalling model: Seeing that centralized firewall operation (or more precisely, rule design and approval) is limited/challenged by the understanding of the application, they transferred control over firewall rule sets (beyond a basic set of infrastructure/ground rules) to the application teams (using of features like OpenStack’s security groups, where he also talked about limitations of those). They compensated the loss of “centralized enforcement by a security group” with rule reviews — an approach that will become way more relevant (and necessary) in the future.

25th USENIX Security Symposium & WOOT Workshop

Mon, 12 Sep 2016 00:00:00 +0000

Last month the annual USENIX Security Symposium with its co-located workshops (WOOT, CSET, FOCI, ASE, and HotSec) was held in Austin, Texas. The program of the conference together with the published papers can be found here and information on the workshops can be found here.

The research topics were quite diverse and included subjects such as low-level attacks, cryptographic attacks, and vehicle attacks. To give you an impression on the research that has been presented at the conference, let us discuss some of the talks in the following:

To Control Something

Sat, 10 Sep 2016 00:00:00 +0000

Some years ago I discussed the meaning of the term “control” in this post, but at the time I was mainly referring to the noun “control”. Given I’ll extensively use the term “control” as a verb in the next parts of “the DMZ series” and some upcoming talks I reflected a bit on its meaning (as a verb). In the following I’ll lay out the definition/understanding to be employed at those occasions.

Merriam-Webster defines, amongst others, as follows:

Hardware Hacking Week @ ERNW

Fri, 09 Sep 2016 00:00:00 +0000

Internal workshops are one of the reoccurring events at ERNW, that help us to gain knowledge in areas outside our usual expertise. One of the recent workshops which happened during the week from August 22nd-25th was Hardware Hacking. Held by Brian Butterly (@BadgeWizard) and Dominic Spill (@dominicgs), this workshop took place in two parts. Brian kickstarted the introductory session by guiding us through the fundamental steps of Hardware Hacking. Brian did an excellent job of making things simpler by giving a detailed explanation on the basic concepts. For a beginner in hardware hacking, the topic could be rather intimidating if not handled properly.

Considerations on DMZ Design in 2016, Part 2: A Quick Digression on Reverse Proxies

Thu, 08 Sep 2016 00:00:00 +0000

This is the second part of a series with considerations on DMZ networks in 2016 (part 1 can be found here). Beforehand I had planned to cover classification & segmentation approaches in this one, but after my little rant on how “the business” might approach & think about reverse proxies in the first part, I felt tempted to elaborate a bit further on this particular topic. I kindly ask for your patience 😉 and will digress a bit for the moment.

KNXmap: A KNXnet/IP Scanning and Auditing Tool

Mon, 05 Sep 2016 00:00:00 +0000

Users of the KNX, a standard for home automation bus systems, may already have come across KNXnet/IP (also known as EIBnet/IP): It is an extension for KNX that defines Ethernet as a communication medium for KNX which allows communication with KNX buses over IP driven networks. Additionally, it enables one to couple multiple bus installations over IP gateways, or so called KNXnet/IP gateways.

In the course of some KNX related research we’ve had access to various KNXnet/IP gateways from different vendors, most of them coupled in a lab setup for testing purposes. The typical tools used for such tasks are ETS, the professional software developed by the creators of KNX (proprietary, test licenses available) and eibd, an open source implementation of the KNX standard developed by the TU Vienna.

MRMCD16 – diagnosis:critical

Sat, 03 Sep 2016 00:00:00 +0000

This year’s MRMCD16 had a topic that immediately let me submit a talk about medical device security: “diagnosis:critical”. Or to quote the official website:

Security issues in soft- and hardware have a low chance of healing, especially in medical IT.

Despite years of therapy using code reviews and programming guidelines, we still face huge amounts of vulnerable software that probably is in need of palliative treatment.

Security vulnerabilities caused by the invasion of IT in the medical sector are becoming real threats. From insulin pumps over analgesic pumps through to pace makers, more and more medical devices have been hacked already. This year’s motto “mrmcd2016 - diagnosis:critical” stands summarizing for the current state of the whole IT sector.

Reverse Engineering With Radare2 – Part 2

Mon, 29 Aug 2016 00:00:00 +0000

Welcome back to the radare2 reversing tutorials. If you’ve missed the previous parts, you can find them here and here.

Last time we’ve used the rabin2 application to view the strings found inside the challenge01 binary to find password candidates. Based on the results we looked into the assembly to find the correct password. In this post, we’ll go through the next challenge and try out some of the features provided by radare2.

Considerations on DMZ Design in 2016, Part 1

Sat, 27 Aug 2016 00:00:00 +0000

I’m currently involved in a “DMZ Redesign” effort in a sufficiently large enterprise (800+ hosts in “the DMZ”) and I thought this might be an opportunity to reflect on some aspects of “DMZ networks” in a series of posts.

Some of you already know that, at ERNW, we have a tendency to discuss stuff starting with some formal definitions and a bit of abstract (overview) approach. It’s not different this time ;-), so let’s first find out what the term “DMZ” means, what such a thing is considered to be and to deliver, and what the actual state of affairs might be in 2016. Different people within an organization might have quite different understandings in this space.
Further it’s entirely possible that the DMZ networks are not operated by a company themselves but by an outsourcing partner which then means that “placing a system in the DMZ” becomes “ordering a DMZ [network] port” by means of some web-based procedure or ticket system, which in turn might have a number of interesting implications (we’ll have a dedicated post on those).

ERNW Hardening Repository

Sun, 21 Aug 2016 00:00:00 +0000

Today we started publishing several of our hardening documents to a dedicated GitHub repository — and we’re quite excited about it! It took a while to develop a suitable markdown template to support all the requirements you have when you write a hardening guide, but we’re online now!

At the moment, only a few hardening guides are online, but that should continuously increase in the future.

Click here for the GitHub ERNW Hardening Repository!

Follow-Up on CVE-2016-1409 – IPv6 NDP DoS Vulnerability

Sun, 21 Aug 2016 00:00:00 +0000

This is a guest post from Jed Kafetz.

After seeing Christopher’s post I decided to create a proof using GNS3 and Virtualbox.
The aim is to perform the exact attacking using Antonios Atlasis’ Chiron tools and run a Wireshark packet capture to prove the hop limit drops below 255.

The following topology is used in GNS3:

The routers used are Cisco C372 and the machine labled Ubuntu is running 14.04 LTS Ubuntu Desktop, default installation. F0/0 is on the right and F0/1 is on the left.

Reverse Engineering With Radare2 – Part 1

Fri, 19 Aug 2016 00:00:00 +0000

Welcome back to the radare2 reversing tutorials. If you’ve missed the intro, you can find it here.

The last time you got the challenge01 binary and your goal was to find the password for the login. Let’s see how the application looks like:

$ ./challenge01
##################################
#          Challenge 1           #
#                                #
#      (c) 2016 Timo Schmid      #
##################################
Enter Password: test
Wrong!

The first and simplest step would be to look for strings inside the binary. We could do this either by using the unix utility strings or the binary analyzing binary from radare rabin2:

Black Hat 2016 Summary

Tue, 09 Aug 2016 00:00:00 +0000

Just a few days ago I had a blast again at this year’s Black Hat. Some of the talks were really worth listening to, so I wanted to point them out and give a short summary.

USING UNDOCUMENTED CPU BEHAVIOR TO SEE INTO KERNEL MODE AND BREAK KASLR IN THE PROCESS – Anders Fogh & Daniel Gruss

They had the last slot at the last day of Black Hat which resulted in a kind of empty room, but in my opinion it was an awesome talk and I even had the pleasure to meet these two guys at our ERNW dinner.

PFX Profiles in Microsoft’s System Management Server

Fri, 05 Aug 2016 00:00:00 +0000

In a recent assessment, we had to evaluate how Microsoft’s System Management Server (SMS) certificate management solution (CMS) stores and handles certificates. This question came up because sensitive, encrypted user certificates were to be stored in the SMS CMS. Due to the sensitivity of the handled certificates, we assessed the protection capabilities of the certificate management solution against extraction attempts from a local attacker with administrative privileges.

How did we do it?

We determined a five steps approach to gain access to the certificates and be able to decrypt the accessed certificate material:

Reverse Engineering With Radare2 – Intro

Wed, 03 Aug 2016 00:00:00 +0000

As some of you may know, there is a “new” reverse engineering toolkit out there which tries to compete with IDA Pro in terms of reverse engineering. I’m talking about radare2, a framework for reversing, patching, debugging and exploiting.

It has large scripting capabilities, runs on all major plattforms (Android, GNU/Linux, [Net|Free|Open]BSD, iOS, OSX, QNX, w32, w64, Solaris, Haiku, FirefoxOS and even on your pebble smartwatch 😉 ) and is free.

Pentesting Webservices with Net.TCP Binding

Mon, 01 Aug 2016 00:00:00 +0000

Hi all,

Most of you that are pentesters may have already tested plenty of webservices using SOAP (Simple Object Access Protocol)* *for communication. Typically, such SOAP messages are transferred over HTTP (Hypertext Transfer Protocol) and are encapsulated in XML (Extensible Markup Language). Microsoft has developed different representations of this protocols to reduce the network load. As these representations/protocols aren’t really covered by typical tools out there, this post will show you some of them, and a proxy which can be used to simplify the testing.

Not Sure Which Talks to Attend at BHUSA?

Fri, 29 Jul 2016 00:00:00 +0000

Hi,

I won’t be in Vegas for Black Hat this year as there’s a direct conflict with one of my kids’ birthdays, but I thought one or another reader might find it helpful to get some inspiration as for selecting the talks to catch (not least as there’s so many interesting ones). I hence decided to quickly write this post.

Here’s my would-be schedule for the first day (second day to follow, maybe, in another post), under the assumption to attend exactly one talk per slot. I could give a longer rationale per talk than the one below, based on several (mostly technical) factors, but this is just about providing suggestions in a brief form.
Disclaimer: I was on the BH guest review board this year so I might be biased in some cases.

Remote Code Execution via Server Side Template Injection at OFBiz 13.07.03 (CVE-2016-4462)

Fri, 29 Jul 2016 00:00:00 +0000

Dear Reader,

this blog post is about Server Side Template Injections for the Apache Freemarker Template Engine, how to detect them, how to craft an exploit and what countermeasures can be implemented. Server Side Template Injections are critical because they often allow even Remote Code Execution, like the exploit of Apache OFBiz 13.07.03 that triggered this post in the first place. It is fair to note, that the exploit of Apache OFBiz requires a valid session with the server, but often this is just an inconvenience for an attacker.

Your Mouse Got Sick and You Don’t Know it. aka “Reverse Shell via Mouse”

Fri, 29 Jul 2016 00:00:00 +0000

Ever got a backdoor installed on your computer by your beloved mouse? Here’s the story of a poor mouse that got really, really sick.

Agent “Danger Mouse”

Do you remember the times where people put Teensy-boards and USB hubs in their mouses? [Chris? ;)] Their aim was to attach an additional Human Interface Device (HID, like keyboards or mouses) with some payload in kind of e.g. keystrokes or mouse movements. Also, there are devices available like the USB Rubber Ducky in the housing of a USB thumb drive.
The principle is easy: The tools are using a programmable microcontroller with the capability to emulate USB HID. That’s it. Just program your board of choice with the payload fitting your needs and plug it in at the target computer. The latter will recognize it as a keyboard/mouse and the payload-keystrokes will be entered.
But why should external hardware be used? Many modern gaming peripherals provide functions to store macros on them, including enough onboard memory for little payloads.

New Ransomware-Wave Analysis

Thu, 28 Jul 2016 00:00:00 +0000

In the context of a customer project, we examined a new variant of the Locky ransomware. As in the meantime stated by a law enforcement agency, this has been part of a large wave of attacks hitting various enterprises in the night from Tuesday (2016-07-26) to Wednesday.

As an initial attack vector, the attackers use emails with an attachment that probably even uses a 0day exploit, that enables the payload to be executed already when displayed in the MS Outlook preview.

REcon 2016 – A Quick Recap

Mon, 25 Jul 2016 00:00:00 +0000

Some of us had the pleasure to visit this year’s REcon in Montreal, Canada. Unfortunately, work caught us just when we arrived back in Germany, so I haven’t had time to sit down and write down a few words so far. However, we think that what we’ve experienced at REcon is worth writing about.

The overall quality of the speakers and talks were very nice. What really amazed me was the art work of REcon:

Notes on Hijacking GSM/GPRS Connections

Sun, 17 Jul 2016 00:00:00 +0000

As shown in previous blogposts we regularly work with GSM/GPRS basestations for testing devices with cellular uplinks or to simply run a private network during TROOPERS. Here the core difference between a random TROOPERS attendee and a device we want to hack is the will to join our network, or not! While at the conference we hand out own SIM cards which accept the TROOERPS GSM network as their “home network” some device need to be pushed a little bit.
Every SIM card has it’s own home network, which is encoded in the fist five (European standard) or six (North American standard) digits of its IMSI – International Subscriber Number. The first three digits are the MCC, the Mobile Country Code, the next two/three the MNC, Mobile Network Code. International network overview are publicly available and for example can be found >here<. For instance, Germany has the MCC 262 and Vodafone Germany uses MNC 02. So a SIM card with an IMSI starting with 26202 belongs to them.
Sticking to the settings in its own SIM card a device will always prefer to connect to it’s own home network above all others. If the home network is not available it will usually go for the strongest signal. To protect users from unnecessary costs, an operator will usually add certain rules to prevent the device from connecting to other networks in the same country. So if you’re an O2 customer in Germany, visit a shopping center and only have reception for a T-Mobile cell, your phone will not directly jump into this network, even though it’s the strongest signal source.

Gotta Catch ‘Em All! – WORLDWIDE! (or how to spoof GPS to cheat at Pokémon GO)

Fri, 15 Jul 2016 00:00:00 +0000

The moment, when your team leader asks you to cheat at Pokémon GO…everyone knows it, right? No? Well, I do 😉

GPS Spoofing Setup

As I’m not a gamer, the technical part was of much more interest – that’s the real gaming for me.
So, challenge accepted!

In the past I was often fiddling around with SDR (Software Defined Radio), started with DVB-T sticks some years ago. When I came to ERNW in 2014 I got in touch with Michael Ossman’s great HackRF One for the first time, and subsequently my thesis was based on SDR.

Jenkins Remoting RCE II – The return of the ysoserial

Fri, 01 Jul 2016 00:00:00 +0000

Jenkins is a continuous integration server, widely used in Java environments for building automation and deployment. The project recently disclosed an unauthenticated remote code execution vulnerability discovered by Moritz Bechler. Depending on the development environment, a Jenkins server can be a critical part of the infrastructure: It often creates the application packages that later will be deployed on production application servers. If an attacker can execute arbitrary code, s/he can easily manipulate those packages and inject additional code. Another scenario would be that the attacker stealing credentials, like passwords, private keys that are used for authentication in the deployment process or similar.

SnoopCon Guest Day

Fri, 01 Jul 2016 00:00:00 +0000

This year I had the pleasure to join the guest day of BT’s SnoopCon. There were quite a number of interesting talks throughout the day such as

Saumil Shah‘s presentation on Stegosploit (as well as his rant about the state of information security)
Dr. Grigorios Fragkos‘ talk on airplane security (where he presented some maybe not-so-pleasant but also some good-to-hear facts on the security posture of airplanes)
Dominic Spill‘s demonstration of tools and methods used to reverse engineer RF protocols
Hacker Fantastic‘s talk on how to use the AX.25 protocol to bounce radio signals off the ISS to communicate with systems around the world
Kostas Litovois’ and Vincent Yiu’s presentation on #WePWNise, a tool that can be used to efficiently create malicious VBA macros (by taking EMET configuration details into account)
Bryan Fite‘s talk on how we have to think about Safety, Security, and Privacy in the IoT age.

I really enjoyed the talks and had a great time! Thanks to all the organizers and speakers!

Some infos about SAP Security Note 2258786

Thu, 30 Jun 2016 00:00:00 +0000

On the 8th of March SAP released the security note for a vulnerability we reported during an assessment of a SAP landscape. The issue affects the SAP NetWeaver Web Administration Interface. By knowing a special URL a malicious user can acquire version information about the services enabled in the SAP system as well as the operating system used. We wanted to share some details on the issue.

The vulnerability is a bypass of the HTTP Basic Authorization for the SAP Web Administration Interface. It discloses version information about the system respectively operating system, a brief SAP patch level overview and running services including their corresponding ports.

VoLTE Security Analysis, part 2

Fri, 24 Jun 2016 00:00:00 +0000

In our talk IMSEcure – Attacking VoLTE Brian and me presented some theoretical and practical attacks against IP Multimedia Subsystems (IMS). Some of the attacks already have been introduced in a former blogpost and Ahmad continued with a deeper analysis of the Flooding and targeted DoS scenario. But still, there are some open topics I’d like to continue with now. The methods I am demonstrating here also help to get a better understanding of VoLTE/IMS and how it is implemented on modern smartphones.

Area41 Conference 2016

Sat, 18 Jun 2016 00:00:00 +0000

Last Friday, Brian and I were at the Area41 Security Conference. The conference is a branch of Defcon conference and is more or less a small conference of the Swiss hacker community. Being in a “rock music club”, the speakers presented on a stage where usually the rock stars are performing – which gives the conference a very special flair and an interesting atmosphere. We’ve been at the conference to present our research about VoLTE technology including some attack scenarios we’ve evaluated in the past. More on this later, let’s first talk about the conference itself.

SAMLReQuest Burpsuite Extention

Mon, 06 Jun 2016 00:00:00 +0000

Security Assertion Markup Language (SAML) is an XML standard for exchanging authentication and authorization data between a Service Provider (SP) and an Identification Provider (IdP). SAML is used in many Single Sign-On (SSO) implementations, when a user is authenticated once by IdP to access multiple related SPs. When a user requests to access a SP, it creates a SAML Authentication Request and redirects the user to IdP to be authenticated according to this authentication request. If the user is successfully authenticated, IdP creates a SAML authentication response and sends it back to SP through the user’s browser.

IPv6 & Threat Intelligence

Fri, 03 Jun 2016 00:00:00 +0000

Tomorrow, I will join a meeting where I’m expected to contribute, amongst others, to a discussion on the impact of IPv6 on threat intelligence. To prepare for that I started putting together some thoughts & ideas on the topic, and I even thought I might share this in a post (the one you read right now ;-), not least to, maybe, stimulate a discussion.

I don’t know much about threat intelligence so it might happen that, at times, I use some misguided terms or I expose a (too) naïve understanding of some concepts. Happy to be corrected in one way or another.

The ULIN Story

Fri, 03 Jun 2016 00:00:00 +0000

Some of you might have noticed the articles, or the leaked manual itself, about a tool called ULIN. ULIN is a “bleeding-edge spy tool” for mobile communication networks. According to the manual, it is aimed to be a surveillance software for agencies (or others with enough money) for tracking and intercepting the Voice Calls and SMS of arbitrary phones. They call this “remote recording and geolocation of mobile handsets using 2G/3G/4G networks”.

New Methods for Exploiting ORM Injections in Java Applications (HITB16)

Thu, 02 Jun 2016 00:00:00 +0000

The HITBSecConf or “Hack In The Box” in Amsterdam is a well known security conference in Europe. We also attended this year too, and there were quite some interesting talks at the HITBSecConf16 conference. One of the talks was about “New Methods for Exploiting ORM Injections in Java Applications” by the security researchers Mikhail Egorov and Sergey Soldatov.

I. What is Object-Relational Mapping (ORM)?

ORM stands for Object-Relational Mapping, which is a technique that automatically converts data from a relational database management system (RDBMS) into objects. This is often used in business applications of today.

Implementing an Obsolete VPN Protocol on Top of HTTP: Because Why Not?

Tue, 31 May 2016 00:00:00 +0000

Recently I’ve started some research on MikroTik’s RouterOS, the operating system that ships with RouterBOARD devices. As I’m running such a device myself, one day I got curious about security vulnerabilities that have been reported on the operating system and the running services as it comes with tons of features. Searching for known vulnerabilities in RouterOS on Google doesn’t really yield a lot of recent security related stuff. So I thought, there is either a lack of (public) research or maybe it is super secure… 🙂

CVE-2016-1409 – IPv6 NDP DoS Vulnerability in Cisco Software

Mon, 30 May 2016 00:00:00 +0000

Dear readers,

As you may have already noticed, Cisco released an urgent security advisory describing an IPv6 Neighbor Discovery DoS Vulnerability in several flavors of Cisco’s operating systems. Currently IOS-XR, XE and NX-OS are affected while ASA and “classic” IOS are under investigation. At first glance, it might look like yet another IPv6 DoS vulnerability. Looking closer, Cisco is mentioning an unauthenticated, remote attacker due to insufficient processing logic for crafted IPv6 NDP packets that are sent to an affected device. Following the public discussion about the vulnerability, it seems that these packets will reach the, probably low rate-limited, LPTS filter/queue on IOS XR devices “crowding” out legitimate NDP packets resulting in a DoS for IPv6 traffic, or in general a high CPU load as these packets will be processed by the CPU. More details are currently not available, but this might indicate the affected systems aren’t doing proper message validation checks on NDP packets (in addition to the LPTS filter/queue problem).

Telescope – Peering Into the Depths of TLS Traffc in Real-Time (HITB16)

Mon, 30 May 2016 00:00:00 +0000

Last week we have visited the HITBSecConf16 – conference in Amsterdam.
There were many interesting talks, and in this post I am going to tell you about a talk held by Radu Caragea – “Telescope: Peering Into the Depths of TLS Traffic in Real-Time”.

While performing a dynamic malware analysis one often needs to analyze network traffic in order to determine malware communication with C&C servers, to observe the malware delivery from sites, or to investigate honeypot traffic under TLS.
There are already existing solutions to help with this task. However in the given talk considering virtual environments the speaker presented a novel technique that works for virtualized machines with a minimal overhead, and is actually OS-agnostic and crypto-library-agnostic.

The Beauty of IPv6 Link-Local Addressing. Not

Sat, 28 May 2016 00:00:00 +0000

In November 2014, after quite some controversy in the IETF OPSEC working group (for those interested look at the archives), the Informational RFC 7404 “Using Only Link-Local Addressing inside an IPv6 Network” was published. It is authored by Michael Behringer and Eric Vyncke and discusses the advantages & disadvantages of an approach using “only link-local addresses on infrastructure links between routers”.

So it’s (merely) about “infrastructure links” which some people call “transit networks” or “point to point” (ptp) links. I’m aware that there might be subtle differences between all these, depending on your specific use of the terms. Still I assume that most readers will have an understanding of what types of links are in focus of the RFC, and subsequently of this post.

Some Notes on Utilizing Telco Networks for Penetration Tests

Wed, 25 May 2016 00:00:00 +0000

After a couple of years in pentesting Telco Networks, I’d like to give you some insight into our pentesting methodology and setup we are using for testing “Mobile and Telecommunication Devices”. I am not talking about pentesting professional providers’ equipment (as in previous blogposts), it is about pentesting of devices that have a modem in place like a lot of IoT devices (you know about the fridge having a GSM Modem, right?) do.

WPAD Name Collision Vulnerability (TA16-144A)

Tue, 24 May 2016 00:00:00 +0000

Yesterday the US-CERT released a Technical Alert (TA16-144A) about the recently found WPAD Name Collision Vulnerability. We will give you a summary about the vulnerability as well as the basic mechanisms here.

WPAD

The Web Proxy Auto-Discovery Protocol is used to auto-configure the proxy for web browsers. So when joining the according network the browser can use DHCP and DNS methods to find a specific configuration file (typically named wpad.dat), which is loaded and applied to the browser’s settings. Therefore, there is no need to configure each browser in your environment individually/manually.

BMC BladeLogic Vulnerabilities PoCs

Mon, 23 May 2016 00:00:00 +0000

Hi everyone!

A quick update: earlier in our blog we released BMC BladeLogic: CVE-2016-1542 and CVE-2016-1543 vulnerabilities. Now the exploits are also available in our github if you want to check your systems 😉

Have a nice week,
Olga

Introduction of a new hardware guy

Wed, 18 May 2016 00:00:00 +0000

Hi folks!

We couldn’t be more proud to welcome such a predestined #1 hardware hacking victim, than VICTor is!
Before Brian and I gave a lecture on hardware hacking last week at DHBW Mosbach, we felt, that we needed a custom victim which is fully documented and provides a good “hackability” to the students.
Surely we could also have used some cheap $wifi_ap, but here’s the thing: Would you really want to use a device which you don’t really know? Mostly, there’s a massive lack of documentation regarding the SoCs used…not to mention the unavailability of schematics and layouts.
As we wanted to teach students the basics of hardware hacking effectively, we decided to create something by ourselves.

Review about the System and Security Info iOS App from SektionEins GmbH

Wed, 18 May 2016 00:00:00 +0000

Dear readers of Insinuator,

Today I want to give a little review about the latest app released by SektionEins called “System and Security Info” due to its recent media appearance. So first of all the app can be obtained via the Apple App store for 0,99€ at the time this article was written. This article will try to answer two basic questions: for whom (or “which groups of people”) is this app helpful, and which security features does this app actually has. The design of the app is straight forward and pretty minimalistic with a clean and modern design. The first page of the Application called “Overview” provides nothing more than the current CPU usage of the device, with detailed subdivision in User, Idle, Total and Load. The next section provides an overview about the used RAM divided into Wire, Active RAM usage, Inactive RAM usage, “other”, free and the total amount of the device’s ram. The next option shows the used and unused part of the devices available storage, with “used”, “free” and total amount of space. While these features can be handled with several other (free and open source) applications I won’t write a comment wether it these components make sense.

Because of Cyber – A Recap

Wed, 11 May 2016 00:00:00 +0000

Troopers16 has been over for quite a while now, but because sharing is caring, we would like to give you some more insight and share some gems that happened over the 2 days of us running a small/medium sized enterprise in mid-west Russia as part of the well received FishBowl side story.

Technology wise the whole infrastructure of FishBowl, as well as the Cyber Emergency Response Team, was hosted on one FreeBSD machine with exception of the challenge scoreboard which was on site only, hence conference network only.
The C.E.R.T. web site was static web site using the jekyll engine. FishBowl on the other hand required some dynamic web magic which is why we choose to use the flask framework. For the FishBowl web design we simply helped ourselves with the styles of the Troopers web site, who of you noticed? 😉
All web related stuff was reverse proxied by an nginx to provide a common layer of technology even though every venture was segregated into its own FreeBSD jail environment.
For mail a simple postfix setup was set up. Having a proper mail server for such »shenanigans« turned out to be very enjoyable, but more on that later.

How ‘security’ black boxes might corrupt your investment

Fri, 29 Apr 2016 00:00:00 +0000

Usually I’m not the kind of guy who talks about such economic topics. Because I’m an engineer / security researcher who is exclusively concerned with understanding technical problems and if possible, solving them accordingly. My whole education is based on this and contains predominantly technical aspects of information security. This sometimes makes it difficult to understand what the market cares about (and why some products are being developed / exist on the market 😉 ). Nevertheless, a current engagement for one of our customers made me stumble upon such a product.

A Trip to Hannover Messe

Wed, 27 Apr 2016 00:00:00 +0000

Once every few years I decide to head to Hannover and attend Hannover Messe, probably the largest industrial trade fair in Germany and apparently on of the most important in the world. As this year’s main topic was “Industrie 4.0” I simply could not resist to go out on a hunt for new and interesting (secure) smart connected magic! And trust me, I was not disappointed – here’s a few of my impressions.

SAP Security @ Troopers16

Mon, 25 Apr 2016 00:00:00 +0000

When it comes to SAP, Troopers has two events that are about Security in SAP Systems in particular. On the first day of the Troopers16 Trainings the BIZEC workshop takes place. The second event is a dedicated SAP track during the conference. Apart from these events there were of course a lot of nice folks to talk to (about SAP) 🙂 This post is a short overview about SAP security @ TROOPERS16.

Defense & Management Day 2

Fri, 15 Apr 2016 00:00:00 +0000

TROOPERS16 offered many different speakers from around the globe. Below are three different talks from the afternoon of Day 2’s Defense and Management Track.

===

The TROOPERS16 talk “Attacking & Protecting Big Data Environments” presented the research of Birk Kauer and Matthias Luft, (ERNW) in which they showed how enterprise-grade “big data” environments, based on e.g. HortonWorks or Cloudera, comprising of components such as HDFS, Yarn, Hue, Flume, Hive, Spark, Sentry/Ranger could be attacked. These environments typically process huge amounts of data. The data is either stored in a cluster file system or streamed into clusters. The processing of these datasets are done by jobs, and these jobs can be arbitrary code execution.

Infiltrate and Syscan 360

Fri, 15 Apr 2016 00:00:00 +0000

Hi everyone,

I spent the last weeks traveling to Singapore and Miami to present my Xenpwn research about double fetch vulnerabilities in paravirtualized devices at Infiltrate and Syscan360. You can find my slides here. Both conferences had great organization, very technical talks and a cool audience. In the following I want to give a short recap of some of the talks I liked the most:

Sean Heelan – Automatic Root-Cause Identification for Crashing Executions (Infiltrate)

Sean Heelan talked about his work on automated root cause analysis. The goal of this research is to give a human researcher a detailed analysis of the potential root causes (in the form of violated predicates) that triggered a crash during a fuzzing run. Sean summarizes the core idea of his research much better than I would be able to in his blog post, which also contains a link to his slides. I’m always a big fan of his talks because he is one of the few peoples working in the intersection between the academic program verification community and the IT security industry.

Discover the Unknown: Analyzing an IoT Device

Mon, 11 Apr 2016 00:00:00 +0000

This blog post will give a brief overview about how a simple IoT device can be assessed. It will show a basic methodology, what tools can be used for different tasks and how to solve problems that may arise during analyses. It is aimed at readers that are interested in how such a device can be assessed, those with general interest in reverse engineering or the ones who just want to see how to technically approach an unknown device.

Summary GI Sicherheit

Fri, 08 Apr 2016 00:00:00 +0000

This is a short summary of selected talks (i.e. those that I found the most interesting of those I was able to personally attend) of the GI Sicherheit 2016.

First of all, congratulations to Dr. Fabian Yamaguchi, who received an award (the GI Promotionspreis) for his PhD thesis “Pattern-Based Vulnerability Discovery“!
His work presents an “approach for identifying vulnerabilities which combines techniques from static analysis, machine learning, and graph mining to augment the analyst’s abilities rather than trying to replace her” by identifying and highlighting patterns of potential vulnerabilities in source code.

TSD 2016 – Follow Up

Thu, 07 Apr 2016 00:00:00 +0000

Thanks again for all the great talks and fruitful discussions @TSD 2016! I hope everybody had a safe trip home and enjoyed Troopers as we did. In the meantime I contacted all speakers to talk about publication of their slidesets. Some of them agreed (or already published them on their own) so I’d like to share these with you:

Alexandre De Oliveira – Assaulting IPX Diameter roaming network
Siddharth Rao – The known unknowns of SS7 and beyond.
Joao Collier de Mendonca – “rucki zucki” scanning tool
Harald Welte – Open Source Network Elements for Security Analysis of Mobile Networks
Ravi & Altaf Shaik – Don’t connect to my 4G base station: investigating info leaks in 4G basebands

Unpatchable – Living with a vulnerable implanted device

Thu, 07 Apr 2016 00:00:00 +0000

TL;DR: Marie Moe talked about security issues of medical devices, especially implantable devices like pacemakers, but not in overwhelming technological depth. She wanted to point out the necessity of intensified security research in the field of medical devices as vendors and medical personnel seem to be lacking necessary awareness of security of devices, interfaces, services, and even data privacy.”Get involved, join the cavalry” was her core message.

Lub-Dub-Lub-Dub-Lub-Dub
Marie started her talk with the sound of a repeating heartbeat. First she introduced how she came up with the topic of her talk: Marie relies on a pacemaker herself andsince she got it implanted she was curious how secure this little device might be. A minimum education of the auditorium followed including an explanation how a human heart works and what a pacemaker does.

Security Assessment of Microsoft DirectAccess

Wed, 06 Apr 2016 00:00:00 +0000

A talk about DirectAccess (an IPv6-only VPN solution) was given by our colleague Ali Hardudi during IPv6 summit. Ali has recently finished his master thesis on this topic.

The DirectAccess VPN technology was introduced by Microsoft starting from Windows server 2008. It allows users remotely, seamlessly and securely connect to their internal network resources without a need to provide user credentials, which is done using different technologies such as Windows domain group policies.

Anonymization IPv6 in PCAPs – Challenges and Wins

Tue, 05 Apr 2016 00:00:00 +0000

Jasper Bongertz is a Senior Technical Consultant at Airbus Defence and Space CyberSecurity. He is focusing on IT security, Incident Response and Network Forensics.
During the IPv6 summit on Troopers16 he had given a talk on anonymization IPv6 in PCAPs and presented his new tool.

Sometimes you need to share your packet capture files (PCAPs), but distributing them involves a risk of exposing the confidential information. To avoid this, you must sanitize your PCAPs. The goal of sanitization is to remove the critical details but keep enough information for the PCAP to still be useful. The original-to-sanitized ratio is based on your goals.

Passive Intelligence Gathering and Analytics – It’s all Just Metadata!

Tue, 05 Apr 2016 00:00:00 +0000

The first talk after the keynote on day 2 of TROOPERS was from Christopher Truncer about passive intelligence gathering and the analytics of that. Christopher Truncer (@ChrisTruncer) is a red teamer with Mandiant. He is a co-founder and current developer of the Veil-Framework, a project aimed to bridge the gap between advanced red team and penetration testing toolsets.

His talk is mainly about defending a network from different threats by collecting and analyzing metadata from different sources.

The Kings in your Castle

Tue, 05 Apr 2016 00:00:00 +0000

At the second day of the TROOPERS16 conference an interesting talk about Advanced Persistent Threats took place from Marion Marschalek and Raphaël Vinot. Marion Marschalek is a Security Researcher, focusing on the analysis of emerging threats and exploring novel methods of threat detection. Marion started her career within the anti-virus industry and also worked on advanced threat protection systems where she built a thorough understanding of how threats and protection systems work and how both occasionally fail.

draft-vyncke-pim-mld-security

Mon, 04 Apr 2016 00:00:00 +0000

Right now, I’m in Buenos Aires for IETF95 where, amongst others, an Internet-Draft authored by Eric Vyncke, Antonios Atlasis and myself will be presented (and hopefully discussed) in two working groups. In the following I want to quickly lay out why we think this is an important contribution.

As some of you may remember about two years ago we started an internal research project on the IPv6 “helper procotol” Multicast Listener Discovery (MLD) and its security properties. One outcome of this research project was Jayson Salazar‘s excellent thesis on the topic (the full document can be found here), another outcome were the related talks we gave at DeepSec 2014 and at Troopers15.

Advanced IPv6 Network Reconnaissance

Sun, 03 Apr 2016 00:00:00 +0000

Fernando Gont, who is specializing in the field of communications protocols security, gave a talk during this year’s Troopers IPv6 summit. He spoke about network reconnaissance techniques in IPv6 area and presented a brand new set of tools for this purpose.

Comparing with methods for IPv4, reconnaissance techniques for IPv6 should be different. It offers much larger address space, so such attacks as brute force address scanning are not feasible anymore, because it would take too much time to send one packet to each and every possible address. Fernando has also noted that in general network reconnaissance support in security tools has traditionally been poor. Together these facts prompt that it’s time for something new, and recently a new IETF RFC 7707 was published.

Patch Me If You Can

Sat, 02 Apr 2016 00:00:00 +0000

Right after the Opening Keynote of TROOPERS16, an informative and interesting talk took place at the SAP Security track. This talk was given by three speakers; Damian Poddebniak who is currently a master student at the University of Applied Sciences of Münster, Sebastian Schinzel who works as an IT security Professor at the University of Applied Sciences of Münster and he is also the founder of CycleSEC GmbH and finally the sixth-time speaker at Troopers “Andreas Wiegenstein” who is the CTO of Virtual Forge GmbH and a professional SAP security consultant since 2003.

Tools for Troubleshooting and Monitoring IPv6 Networks

Sat, 02 Apr 2016 00:00:00 +0000

Yet another interesting 180-minute workshop in IPv6 Security Summit of TROOPERS16, which aimed to introduce the IPv6 troubleshooting and monitoring tools, which are essentially needed by users in order to know how to deal with IPv6 in any IPv6-enabled network.

Before we dive into this post, let me introduce you in few words “Gabriel Müller” the speaker and the instructor of this workshop. Gabriel works as a senior consultant at AWK Group by mainly assisting clients in the public and private sectors as a project manager and an expert in the network area.

Building a secure and reliable IPv6 Guest Wi-Fi Network by Christopher Werny

Fri, 01 Apr 2016 00:00:00 +0000

Christopher Werny leads the network security team for ERNW and since 2005 he is involved in numerous IPv6 projects where he is responsible for planning, implementation and troubleshooting existing projects.

The first topic he approached was “How to build a conference WLAN Network in General”. The very first suggestion was to put it to the 5GHz channel because there could be a lot of interferences in the 2.4 GHz channel. The basic idea here is to disable 802.11b completely if it´s possible in your environment and no-one is using it anyway. Further you should also consider nearby Wi-Fi signals and on which channels they reside. His next recommendation was about setting the inactivity timer to short intervals, this will avoid unnecessary resource spending from the APs when they try to track down moved or shut down devices. His last general recommendation from him was regarding a central DHCP Server. This will enable the roaming from mobile devices without getting a new IP-Address when bridged mode is enabled for the APs.

Caring for file formats

Fri, 01 Apr 2016 00:00:00 +0000

Ange Albertini is a reverse engineer and author of Corkami.

First and foremost he explained what a polyglot file is. A polyglot is a special file that has more than one type in the same file. For example, Ange Albertini demonstrated a polyglot which is a pdf, a pdf reader, a java executable and an html file inside of one file. The second polyglot he demonstrated was a file which had the characteristics that when you encrypted it with AES you get a PNG image and if it´s encrypted with another key you will get a flash video and when you encrypted it with DES you get a PDF document. He pointed out that a file format is not just a sequence of byte it´s rather a computer dialect to communicate between communities. He also highlighted that people don’t really care about what is behind the file format they only what to use it and communicate with other people.

Imma Chargin Mah Lazer-How to protect against (D)DoS attacks

Fri, 01 Apr 2016 00:00:00 +0000

Denial of Service (DoS) attacks aim to make services and systems unavailable to legitimate users . If these attacks are performed by multiple sources at the same time and for the same target, they are called Distributed Denial of Service (DDoS) attacks. This talk “Imma Chargin Mah Lazer” describes different types of (D)DoS attacks that are out in the wild and are seen on a daily basis by different corporations. Furthermore, a multi-layered strategy to mitigate such kinds of attacks has been presented within the talk. The speaker is Dr. Oliver Matula, an IT security researcher at ERNW who holds a PHD degree in physics. He presented the topic in a simple way which eases the delivery of information to audience of different technical levels and backgrounds.

QNX: 99 Problems but a Microkernel ain’t one!

Fri, 01 Apr 2016 00:00:00 +0000

The talk “QNX: 99 Problems but a Microkernel ain’t one!” was part of the Troopers conference in Heidelberg, 16 March 2016. The talk was done by the researchers Alex Plaskett and Georgi Geshev from the MWR Labs. The MWR Labs is the research department of the cyber security consultancy MWR InfoSecurity located in the UK.

The talk provided an overview of the research on the architecture and security systems of the QNX kernel with focus on the Blackberry 10 operating system. The talk was divided into two parts. First Alex Plaskett gave an introduction regarding the general structure of the QNX operation system and introduced the main subsystems. Second Georgi Geshev presented tools and approaches to abuse vulnerabilities in the QNX system.

The road to secure Smart Cars: ENISA approach

Fri, 01 Apr 2016 00:00:00 +0000

At TROOPERS16, Dr. Cédric LÉVY-BENCHETON an expert in cyber security at ENISA, the European Union Agency for Network and Information Security. Dr. Cédric LÉVY-BENCHETON holds a presentation about cyber security of IoT (Internet of Things) and smart cars he presents the current threats in IoT and Smart cars. ENISA is an agency of the European Union. ENISA assists the Commission, the Member States and, the business community in meeting the requirements of network and information security.

unrubby: reversing without reversing

Fri, 01 Apr 2016 00:00:00 +0000

The talk “unrubby: reversing without reversing” was part of the Troopers conference in Heidelberg, 16 March 2016. The talk was done by Richo Healey, who is currently working on the security engineering team at the Irish payment company Stripe. Richo Healey is an experienced conference speaker. Amongst other he has spoken at Kiwicon, DEF CON and 44con.

In his talk Richo Healey spoke about reverse engineering of Ruby software. First he talked about existing tools and techniques to regenerate source code from Ruby bytecode. Then he presented a new concept, which is implemented in his tool “unrubby”.

BMC BladeLogic: CVE-2016-1542 and CVE-2016-1543