On November 3rd, 2019, we have reported a critical vulnerability affecting the
Android Bluetooth subsystem. This vulnerability has been assigned
CVE-2020-0022
and was now patched in the
latest security patch
from February 2020. The security impact is as follows:
On Android 8.0 to 9.0, a remote attacker within proximity can silently execute
arbitrary code with the privileges of the Bluetooth daemon as long as
Bluetooth is enabled. No user interaction is required and only the Bluetooth
MAC address of the target devices has to be known. For some devices, the
Bluetooth MAC address can be deduced from the WiFi MAC address. This
vulnerability can lead to theft of personal data and could potentially be used
to spread malware (Short-Distance Worm).
On Android 10, this vulnerability is not exploitable for technical reasons and
only results in a crash of the Bluetooth daemon.
Android versions even older than 8.0 might also be affected but we have not
evaluated the impact.
Users are strongly advised to install the latest available security patch from
February 2020. If you have no patch available yet or your device is not
supported anymore, you can try to mitigate the impact by some generic behavior
rules:
Did you know that in the ever evolving field of Web and Desktop apps, it turns
out these can all now be powered with JavaScript? You read that right:
JavaScript is now used to power both web apps (Node.js) as well as Desktop apps
(Electron). What could possibly go wrong?
So, the burning question is: how does this affect Web and Desktop app security?
If you want to find out, come to our training and you will experience this in a
100% hands-on fashion! 🙂
Once again, we are super excited to announce that Blackhoodie is happening at
Troopers 2020. This is the 3rd time that Blackhoodie is joining with Troopers.
As always, one of the main motivation for Blackhoodie is bringing more women
into reversing and other core security topics. So we would like to see more
women apply to the training slots. However, if you are not a woman and still
feel really excited about Blackhoodie, you are welcome to apply. The
registration is open now. Please hurry up and make your registration now. We
will close the registration once the seats are filled up with enough quality
submissions. We do have a very limited number of seats at this training site. So
we apologize in advance if we can’t accommodate everyone, even though we wish we
could!
The Windows Insight repository now
hosts the
Windows Telemetry ETW Monitor
framework. The framework monitors and reports on Windows Telemetry ETW (Event
Tracing for Windows) activities – ETW activities for providing data to Windows
Telemetry. It consists of two components:
the Windbg Framework: a set of scripts for monitoring Windows Telemetry ETW
activities. The scripts are fed to a running windbg instance, connected to the
Windows instance whose Windows Telemetry ETW activities are monitored.
the Telemetry Information Visualization (TIV) framework for visualization of
information and statistics. The TIV framework is a set of Python scripts that
visualize information and statistics based on the data produced by the Windbg
Framework. The output of the TIV framework is a report in the form of a web
page.
Our workshop “TLS in the enterprise” was held for the first time at Troopers
2018 and was our special contribution to the IT Security world to increase the
usage of TLS and point out the pitfalls, when switching to TLS.
But time is changing and TLS is a kind of standard nowadays, at least when
looking at HTTPS, but there are still a lot of things to do regarding other
protocols like
Containerization dominates the market nowadays. Fancy buzzwords like continuous
integration/deployment/delivery, microservices, containers, DevOps are floating
around, but what do they mean? What benefits do they offer compared to the old
dogmas? You’re gonna find out in our training!
We are going to start with the basics of Docker, Containers and DevOps, but soon
you’ll end up with your own applications running inside containers with the
images residing in your own registry. Of course, following the microservices
approach, and the second day hasn’t even started.After the fundamental topics of
containerization are understood, you’re going to create and operate your own
Kubernetes cluster. A lot of fun and challenging exercises lie ahead, to give
you hands-on experience with all the technologies.
Some time ago I had the pleasure to speak at the BASTA!
Autumn 2019 conference. There, I promised to publish my
slides
such that they can be used as a reference for developers and security guys like
me. And with this blog post I would like to hold up to my promise.
Overall, the talk was about the challenges of “How to bring security into modern
DevOps processes”. Hence, I demonstrated how security can be integrated more or
less seamlessly into the modern agile software development workflow. I proposed
some risk-depended recommendations about which measurements should be
established, for example, within the CI pipeline.
“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process
our bank transactions, handle our private data and set us up on romantic dates.
However, few of us care to wonder,”How (in)secure can these apps be?” Well… at
Troopers 20, you can learn how to answer this question yourself!
In our 2 day long “Hacking mobile apps” workshop, we teach how to find security
vulnerabilities in mobile apps, exploit them and defend against them. We start
from scratch, therefore no prior experience in hacking or developing mobile apps
is required. Whether you want to learn how to pentest mobile apps, you are an
app developer that fancies to secure his/her apps, or just curios, our workshop
is a jumpstart to your goal.
Windows 10 is one of the most commonly deployed operating systems at this time.
Knowledge about its components and internal working principles is highly
beneficial. Among other things, such a knowledge enables:
in-depth studies of undocumented, or poorly documented, system
functionalities;
development of performant and compatible software to monitor or extend the
activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.
The “Insight into Windows Internals” training offered at TROOPERS20 delivers
knowledge on the core components and inner working principles of Windows 10. For
example, the training provides knowledge on how Windows 10 uses virtualization
to isolate security-critical functionalities from attackers that have managed to
compromise the system. The training includes a variety of practical exercises
allowing attendees to observe first-hand the operation of Windows 10.
This week I was at DevSecCon in London
to present my current research on Red Hat OpenShift. In this talk, I gave a
brief introduction to OpenShift, demonstrated some threats that exist for such
environments, and dived into different configuration issues that may affect the
security of OpenShift environments. The implications of misconfigurations of
such an environment have been shown in live demos.
