The Windows Insight repository now
hosts the
Windows Telemetry ETW Monitor
framework. The framework monitors and reports on Windows Telemetry ETW (Event
Tracing for Windows) activities – ETW activities for providing data to Windows
Telemetry. It consists of two components:
the Windbg Framework: a set of scripts for monitoring Windows Telemetry ETW
activities. The scripts are fed to a running windbg instance, connected to the
Windows instance whose Windows Telemetry ETW activities are monitored.
the Telemetry Information Visualization (TIV) framework for visualization of
information and statistics. The TIV framework is a set of Python scripts that
visualize information and statistics based on the data produced by the Windbg
Framework. The output of the TIV framework is a report in the form of a web
page.
Our workshop “TLS in the enterprise” was held for the first time at Troopers
2018 and was our special contribution to the IT Security world to increase the
usage of TLS and point out the pitfalls, when switching to TLS.
But time is changing and TLS is a kind of standard nowadays, at least when
looking at HTTPS, but there are still a lot of things to do regarding other
protocols like
Containerization dominates the market nowadays. Fancy buzzwords like continuous
integration/deployment/delivery, microservices, containers, DevOps are floating
around, but what do they mean? What benefits do they offer compared to the old
dogmas? You’re gonna find out in our training!
We are going to start with the basics of Docker, Containers and DevOps, but soon
you’ll end up with your own applications running inside containers with the
images residing in your own registry. Of course, following the microservices
approach, and the second day hasn’t even started.After the fundamental topics of
containerization are understood, you’re going to create and operate your own
Kubernetes cluster. A lot of fun and challenging exercises lie ahead, to give
you hands-on experience with all the technologies.
Some time ago I had the pleasure to speak at the BASTA!
Autumn 2019 conference. There, I promised to publish my
slides
such that they can be used as a reference for developers and security guys like
me. And with this blog post I would like to hold up to my promise.
Overall, the talk was about the challenges of “How to bring security into modern
DevOps processes”. Hence, I demonstrated how security can be integrated more or
less seamlessly into the modern agile software development workflow. I proposed
some risk-depended recommendations about which measurements should be
established, for example, within the CI pipeline.
“If it’s a thing, then there’s an app for it!”…We trust mobile apps to process
our bank transactions, handle our private data and set us up on romantic dates.
However, few of us care to wonder,”How (in)secure can these apps be?” Well… at
Troopers 20, you can learn how to answer this question yourself!
In our 2 day long “Hacking mobile apps” workshop, we teach how to find security
vulnerabilities in mobile apps, exploit them and defend against them. We start
from scratch, therefore no prior experience in hacking or developing mobile apps
is required. Whether you want to learn how to pentest mobile apps, you are an
app developer that fancies to secure his/her apps, or just curios, our workshop
is a jumpstart to your goal.
Windows 10 is one of the most commonly deployed operating systems at this time.
Knowledge about its components and internal working principles is highly
beneficial. Among other things, such a knowledge enables:
in-depth studies of undocumented, or poorly documented, system
functionalities;
development of performant and compatible software to monitor or extend the
activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.
The “Insight into Windows Internals” training offered at TROOPERS20 delivers
knowledge on the core components and inner working principles of Windows 10. For
example, the training provides knowledge on how Windows 10 uses virtualization
to isolate security-critical functionalities from attackers that have managed to
compromise the system. The training includes a variety of practical exercises
allowing attendees to observe first-hand the operation of Windows 10.
This week I was at DevSecCon in London
to present my current research on Red Hat OpenShift. In this talk, I gave a
brief introduction to OpenShift, demonstrated some threats that exist for such
environments, and dived into different configuration issues that may affect the
security of OpenShift environments. The implications of misconfigurations of
such an environment have been shown in live demos.
Hi there,
like in recent years the popular
Hacking 101 workshop
will take place on TROOPERS20, too! The workshop will give you an insight into
the hacking techniques required for penetration testing. These
techniques will cover various topics:
Information gathering
Network scanning
Web application hacking
Low-level exploitation
…and more!
During this workshop you will learn, step by step, a testing methodology
that applies to the majority of scenarios. So imagine you have to assess the
security of a system running on the Internet. How would you start? First,
you need a good understanding of the target, including running services or
related systems. Just scanning the target’s IP address will most likely not
reveal all relevant information you can get. In the information gathering step,
you will learn where you could find more relevant information than just a list
of open ports. A brief understanding of the target and it’s related
systems/services/applications will make scanning and identifying
vulnerabilities a lot easier and more effective. Then, the last step will be
the exploitation of the identified vulnerabilities, with the ultimate aim to
get access to the target system and pivot to other, probably internal,
systems and resources.
We are happy to announce that TROOPERS20 will feature the 5th anniversary of the
popular Windows & Linux Binary Exploitation workshop!
In this workshop, attendees will learn how to exploit those nasty stack-based
buffer overflow vulnerabilities by applying the theoretical methods taught in
this course to hands-on exercises. Exercises will be performed for real world
(32-bit) software such as the Foxit Reader Plugin for Firefox, Wireshark, and
nginx.
Each exercise will start with an initially uncontrolled overwrite of the
instruction pointer register by a stack-based buffer overflow vulnerability.
From there on, we will work our way through many obstacles to finally gain
remote code execution. Obstacles that will be encountered during the exercises
include modern stack-based buffer overflow defense mechanisms such as stack
cookies, data execution prevention (DEP), and address space layout randomization
(ASLR). For all of these defense mechanisms, attendees will learn and apply
certain methods to bypass the protection.
After our
last blogpost
regarding Emotet and several other Emotet and Ransomware samples that we
encountered, we recently stumbled across a variant belonging to the Gozi,
ISFB, Dreambot respectively Ursnif family. In this blogpost, we want to
share our insights from the analysis of this malware, whose malware family is
mainly known for being a banking trojan that typically tries to infect browser
sessions and sniff/redirect data. In particular, we are going to provide details
about the first stage Word Document, the embedded JavaScript/XSL document, an
in-depth runtime analysis of the downloaded executable, and some details
regarding detection.
