I’ve been at Black Hat Vegas last week and in the following I’ll shortly discuss
some talks I’ve attended and which I found interesting.
Gabriele Fisher &
Luke Valenta: Monsters in the Middleboxes.
Building Tools for Detecting HTTPS Interception
This talk was about identifying if inbound HTTPS traffic reaching a server had
been intercepted by a middlebox (or
its software equivalent which is usually called “middleware”, a prominent
example being the Lenovo Superfish piece a few years ago) on its path.
Some weeks ago, Heinrich and I had the pleasure to participate in the
heisec-Webinar
“Emotet bei Heise – Lernen aus unseren Fehlern”.
We really enjoyed the webinar and the (alas, due to the format: too short)
discussions and we hope we could contribute to understand how to make Active
Directory implementations out there a bit safer in the future.
Now, I have the pleasure to announce a continuation of our talk about Active
Directory security next week, Wednesday, 14^(th) of August @heisec in the format
of a technical talk
“Emotet bei Heise – Online-Fachgespräch zum Schutz vor Cybercrime”.
Seats are still available 😉
During security assessments we sometimes obtain access to a restricted shell on
a target system. To advance further and gain complete control of the system, the
next step is usually to break out of this shell. If the restricted shell
provides access to certain system binaries, these binaries can often be
exploited to perform such a break out. Here we would like to show an interesting
example of such a break out by using the tcpdump binary.
While waiting for a download to complete, I stumbled across an interesting
blogpost.
The author describes a flaw in LibreOffice that allowed an attacker to execute
code. Since this was quite recent, I was interested if my version is vulnerable
to this attack and how they fixed it. Thus, I looked at the sources and luckily
it was fixed. What I didn’t know before however was, that macros shipped with
LibreOffice are executed without prompting the user, even on the highest macro
security setting. So, if there would be a system macro from LibreOffice with a
bug that allows to execute code, the user would not even get a prompt and the
code would be executed right away. Therefor, I started to have a closer look at
the source code and found out that exactly this is the case!
After the
Emotet Incident at Heise,
where
ERNW has been consulted for Incident Response,
we decided to start a blogpost series, in which we want to regularly report on
current attacks that we observe. In particular we want to provide details about
the utilized pieces of malware, different stages, and techniques used for the
initial infection and lateral movement. We hope that this information might help
you to detect ongoing incidents, apply countermeasures, and in the best case to
figure out proactive countermeasures and security controls beforehand.
This post by Jeff (@jeffmakes) was delayed due to interferences with other
projects but nevertheless, enjoy!
This year, it was my great honour to design the hardware for the Troopers19
badge.
We wanted to make a wifi-connected MicroPython-powered badge; something that
would be fun to take home and hack on. It was a nice opportunity to use a
microcontroller platform that I hadn’t tried before. I also used the project as
a chance to finally migrate my PCB workflow from Eagle to Kicad. Inevitably it
was a painful transition, which resulted in quite some delay to the project as I
floundered around in the new tool, but it does mean the design files are in an
open format which I hope will benefit the community of Troopers attendees and
future badge designers!
innovaphone fixed several vulnerabilities in two
VoIP products that we disclosed a while ago. The affected products are the
Linux Application Platform
and the
IPVA.
Unfortunately, the release notes are not public (yet?) and the vendor does not
include information about the vulnerabilities for the Linux Application
Platform. Therefore, we decided to publish some more technical details for the
issues.
Multiple Vulnerabilities in Linux Application Platform
The Linux Application Platform was affected by three vulnerabilities that could
be chained to get full root access to a target system. However, the initial
access vector is only exploitable by authenticated users. The vulnerabilities
have been identified on the Linux Application Platform V10 SR41. According to
the vendor they have been fixed in
V10 SR57.
Again, Cisco released security advisories for their software-defined networking
(SDN) solution called Application Centric Infrastructure (ACI). As before (see
blog post
here),
the published advisories originated from research performed in our ACI lab.
In some organizations we work with a certain state of IPv6 deployment has been
reached in the interim which includes, among others, the following aspects:
the network infrastructure is IPv6-enabled (incl. interface addressing,
routing [protocols] and the like).
parts of supporting services (security functions, monitoring, system
management) include IPv6 in a proper way.
3rd party providers have been contractually obliged to deliver their services
in an “IPv6-enabled” mode (as opposed to only being “IPv6-capable” which was
the standard requirement in many RFIs during earlier years).
It might then happen that networking people (who often are the initial
motivators for deploying IPv6) in such organizations are stating, when asked
about IPv6: “it’s [mostly] done”.
Point is that, alas, this does not necessarily mean that a single service or
application is *actually using* IPv6, so while the above certainly constitutes
an achievement it might not even be halfway through.
The next major release of DirectoryRanger is now available for customers, and
for everyone who would like to try it ;-). Current attacks show that quite often
the topic of Active Directory Security is not on the security agenda, but it
should be, and this was the reason for us to build the tool and, of course, to
maintain and improve it. So what are the major new features released with
DirectoryRanger 1.5.0? Here we go: