This post by Jeff (@jeffmakes) was delayed due to interferences with other
projects but nevertheless, enjoy!
This year, it was my great honour to design the hardware for the Troopers19
badge.
We wanted to make a wifi-connected MicroPython-powered badge; something that
would be fun to take home and hack on. It was a nice opportunity to use a
microcontroller platform that I hadn’t tried before. I also used the project as
a chance to finally migrate my PCB workflow from Eagle to Kicad. Inevitably it
was a painful transition, which resulted in quite some delay to the project as I
floundered around in the new tool, but it does mean the design files are in an
open format which I hope will benefit the community of Troopers attendees and
future badge designers!
innovaphone fixed several vulnerabilities in two
VoIP products that we disclosed a while ago. The affected products are the
Linux Application Platform
and the
IPVA.
Unfortunately, the release notes are not public (yet?) and the vendor does not
include information about the vulnerabilities for the Linux Application
Platform. Therefore, we decided to publish some more technical details for the
issues.
Multiple Vulnerabilities in Linux Application Platform
The Linux Application Platform was affected by three vulnerabilities that could
be chained to get full root access to a target system. However, the initial
access vector is only exploitable by authenticated users. The vulnerabilities
have been identified on the Linux Application Platform V10 SR41. According to
the vendor they have been fixed in
V10 SR57.
Again, Cisco released security advisories for their software-defined networking
(SDN) solution called Application Centric Infrastructure (ACI). As before (see
blog post
here),
the published advisories originated from research performed in our ACI lab.
In some organizations we work with a certain state of IPv6 deployment has been
reached in the interim which includes, among others, the following aspects:
the network infrastructure is IPv6-enabled (incl. interface addressing,
routing [protocols] and the like).
parts of supporting services (security functions, monitoring, system
management) include IPv6 in a proper way.
3rd party providers have been contractually obliged to deliver their services
in an “IPv6-enabled” mode (as opposed to only being “IPv6-capable” which was
the standard requirement in many RFIs during earlier years).
It might then happen that networking people (who often are the initial
motivators for deploying IPv6) in such organizations are stating, when asked
about IPv6: “it’s [mostly] done”.
Point is that, alas, this does not necessarily mean that a single service or
application is *actually using* IPv6, so while the above certainly constitutes
an achievement it might not even be halfway through.
The next major release of DirectoryRanger is now available for customers, and
for everyone who would like to try it ;-). Current attacks show that quite often
the topic of Active Directory Security is not on the security agenda, but it
should be, and this was the reason for us to build the tool and, of course, to
maintain and improve it. So what are the major new features released with
DirectoryRanger 1.5.0? Here we go:
The PowerShell Conference Europe 2019 took place last
week in Hannover, and I had the pleasure to attend and speak for the second year
in a row. I want to thank @TobiasPSP@Alexandair@sqldbawithbeard and the
@PSConfEU crew for putting up this
#PowerShell feast. From a RaspberryPi
to the Clouds, from PowerShell internals to a dancing Lego robot, if you have
anything to do with windows, PowerShell, or a computer, there was some content
made for you…[I will update this post with links as soon as the videos are
published. Make sure to check it out.]
In this post I’ll cover some properties of the Windows Server 2019 IPv6 stack.
It is an update of a similar post I wrote on the
IPv6 properties of Server 2016
a while ago.
For this reason I will mostly look at the same properties I did at the time
(read: at times without providing too much technical background information;
that can be found in the other post) and I’ve hence performed the same types of
practical tests.
The Windows Insight repository
currently hosts four articles on VSM (Virtual Secure Mode):
Virtual Secure Mode: Architecture Overview (Aleksandar Milenkoski): In
this work, we discuss the architecture of a virtualized Windows environment.
**Virtual Secure Mode: Communication Interfaces **(Aleksandar Milenkoski):
In this work, we discuss the communication interfaces that VSM implements:
Isolated User Mode (IUM) system calls, normal-mode services, secure services,
and hypercalls.
Virtual Secure Mode: Protections of Communication Interfaces (Aleksandar
Milenkoski): This work discusses implemented mechanisms for securing the
above VSM communication interfaces. This includes restrictions on issuing
hypercalls, data marshalling and sanitization, and secure data sharing.
Virtual Secure Mode: Initialization (Dominik Phillips, Aleksandar
Milenkoski): This work describes the process for VSM initialization
activities performed by the Windows loader and the Windows kernel when Windows
10 is booted.
Heise berichtet aktuell öffentlich über die
Emotet-Infektion im eigenen Haus,
bei dessen Aufklärung ERNW unterstützte.
Damit liefert Heise Informationen
zum Verlauf aktueller Angriffe, aber insbesondere auch wertvolle Einsichten zu
Vorbeugung, Erkennung, Analyse und Gegenmaßnahmen aus eigener Erfahrung, wie sie
nur selten der Öffentlichkeit preisgegeben werden.
Ein Team aus Incident-Response Spezialisten der ERNW Research unterstützte Heise
bei der Analyse und Rekonstruktion des Vorfalls und analysierte die
Schadsoftware, um deren Ausbreitungswege nachzuvollziehen und IoCs (Indicators
of Compromise) zu extrahieren. Hierdurch konnten effektive Gegenmaßnahmen
entwickelt und gemeinsam mit Heise erfolgreich umgesetzt werden.
The Windows Insight repository
currently hosts three articles on the TPM (Trusted Platform Module):
The TPM: Communication Interfaces (Aleksandar Milenkoski): In this work,
we discuss how the different components of the Windows 10 operating system
deployed in user-land and in kernel-land, use the TPM. We focus on the
communication interfaces between Windows 10 and the TPM. In addition, we
discuss the construction of TPM usage profiles, that is, information on system
entities communicating with the TPM as well as on communication patterns and
frequencies;
The TPM: Integrity Measurement (Aleksandar Milenkoski): In this work, we
discuss the integrity measurement mechanism of Windows 10 and the role that
the TPM plays
as part of it. This mechanism, among other things, implements the production
of measurement data. This involves calculation of hashes of relevant
executable files or of code sequences at every system startup. It also
involves the storage of these hashes and relevant related data in log files
for later analysis;