When I recently joined the Windows Security team at ERNW, Enno asked me if I
wanted to write a ‘welcome’ blogpost on a topic of my choosing… Up for the
challenge, and since I had been playing with BloodHound & Cypher for the last
couple of months, I first thought I would do something on that topic.
However, after gathering my thoughts and some Cypher I had collected here and
there, I realized that the topic of Bloodhound Cypher might actually require
several blog posts… And so I changed my mind. I will keep the joys of Cypher for
later, and in this post, I will talk about a tiny tool I wrote to query the
Mitre ATT&CK™ knowledge base from the comfort of a PowerShell prompt.
In Mai 2018, Tobias and me were in Cologne at the Building IoT conference. The
topics of the talks covered a broad spectrum of the Internet of Things field.
There were three tracks covering different topics ranging from the jungle of IoT
protocols, secure Linux hypervisors specially developed for IoT modules to
machine learning and blockchain.
In “How to secure over the air updates” the speaker showed how to securely
deploy updates over the standard communication channel to the target device.
Many consumer IoT devices have a short support for updates if they get any
updates at all. This leads and in the future will lead to bad news like botnets,
bricked devices and exploited IP cameras streaming publicly. Therefore, a patch
and vulnerability management is required – especially in industrial Internet of
Things devices. Some updates have to be performed over the air due to the
physical inaccessibility of some IoT devices in production environments. There
are two possibilities to update such systems: First, a rescue OS (Operating
System) boots and overwrites the existing production OS. The second option is a
redundant OS, which copies the updates to the inactive OS and reboots to that.
I had the pleasure to give a presentation at the
Security Interest Group Switzerland Technology Conference
about modern application stacks and how they can be used to improve
infrastructure and application security posture – the slides can be found
here.
Besides seeing a lot of old friends, I
particularly enjoyed a round table discussion on security integration into CI/CD
pipelines. There was a relevant exchange on approaches that actually work and
were tested in environments beyond just recommending some container scanner
(product). One participant had an interesting case study on how they enabled
developers to maintain WAF policies in configuration files in their code
repository including automated deployment to the WAF. He also emphasized that
the environments with actual security benefits resulted from a close cooperation
between development and security team (were domain knowledge was combined 😉 ).
After quite some time and work, I’m happy to announce the new release of the
LinuxHeapAnalysis
Plugins, which are now part of the Rekall
project, but not yet part of an official Rekall release, so you have to grab
them manually.
This release fixes several bugs and adds the following features:
Support for Glibc version 2.26 (tcache chunks) and 2.27
Heapsearch now includes Rekall’s yara scan functionality
x86 Glibc versions with a modified MALLOC_ALIGNMENT value of 16 (as done in
arch’s glibc package 2.26) are now supported
Improved retrieval of main_arena and new automated retrieval of malloc_par
struct; so for the majority of cases, the corresponding cmd line options are
not necessary anymore and hence no debug information have to be retrieved.
main_arena and malloc_par struct retrieval now also applies for statically
linked binaries; there might however be cases, where it is necessary to
specify the malloc_par struct offset and the used glibc version number
While Glibc version 2.27 does not really change much for the heap from a
forensics point of view, version 2.26 introduced a new feature called tcache
(per thread cache). Those caches are essentially just a new type of bin, holding
freed chunks, but
seem to improve the performance.
Sadly,
only two days after its
first commit,
there was already a blog post explaining
the functionality (not so sad 😉 ) and also some discovered vulnerabilities
(here we go with the sad part).
Besides introducing a new landscape for attackers, this feature added two new
heap management structs and one additional chunk per thread-heap (each thread
has its own heap, up until an upper limit). This chunk is located at the
beginning of each heap and hence, part of a raw heap dump (so be aware of that,
if you are doing a raw analysis without the plugins).
The chunk holds the content of the tcache_perthread_struct, which has to
members:
IoT is everywhere right now and there are a lot of products out there. I have
been looking at an IP Gateway lately and found some serious issues. The
Busch-Welcome IP-Gateway from Busch-Jaeger
is one of the devices that bridges the gap between sensors and actors in your
smart home and the network/Internet. It enables the communication to a door
control system that implements various smart home functions. The device itself
is offering an HTTP service to configure it, which is protected by a username
and password. Some folks even actually expose the device and its login to the
Internet. I tried to configure one of these lately and stumbled upon some
security issues that I would like to discuss in this blog post.
Last week (25^(th) – 27^(th) April), I attended the “Sicherheit 2018” in
Konstanz which is the annual meeting of the security community of the
Gesellschaft für Informatik e.V. (GI) in Germany. The conference is in equal
proportions attended by researchers and people of the industry working in
security-related disciplines which lead to lively and pleasant discussions
conversations.
The topics discussed were contentual wide-reaching, so there were very technical
talks like Sebastian Banescu who was the winner and one of two candidates
nominated for the best PhD thesis award presenting about “Characterizing the
Strength of Software Obfuscation Against Automated Attacks”, as well as
conceptual presentations such as Sabrina Krausz elucidated her bachelor thesis
about an integrated procedure model for planning and implementing an ISMS on the
example of the pharmaceutical production.
We are very excited to publish some (more to come!) of our photos from
TROOPERS18! Based on feedback from #TR18
we would also like to take a moment for our official TROOPERS photographer to
introduce himself and tell you a little about what inspires him.
Peter Walter is a 37 year old photographer based in Germany near Stuttgart. For
many years now he is the official TROOPERS photographer and very proud to be
part of the Troopers family.
As our journey to the new product continues we are facing the typical challenges
of phase 2 in the software development life cycle, the design phase (see
part 1 for the overview of
the phases):
Design and Components
The new tool will deal with Active Directory security so it has to integrate
into large scale Windows based customer environments, which in turn makes the
decision about the components quite easy ;-). We have chosen .NET as our primary
development platform including key components from Microsoft to run our
application, these components include the IIS and Microsoft SQL Express/Server
and of course one Windows Server.
Lately I’ve been analyzing a .NET binary that was quite interesting. It was a
portable binary that shipped without any third-party dependencies. I started
looking at the .NET assembly with ILSpy and noticed that there was not that much
code that ILSpy found and there were a lot of references to classes/methods that
were neither in the classes identified by ILSpy nor were they part of the .NET
framework.
At some point I was going through everything that ILSpy displayed about the
binary, including the resources which were looking very interesting:
Stefan and I had the pleasure of joining a one-day closed workshop on Industrial
IoT Security. As always, we ended up with plenty of new research ideas and great
contacts. We hope of course to post on follow-up research, but in this short
post we quickly want to publish our slides which contain our input for the
workshop. We mainly presented on IT security challenges for modern IIoT
environments and presented some case studies for successful hardening/protection
of IIoT environments as well as security in IIoT product development.
