Last week (25^(th) – 27^(th) April), I attended the “Sicherheit 2018” in
Konstanz which is the annual meeting of the security community of the
Gesellschaft für Informatik e.V. (GI) in Germany. The conference is in equal
proportions attended by researchers and people of the industry working in
security-related disciplines which lead to lively and pleasant discussions
conversations.
The topics discussed were contentual wide-reaching, so there were very technical
talks like Sebastian Banescu who was the winner and one of two candidates
nominated for the best PhD thesis award presenting about “Characterizing the
Strength of Software Obfuscation Against Automated Attacks”, as well as
conceptual presentations such as Sabrina Krausz elucidated her bachelor thesis
about an integrated procedure model for planning and implementing an ISMS on the
example of the pharmaceutical production.
We are very excited to publish some (more to come!) of our photos from
TROOPERS18! Based on feedback from #TR18
we would also like to take a moment for our official TROOPERS photographer to
introduce himself and tell you a little about what inspires him.
Peter Walter is a 37 year old photographer based in Germany near Stuttgart. For
many years now he is the official TROOPERS photographer and very proud to be
part of the Troopers family.
As our journey to the new product continues we are facing the typical challenges
of phase 2 in the software development life cycle, the design phase (see
part 1 for the overview of
the phases):
Design and Components
The new tool will deal with Active Directory security so it has to integrate
into large scale Windows based customer environments, which in turn makes the
decision about the components quite easy ;-). We have chosen .NET as our primary
development platform including key components from Microsoft to run our
application, these components include the IIS and Microsoft SQL Express/Server
and of course one Windows Server.
Lately I’ve been analyzing a .NET binary that was quite interesting. It was a
portable binary that shipped without any third-party dependencies. I started
looking at the .NET assembly with ILSpy and noticed that there was not that much
code that ILSpy found and there were a lot of references to classes/methods that
were neither in the classes identified by ILSpy nor were they part of the .NET
framework.
At some point I was going through everything that ILSpy displayed about the
binary, including the resources which were looking very interesting:
Stefan and I had the pleasure of joining a one-day closed workshop on Industrial
IoT Security. As always, we ended up with plenty of new research ideas and great
contacts. We hope of course to post on follow-up research, but in this short
post we quickly want to publish our slides which contain our input for the
workshop. We mainly presented on IT security challenges for modern IIoT
environments and presented some case studies for successful hardening/protection
of IIoT environments as well as security in IIoT product development.
Hey there, for those of you that roll your eyes when writing the nth Information
Disclosure Finding in a report, here is a short story of how such information
helped compromising a system.
In a recent penetration we found a hidden debug page which disclosed information
about internal parameters. Along with database connection strings and key
material there was a username and a user home parameter disclosed on said debug
page.
During a recent customer project we identified several vulnerabilities in the
VMware vRealize Automation Center such as a DOM-based cross-site scripting and a
missing renewal of session tokens during the login. The vulnerabilities have
been disclosed to VMware on November 20th, 2017. A security advisory for the
vulnerabilities has been made available
here on April
12th, 2018.
Just a few words regarding the cross-site scripting vulnerability. This
vulnerability is present within a GET request to the URL /vcac/gadgets/ifr
because of certain URL parameters whose values are directly passed to an eval
function call. The vulnerable parameters are gwt:onLoadErrorFn and
gwt:onPropertyErrorFn. It seems that these parameters are actually never used
by the application and we only found them by looking at the source code.
This blogpost contains summaries of talks from this year’s
TROOPERS18 Attack & Research Track.
Reverse Engineering Blackbox Systems with GreatFET & Facedancer by Kate Temkin and Dominic Spill
USB is everywhere, your phone, gaming consoles, IoT waffle irons, you name it.
Due to its’ widespread use in everyday life it is typically trusted by the user.
And even if one wanted to find out what’s happening behind the scenes, surely
digging into USB communication is too much of a chore to be worth the hassle,
right? This talk by Kate Temkin and Dominic Spill are about to prove that very
wrong with an impressive display of their tools
GreatFET and
Facedancer.
This blogpost contains summaries of talks from this year’s
TROOPERS18 Defense & Management Track.
All Your Cloud Are Belong to Us
The talk “All Your Cloud Belong Are Belong to Us” was held by
Nate Warfield, who is a Senior Security Program
Manager for the Microsoft Security Response Center (MSRC).
Before Microsoft he worked as a network engineer about 18 years and 10 of this
for a large amount of cell phone companies.
Nate gives an overview about the state of the cloud solution provided by
Microsoft, Azure, and how he hunts vulnerabilities in this environment.
Finally he concludes that the giving up your infrastructure to the cloud doesn’t
mean that you give up your responsibility.
Before his infosec career Graeme was a street performer, then security
researcher, now he calls himself a defender. The talk was built around the
following sentence: “The infosec industry and community have completely failed
to create meaningful change in the behavior of people”.
The following example is a resume of how hacking worked from 1988 to 2017:
