The first time I’ve heard about RFID was at high school, back in 2002, when I
was studying Electronics. Back in that time, this technology was like some sort
of black magic to me. A few years later in 2011, our government in Argentina
decided to implement a “new technology” called NFC, designed as the new and only
way of payment for the use of public transport. So, I decided to understand it
better, play with it, and try some hacks I heard from the cool people of the
CCC.
In this article, we describe the impact of the increased use of Docker in
corporate environments on forensic investigations and incident analysis. Even
though Docker is being used more and more (Portworx, Inc., 2017), the
implications of the changed runtime environment for forensic processes and tools
have barely been considered. We describe the technological basics of Docker and,
based on them, outline the differences that occur with respect to digital
evidence and previously used methods for evidence acquisition. Specifically, we
look at digital evidence within a Docker container which are lost or need to be
acquired in different ways compared to a classical virtual machine, and what new
traces and opportunities arise from Docker itself.
If you attack someone, they will defend themselves, but if you tickle them, they
will eventually crack open. This surprisingly applies to Android apps as well!
Therefore, I created AndroTickler, not to test apps against certain attacks or
examine them for specific vulnerabilities, which developers would learn to
avoid. However, it helps pentesters to analyze and test apps in their own style,
but in a faster, easier and more flexible way. AndroTickler is a
Swiss-Army-Knife pentesting tool for Android apps. It provides information
gathering, static and dynamic analysis features, and also automates actions that
pentesters frequently do and highly need during their pentests. In addition, it
makes use of the powerful Frida to hook to the app and manipulate it in
real-time.
We have a short update from the TelcoSecDay 2018 Agenda. But before that, a
short reminder. The CFP for TelcoSecDay 2018 is still open. If you are into
telco research, and if you have something interesting to talk, please make a
submission here. The deadline is 17th
February 2018.
Here are the first two confirmed speakers who are going to talk about the below
mentioned topics:
Title: Data Security for 4G Interconnection and 5G Interconnection Risk
Areas
Here is a short blog post that explains how you can make your own
Man-in-the-Middle (MitM) setup for sniffing the traffic between a SIM card and
the backend server. This is** NOT a new research** but I hope this will help
anyone who doesn’t have a telco background to get started to play with mobile
data sniffing and fake base stations. This is applicable to many scenarios today
as we have so many IoT devices with SIM cards in it that connects to the
backend.
In this particular case, I am explaining the simplest scenario where the SIM
card is working with 2G and GPRS. You can probably expect me with more articles
with 3G, 4G MitM in future. But lets stick to 2G and GPRS for now.
We are thrilled to announce the
Blackhoodie event at
Troopers 2018 on March 12th and 13th in Heidelberg.
This time it is going to be a 2 day workshop with various interesting topics
related to reverse engineering. We will make sure that you get some hands on
experience with reversing and more.
As always, one of the main motivation for
Blackhoodie is bringing more women into
reversing.
So we would like to see more women apply to the training slots. However, we are
open to everyone who would like to apply. We do have a very limited number of
seats at this training site. So we apologize in advance if we can’t accommodate
everyone, even though we wish we could! Please apply before “February 20th”
and we will contact you regarding next steps.
As Kai and I will be holding a
TROOPERS workshop on automation with ansible,
we needed a setup for the attendees to use ansible
against virtual machines we set up with the necessary environment. The idea was,
that every attendee has their own VMs to run ansible against, ideally including
one to run ansible from, as we want to avoid setup or version incompatibilities
if they set up their own ansible environment on their laptop. Also they should
only be able to talk to their own machines, thus avoiding conflicts because of
accidental usage of wrong IPs or host names but also simplify the setup for the
users.
A new ERNW whitepaper was just published. I wrote this whitepaper in the course
of my bachelor thesis and it examines multi-factor authentication in Microsoft
Windows environments:
Credential theft and the subsequent reuse of stolen credentials are a
significant problem in today’s information security. To counter the associated
risks, a planned approach is required as part of a comprehensive security
architecture program. This includes the implementation of multi-factor
authentication as an important building block. This whitepaper covers the
relevant steps of implementing a multi-factor authentication system in an
enterprise environment and closes with a security evaluation.
At Troopers18 there will be a new special track on
Microsoft Active Directory and its security aspects, similar to the SAP security
track which we established some years ago. The AD security track will feature,
amongst others, the following talks.
Sean Metcalf: Active Directory Security. The Journey
Abstract: This talk is a journey into the challenges most organizations
encounter while trying to secure their ‘castle’. The attacker has to be right
only once, right? Not exactly. We will walk through effective security
strategies that will stymie and frustrate attackers and better protect the
Active Directory environment.
I am amazed by how this years BlackHoodie
unraveled. Three days that included a pre-conference of lightening talks and two
parallel tracks with a total of 64 enthusiastic members. The very spirit of
BlackHoodie is nothing other than the quest to
gain deep knowledge. Reverse engineering is one of the hardest fields in
security. It touches on all fields of computing, starting from assembly,
programming, file formats, operating systems, networks and what not. This makes
it hard but an extremely fulfilling experience to spend time learning it. For
me, the very idea of staring at a binary till you understand what it does is a
magical feeling.