Looking at IPv6 deployment graphs like
this one it
becomes clear that IPv6 still is not widely deployed in enterprise space (the
reason for the apparent oscillation in that curve is the difference between
working days – where people use their office computers – and weekend where they
preferably use their smartphones or their home equipment connected by means of
broadband networks).
There’s a number of good reasons for this (in a nutshell: the overall IPv6
architecture is oriented around, and benefits, the decoupling of mostly
autonomous, self-organized endpoints from a well-managed/provider-managed
network infrastructure which isn’t exactly the operations model many large
enterprise organizations have in mind for their networks. also you might have a
look at
these slides
from RIPE74 to understand some of the reluctance to deploy IPv6 in certain
companies).
The conference was very well organized and attendee focused, which could be seen
by the many little details found on the conference. For example you never ran
out of coffee or beverages, there was a new Hallway Track where you could meet
people from all disciplines, discuss about your favorite topics and there was
always a place to sit and take a break between all those interesting
presentations. I had the chance to speak to very nice people from different
industries, most importantly in my case on the topic security. It was nice to
see how the Docker community is growing and the adoption rate is increasing,
especially in companies. The main focus of the conference (especially seen in
talks held by people from Docker Inc.) was the Docker Enterprise Edition.
the
last post was
about a fuse filesystem which provides a read-only access to the proprietary
bluecoat filesystem. After some further investigations based on the
possibilities this offered us, I started to implement a tool which allows to
modify parts of the filesystem.
Protection Mechanisms
Since last time, the discovered filesystem structures still had unknown fields.
Some of those fields could be reconstructed and their purpose in the whole
construct. The format of the Partition-Header for example could now be
described as
Some time ago, one of our customers contacted us with a special request. For
some legitimate reason, they needed to centrally collect certain certificates
including their private keys which were distributed across many client systems
running Windows and stored in the corresponding user stores. Unfortunately (only
in this case, but actually good from a security perspective), the particular
private keys were marked non-exportable making a native export in the context of
the user impossible. As if this wasn’t enough, the extraction was supposed to be
executed in the context of the current user (i.e. without administrative
privileges) while not triggering the existing Anti Virus solution at all. Also,
the certificates needed to be transferred to some trusted system where they
could not be accessed in an unauthorized way. So let’s have a look how we
tackled these problems:
We are super excited for TROOPERS18 (March
12-16th, 2018) as are many of you! We even have this great saying that “after
TROOPERS is before TROOPERS”, which means we spend a lot of time looking
through feedback from attendees, speakers/trainers, and our own Crew for ways to
not only top what we’ve done in the years before, but also how to simply make it
better for everyone involved. Looking around at our Crew we realized how
many have either attended TROOPERS or other conferences as students. We heard
from them, as well as other students, how life changing it was to be able, as a
student, to attend an IT-Security conference. How they got to meet a speaker
whose work they’d read about in class. How people felt even more a part of the
community they were studying hard to belong to.
A while ago I wrote a short paper laying out options for an enterprise
organization to get global IPv6 address space from the RIPE NCC, discussing the
advantages and disadvantages of different approaches. As I think the topic may
be of interest for others, too, I’ve distilled an anonymized version. It can be
found here. I hope
some of you find it useful.
In one of the last pentests we’ve found an epmd (Erlang port mapper daemon)
listening on a target system (tcp/4369). It is used to coordinate distributed
erlang instances, but also can lead to a RCE, given one knows the so called
“authentication cookie”. Usually, this cookie is located in ~/.erlang.cookie and
is generated by erlang at the first start. If not modified or set manually it is
a random string [A:Z] with a length of 20 characters. If an attacker gains
this cookie, a RCE is quite easy – as I like to describe below.
You may remember
our last post regarding
the SGOS system and the proprietary file system. Since then, we got access to a
newer version of the system (6.6.4.2). Still not the most current one (which
seems to be 6.7.1.1) nor of the 6.6.x branch (which seems to be 6.6.5.1) though.
As this system version also used the same proprietary filesystem (although it
initially booted from a FAT32 partition), I decided to take a deeper look into
this.
This is my short write up on Daycon X1, 2017. The
summit was held at Dayton, the land where
Wright brothers were born.
Apart from being my first US trip, I also gave my first training on Hacking 101
also called the Bootcamp.
The Daycon X1 bootcamp started on 18th September. Ahmad, my colleague focused
on web security, network scanning and metasploit exercises. I mainly handled
classes on reversing and binary exploitation along with some pcap anaylsis and
network attacks. It was highly fulfilling experience to give a workshop.
Teaching is definitely the best way to learn any topic by digging deep into
it.The simpler you can explain, the more clarity you have on the topic. But I
must say that it was indeed exhausting by the end of three days.
Last week I had the pleasure to participate at the
first RIPE IoT Roundtable Meeting
in Leeds (thanks! to
Marco Hogewoning
for organising it). It was a day with many fruitful discussions. I particularly
enjoyed Robert Kisteleki‘s talk on RIPE NCC’s own
design & (security) process considerations in the context of
RIPE Atlas (at TR17 NGI there was an
intro to Atlas,
too).
In this post I’d like to quickly lay out the main points of my own contribution
on “Balanced Security for IPv6 CPE Revisited” (the slides can be found
here).