As you may know, we published a
whitepaper
discussing the behavior of different operating systems once they receive IPv6
configuration parameters from different sources two years ago. At that time, the
results were quite a mess. We were curious whether the situation is still so
“dire” like two years ago. We fired up the lab, updated the tested operating
systems and performed the tests again.
To summarize, at least in scenarios were only one router is involved, the
results look way more consistent (even cross operating system) then two years
ago. So we made progress on this front. Unfortunately, as soon as a second
router is introduced into the segment it gets messy and the operating systems do
show inconsistent behavior.
I’m happy to announce the release of several Glibc heap analysis plugins (for
Linux), resp. plugins to gather information from keepassx and zsh, which are now
included in the
Rekall Memory Forensic Framework. This
blogpost will demonstrate these plugins and explain how they can be used. More
detailed information, including real world scenarios, will be released after the
talk
at this years DFRWS USA.
Before being able to reliably analyze the heap of a process, a profile, for the
Glibc version being used, must be provided. However, this step should for most
cases be fairly simple and only consist of gathering the offset for the mp_
and main_arena variables:
Just recently we discussed IPv6 filter rules for NIC-level firewalls (in a
virtualized data center) with a customer. I’d like to take this as an
opportunity to lay out potential approaches for local packet filtering of IPv6,
which in turn might somewhat depend on the address configuration strategy chosen
for the respective systems (for the latter you may refer to
this post
or
to this talk
from the Troopers NGI event).
Some of this has already been discussed in
RFC 4890 Recommendations for Filtering ICMPv6 Messages in Firewalls
but that document is from 2007 and things may have changed in the interim.
Let’s start with a quick look at the traffic which might be of interest. We will
take a server perspective here, read: which types of IPv6 traffic might have to
be accepted by a host/NIC firewall in order to support proper operations? I will
discuss the following, with a focus on the implications of filtering them
locally:
A Cisco Catalyst 3560 switch running the software “C3560c405ex-UNIVERSALK9-M”
version 15.2(2)E4 connecting
A Linux based attacker system running Chiron and
A FreeBSD target system, running different OS versions and configurations and
A Linux based laptop running a control script that remotely performed the
necessary tasks on the two machines mentioned above
The main question was: Would the impact on the target system and the possible
attacks that were observed with the Windows Server 2016 victim be reproducible
on other operating systems? Or would those behave totally differently?
Over one of the recent long weekends I attended the 17th
“Gulaschprogrammiernacht”, or “GPN17” for short, in Karlsruhe, the largest CCC
Event after the Chaos Communication Congress with roughly a thousand attendees.
The name literally translates to “goulash programming night”, which makes about
as much sense as the German version. Despite the name it lasted from Thursday to
Sunday, had a much wider scope than just coding and offered various other (incl.
vegan) dishes besides goulash. As an active member of the CCC community I
planned on attending it anyway, but submitted my talk about Automated Binary
Analysis in case there was interest. I didn’t anticipate that much interest
given that it was a fairly theoretical IT-Security topic at an event that was
not focused on IT-Security, but nonetheless the hall was filled with people from
various backgrounds like math, formal verification and software optimization.
The talk was an improved version of the one I gave at
Bsides Ljubljana,
incorporating feedback I received and new things I had learned since then. The
English slides are available
here, the recording
of the talk in German can be found
here.
27 April 2016 marked a turning point for a lot of countries as well as a lot
businesses worldwide: EU regulation 2016/679 (going by it’s more widely known
name General Data Protection Regulation and abbreviated GDPR) was adopted by the
European Parliament, the Council as well as the Commission [1]. Especially
readers from countries outside of the EU might ask “Why should this be of
interest for me?”.
The point is: if your business is dealing with data of EU citizens (e.g. because
you are having an online shop selling goods in the EU, or you operate a social
network platform with customers that are EU citizens) you are liable under GDPR
– this is regulated in Article 3, section 2 of the regulation: “This Regulation
applies to the processing of personal data of data subjects residing in the
Union by a controller not established in the Union, where the processing
activities are related to: (a) the offering of goods or services to such data subjects in the Union; or (b) the monitoring of their behaviour.”
I’d guess that if you are reading these lines you become aware (if not have been
so before) that your business might most probably be affected by GDPR as well.
Now, the purpose of this blog post is not to enlighten you on the basics of GDPR
but to discuss one special, interesting aspect of this regulation:
pseudonymisation and how it might support your way to become compliant with
GDPR.
Inspiriert durch die erfolgreichen Round Table Session der TROOPERS freuen wir
uns Ihnen heute mit dem AgileSecurity Insight Summit 2017 eine weitere
Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit
vorzustellen.
Die Veranstaltung beginnt am Morgen mit einer Keynote, gefolgt von Fallstudien
und Vorträgen durch interne und externe Referenten aus der Industrie. Im
Anschluss werden alle Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an
beiden Round-Table Sessions teilnehmen. In den Round-Table Sessions werden unter
Expertenmoderation typische Problemstellungen und Lösungsansätze diskutiert.
The following post is in German as it is covering a Training with German as the
main language.
Professionelles Training im Workshop Character:
Docker, Microservices, Kubernetes, DevOps, Continuous
Integration/Deployment/Delivery (CI/CD), Container – moderne
Entwicklungsprozesse kommen nicht mehr ohne diese Begriffe aus. In diesem Kurs
lernen Sie die Security Grundlagen um diese Dinge zu beherschen.
Docker Security & (Sec) DevOps Training:
Im Training werden unter Anderem die folgenden Fragestellungen behandelt:
Wie stark/zuverlässig sind die Isolationsmechanismen hinter
Docker/Linux/Betriebssystem-Containern?
Wie beeinflussen Container typische Applikations- und Netzwerk-Landschaften?
Wie beeinflussen die CI/CD/Microservice Paradigmen traditionelle
Entwicklungsprozesse?
Wie sieht eine typische CI/CD Pipeline aus?
Was sind potentielle Schnittstellen zwischen „Security“ und diesen Paradigmen?
Welche zusätzlichen Security-Herausforderungen ergeben sich aus der
veränderten Entwicklungslandschaft und neuen Tool-Chains?
Voraussetzungen:
Die Teilnehmer sollten grundlegende Kenntnisse der Linux Kommandozeile
besitzen
sowie ein System mit einem SSH Client. Teilnehmer die die Demo-VM gerne selbst
betreiben möchten erhalten diese auf einem USB-Stick, müssen sich aber selbst
um
Import und Start kümmern.
The following post is in German as it is covering an Event with German as the
main language.
INSIGHT SUMMIT 2017 präsentiert Active Directory Security & Secure
Operations
Inspiriert durch die erfolgreichen Round Table Sessions der TROOPERS freuen wir
uns Ihnen heute mit dem Active Directory Insight Summit 2017 eine weitere
Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit
vorzustellen.
Die Veranstaltung beginnt am Morgen mit einer Hinführung zum Thema Active
Directory Sicherheit gefolgt von Fallstudien und Vorträgen durch interne und
externe Referenten aus Wirtschaft und Industrie. Im Anschluss werden alle
Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round Table
Sessions teilnehmen (jeder Teilnehmer kann an beiden Sessions teilnehmen). In
den Round Table Sessions werden unter Expertenmoderation typische
Problemstellungen und Lösungsansätze diskutiert.
Last friday Florian and me attended the
6th No-Spy Conference in Stuttgart, Germany. We
gave a talk about surveillance and censorship on modern devices in North Korea
and discussed various aspects with the attendees. The atmosphere was very
welcoming and we had some nice discussions about various topics which allowed us
to better clarify some things. The slides are available
here.