The following post is in German as it is covering an Event with German as the
main language.
INSIGHT SUMMIT 2017 präsentiert Active Directory Security & Secure
Operations
Inspiriert durch die erfolgreichen Round Table Sessions der TROOPERS freuen wir
uns Ihnen heute mit dem Active Directory Insight Summit 2017 eine weitere
Veranstaltung in einer Reihe zu Trend-Themen im Bereich der IT-Sicherheit
vorzustellen.
Die Veranstaltung beginnt am Morgen mit einer Hinführung zum Thema Active
Directory Sicherheit gefolgt von Fallstudien und Vorträgen durch interne und
externe Referenten aus Wirtschaft und Industrie. Im Anschluss werden alle
Teilnehmer in zwei Gruppen aufgeteilt, die nacheinander an beiden Round Table
Sessions teilnehmen (jeder Teilnehmer kann an beiden Sessions teilnehmen). In
den Round Table Sessions werden unter Expertenmoderation typische
Problemstellungen und Lösungsansätze diskutiert.
Last friday Florian and me attended the
6th No-Spy Conference in Stuttgart, Germany. We
gave a talk about surveillance and censorship on modern devices in North Korea
and discussed various aspects with the attendees. The atmosphere was very
welcoming and we had some nice discussions about various topics which allowed us
to better clarify some things. The slides are available
here.
From May 8th to 12th I was able to attend the 74th RIPE meeting in Budapest,
Hungary. Being rather new to the networking community, I enjoyed learning a lot
of different things, not only from the various interesting talks but also from
inspiring conversations with a variety of people from all areas during the
beautiful social events.
As it was the first RIPE meeting for me, I was very thankful for the “Newcomer’s
Introduction” on Monday morning, containing a RIPE and RIPE NCC 101. It was
quite helpful to get into the mindset and understand the structure of the
meeting, like the division into different working groups based on the
participants’ interests. After familiarizing myself with the concept, I chose to
attend several sessions on Address Policy, IPv6, Routing, Open Source, and DNS
working groups besides the general plenary sessions. I’ll be reviewing those
sessions here.
I’m on my way back from the
RIPE74 meeting in Budapest. It was a great event:
quite a few nice technical talks in the plenary, productive working group
meetings and some really good hallway discussions.
Big thanks to the RIPE NCC team for the smooth organization and for taking care
of us!
Here’s some stuff I found particularly interesting:
Andrew Alston’s take on “Anti-Shutdown
Policies” (slides
and video incl. extensive mic
discussion)
The git-shell is a restricted shell maintained by the git developers and is
meant to be used as the upstream peer in a git remote session over a ssh tunnel.
The basic idea behind this shell is to restrict the allowed commands in a ssh
session to the ones required by git which are as follows:
git-receive-pack
Receives repository updates from the client.
git-upload-pack
Pushes repository updates to the client.
git-upload-archive
Pushes a repository archive to the client.
Besides those built-in commands, an administrator can also provide it’s own
commands via shell scripts or other executable files. As those are typically
completely custom, this post will concentrate on the built-in ones.
It is a pleasant surprise for many (us included) that Microsoft implemented
support for the RDNSS (RFC 8106) option
in Router Advertisements beginning with the
Windows 10 Creators Update.
Interestingly, I wasn’t able to find any official documents from Microsoft
stating this. As we are involved in a lot of IPv6 related projects for our
customers, the lack of RDNSS support for Windows and DHCPv6 for Android is a
major pain point when implementing IPv6 in mixed client segments, as you need to
implement both mechanisms to ensure that all clients do get the relevant network
parameters. I won’t beat on the dead horse, but Microsoft’s decision is a huge
step in the right direction and one can hope that one day Google finds a
“compelling use case” to implement at least stateless DHCPv6 for Android.
This is the 3rd post in the series of Autonomic Network (AN), it will dedicated
for discussing the vulnerabilities. I recommend reading the first 2 parts
(part one,
part two) to be
familiar with the technology and how the proprietary protocol is constructed.
Initially we will discuss 2 of the reported CVEs, but later there is more CVEs
to come 😉
Here is a quick overview on how our network looks like for 2 CVEs
Troopers ’17 – the 10th edition – madness is over and
hopefully all of you are well rested and recovered after this special week. Of
course the rest of the world did not stand still and thus Google lifted the
curtains on a new public portal collecting and promoting the Open Source
Software projects developed by employees of Google:
opensource.google.com. There are a lot of
interesting projects that might incubate new interesting developments. And even
security oriented tools and projects (51 at the time of writing to be precise)
are publically available [1].
Given the
CfP for Black Hat US in
Vegas ends in a few days – and as
apparently somepeople have
already started to think about their TR18 submissions – I’ll quickly provide
some loose recommendations on how to write a submission here. There’s quite some
reasonable advice out there already (the BH CfP site lists
this
and
this which
you should both read as well) but some of you might find it useful to get (yet)
another perspective.
This is the second part in the Autonomic Network series. We have introduced
previously in our
first part the
Autonomic Network (AN), took a look about the needed configuration to run it on
Cisco gear and what is the expected communication flow. In this post, we will
dive deeper to have a closer look on the packets and how they are composed.
Cisco’s AN protocol is a proprietary one and as far as I know, the analysis
provided here for the protocol is the first of its kind.