This is a 3-part series which introduces and analyzes Cisco’s implementation for Autonomic Network. In the 1st part, the technology is introduced and we have an overview about communication flow. In the 2nd part, Cisco’s proprietary protocol is reverse engineered ? then finally in the 3rd part, multiple vulnerabilities will be disclosed for the first time. If you’re aware of the technology, you can skip directly to part 2 where the action begins!
Continue reading Continue readingCSA Summit CEE and BSides Ljubljana 2017
At the end of last week I had the pleasure to visit the CSA Summit CEE and the Bsides Event in Ljubljana.
At CSA, I was talking about hypervisors, breakouts and an overview of security
measures to protect the host.
(Slides)
This ranged from the basic features some hypervisors provide out of the box to
advanced features like SELinux, device domain models and XSM-FLASK.
Most of the other talks were more targeted towards management level employees, but even as a fairly technical person I found Mike Bursell’s talk highly interesting. After my talk about securing the host system from a malicious guest, he dealt with the inverse: Technologies to protect a guest from a malicious or compromised host.
Continue reading Continue readingInformation About SAP Security Note 2336795
Last year I encountered a slight variation of an internal port scan vulnerability for the CrystalReports component of SAP Business Objects. The original vulnerability was presented and disclosed by rapid7 in the talk “Hacking SAP Business Objects”. The corresponding slides can be found here.
Basically, the original vulnerability allowed port scanning of (internal) systems via the URL http://hostname/CrystalReports/viewrpt.cwr?id=$ID&wid=$WID&apstoken=ip:port@$TOKEN. By accessing this URL, different responses were received depending on if the port (parameter port in the URL) of the system (parameter ip in the URL) was in the state “open” or “closed”. The original vulnerability has been fixed a long time ago (SAP security note 1432881), but the fix did allow for a slight variation to make the attack work again.
Continue reading Continue readingTesting RFC 6980 Implementations with Chiron
In the recent post on the IPv6 properties of the latest MS Windows versions I announced another one providing details on the RFC 6980 related testing I had performed. So here we go.
When doing IPv6 security testing there’s mainly four toolkits which can be used:
- Antonios Atlasis‘ Chiron
- Marc Heuse’s THC-IPV6
- Fernando Gont‘s IPv6 Toolkit
- Scapy (whose IPv6 capabilities are, afaik, mainly maintained by Guillaume Valadon. some tutorial on IPv6 packet crafting with scapy can be found here).
Each of them has specific strenghts & limits, which will not be discussed here. For the testing I performed I chose Chiron as it has the most powerful options when it comes to IPv6 extension headers and fragmentation.
Continue reading Continue reading31c0n 2017 in Auckland, New Zealand
Last week we gave a talk at the very first 31c0n in Auckland, New Zealand. The talk focused mainly on the methodology that we use to assess security products.
More specifically, this methodology consists of 7 steps
- Literature Research
- Jailbreak the Target
- Identify Components
- Understand the Architecture
- Map the Attack Surface
- Prioritize
- Analyze.
Details on these steps as well as general suggestions to viable alternatives for security products can be found here in the slides.
Continue reading Continue readingTroopers17 GSM Network – How about your own SMPP Service?
The event of the events is getting closer and again, we are very optimistic to have a lot of awesome trainings, talks, evening events, and discussions. But we again will also have some “features” and gimmicks for those of you who would like to play with new, old, or just interesting technologies. As you might remember, since some years one of these features is and again will be our own GSM Network. As we are improving our setup from year to year, this time we’d like to give you the chance to actively participate with ideas and your own services.
Continue reading Continue readingAgile Development & Security
I’m a big fan of Chris Gates’ publications on DevOops and From Low to Pwned. The content reflects a lot of issues that we also experience in many assessments in general and assessments in agile environments in particular. In addition, we were supporting several projects recently that were organized in an agile way. In this post, I want to summarize some thoughts on how security work can/should be integrated into agile projects. The post was also a result from the preparation of our upcoming Troopers workshop on Docker Security & Devops, which of course also covers organizational aspects, but not to the degree this post describes them.
Continue reading Continue readingCloudflare Incident #Cloudbleed
Exactly one week ago I noticed an “urgent” tweet from Tavis Ormandy to get in
contact with the Cloudflare team.
Normally when a tweet like this appears from Tavis, something is horribly
broken. Well, today we know the background of this tweet as the
bug tracker
issue went public and it exposed quite a bug from Cloudflare.
While there is some background story how Tavis found the bug, because he wasn´t actively looking into the Cloudflare infrastructure and it was rather discovered by accident when odd data appeared in his fuzzing corpus. When he looked closely he found data that was not in any mean related to the expected data from various websites.
Continue reading Continue readingExploitation of IMS in absence of confidentiality and integrity protection
IP Multimedia Subsystem (IMS) offers many multimedia services to any IP-based access network, such as LTE or DSL. In addition to VoLTE, IMS adds service provider flexibility, better QoS and charging control to the 4th generation of mobile networks. IMS exchanges SIP messages with its users or other IMS and usually these communications are secured by TLS or IPSec. But if an attacker manages to break the confidentiality and the integrity with IMS, he would find it vulnerable to several attacks.
Continue reading Continue readingSummary of “Lockpicking in the IoT” at 33C3
“Lockpicking in the IoT, …or why adding BTLE to a device sometimes isn’t smart at all” by Ray was one of my favourite talks, as it beautifully showed many different attack vectors as well as giving a nice guide for getting started in this area.
It impressed me how carefree vendors and startups handled hardware and software
security in “smart” devices as it seems that their devices were more or less
easy to own. In his talk Ray pointed out physical AND implementational
weaknesses that remained even after he reported them to the vendors.
The most prominent sample he gave was when he opened a “Masterlock” by spinning
a magnet on the lock itself to open it.