This is part 1 of our report series on interesting talks of the 33rd Congress of the Chaos Computer Club. Every year the congress attracts hundreds (up to twelve thousand this year) of technical interested people with the opportunity to socialize and exchange knowledge with each other. The congress is organized by the European largest hacker association and speakers give talks about technical and societal issues like surveillance, privacy, freedom of information, data security and various more.
Continue reading Continue readingTR17 Training: Hacking 101
Hi there,
Like in recent years the popular
Hacking 101 workshop
will take place on TROOPERS17, too! The workshop will give attendees an insight
into the hacking techniques required for penetration testing. These
techniques will cover various topics:
- information gathering
- network scanning
- web application hacking
- low-level exploitation
…and more!
During this workshop you will learn, step by step, a testing methodology that is applicable to the majority of scenarios. So imagine you have to assess the security of a system running on the Internet. How would you start? First, you need a good understanding about the target, including running services or related systems. Just scanning an IP will most likely not reveal a lot of information about the system. The gathered information may help you to identify communication relations of services that could include vulnerabilities. A brief understanding of the target and it’s related systems/services/applications will make scanning and identifying vulnerabilities a lot easier and more effective. Then, the last step will be the exploitation of the identified vulnerabilities, with the ultimate aim to get access to the target system and pivot to other, probably internal, systems and resources.
Continue reading Continue readingCisco: Magic WebEx URL Allows Arbitrary Remote Command Execution – Project Zero
Tavis did it again[1]. As stated in the title it is possible to remotely execute commands via the Chrome extension for the popular meeting software Cisco WebEx. This post summarizes the most relevant information for you.
A test page with working demo code is available to check for the issue on Windows systems [2]. From our point of view the Chrome extension is affected by this issue as well as the Firefox extension as both extension APIs are quite similar. However, Mozilla blocked the FireFox plugin to protect users from the risk of being exploited through the plugin[3][4]. IE seems to be fine thanks to Cisco’s decision to invoke the WebEx Meeting Center via e.g. ActiveX.
Continue reading Continue readingInsomni’hack pwn50 write-up
Hi all,
i´ve looked a bit at the Insomni’hack CTF
which took place on the 21st January and lasted for 36 hours.
For the sake of warming up a bit for our Troopers workshop
Windows and Linux Exploitation,
I
decided to create a write-up of the first pwn50 challenge.
To grab your own copy of the presented files you can also find it in our Github repository:
When downloading the first binary, we are presented with 2 files:
Continue reading Continue readingFirst dedicated Forensic Computing Training at TR17
I am looking forward to our newly introduced dedicated Forensic Computing
Training at TR17!
We will start the first day with a detailed background briefing about Forensic
Computing as a Forensic Science, Digital Evidence, and the Chain of Custody. The
rest of the workshop we will follow the Order of Volatility starting with the
analysis of persistent storage using file system internals and carving, as well
as RAID reassembly with lots of hands-on case studies using open source tools.
As a next step, we will smell the smoking gun in live forensics exercises.
Depending on your preferences we will then dig a bit into memory forensics and
network forensics.
TelcoSecDay 2017 – 2nd Round of Talks
Hello and a Happy new Year!
There are only two and a half months left, so I’d like to publish the next two talks for TelcoSecDay 2017, taking place at 21st of March in Heidelberg. Both talks are about the security of an upcoming technology which importance will raise in near future: 5G Networks.
One of the talks will be from an attacker’s point of view, highlighting weaknesses of 2G/3G/4G networks and what we have to fix in 5G, and the other one will give us insights into current developments of the 3GPP standardization group.
Continue reading Continue readingTR17 Training: Crypto attacks and defenses
This is a guest blog written by Jean-Philippe Aumasson & Philipp Jovanovic about their upcoming TROOPERS17 training: Crypto attacks and defenses.
The 1-day training from last TROOPERS has become a 2-day training, featuring even more real-world attacks and defenses as well as new hands-on sessions! We’ll teach you, step by step, how to spot and exploit crypto vulnerabilities, how to use the strongest forms of state-of-the-art cryptography to secure modern systems (like IoT or mobile applications), and bring you up to speed on the latest and greatest developments in the world of cryptography, such as TLS 1.3, blockchains, and post-quantum crypto.
Continue reading Continue readingWoolim – Lifting the Fog on DPRK’s Latest Tablet PC
Niklaus, Manuel and me had a great time speaking about one of the latest Tablet PCs from DPRK at 33C3 this year. Our work on RedStar OS from last year revealed a nasty watermarking mechanism that can be used to track the origin and distribution path of media files in North Korea. We have seen some interesting dead code in some of RedStar’s binaries that indicated a more sophisticated mechanism to control the distribution of media files. We got hands on a Tablet PC called “Ul-lim” that implemented this advanced control mechanism.
Continue reading Continue readingIPv6 Configuration Approaches for Servers
In this post I’ll discuss configuration approaches for systems which usually have been configured with “static” IP parameters in the IPv4 age/context (like servers in data centers). When it comes to IPv6 there are more options and we’ll have a look at their implications and potential advantages/disadvantages.
From my perspective there’s mainly four possible approaches which we see being implemented or considered in our (predominantly enterprise) customer space. Before we have a closer look at those let’s quickly write down requirements that the involved planners or sysadmins might have in mind when it comes to provisioning the systems in question. Some of those requirements might seem obvious but it could still make sense to note them for the discussion to follow. These might include:
Continue reading Continue reading3rd Round of TROOPERS17 Talks
We had to make some tough choices regarding our TROOPERS17 Main Conference Agenda. Thank you again to everyone for submitting! The full agenda will be published later this week, but for now here are the next round of talks!
Ivan Pepelnjak: Securing Network Automation
If you have operational experience in running large networks then you’re
probably yearning to replace the traditional way of managing individual network
devices via SSH with something better and more reliable. Software Defined
Networking (SDN) was touted as the all-encompassing solution, but what we got
instead is a heap of academic ideas, several platforms that require as much
investment as an SAP deployment, and a bunch of proprietary products focused
more on increasing lock-in and vendor revenue than solving operational problems.