This
was one of the few technical talks at 33c3 I managed to see, by that I mean
live-stream during an access control shift, by Clémentine Maurice and Moritz
Lipp.
The talk gave an overview of some already known possible information leaks by
abusing certain x86 instructions(the same concept applies to ARM too though) and
demonstrating the various ways an attacker could use them. They started off by
quickly explaining how the caches on modern CPUs are set up and how they work
and how you can exploit the timing differences in memory accesses to leak data
without actually knowing the content of the cache. This data leak can then be
used to establish a covert channel.
Have you for example thought about classes of incidents that are most likely to
affect you and formulated Incident Handling Preparation Plans for those
incidents?
In this post we’ll take a detailed look at the properties of the Windows Server
2016 IPv6 stack.
I perform(ed) this exercise for several reasons:
Server 2016 is the latest OS released by Microsoft so this might give an
indication as for their plans & strategy when it comes to supporting certain
specifications.
(here you may keep in mind that the ~50 IETF meetings having passed since the
publication of RFC 2460 provided ample opportunity for creative minds to come
up with ever new ideas for “enhancing” IPv6, without too much real-life
feedback/reality checks from enterprise space though, as simply not many of
such organizations have deployed it at scale… or are incentivized to send
their employees to week-long meetings in expensive hotels on other continents
twice a year…).
as I laid out
in this post
the configuration approach an organization takes for their servers might
depend on the support of specific features.
obviously for both IPv6 planning and operations it might be helpful to
understand the respective behavior of individual operating systems (which is
why we researched stuff like
this
or
this
in the past).
many years ago Microsoft published white papers with details as for the TCP/IP
parameters of their OSs (incl. stuff like registry parameters to control it
etc.) but I’m not aware of such a document for Server 2016 or Windows 10. I
hence hope this post can somewhat contribute to public knowledge of the
intricacies of their latest IPv6 stack.
This is part 1 of our report series on interesting talks of the 33rd
Congress of the Chaos Computer Club. Every year the congress attracts hundreds
(up to twelve thousand this year) of technical interested people with the
opportunity to socialize and exchange knowledge with each other. The congress is
organized by the European largest hacker association and speakers give talks
about technical and societal issues like surveillance, privacy, freedom of
information, data security and various more.
Hi there,
Like in recent years the popular
Hacking 101 workshop
will take place on TROOPERS17, too! The workshop will give attendees an insight
into the hacking techniques required for penetration testing. These
techniques will cover various topics:
information gathering
network scanning
web application hacking
low-level exploitation
…and more!
During this workshop you will learn, step by step, a testing methodology
that is applicable to the majority of scenarios. So imagine you have to
assess the security of a system running on the Internet. How would you
start? First, you need a good understanding about the target, including running
services or related systems. Just scanning an IP will most likely not reveal
a lot of information about the system. The gathered information may help you to
identify communication relations of services that could include vulnerabilities.
A brief understanding of the target and it’s related
systems/services/applications will make scanning and identifying
vulnerabilities a lot easier and more effective. Then, the last step will be
the exploitation of the identified vulnerabilities, with the ultimate aim to
get access to the target system and pivot to other, probably internal,
systems and resources.
Tavis did it again[1]. As stated in the title it is possible to remotely
execute commands via the Chrome extension for the popular meeting software Cisco
WebEx. This post summarizes the most relevant information for you.
A test page with working
demo code
is available to check for the issue on Windows systems [2]. From our point of
view the Chrome extension is affected by this issue as well as the Firefox
extension as both extension APIs are quite similar. However, Mozilla blocked the
FireFox plugin to protect users from the risk of being exploited through the
plugin[3][4]. IE seems to be fine thanks to Cisco’s decision to invoke the
WebEx Meeting Center via e.g. ActiveX.
i´ve looked a bit at the Insomni’hack CTF
which took place on the 21st January and lasted for 36 hours.
For the sake of warming up a bit for our Troopers workshop
Windows and Linux Exploitation,
I
decided to create a write-up of the first pwn50 challenge.
To grab your own copy of the presented files you can also find it in our
Github
repository:
When downloading the first binary, we are presented with 2 files:
I am looking forward to our newly introduced dedicated Forensic Computing
Training at TR17!
We will start the first day with a detailed background briefing about Forensic
Computing as a Forensic Science, Digital Evidence, and the Chain of Custody. The
rest of the workshop we will follow the Order of Volatility starting with the
analysis of persistent storage using file system internals and carving, as well
as RAID reassembly with lots of hands-on case studies using open source tools.
As a next step, we will smell the smoking gun in live forensics exercises.
Depending on your preferences we will then dig a bit into memory forensics and
network forensics.
There are only two and a half months left, so I’d like to publish the next two
talks for TelcoSecDay 2017,
taking place at 21st of March in Heidelberg. Both talks are about the security
of an upcoming technology which importance will raise in near future: 5G
Networks.
One of the talks will be from an attacker’s point of view, highlighting
weaknesses of 2G/3G/4G networks and what we have to fix in 5G, and the other one
will give us insights into current developments of the 3GPP standardization
group.
The
1-day training from last TROOPERS
has become a 2-day training, featuring even more real-world attacks and defenses
as well as new hands-on sessions! We’ll teach you, step by step, how to spot and
exploit crypto vulnerabilities, how to use the strongest forms of
state-of-the-art cryptography to secure modern systems (like IoT or mobile
applications), and bring you up to speed on the latest and greatest developments
in the world of cryptography, such as TLS 1.3, blockchains, and post-quantum
crypto.
