Niklaus, Manuel and me had a great time speaking about one of the latest Tablet PCs from DPRK at 33C3 this year. Our work on RedStar OS from last year revealed a nasty watermarking mechanism that can be used to track the origin and distribution path of media files in North Korea. We have seen some interesting dead code in some of RedStar’s binaries that indicated a more sophisticated mechanism to control the distribution of media files. We got hands on a Tablet PC called “Ul-lim” that implemented this advanced control mechanism.
Continue reading Continue readingIPv6 Configuration Approaches for Servers
In this post I’ll discuss configuration approaches for systems which usually have been configured with “static” IP parameters in the IPv4 age/context (like servers in data centers). When it comes to IPv6 there are more options and we’ll have a look at their implications and potential advantages/disadvantages.
From my perspective there’s mainly four possible approaches which we see being implemented or considered in our (predominantly enterprise) customer space. Before we have a closer look at those let’s quickly write down requirements that the involved planners or sysadmins might have in mind when it comes to provisioning the systems in question. Some of those requirements might seem obvious but it could still make sense to note them for the discussion to follow. These might include:
Continue reading Continue reading3rd Round of TROOPERS17 Talks
We had to make some tough choices regarding our TROOPERS17 Main Conference Agenda. Thank you again to everyone for submitting! The full agenda will be published later this week, but for now here are the next round of talks!
Ivan Pepelnjak: Securing Network Automation
If you have operational experience in running large networks then you’re
probably yearning to replace the traditional way of managing individual network
devices via SSH with something better and more reliable. Software Defined
Networking (SDN) was touted as the all-encompassing solution, but what we got
instead is a heap of academic ideas, several platforms that require as much
investment as an SAP deployment, and a bunch of proprietary products focused
more on increasing lock-in and vendor revenue than solving operational problems.
PoC Con Seoul 2016
Recently I had the pleasure to join the
PowerOfCommunity conference in Seoul.
Florian and Felix attended the conference in the past and enjoyed it a lot, so I
took the opportunity to join this year. From what I had heard the conference is
highly technical, offensive security and community focused (surprise 😉 ). Boy
did they deliver!
Located in a hotel next to a nice park and close to the famous Gangnam district
in Seoul we came together to feel the power of community. The conference was
planned for two days and offered two tracks per day. Several key talks were
presented for everyone.
I really liked the topics a lot. Some contributions I found particularly
interesting were:
Petr Švenda with “The Million-Key Question – How RSA Public Key Leaks Its
Origin”, where he presented his research of fingerprinting RSA public keys. By
analyzing the RSA keys from smartcards and software sources he was able to find
similarities between them, which allowed fingerprinting the generating source
for some cases. With this information it could be possible gather some
potentially important details from simple keys. He is currently expanding his
work, please send him an E-Mail if you have RSA keys from an exotic resource. 😉
TR17 Training: Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer
This is a guest blog written by Hanno Böck who will be running the Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer at TROOPERS17.
Fuzzing is a very old technique to find bugs and vulnerabilities in software. However it has seen a new push in recent years due to vastly improved tools. The compilers gcc and clang have received Sanitizer tools that allow finding a lot of bugs like use after free errors and out of bounds reads that are otherwise very hard to find.
Continue reading Continue reading2nd Rounds of TROOPERS17 Talks!
It is the end of the year and we are hoping it is not too hectic of a time for you all! But if it is, hopefully the announcement of our next round of TROOPERS17 talks is enough to get you in the TROOPERS (if not the holiday) spirit 🙂
Francis Alexander & Bharadwaj Machiraju: How we hacked Distributed Configuration Management Systems
With increase in necessity of distributed applications, coordination and configuration management tools for these classes of applications have popped up. These systems might pop-up occasionally during penetration tests. The major focus of this research was to find ways to abuse these systems as well as use them for getting deeper access to other systems.
Continue reading Continue readingA short Addendum on the Mirai Botnet Blog Post
While doing heap research on Linux processes (results are going to be published
soon), I came across the bot from the Mirai Botnet. As already mentioned in the
blog post by
Brian,
the Mirai bot uses obfuscated configuration data which contains e.g. the CnC
server. When now confronted only with a bot (e.g. in the context of a running
task or the ELF binary), but without the according source code, the decryption
of this configuration data for e.g. incident analysis purposes might not be
easily possible (with the python script from the blog post), if the key has been
changed.
But in this case that is not a problem at all, because
TelcoSecDay 2017 – First Talks Published
Even if the CFP for TelcoSecDay 2017 is officially closed, I am still getting
mails in. First of all: thank you for all your great feedback! As the
TelcoSecDay is a complimentary and non-public event with highly specialized
topics, it only works by sharing knowledge with each other. But please keep in
mind that the speaker-slots are limited and I have to make a decision at some
point of time.
Anyhow, I am looking forward for a great event and I am proud to publish the
first accepted talks:
Research Diary: Bluetooth. Part 2
Recently we posted first part of our Bluetooth research diary. Today, we want to continue on that topic and tell you about Bluetooth proxying and packet replay with a new tool.
This time we had a new gadget to play with: our colleague Florian Grunow shared
with us a curious IoT device – Bluetooth socks… real socks that you control with
an app to heat your feet. The future is here… 😉
Analyzing yet another Smart Home device
As you have probably already recognized, some of us here at ERNW are doing research in the area of smart home technologies e.g. KNX. Recently, we took a deeper look into a device which is used to control a smart home system produced by the vendor BAB TECHNOLOGIE GmbH called “eibPort”. This device can be used to control smart home systems based on different technologies e.g. EnoCean or KNX depending on the version of the device. The eibPort comes with a visualization running on a webserver to control the whole system e.g. open or close windows, changing the temperature in different rooms or turning the alarm system on or off by simply clicking on symbols. The following screenshots illustrate an example of such a visualization:
Continue reading Continue reading