Recently I had the pleasure to join the
PowerOfCommunity conference in Seoul.
Florian and Felix attended the conference in the past and enjoyed it a lot, so I
took the opportunity to join this year. From what I had heard the conference is
highly technical, offensive security and community focused (surprise 😉 ). Boy
did they deliver!
Located in a hotel next to a nice park and close to the famous Gangnam district
in Seoul we came together to feel the power of community. The conference was
planned for two days and offered two tracks per day. Several key talks were
presented for everyone.
I really liked the topics a lot. Some contributions I found particularly
interesting were:
Petr Švenda with “The Million-Key Question – How RSA Public Key Leaks Its
Origin”, where he presented his research of fingerprinting RSA public keys. By
analyzing the RSA keys from smartcards and software sources he was able to find
similarities between them, which allowed fingerprinting the generating source
for some cases. With this information it could be possible gather some
potentially important details from simple keys. He is currently expanding his
work, please send him an E-Mail if you have RSA keys from an exotic resource. 😉
TR17 Training: Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer
This is a guest blog written by Hanno Böck who will be running the Fuzzing with American Fuzzy Lop, Address Sanitizer and LibFuzzer at TROOPERS17.
Fuzzing is a very old technique to find bugs and vulnerabilities in software. However it has seen a new push in recent years due to vastly improved tools. The compilers gcc and clang have received Sanitizer tools that allow finding a lot of bugs like use after free errors and out of bounds reads that are otherwise very hard to find.
Continue reading Continue reading2nd Rounds of TROOPERS17 Talks!
It is the end of the year and we are hoping it is not too hectic of a time for you all! But if it is, hopefully the announcement of our next round of TROOPERS17 talks is enough to get you in the TROOPERS (if not the holiday) spirit 🙂
Francis Alexander & Bharadwaj Machiraju: How we hacked Distributed Configuration Management Systems
With increase in necessity of distributed applications, coordination and configuration management tools for these classes of applications have popped up. These systems might pop-up occasionally during penetration tests. The major focus of this research was to find ways to abuse these systems as well as use them for getting deeper access to other systems.
Continue reading Continue readingA short Addendum on the Mirai Botnet Blog Post
While doing heap research on Linux processes (results are going to be published
soon), I came across the bot from the Mirai Botnet. As already mentioned in the
blog post by
Brian,
the Mirai bot uses obfuscated configuration data which contains e.g. the CnC
server. When now confronted only with a bot (e.g. in the context of a running
task or the ELF binary), but without the according source code, the decryption
of this configuration data for e.g. incident analysis purposes might not be
easily possible (with the python script from the blog post), if the key has been
changed.
But in this case that is not a problem at all, because
TelcoSecDay 2017 – First Talks Published
Even if the CFP for TelcoSecDay 2017 is officially closed, I am still getting
mails in. First of all: thank you for all your great feedback! As the
TelcoSecDay is a complimentary and non-public event with highly specialized
topics, it only works by sharing knowledge with each other. But please keep in
mind that the speaker-slots are limited and I have to make a decision at some
point of time.
Anyhow, I am looking forward for a great event and I am proud to publish the
first accepted talks:
Research Diary: Bluetooth. Part 2
Recently we posted first part of our Bluetooth research diary. Today, we want to continue on that topic and tell you about Bluetooth proxying and packet replay with a new tool.
This time we had a new gadget to play with: our colleague Florian Grunow shared
with us a curious IoT device – Bluetooth socks… real socks that you control with
an app to heat your feet. The future is here… 😉
Analyzing yet another Smart Home device
As you have probably already recognized, some of us here at ERNW are doing research in the area of smart home technologies e.g. KNX. Recently, we took a deeper look into a device which is used to control a smart home system produced by the vendor BAB TECHNOLOGIE GmbH called “eibPort”. This device can be used to control smart home systems based on different technologies e.g. EnoCean or KNX depending on the version of the device. The eibPort comes with a visualization running on a webserver to control the whole system e.g. open or close windows, changing the temperature in different rooms or turning the alarm system on or off by simply clicking on symbols. The following screenshots illustrate an example of such a visualization:
Continue reading Continue readingResearch Diary: Blue Coat
As a part of our research time here at ERNW, last week we had an interesting time looking at one of the widespread and commonly adopted proxy appliance by many organizations Blue Coat Secure Gateway.
Introduction
The Blue Coat proxy Secure Gateway (SG) has been already in the market since
2001 [1]. The main aim of introducing the appliance was to achieve the
following goals [2]:
• High performance optimization.
• Increasing the security measurements, by introducing malware/spyware
protections, web based filtering, virus scanning and more.
• Flexible Access Control capabilities.
Some Notes from the Lab – BlackNurse in the IPv6 Era
Since BlackNurse was released on 10th of November, we asked ourselves whether this problem does also apply to ICMPv6 traffic. To answer this question, Christian Tanck (one of our students) build a lab with several firewall appliances. Kudos to him for testing and the following blog post.
Intro
On 10^(th) of November, 2016 the TDC Security Operations Center in Denmark published the BlackNurse Denial of Service Attack Report as an PDF download on their website and a blog post written by Erik Hjelmvik from NETRESEC. He was involved in the project by helping with the analysis of packet dumps, testing different systems, with ideas for test scenarios and at least inspired me with his blog post on how to build a test lab described later in this post. The attack on its own was discovered by the TDC analysts Kenneth B. Jørgensen and Lenny Hansson.
Continue reading Continue readingResearch Diary: IP-Cameras Part 2
Hi everybody,
This is the second entry in our research diary on IP cameras. If you haven’t
done so yet, you should read the first entry in advance. This time we focused
more on analysis and exploitation.
Another entry vector
After running a vulnerability scan on both devices, it was revealed that the M1033 has multiple buffer overflow vulnerabilities (CVE-2012-5958 to CVE-2012-5965), which are readily exploitable via Metasploit. This gave us another shell (in addition to the root shell mentioned in the last post), though this time it was not a root shell. By using the find command, we searched for executables having the setuid or setgid bit set. We hoped to use one of those to escalate privileges. To do so yourself add the parameter -perm -4000 to find and it will search for files having the setuid bit set. If you try that on your own unix-like device, for example it should yield /bin/passwd which is perfectly reasonable as you’re able to change your password without being root.
Continue reading Continue reading