As a part of our research time here at ERNW, last week we had an interesting
time looking at one of the widespread and commonly adopted proxy appliance by
many organizations Blue Coat Secure Gateway.
Introduction
The Blue Coat proxy Secure Gateway (SG) has been already in the market since
2001 [1]. The main aim of introducing the appliance was to achieve the
following goals [2]:
• High performance optimization.
• Increasing the security measurements, by introducing malware/spyware
protections, web based filtering, virus scanning and more.
• Flexible Access Control capabilities.
Since BlackNurse was released on 10th of November, we asked ourselves whether
this problem does also apply to ICMPv6 traffic. To answer this question,
Christian Tanck (one of our students) build a lab with several firewall
appliances. Kudos to him for testing and the following blog post.
Intro
On 10^(th) of November, 2016 the
TDC Security Operations Center in Denmark
published the BlackNurse Denial of Service Attack Report as an
PDF download on their website and
a
blog post
written by Erik Hjelmvik from NETRESEC. He was involved in the project by
helping with the analysis of packet dumps, testing different systems, with ideas
for test scenarios and at least inspired me with his blog post on how to build a
test lab described later in this post. The attack on its own was discovered by
the TDC analysts Kenneth B. Jørgensen and Lenny Hansson.
Hi everybody,
This is the second entry in our research diary on IP cameras. If you haven’t
done so yet, you should read the first entry in advance. This time we focused
more on analysis and exploitation.
Another entry vector
After running a vulnerability scan on both devices, it was revealed that the
M1033 has multiple buffer overflow vulnerabilities (CVE-2012-5958 to
CVE-2012-5965), which are readily exploitable via Metasploit. This gave us
another shell (in addition to the root shell mentioned in the last post), though
this time it was not a root shell. By using the find command, we searched for
executables having the setuid or setgid bit set. We hoped to use one of
those to escalate privileges. To do so yourself add the parameter -perm -4000
to find and it will search for files having the setuid bit set. If you try
that on your own unix-like device, for example it should yield /bin/passwd
which is perfectly reasonable as you’re able to change your password without
being root.
I recently had the pleasure to attend two events organized by the
Digital Society Institute,
one was a
workshop on software vulnerabilities and one
was their annual
conference.
For both events I delivered input on the security of security products and their
evaluation (slides can be found
here).
The DSI did a great job of assembling people from various areas (e.g. industry,
academia, politics, and research) so there was a lot of input which is not
covered by conferences I usually attend. The workshop I attended also resulted
in a short policy recommendation when it comes to the security of security
products which can be found
here.
Andrei Costin (at http://firmware.re project) is here,
and this is the second post from a series of guest postings courtesy of ERNW
(thanks Niki and Enno!).
It summarized five presentations of the 6th Annual Workshop on Security and
Privacy in Smartphones (SPSM’16). In short, it contained presentations on:
over-the-top and phone number abuse, smartphone fingerprinting, apps privacy
increase and protection/security, and apps privacy ranking.
As you probably know we perform research on a regular base at ERNW.
We – Olga and Rafael – started with a research project about Bluetooth. Our
first goal was to gain some knowledge about the tools used by most Linux systems
to communicate with Bluetooth hardware, such as BlueZ. A good help for that was
the amazing Bluetooth hacking workshop we had before (check
the link in
our blog!)
To get a better understanding of the tools you need some Bluetooth hardware to
interact with.
The hardware we used for our research so far are the very cool TexasInstruments
SimpleLink™ Bluetooth low energy/Multi-standard SensorTag (CC2650STK) and a
Fitness Wristband found at home.
As you probably know we perform research on a regular basis at ERNW. This post
is the first entry on our – Benjamin’s and Pascal’s – research diary. You might
already have seen
Oliver’s post on setting up an research environment
or Brian’s posts on IoT botnets
(here and
here).
With that in mind we want to take a look at one of the market leaders for
network camera equipment: AXIS.
At first we’d like to give a quick overview of our research objects. We bought
two cameras, an AXIS M1033-W and an AXIS M3005-V. The M1033’s description states
that it is for “small business, hotels, residences and more”. The M3005 has a
typical dome design and was actually seen in some customer environments during
projects this year.
This year’s
BlackHoodie
workshop rolled out with 28 amazing women from all parts of the world. It was a
very vibrant group with students, professionals, engineers, researchers,
physicists and what not. This is the second year that
Marion Marschalek is running this reverse
engineering workshop exclusively for women. There were a variety of topics that
were covered. This includes anti emulation tricks, anti debuggers, packers,
obfuscation, encryption/decryption functions, and a lot of fun with IDA.
This is the 3rd part of this loose series on considerations of (operating) DMZs
in 2016 (part 1 on the role of a DMZ is can be found
here,
part 2 on reverse proxies
here).
Again,
I dare to deviate a bit from the plan & order I initially had in mind – today I
will cover one process whose maturity may significantly influence the overall
security posture of a DMZ environment: firewall rule management.
My attendance throughout the entire ACM CCS 2016 week and my presentation at
TrustED was possible thanks to generous support from Enno Rey and ERNW, and I
thank them again for this opportunity!
