I recently had the pleasure to attend two events organized by the Digital Society Institute, one was a workshop on software vulnerabilities and one was their annual conference. For both events I delivered input on the security of security products and their evaluation (slides can be found here). The DSI did a great job of assembling people from various areas (e.g. industry, academia, politics, and research) so there was a lot of input which is not covered by conferences I usually attend. The workshop I attended also resulted in a short policy recommendation when it comes to the security of security products which can be found here.
Continue reading Continue readingCCS’16 – Day 2 – 25th October 2016
Hello again.
Andrei Costin (at http://firmware.re project) is here, and this is the second post from a series of guest postings courtesy of ERNW (thanks Niki and Enno!).
Few days ago, the first CCS’16 summarization post went online: https://insinuator.net/2016/11/introduction-ccs16-day-1-24th-october-2016/
It summarized five presentations of the 6th Annual Workshop on Security and Privacy in Smartphones (SPSM’16). In short, it contained presentations on: over-the-top and phone number abuse, smartphone fingerprinting, apps privacy increase and protection/security, and apps privacy ranking.
Continue reading Continue readingResearch Diary: Bluetooth
As you probably know we perform research on a regular base at ERNW.
We – Olga and Rafael – started with a research project about Bluetooth. Our first goal was to gain some knowledge about the tools used by most Linux systems to communicate with Bluetooth hardware, such as BlueZ. A good help for that was the amazing Bluetooth hacking workshop we had before (check the link in our blog!)
To get a better understanding of the tools you need some Bluetooth hardware to
interact with.
The hardware we used for our research so far are the very cool TexasInstruments
SimpleLink™ Bluetooth low energy/Multi-standard SensorTag (CC2650STK) and a
Fitness Wristband found at home.
Research Diary: IP-Cameras
As you probably know we perform research on a regular basis at ERNW. This post is the first entry on our – Benjamin’s and Pascal’s – research diary. You might already have seen Oliver’s post on setting up an research environment or Brian’s posts on IoT botnets (here and here). With that in mind we want to take a look at one of the market leaders for network camera equipment: AXIS.
At first we’d like to give a quick overview of our research objects. We bought two cameras, an AXIS M1033-W and an AXIS M3005-V. The M1033’s description states that it is for “small business, hotels, residences and more”. The M3005 has a typical dome design and was actually seen in some customer environments during projects this year.
Continue reading Continue readingBlackHoodie 2016
This year’s BlackHoodie workshop rolled out with 28 amazing women from all parts of the world. It was a very vibrant group with students, professionals, engineers, researchers, physicists and what not. This is the second year that Marion Marschalek is running this reverse engineering workshop exclusively for women. There were a variety of topics that were covered. This includes anti emulation tricks, anti debuggers, packers, obfuscation, encryption/decryption functions, and a lot of fun with IDA.
Continue reading Continue readingConsiderations on DMZ Design in 2016, Part 3: Some Notes on Firewall Rule Management
This is the 3rd part of this loose series on considerations of (operating) DMZs
in 2016 (part 1 on the role of a DMZ is can be found
here,
part 2 on reverse proxies
here).
Again,
I dare to deviate a bit from the plan & order I initially had in mind – today I
will cover one process whose maturity may significantly influence the overall
security posture of a DMZ environment: firewall rule management.
Introduction & CCS’16 – Day 1 – 24th October 2016
I am Andrei Costin (at http://firmware.re project), and this is the first post from a series of guest postings courtesy of ERNW.
Between 24th and 28th October, I had the pleasure and the great opportunity to attend ACM CCS 2016 in Vienna, Austria, where I also presented at the TrustED’16 workshop my paper titled “Security of CCTV and Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations”.
My attendance throughout the entire ACM CCS 2016 week and my presentation at TrustED was possible thanks to generous support from Enno Rey and ERNW, and I thank them again for this opportunity!
Continue reading Continue readingIoT the S is for Secure – Unknown Administration Interface in Wireless Plug
Dear Readers,
just recently i bought a wireless plug on Amazon with the main use of controlling my coffee machine with an app. The installation of the wireless plug was quite easy and only requires me to set my Wifi SSID and my passphrase – that’s it. But what happened behind the scenes? I visited the control interface of my router and saw that along with the other devices there was a new one with the network name HF-LPB100 and a local IP address in my case 192.168.0.235. First of all i wondered about the name itself, but ignored that and kept on looking for open ports.
Continue reading Continue reading(Securely) Updating Smart Devices / Some Considerations
How to provide updates to IoT devices – yes, I’m aware this might be a overly
broad generalization for many different devices – has been the topic of many
discussions in the last years (for those interested the papers from the
“Internet of Things Software Update Workshop (IoTSU)”
might be a good starting point).
Given Matthias and I will moderate the respective session at tomorrow’s
IoT Insight Summit
I started writing down some points that we consider relevant in this context.
15. Cyber-Sicherheits-Tag
Today Kevin and I had the pleasure to to present at the German 15. Cyber-Sicherheits-Tag in Berlin which is organized by the Alliance for Cyber Security. This iteration covered security aspects of the Internet of Things and we enjoyed some great conversations. The presentations were limited to ten slides and can be found here:
Kevin Schaller – Defense in Depth in IoT
Matthias Luft – Update Management in IoT
Since the slides were supposed to be short and only support the presentation, you still have the chance to get the full content (and even challenge it or ask to dive deeper during the break-out discussions) next week at our own IoT event 😉
Continue reading Continue reading