just recently i bought a wireless plug on
Amazon with
the main use of controlling my coffee machine with an app. The installation of
the wireless plug was quite easy and only requires me to set my Wifi SSID and my
passphrase – that’s it. But what happened behind the scenes? I visited the
control interface of my router and saw that along with the other devices there
was a new one with the network name HF-LPB100 and a local IP address in my case
192.168.0.235. First of all i wondered about the name itself, but ignored that
and kept on looking for open ports.
How to provide updates to IoT devices – yes, I’m aware this might be a overly
broad generalization for many different devices – has been the topic of many
discussions in the last years (for those interested the papers from the
“Internet of Things Software Update Workshop (IoTSU)”
might be a good starting point).
Given Matthias and I will moderate the respective session at tomorrow’s
IoT Insight Summit
I started writing down some points that we consider relevant in this context.
Today Kevin and I had the pleasure to to present at the German
15. Cyber-Sicherheits-Tag
in Berlin which is
organized by the
Alliance for Cyber Security.
This iteration covered security aspects of the Internet of Things and we enjoyed
some great conversations. The presentations were limited to ten slides and can
be found here:
Since the slides were supposed to be short and only support the presentation,
you still have the chance to get the full content (and even challenge it or ask
to dive deeper during the break-out discussions) next week at
our own IoT event
😉
Last Friday I gave a talk at the ITSeCX in St.
Pölten, Austria. The conference, hosted by the local University of Applied
Sciences, has already taken place ten times. I don’t know how many people
attended this time, 2014 there were about 600;
I read somewhere on the net.
There were four tracks and some workshops from 4pm to the conference’s end at
midnight. I enjoyed the community-feeling there very much, even though I arrived
late. The only talks I saw, were Adrian Dabrowski speaking about the DARPA Cyber
Grand Challenge, the finals took part in Las Vegas this August, and the very
entertaining end-of-year review from two UAS guys.
TROOPERS16 was packed with epic talks
from around the world, an unknown evil twin brother appearing, hands-on
trainings, and a legendary year for our TROOPERS Charity efforts! If you were
there you might be wondering to yourself how could they possibly top it? Well, I
am going to let you in on a little secret: Next year is the 10th edition of
TROOPERS. One DECADE of TROOPERS, and we
are pulling out all the stops! Starting with the announcement of the first 5
talks!
As we all know an IPv6 enabled host can have multiple addresses. In order to
select a source address for a to-be established outbound connection, operating
systems implement a source address selection mechanism that evaluates multiple
source address candidates and selects the (potentially) best candidate. Criteria
for this selection are defined in
RFC6724 (which obsoletes RFC 3484).
To find out if there are differences as for the way various OSs implement this
mechanism we performed a little study whose results can be found in
this whitepaper.
Those differences might be particularly relevant for data center environments or
enterprise networks with a variety of heterogeneous client operating systems. If
interested in IPv6 in enterprise networks
this training
that I’ll give in some weeks might be worth attending for some of you, too.
For the 6th year in a row, the next TelcoSecDay will take place in 2017 on March
21th. Again, it will be held one day before
Troopers IT-Security Conference as an invitation-only
event. For those of you who don’t know the TSD, it is organized by ERNW and is
aimed at bringing researchers and people from the telecommunication industry
together to discuss about current security weaknesses, challenges and
strategies. To do so, various topics will be presented during the talks and
there will surely be enough time to follow-up in extensive discussions.
To give you an idea, here’s the
TSD 2016 agenda,
and here’s
the one of 2015.
Just a few days ago I had the pleasure of visiting
Day-Con X. I listened to some great talks in the closed
and public sessions. Since the first day was the security summit (closed
session) I will just name a few titles with some brief words.
Captivating Security – Safety versus Passion (Josh More):
Was quite interesting to compare the IT-World with zoos.
Beyond Embedded (Brittany Postnikoff):
Robots are fun soon :).
The newest addition to ERNW, ERNW Insight which now hosts
TROOPERS, is launching a new concept this
year. Based on the successful TROOPERS Roundtable sessions, ERNW Insight will
host a series events every year covering current and relevant topics in the
field of IT Security. While the style of the events may vary the in-depth
knowledge sharing that you have come to know from TROOPERS will not!
The inaugural event will be
our IoT Insight Summit,
taking place on November 15, 2016 at the
Crowne Plaza Heidelberg.
This 1-day event will begin with a keynote and case study from industry
experts. Afterwards, all participants will be divided into five groups of 10
persons each to participate in our “Break Out Sessions”. Every participant will
get the opportunity to attend all 5 Break Out Sessions, where our IT Security
moderators will lead discussions on typical problems and solutions in IoT.
Sorry about the larger delay between the previous post and this one, but I was
very busy the last weeks.
(And the technology I wanted to show wasn’t completely implemented in radare2,
which means that I had to implement it on my own 😉 ). In case you’re new to
this series, you’ll find the previous posts
here.
As you may already know, we’ll deal with the third challenge today. The purpose
for this one is to introduce
some constructs which are often used in real programs.