Yesterday the US-CERT released a
Technical Alert (TA16-144A)
about the recently found WPAD Name Collision Vulnerability. We will give you a
summary about the vulnerability as well as the basic mechanisms here.
WPAD
The Web Proxy Auto-Discovery Protocol is used to auto-configure the proxy for
web browsers. So when joining the according network the browser can use DHCP and
DNS methods to find a specific configuration file (typically named wpad.dat),
which is loaded and applied to the browser’s settings. Therefore, there is no
need to configure each browser in your environment individually/manually.
We couldn’t be more proud to welcome such a predestined #1 hardware hacking
victim, than VICTor is!
Before Brian and I gave a lecture on hardware hacking last week at
DHBW Mosbach, we felt, that we needed a custom
victim which is fully documented and provides a good “hackability” to the
students.
Surely we could also have used some cheap $wifi_ap, but here’s the thing: Would
you really want to use a device which you don’t really know? Mostly, there’s a
massive lack of documentation regarding the SoCs used…not to mention the
unavailability of schematics and layouts.
As we wanted to teach students the basics of hardware hacking effectively, we
decided to create something by ourselves.
Today I want to give a little review about the latest app released by
SektionEins called “System and Security Info” due to its recent media
appearance. So first of all the app can be obtained via the Apple App store for
0,99€ at the time this article was written. This article will try to answer two
basic questions: for whom (or “which groups of people”) is this app helpful, and
which security features does this app actually has. The design of the app is
straight forward and pretty minimalistic with a clean and modern design. The
first page of the Application called “Overview” provides nothing more than the
current CPU usage of the device, with detailed subdivision in User, Idle, Total
and Load. The next section provides an overview about the used RAM divided into
Wire, Active RAM usage, Inactive RAM usage, “other”, free and the total amount
of the device’s ram. The next option shows the used and unused part of the
devices available storage, with “used”, “free” and total amount of space. While
these features can be handled with several other (free and open source)
applications I won’t write a comment wether it these components make sense.
Troopers16 has been over for quite a while now, but because sharing is caring,
we would like to give you some more insight and share some gems that happened
over the 2 days of us running a small/medium sized enterprise in mid-west Russia
as part of the well received FishBowl side story.
Technology wise the whole infrastructure of FishBowl, as well as the Cyber
Emergency Response Team, was hosted on one FreeBSD machine with exception of the
challenge scoreboard which was on site only, hence conference network only.
The C.E.R.T. web site was static web site using the jekyll
engine. FishBowl on the other hand required some dynamic web magic which is why
we choose to use the flask framework. For the
FishBowl web design we simply helped ourselves with the styles of the
Troopers web site, who of you noticed? 😉
All web related stuff was reverse proxied by an nginx to
provide a common layer of technology even though every venture was segregated
into its own FreeBSD jail environment.
For mail a simple postfix setup was set up. Having a proper mail server for such
»shenanigans« turned out to be very enjoyable, but more on that later.
Usually I’m not the kind of guy who talks about such economic topics. Because
I’m an engineer / security researcher who is exclusively concerned with
understanding technical problems and if possible, solving them accordingly. My
whole education is based on this and contains predominantly technical aspects of
information security. This sometimes makes it difficult to understand what the
market cares about (and why some products are being developed / exist on the
market 😉 ). Nevertheless, a current engagement for one of our customers made me
stumble upon such a product.
Once every few years I decide to head to Hannover and attend
Hannover Messe, probably the largest industrial
trade fair in Germany and apparently on of the most important in the world. As
this year’s main topic was “Industrie 4.0” I simply could not resist to go out
on a hunt for new and interesting (secure) smart connected magic! And trust me,
I was not disappointed – here’s a few of my impressions.
When it comes to SAP, Troopers has two events that are about Security in SAP
Systems in particular. On the first day of the Troopers16 Trainings the BIZEC
workshop takes place. The second event is a dedicated SAP track during the
conference. Apart from these events there were of course a lot of nice folks to
talk to (about SAP) 🙂 This post is a short overview about SAP security
@ TROOPERS16.
TROOPERS16 offered many different
speakers from around the globe. Below are three different talks from the
afternoon of Day 2’s Defense and Management Track.
===
The TROOPERS16 talk
“Attacking & Protecting Big Data Environments”
presented the research of Birk Kauer and Matthias Luft, (ERNW)
in which they showed how enterprise-grade “big data” environments, based on e.g.
HortonWorks or Cloudera, comprising of components such as HDFS, Yarn, Hue,
Flume, Hive, Spark, Sentry/Ranger could be attacked. These environments
typically process huge amounts of data. The data is either stored in a cluster
file system or streamed into clusters. The processing of these datasets are done
by jobs, and these jobs can be arbitrary code execution.
I spent the last weeks traveling to Singapore and Miami to present my Xenpwn
research about double fetch vulnerabilities in paravirtualized devices at
Infiltrate and Syscan360. You can find my slides
here. Both conferences had great
organization, very technical talks and a cool audience. In the following I want
to give a short recap of some of the talks I liked the most:
Sean Heelan – Automatic Root-Cause Identification for Crashing Executions (Infiltrate)
Sean Heelan talked about his work on automated root cause analysis. The goal of
this research is to give a human researcher a detailed analysis of the potential
root causes (in the form of violated predicates) that triggered a crash during a
fuzzing run. Sean summarizes the core idea of his research much better than I
would be able to in his
blog post,
which also contains a link to his slides. I’m always a big fan of his talks
because he is one of the few peoples working in the intersection between the
academic program verification community and the IT security industry.