This blog post will give a brief overview about how a simple IoT device can be assessed. It will show a basic methodology, what tools can be used for different tasks and how to solve problems that may arise during analyses. It is aimed at readers that are interested in how such a device can be assessed, those with general interest in reverse engineering or the ones who just want to see how to technically approach an unknown device.
Continue reading Continue readingSummary GI Sicherheit
This is a short summary of selected talks (i.e. those that I found the most interesting of those I was able to personally attend) of the GI Sicherheit 2016.
First of all, congratulations to Dr. Fabian Yamaguchi, who received an award
(the GI Promotionspreis) for his PhD thesis
“Pattern-Based Vulnerability Discovery“!
His
work presents an “approach for identifying vulnerabilities which combines
techniques from static analysis, machine learning, and graph mining to augment
the analyst’s abilities rather than trying to replace her” by identifying and
highlighting patterns of potential vulnerabilities in source code.
TSD 2016 – Follow Up
Thanks again for all the great talks and fruitful discussions @TSD 2016! I hope everybody had a safe trip home and enjoyed Troopers as we did. In the meantime I contacted all speakers to talk about publication of their slidesets. Some of them agreed (or already published them on their own) so I’d like to share these with you:
Alexandre De Oliveira – Assaulting IPX Diameter roaming network
Siddharth Rao – The known unknowns of SS7 and beyond.
Joao Collier de Mendonca – “rucki zucki” scanning tool
Harald Welte – Open Source Network Elements for Security Analysis of Mobile Networks
Ravi & Altaf Shaik – Don’t connect to my 4G base station: investigating info leaks in 4G basebands
Unpatchable – Living with a vulnerable implanted device
TL;DR: Marie Moe talked about security issues of medical devices, especially implantable devices like pacemakers, but not in overwhelming technological depth. She wanted to point out the necessity of intensified security research in the field of medical devices as vendors and medical personnel seem to be lacking necessary awareness of security of devices, interfaces, services, and even data privacy.”Get involved, join the cavalry” was her core message.
Lub-Dub-Lub-Dub-Lub-Dub
Marie started her talk with the sound of a repeating heartbeat. First she
introduced how she came up with the topic of her talk: Marie relies on a
pacemaker herself andsince she got it implanted she was curious how secure this
little device might be. A minimum education of the auditorium followed including
an explanation how a human heart works and what a pacemaker does.
Security Assessment of Microsoft DirectAccess
A talk about DirectAccess (an IPv6-only VPN solution) was given by our colleague Ali Hardudi during IPv6 summit. Ali has recently finished his master thesis on this topic.
The DirectAccess VPN technology was introduced by Microsoft starting from Windows server 2008. It allows users remotely, seamlessly and securely connect to their internal network resources without a need to provide user credentials, which is done using different technologies such as Windows domain group policies.
Continue reading Continue readingAnonymization IPv6 in PCAPs – Challenges and Wins
Jasper Bongertz is a Senior Technical Consultant at Airbus Defence and Space
CyberSecurity. He is focusing on IT security, Incident Response and Network
Forensics.
During the IPv6 summit on Troopers16 he had given a
talk
on anonymization IPv6 in PCAPs and presented his new tool.
Sometimes you need to share your packet capture files (PCAPs), but distributing them involves a risk of exposing the confidential information. To avoid this, you must sanitize your PCAPs. The goal of sanitization is to remove the critical details but keep enough information for the PCAP to still be useful. The original-to-sanitized ratio is based on your goals.
Continue reading Continue readingPassive Intelligence Gathering and Analytics – It’s all Just Metadata!
The first talk after the keynote on day 2 of TROOPERS was from Christopher Truncer about passive intelligence gathering and the analytics of that. Christopher Truncer (@ChrisTruncer) is a red teamer with Mandiant. He is a co-founder and current developer of the Veil-Framework, a project aimed to bridge the gap between advanced red team and penetration testing toolsets.
His talk is mainly about defending a network from different threats by collecting and analyzing metadata from different sources.
Continue reading Continue readingThe Kings in your Castle
At the second day of the TROOPERS16 conference an interesting talk about Advanced Persistent Threats took place from Marion Marschalek and Raphaël Vinot. Marion Marschalek is a Security Researcher, focusing on the analysis of emerging threats and exploring novel methods of threat detection. Marion started her career within the anti-virus industry and also worked on advanced threat protection systems where she built a thorough understanding of how threats and protection systems work and how both occasionally fail.
Continue reading Continue readingdraft-vyncke-pim-mld-security
Right now, I’m in Buenos Aires for IETF95 where, amongst others, an Internet-Draft authored by Eric Vyncke, Antonios Atlasis and myself will be presented (and hopefully discussed) in two working groups. In the following I want to quickly lay out why we think this is an important contribution.
As some of you may remember about two years ago we started an internal research project on the IPv6 “helper procotol” Multicast Listener Discovery (MLD) and its security properties. One outcome of this research project was Jayson Salazar‘s excellent thesis on the topic (the full document can be found here), another outcome were the related talks we gave at DeepSec 2014 and at Troopers15.
Continue reading Continue readingAdvanced IPv6 Network Reconnaissance
Fernando Gont, who is specializing in the field of communications protocols security, gave a talk during this year’s Troopers IPv6 summit. He spoke about network reconnaissance techniques in IPv6 area and presented a brand new set of tools for this purpose.
Comparing with methods for IPv4, reconnaissance techniques for IPv6 should be different. It offers much larger address space, so such attacks as brute force address scanning are not feasible anymore, because it would take too much time to send one packet to each and every possible address. Fernando has also noted that in general network reconnaissance support in security tools has traditionally been poor. Together these facts prompt that it’s time for something new, and recently a new IETF RFC 7707 was published.
Continue reading Continue reading