While running some SS7 pentests last year, I developed a small tool automating
some of the well-known SS7 attack cases. Today I’m releasing the first version
of ss7MAPer, a SS7MAP (pen-)testing
toolkit.
The toolkit is build upon the
Osmocom SS7 stack and implements
some basic MAP messages. At its current state tests against the
HLR are ready for use,
in future versions tests against
VLR,
MSC and
SMSC will follow.
The source code of the tool is published on
github, feel free to use and extend.
I’ll be on the
“IPv6 Panel”
at Cisco Live next week and somewhat in
preparation I started thinking about what we currently see when it comes to IPv6
deployment in our customer space. We notably observe a large gap between
“textbook planning & transition strategies” and what’s happening in real-life in
those organizations. I hence decided to write down some of these observations in
a quick series of posts to be published in the upcoming days and, maybe more
importantly, to reflect on the reasoning of this apparent mismatch between
theory and practice. I dare to add a dose of devil’s advocate here+there…
For today let’s start with some comments on IPv6 address planning.
It’s me again with another teaser for an upcoming workshop at the
IPv6 Security Summit. This one
is a classic! If you happen to deploy IPv6 in your environment in the near
future, but didn’t had the time to think about the security implications, this
workshop
is the right place to start.
We will start the workshop with a quick refresher of the core behavior of IPv6
to make sure that every attendee is on the same page. Before we start discussing
and demonstrating various IPv6 attacks, we dive into (a little more abstract)
topic of why IPv6 security actually isn’t that easy to implement. We will
continue with IPv6 attacks targeted at the local link. Rafael and I will
introduce commonly used IPv6 attack tools as well as performing various attacks
in a dedicated lab environment. Every attendee is encouraged to participate in
these exercises. We will provide you with the necessary tools; you just have to
bring a laptop with (ideally) Linux installed. We will prepare some virtual
machines including VMware Player in case your corporate laptop runs Windows.
today I want to talk about OSPFv3. I won’t cover the glory details of
OSPFv3, there are smarter guys than me out
there who did that
already 😉 and
there are great resources to familiarize yourself with the protocol. However, it
should be noted that OSPFv3 is not only OSPF for IPv6, OSPFv3 brought some major
enhancements compared to OSPFv2. Wouldn’t it be cool to benefit from the
enhancements in the IPv4 world as well?
Today I want to give you a little teaser about my upcoming talk at the
IPv6 Security Summit about
First-Hop-Security on HP devices. In the past I presented on about
First-Hop-Security in the
Cisco realm and
in virtualized environments.
Until recently, Cisco was mostly the only vendor who had a sufficient
implementation of various IPv6 security features on their access-layer switches,
but HP closed the gap considerably and it’s time to have an in-depth look
at their implementation of those features.
some of you may have seen my last
blog post
about the preparation of the Troopers network. Today I want to give you a little
teaser on what to expect for the
talk
I will present during the IPv6 Security Summit. As the title implies, it’s not
only about building a secure IPv6 WiFi, but also a reliable one. One might think
that there aren’t many differences in comparison to IPv4, but the heavy reliance
on multicast of IPv6 does have implications for Wi-Fi networks in general.
I am currently preparing the Troopers network in a
lab environment to ensure that we all will have a smooth Wi-Fi experience during
Troopers. I wanted to spice things up a little bit for the Wi-Fi deployment
(more on that in a following blogpost) and get rid of IPv4 wherever possible.
Our Wi-Fi infrastructure consists of typical Cisco Access Points (1602) and a
2504 Wireless LAN Controller. Beginning with WLC image 8.0 it is finally
supported to establish the CAPWAP tunnel between the AP and the WLC over IPv6,
which is awesome and I wanted to implement it right away.
Some weeks ago Hendrik explained in his blogpost
Security Analysis of VoLTE, Part 1
some attack vectors for Voice over LTE (VoLTE). One attack vector introduced was
Denial of Service (DoS), which I also discussed in my Masterthesis “Evaluation
of IMS security and Developing penetration tests of IMS”.
In general, DoS attacks aim to prevent a system or a network from efficiently
providing its service to legitimate users . The impact of such attacks can vary
from a big degradation of quality to total blockage. DoS can occur on users
level, where a user or a group of users cannot use the service. But the common
conception of DoS is on the service level, where the whole service is broken,
unstable or totally down. This blog post is about targeting DoS of the whole
VoLTE service by attacking IMS.
I am very happy to announce the second round of talks for the
TelcoSecDay 2016.
As mentioned in my
previous post
it will take place on March 15th. All invitations should be out by now; if you
think you can contribute to the group and you are willing to join us – please
let me know (hschmidt@ernw.de).
Still, not all talks are confirmed but the newly published talks will provide an
idea about TSD 2016 and its discussions.
In this part of the series (for the other parts see
[1],
[2],
[3],
[4],
[5]) we’ll
discuss approaches to implement security measures suited to protect from
IPv6-related threats on the host level.
These can be grouped into the following generic categories each of which will be
described in more detail in the following:
“Minimal machine” approach
Static configuration of IPv6 parameters
Tweaking the behavior of IPv6-related mechanisms/protocols
Local packet filtering
Some of you might recall that we published IPv6 hardening guides for both
Linux
and
Windows a
while ago and we’ll reference those exact documents below, by [Hard_Linux]
and [Hard_Windows] respectively.