Every year a group of us are happy to use the holidays to travel to Hamburg to meet other people and learn something new at the 32C3.
In this small series we’ll present you recaps of some talks we found most interesting, but you also should make sure to watch the recording of them. 😉
by **Alexander Graf
**Video
Alexander Graf presents (insecurity) insights on how cable modems work and connect to the ISP.
Continue reading Continue readingAs you know we (as in ERNW) are quite involved when it comes to vulnerability disclosure and we’ve tried to contribute to a discussion at several occasions, such as Reflections on Vulnerability Disclosure and ERNW Newsletter 50 Vulnerability Disclosure Reflections Case Study.
In this post I want to add (yet) another perspective, motivated by a disclosure procedure which just happened recently.
todb’s article, R7-2015-23: Comcast XFINITY Home Security System Insecure Fail Open is a well planned public forum vulnerability disclosure. The article itself is very well done: It gives credit to the researcher who discovered the vulnerability and it shows a vulnerability disclosure timeline where Rapid7 reached out to Comcast (the vendor). They even go a step further and publish the link showing the process for discovered vulnerabilities in a Rapid7 product as well as how Rapid7 handles disclosing those vulnerabilities they find in external products. For their internal disclosure process, they make sure to release a patch before “publicly announcing the vulnerability in the release notes of the update”(rapid7 disclosure).
Continue reading Continue readingHello everybody,
this time I’d like to share some thoughts and results about our telco research
last year. We gathered a lot of information out of some projects we’d like to
share and discuss with you. The following sections also provide an idea of the
upcoming Telecommunication Security Workshop I will give with Kevin Redon at
Troopers
(click).
The workshop will be about Radio Network Security (covered by Kevin) and
security aspects of the Core Network (covered by myself), mainly focusing on
Voice over LTE (VoLTE). That’s also the topic of today’s post.
In the previous parts of this series (part 1, part 2, part 3, part 4) we covered several aspects of IPv6 security, mainly on the infrastructure level. In today’s post I will follow up by briefly discussing so-called First Hop Security features.
IPv6 First Hop Security (“IPv6 FHS”) is a collection of features (initially
implemented, and named, by Cisco but available on other platforms too) that can
be found on many access layer switches to prevent different attacks in IPv6
networks. The availability of those features is sometimes divided into three
phases and started in 2010 with the release of IOS images containing mainly RA
Guard (see below) and port-based IPv6 ACLs. Phase two was released in early
2012 and contained some more features (namely from the “IPv6 Snooping”
framework) whereas phase three was released at the end of 2012 and contained
some more advanced features (e.g. IPv6 Source Guard). Nowadays usually “phase
one” features are supported on many platforms, at least on physical ones
(support on virtual switches is still somewhat lacking).
There’s
an excellent Cisco FHS Wiki maintained by
Andrew Yourtchenko,
Scott Hogg wrote a
good overview,
as
did Ivan Pepelnjak,
and
this is a nice presentation
on some elements by Jim Small from 2013. Still, from our perspective the main
question is: which of those features should be deployed in production
networks/can be observed in real-life enterprise networks. Actually it’s only
two:
Niklaus and me had the chance to talk about our research on RedStar OS on the 32nd Chaos Communication Congress in Hamburg this year. You can see the talk online at media.ccc.de or on Youtube.
We talked about the details of the watermarking mechanism that we found in July and additional features of RedStar OS like it’s “Virus Scanner” and the system architecture. During the days after our talk we were able to find watermarks applied by RedStar OS in the wild on some sites on the Internet. We can confirm at least 7 different instances of RedStar OS that have applied watermarks to JPGs. Cleaning up the data is work in progress and we will get back to you with the results! Niklaus has put our presentation and additional resources in the git. Feel free to join us in our research and make the world a safer place!
Continue reading Continue readingIn the interim we’ve worked on the agenda of next year’s IPv6 Security Summit (for those not familiar with the event, here’s the 2015 edition and here the one of 2014), and some new talks have been added.
Rafael Schaefer: Advanced IPv6 Attacks Using Chiron. Hands-On Workshop
Outline: During the IPv6 Security Summit at Troopers 14,
Chiron, an all-in-one IPv6 penetration
testing framework was released publicly for first time. Since then, the advanced
features of Chiron were used to discover some 0-day evasion techniques against
high-end commercial and open-source Intrusion Detection / Prevention Systems.
Moreover, for Troopers 15 it was enhanced with new features, like advanced MLD
support and a fake DHCPv6 server, which can be combined with its other features,
like the use of arbitrary Extension Headers and fragmentation to leverage really
advanced attacks.
In this workshop, after a quick refreshing to the basic capabilities of Chiron,
we will focus on the advanced IPv6 functionalities that the framework offers. We
will not only show how to reproduce the latest published IPv6 attacks, but
moreover, how you can create your own arbitrary IPv6 attacking scenarios for
your own security assessments or penetration testing purposes. A lab will be set
up in order not only to reproduce the presented techniques, but to also try your
skills and – why not – to discover your own 0-day techniques :).
As we come to the end of the year we can’t help but take a moment to thank all of your who made TROOPERS15 special! It just makes us all the more pumped to kick it up a notch for TROOPERS16!! #BestWeekEver
Happy Holiday and much Joy to you in the New Year!
Your TROOPERS Team
===
Aaron Zauner:
BetterCrypto: three years in
FIRST
TIME TROOPERS SPEAKER
The BetterCrypto Project started out in the fall of 2013 as a collaborative community effort by systems engineers, security engineers, developers and cryptographers to build up a sound set of recommendations for strong cryptography and privacy enhancing technologies catered towards the operations community in the face of overarching wiretapping and data-mining by nation-state actors. The project has since evolved with a lot of positive feedback from the open source and operations community in general with input from various browser vendors, linux distribution security teams and researchers.
Continue reading Continue readingIn this part of our little series (part 1, part 2, part 3) we continue discussing IPv6 specific filtering of network traffic, namely at intersection points.
As stated in the 1st part, a number of potential security problems in IPv6 networks are related to Extension Headers of IPv6, in particular when combined with fragmentation. At the same time, as of today (December 2015) there is no Internet service or application that actually needs those headers.
Continue reading Continue readingAs we are giving another round of our Incident Analysis workshop at Troopers16, we wanted to give a little sample taste what you can expect.
Table of Contents
Extracting Mail Attachments
Word Document Analysis
Static JavaScript Analysis
Dynamic JavaScript Analysis
Before we dive into the analysis, I wanted to mention that if you are going to analyze anything unknown/potentially malicious, do it in a safe environment (VM with no internet connection, in the best case on a separate physical analysis device, or at least strip all unnecessary functionality from that VM (CVE-2015-3456 is an example to answer the “why”)). Even things like looking at content with a text editor or extracting zip files should be done in the safe environment, as those tools could contain vulnerabilities.
Continue reading Continue readingHere at TROOPERS HQ we are well into the Holiday (read TROOPERS) Spirit so we thought we would publish another round of talks! The current agenda can be found here.
Happy Holidays!
Your TROOPERS Team
===
2nd Day Keynote
FIRST TIME TROOPERS SPEAKER
Bio: Ben Zevenbergen joined the Oxford Internet Institute to pursue a DPhil on the intersection of privacy law, technology, social science, and the Internet. He runs a side project that aims to establish ethics guidelines for Internet research, as well as working in multidisciplinary teams such as the EU funded Network of Excellence in Internet Science. He has worked on legal, political and policy aspects of the information society for several years. Most recently he was a policy advisor to an MEP in the European Parliament, working on Europe’s Digital Agenda. Previously Ben worked as an ICT/IP lawyer and policy consultant in the Netherlands. Bendert holds a degree in law, specialising in Information Law.
Continue reading Continue reading