Welcome to Brazil!
“Welcome to Brazil”, I think, turned to being the most used statement during the past Hackers to Hackers Conference in Sao Paulo. It was used as the main reaction to every speech taking moment, and there were a lot of those! To honor the moments and give you a quick insight into was what going on in Sao Paulo, here is a quick summary of the overall event and our own contribution.
Continue reading Continue readingHi everyone,
we (Christopher, Jan-Pascal and me) had the pleasure to join the 7th DENOG (German Network Operators Group) meeting in Darmstadt which takes place yearly in autumn. For the first time the meeting was scheduled for two days which offered more time for talks and discussions than the previous meetings. The concept of DENOG is to meet, talk, discuss and share experience with the network operator community in Germany.
The meeting started withe a talk from Peter Sievers from Juniper about Network Automation and Programmability. He presented why automation and programmability is getting more and more important even for network operators. It will help to automate the build process, the configuration and should ideally help you operating and troubleshooting your envirnoment. The focus of the talk was on the platforms which are already available and ready to use to automate day to day activities.
Continue reading Continue readingLast week I had the pleasure to attend the “escar” (Embedded Security in
Cars) conference in Cologne, Germany.
Arriving late Tuesday, I had the chance to get a rich breakfast before joining
the con in the hotel Dorint at Cologne’s famous place the Heumarkt.
Unfortunately I had to deal with two stumbling blocks on my way to the Dobrint:
The magnetic sensor of my mobile which went crazy (no compass) and – the date.
11th of November in Cologne means just one thing – carneval! The whole
city was just in a state of exception. Everybody on my way to the venue seemed
to be drinking or beeing already drunk – at 9am! 😉
Being a little late, I went straight to the room after registration. As there
was only one track to follow you could not miss any talk – nice thing!
After we were welcomed by the hosts, and the first talk started.
Last week, on the 27th-28th I attended a nice wireless conference in berlin, the WLPC (Wireless LAN Pros Conference). You can visit their website at http://berlin2015.wlanprosconference.com.
This conference is a community-driven conference from wireless professionals with focus on typical topics that come up when you are planning or running large wireless networks. This is a mainly Twitter based community, you can see some Tweets with hashtags #WLPC for example. There were also some interesting talks about future networks, for example Marko Tisler gave a talk about wireless LAN and SDN and what we can expect and what SDN will not solve for wireless networks.
Continue reading Continue readingIn mid-October our friend Bryan Fite aka Angus Blitter invited the community for the ninth edition of Day-Con. Bryan’s annual security summit, which we regard as the sister event of TROOPERS, is a pretty good reason to visit lovely Dayton, Ohio.
And so we did… ERNW sent in five delegates. Delegates is Day-Con-speak for all attendees and speakers and such a subtle choice of wording sets the tone for the whole event. People seemed to be really focused and the roundtable-like setting during the talks (see above) provided a cozy atmosphere for in-depth expert chatting.
Continue reading Continue readingThat was the opener for my presentation on the Security in Medical Devices at CodeBlue 2015 last week in Tokyo, Japan. A Code Blue often describes a patient in a critical condition, mostly needing resuscitation. That just seemed to be a perfect match, also in the sense that the condition of some medical devices out there are still pretty critical concerning security. If you follow our current research on this you know what I am talking about. I hope that we are not talking about this topic anymore three years from now. That would mean that we have made the world a safer place, although it took some time … 😉
Continue reading Continue readingSome readers will probably be aware that we are amongst the proponents of a
quite strict stance when it comes to filtering IPv6 packets with (certain)
Extension Headers and/or fragmentation, because those can be the source of many
security problems (as laid out
here,
here
or
here).
Actually I still think it was a very good idea of, amongst others, Randy Bush
and Ron Bonica to
suggest the deprecation of IPv6 fragmentation in the IETF.
On
the other hand there are voices arguing that fragmented IPv6 packets will be
needed in some cases, namely DNS[SEC]-related ones.
In this post I will discuss some details of this debate (taking place in many
circles, incl.
this thread
on the ipv6-hackers mailing list which, btw,
you should subscribe to).
The current trend of social coding finally arrived at ERNW! From now on, you will find our public released tools and scripts commonly on https://github.com/ernw. Therefore I would like to share some thoughts/guidelines which you have to keep in mind if you want to be a social coder:
Github and other repository hosts are great if you want to share opensource tools with the community, as they will find a common platform with defined workflows to extend/fix the work to get better software for everyone. What some should note is that (especially in terms of decentralized version control systems (DVCSs) like git, bazaar or mercurial) public really means public. Back in earlier days, if you shared your code with others you probably created a source code package of a defined version of your code. They will get the files you published, nothing more (and nothing less). Beginning with websites like sourceforge, a broader range of public VCSs came up (mostly driven by CVS or SVN). At this time, others were able to view your commit history (if you granted access to them) and all your mistakes you’ve done before your published code state (for example accidentally committed sensitive data). Those mistakes can still happen today. The difference with the DVCS used nowadays is that most of the time you have lesser control of your commit history (in the same way if someone had copied your history commit by commit in SVN, but then you may had noticed it because of the high network traffic). With DVCS, everyone gets a full copy (clone) of your repository even on a simple “checkout” (as called in SVN). This means he/she is able to search your history locally and has all the time he/she needs to do it. Even if you delete your repository (or modify the history), the original state is shared over all who have cloned it beforehand (thats one reason why DMCA takedowns are not that powerful/useful against git repositories). Most of the public hosting platforms even included a search over all repositories (which is really useful if you want to find some tool or try to find the reason why a local tool doesn’t work).
Continue reading Continue readingDear Readers,
today we want to share a method on how to test an OCSP over HTTP validation service with Burp and some Python magic. First a little background about OCSP (Online Certificate Status Protocol): the main purpose of OCSP is to validate the status of an X.509 certificate.
The OCSP responder is the key part of the system. It is run by the certificate authority and responds with one of three possible different answers. The first one is “good”, which indicates that the certificate is not banned, “revoked” means that the certificate is banned, and “unknown” simply says that the status could not be determined, because the issuing CA of the Cert is not known to the responder.
Continue reading Continue reading
On Monday the 28th of September 2015 a rather rare event occurred. At around 4 a.m. the moon changed its colour into a dim of red, luckily the sky was clear enough to see something.
[ picture stolen from NASA ]
If you missed that event your next chance will be in about 15 years or so.
The reason for being awake this early wasn’t the moon in the first place but what followed afterwards – my trip to the hardwear.io Security Conference in The Hague.
Continue reading Continue reading