So this is the third part of our little series on securing IPv6 in enterprise environments. In the first part we tried to develop an understanding of threats in IPv4 networks as a kind-of baseline while analyzing the main differences induced by IPv6 and in the second part we laid out protection strategies on the infrastructure level, focusing on network isolation on the routing layer. Today I’ll dive into discussing IPv6-specific filtering of network traffic.
Continue reading Continue readingInvestigating Memory Analysis Tools – SSDT Hooking via Pointer Replacement
In this blogpost we will briefly explain a well known Syscall hooking technique (a more detailed explanation can be gathered from e.g. http://resources.infosecinstitute.com/hooking-system-service-dispatch-table-ssdt/) used by multiple malware samples (like the laqma trojan) and right after discuss how some memory analysis tools have trouble in the analysis and/or reporting of these.
Before we go further, I just shortly wanted to say, that this post is not intended to be a bashing of any tool. We have the greatest respect for all the effort and work which has been and most probably will be done in the future.
Continue reading Continue reading2nd Rounds of TROOPERS16 Talks
Here’s the second round of TROOPERS16 talks. For more information check out our website: TROOPERS
Happy Holidays and all the best for 2016 to everybody!
Your TROOPERS Team
===
Ivan Pepelnjak: Real-life Software-Defined Security
Vendors, pundits, and industry media love to talk about Software-Defined Everything, but nothing ever changes in the enterprise world, right? Wrong. Some engineers are already solving security problems with a software-defined approach to networking and security, be it microsegmentation in NSX or OpenStack environment, building scale-out IDS clusters, or respond to DoS or intrusion events in real-time… and we’ll cover all these ideas in this fast-paced presentation
Continue reading Continue readingFirst Talks of TROOPERS 2016 Accepted!
Here’s the first round of TROOPERS16 talks. For more information check out our website: TROOPERS
Happy Holidays and all the best for 2016 to everybody!
Your TROOPERS Team
===
Mike Ossmann: Rapid Radio Reversing
Wireless security researchers have an unprecedented array of tools at their disposal today. Although Software Defined Radio (SDR) is the single most valuable tool for reverse engineering wireless signals, it is sometimes faster and easier to use other tools for portions of the reverse engineering process. I’ll discuss how beneficial a hybrid SDR/non-SDR approach has been to security researchers, and I’ll walk through an example of the process.
Continue reading Continue readingDeveloping an Enterprise IPv6 Security Strategy / Part 2: Network Isolation on the Routing Layer
In the first part of this series we tried to identify which risks related to network-related threats actually change when IPv6 gets deployed and hence which ones to take care of in a prioritized manner (as opposed to those which one might be tempted to [initially] disregard with a “has been there in IPv4 already and we did not address it then, why now?” stance). Let’s assume we went through this step and, for those most relevant risks we identified, we want to come up with infrastructure level controls first, before tackling controls to be deployed on the host level (as in many organizations the sysowners of “hosts” like servers in datacenters tend to expect “the network/infrastructure guys to provide the 1st layer of defense against threats”, in particular once those originate from an apparent network layer protocol, that is IPv6).
Continue reading Continue readingDeveloping an Enterprise IPv6 Security Strategy / Part 1: Baseline Analysis of IPv4 Network Security
We’ve been involved in some activities in this space recently and I thought it could be a good idea to share a couple of things we’ve discussed & displayed. Furthermore some time ago – in the Is IPv6 more Secure than IPv4? Or Less? post – I announced to come up with (something like) an “IPv6 threats & controls catalogue” at some point… so here we go: in an upcoming series of a few blogposts I will lay out some typical elements of an “Enterprise IPv6 Security Strategy” incl. several technical pieces (and I plan to give a talk on the exact topic at next year’s IPv6 Security Summit).
Continue reading Continue readingWelcome to Brazil!
Welcome to Brazil!
“Welcome to Brazil”, I think, turned to being the most used statement during the past Hackers to Hackers Conference in Sao Paulo. It was used as the main reaction to every speech taking moment, and there were a lot of those! To honor the moments and give you a quick insight into was what going on in Sao Paulo, here is a quick summary of the overall event and our own contribution.
Continue reading Continue readingDENOG7
Hi everyone,
we (Christopher, Jan-Pascal and me) had the pleasure to join the 7th DENOG (German Network Operators Group) meeting in Darmstadt which takes place yearly in autumn. For the first time the meeting was scheduled for two days which offered more time for talks and discussions than the previous meetings. The concept of DENOG is to meet, talk, discuss and share experience with the network operator community in Germany.
The meeting started withe a talk from Peter Sievers from Juniper about Network Automation and Programmability. He presented why automation and programmability is getting more and more important even for network operators. It will help to automate the build process, the configuration and should ideally help you operating and troubleshooting your envirnoment. The focus of the talk was on the platforms which are already available and ready to use to automate day to day activities.
Continue reading Continue reading13th escar Europe conference | Embedded Security in Cars
Last week I had the pleasure to attend the “escar” (Embedded Security in
Cars) conference in Cologne, Germany.
Arriving late Tuesday, I had the chance to get a rich breakfast before joining
the con in the hotel Dorint at Cologne’s famous place the Heumarkt.
Unfortunately I had to deal with two stumbling blocks on my way to the Dobrint:
The magnetic sensor of my mobile which went crazy (no compass) and – the date.
11th of November in Cologne means just one thing – carneval! The whole
city was just in a state of exception. Everybody on my way to the venue seemed
to be drinking or beeing already drunk – at 9am! 😉
Being a little late, I went straight to the room after registration. As there
was only one track to follow you could not miss any talk – nice thing!
After we were welcomed by the hosts, and the first talk started.
Wireless LAN Pros Conference
Last week, on the 27th-28th I attended a nice wireless conference in berlin, the WLPC (Wireless LAN Pros Conference). You can visit their website at http://berlin2015.wlanprosconference.com.
This conference is a community-driven conference from wireless professionals with focus on typical topics that come up when you are planning or running large wireless networks. This is a mainly Twitter based community, you can see some Tweets with hashtags #WLPC for example. There were also some interesting talks about future networks, for example Marko Tisler gave a talk about wireless LAN and SDN and what we can expect and what SDN will not solve for wireless networks.
Continue reading Continue reading