This year’s Black Hat US saw a number of quite interesting talks in the context
of Windows or Active Directory Security. For those of you too lazy to search for
themselves 😉 and for our own Windows/AD Sec team (who couldn’t send anyone to
Vegas due to heavy project load) I’ve compiled a little list of those.
Paul Stone &
Alex Chapman: WSUSPect – Compromising the Windows
Enterprise via Windows Update
Slides here.
Whitepaper
here.
(Attention: on the BH website there’s an older this. the above link leads to the
latest one).
Although a bit on short notice it was a good meeting with interesting
discussions. I contributed with shortened versions of two talks we had delivered
in the past:
the “MLD Considered Harmful” talk that Antonios,
Jayson and I had presented at the
Troopers IPv6 Security Summit 2015.
The mentioned Internet-Draft on MLD security which
Eric Vyncke, Antonios and myself are
working on can be
found here.
We’re happy to receive any feedback on that one.
Special thanks go to
Jan Zorz
and to CZ.NIC for hosting us and providing refreshments.
Much appreciated, guys!
During the last few months information about one of North Koreas operating
systems was leaked. It is a Linux based OS that tries to simulate the look and
feel of a Mac. Some of it’s features have already been discussed on
variousblogposts and news
articles.
We thought we would take a short look at the OS. This blog post contains some of
the results.
As you can imagine, most interesting for us was to investigate features that
impact the privacy of the users. There are some
publications concerning the security
of the OS, this is an aspect that we will not cover in this post. We will stick
to a privacy issue that we identified in this post. As ERNW has a long history
of “Making the World a Safer Place”, we consider this topic an important one.
The privacy of potential users (especially from North Korea) may be impacted and
therefore we think that the results must be made available for the public. So,
here we go …
Some of you might use WebEx in their daily life. And some of you might use Linux
(as I and many of us do). However, this combination often results in issues with
your PC’s sound or microphone use in a WebEx session.
The problem here is that WebEx won’t run as intended with Firefox and JRE x64.
But the solution is quite easy! Use the x86-versions of each.
In this post I’ll discuss some aspects of vulnerability disclosure. I don’t want
to delve into an abstract & general discussion of vulnerability disclosure (for
those
interested here’s some discussion in
the context of Google’s Project Zero,
this is the well-known CERT/CC approach,
this a paper from WEIS 2006
laying out some variants, and
finally some statement by Bruce Schneier back in 2007). Instead
I will lay out which approach we followed in the past (and why we did so) and
which developments make us consider it necessary to re-think our way of
handling. The post is not meant to provide definitive answers; it was also
written not least to provide clarity for ourselves (“write down a problem in
order to better penetrate it”) and, maybe, to serve as a starting point for a
discussion which will help the community (and us) to find a position on some of
the inherent challenges.
When we wrote our initial blogpost regarding the
evasion of Cisco ACLs by (Ab)Using IPv6,
where we described
(known to Cisco)
cases of Access Control Lists (ACL) circumvention, we also suggested some
mitigation techniques including the blocking of some (if not all) IPv6 Extension
Headers.
Almost a month later, we got
a comment
from Matej Gregr that, even if the ACLs of certain Cisco Switches are
configured to block IPv6 Extension headers like Hop-by-Hop or Destination
Options headers, this does not actually happen/work as expected. Of course this
made us re-visit the lab in the interim ;-).
Last week I gave a short interview for Süddeutsche Zeitung on the security of
medical devices. You can find it
here.
Unfortunately it is in German so I decided to sum up some of my key points that
made it into the article and some that didn’t in this blog post.
The medical devices that we have been looking into include patient monitors,
syringe pumps, EEGs, home monitoring devices and an MRI. All of these devices
had major flaws that look like they came straight out of the 90s. Sometimes, we
were able to crash the machines by simply doing a port scan, sometimes we could
get around access controls protecting PIN codes of devices, and in most cases we
were able to render the machine unusable. All these attacks were performed over
the network and no physical access to the device was needed.
I had the honour to be invited to BT‘s SnoopCon, which is
their annual internal conference for people involved with security at BT. There
were several external and internal speakers and I was stunned by the quality of
the talks and the collaborative atmosphere. Since this event is somewhat
internal (even though I’m obviously allowed to talk about it), I won’t go into
details, however there were two particularly great talks about military war
games (which I personally enjoyed very much given my history in CTF contests)
and PoS security.
Flo and I had the pleasure to present at the CSANordic Summit in Norway.
Being in Oslo for the first time, we enjoyed the conference (small, familiar
atmosphere) very much and want to thank Lars and Kai for putting together such a
good event & having us there!
Internet Information Services (IIS) contains several components that perform
important functions for the application and Web server roles in Windows Server.
As it is designed to be used in an enterprise environment, the security of this
system must be kept at a high level.
By default IIS implements a lot of basic security measures, but are these the
relevant ones to protect your business?
In order to answer this question for one of our customers, we have compiled the
most relevant security settings in an IIS 7.5 Hardening Guide for you. In this
guide we define a baseline security level, which is to be used for so called
“crash and burn systems” (systems with non-critical data, systems whose
availability have no business relevant impact) and a security level high, which
includes all other systems. The mitigations in the baseline section are
non-critical and therefore no further test are necessary. The mitigation in the
section high, are critical in terms of availability and need to be tested
extensively. The system owner must decide, which security level is the right one
for their system, and which mitigation from section high are mandatory for their
system.