Last week I gave a short interview for Süddeutsche Zeitung on the security of
medical devices. You can find it
here.
Unfortunately it is in German so I decided to sum up some of my key points that
made it into the article and some that didn’t in this blog post.
The medical devices that we have been looking into include patient monitors,
syringe pumps, EEGs, home monitoring devices and an MRI. All of these devices
had major flaws that look like they came straight out of the 90s. Sometimes, we
were able to crash the machines by simply doing a port scan, sometimes we could
get around access controls protecting PIN codes of devices, and in most cases we
were able to render the machine unusable. All these attacks were performed over
the network and no physical access to the device was needed.
I had the honour to be invited to BT‘s SnoopCon, which is
their annual internal conference for people involved with security at BT. There
were several external and internal speakers and I was stunned by the quality of
the talks and the collaborative atmosphere. Since this event is somewhat
internal (even though I’m obviously allowed to talk about it), I won’t go into
details, however there were two particularly great talks about military war
games (which I personally enjoyed very much given my history in CTF contests)
and PoS security.
Flo and I had the pleasure to present at the CSANordic Summit in Norway.
Being in Oslo for the first time, we enjoyed the conference (small, familiar
atmosphere) very much and want to thank Lars and Kai for putting together such a
good event & having us there!
Internet Information Services (IIS) contains several components that perform
important functions for the application and Web server roles in Windows Server.
As it is designed to be used in an enterprise environment, the security of this
system must be kept at a high level.
By default IIS implements a lot of basic security measures, but are these the
relevant ones to protect your business?
In order to answer this question for one of our customers, we have compiled the
most relevant security settings in an IIS 7.5 Hardening Guide for you. In this
guide we define a baseline security level, which is to be used for so called
“crash and burn systems” (systems with non-critical data, systems whose
availability have no business relevant impact) and a security level high, which
includes all other systems. The mitigations in the baseline section are
non-critical and therefore no further test are necessary. The mitigation in the
section high, are critical in terms of availability and need to be tested
extensively. The system owner must decide, which security level is the right one
for their system, and which mitigation from section high are mandatory for their
system.
I recently had the pleasure to join the
64th NANOG (North American Network
Operators’ Group) meeting in San Francisco, which can be understood as one of
the largest Internet engineering conferences at all. It takes place three times
a year at different locations in North America.
What I personally like about NANOG is its strong collaborative and cooperative
character. It is not about single persons and also not too much about
spectacular projects but more about discussing technologies, ideas, challenges
and numbers. Every talk has a comparatively large time slot reserved for
discussion, which is often more than fully used. Discussion is typically
actively focused and is more time-consuming (and even more relevant) than the
talk itself. Which often is intended by the community. The climate of discussion
is almost always impressively polite and constructive, even for controversially
discussed topics.
In the course of a customer project I recently documented some thoughts and
general objectives of IPv6 address planning, expanding on stuff I wrote a while
ago in the
series on “Address Plan Considerations”.
An excerpt of that (newer) document
can be found here.
Due to the context it originates from it’s in German, still I hope it’s useful
for some readers.
If you’re interested in the topic it might be a good idea to listen to
Tom Coffeen‘s talk at the upcoming
IPv6 Business Conference, too.
I wrote a small python script that extracts the content from Alcatel .tim
firmware files. It took some time staring at hex values, as well as a fair
amount of guess work to figure out the file format.
All .tim files start with a common header, containing the TiMOS version string,
the build string, the used compression algorithm and the number of segments
included in the file. The common header is followed by a header for each segment
in the file. The segment header contains values like the name of the segment,
the beginning of the segment in the image file, the size of the segment,
compressed as well as extracted, a checksum of the decompressed data and also
the base address and entry point of the data in the routers memory. A segment
header can look like this:
There has been, again, some development within the loki domain. Today I’m going
to write about the latest module added to the suite, a module for decoding and
cracking Cisco’s TACACS+.
TACACS is the Terminal Access Controller Access-Control System, a protocol for
handling remote user authentication and central access control. It originated in
1984 and was used in the old Unix world. TACACS+ is a related protocol developed
by Cisco Systems and is widely used for AAA (Authentication, Authorization,
Accounting) on IOS based devices. It was released as an
open standard in 1993 (and
expired in 1998 by the way ;-)).
End of May eight ERNW members were travelling to Moscow (Russia) to visit the
PHDays V conference. It was a very nice trip
because we met a lot of gentle people, ate some great food and had quite
some fun in this exciting and history-charged metropole, and we were able to get
around using hands and feet (and Google translate ;-)).
The remainder of this post contains summaries of some of the most interesting
talks at PHD V:
I’m back from London where I gave a talk about security evaluation of
proprietary network protocols. I had a great time at
InfoSecurity Intelligent Defence
and BSides London, many thanks for
inviting me and giving me the opportunity to speak to so much nice people.
Find the abstract and the download link to the slides after the break.
Even in the time of Cloud-based security tools, behavior- and machine
learning-based APT detection and colorful security appliances, a lot of
vulnerabilities are still buried deep within the protocol layers. For security
researchers it is quite a challenge to find those in well documented protocols
(take SSL for an example), and when it comes to proprietary protocols, the bar
is raised even (significantly) higher. This keynote will show that there is
still an urgent need for security evaluation on (undocumented) network
protocols, discuss war stories on protocol fails, and also give an
introduction into the methodology of protocol reversing and how those protocol
fails could have been avoided.