Over the past few weeks, multiple news sites have covered some mystical approach
to bruteforce PINs on Apple iOS devices. All articles cover a black box called
IP Box, the fact that PINs can be broken and that sometimes the automatic wipe
after 10 failed tries can be circumvented. Sadly, as often, the what is
described but not the how……
This blog post will give you a simple overview of both the practical attacks and
the vulnerabilities behind them. Although the Headings don’t quite give away the
content, the post starts with a simple PIN bruteforce against iOS 7.x and then
goes over to a more advanced attack on iOS 8.x and a few technical details on
the “black box”.
On March 16^(th), 2015, at the Troopers
IPv6 Security Summit,
we finally released the SI6 Networks’ IPv6 Toolkit v2.0 (Guille). The
aforementioned release is now available at the
SI6 IPv6 Toolkit homepage. It is
the result of over a year of work, and includes improvements in the following
areas:
Increased portability
Bug fixes
Additional features in existing tools
Brand-new tools
Increased Portability
One of the goals that the SI6 Toolkit had since its inception is that of
portability. The SI6 Toolkit has supported all major BSD-derived OSes, Linux,
and Mac OS for a number of years now. And this new release supports yet another
new platform: OpenSolaris. We believe that besides supporting a greater user
base, increased portability ultimately results in improved code quality.
The purpose of this blog post is to elucidate how and why MLD, an IPv6 protocol
we’ve been lately talking quite a bit about, is an unnecessarily complex beast
. This article should also serve to summarize a couple of points we’ve mentioned
during our talks about MLD but which because of time constraints never make it
into the main discussion. We’ve talked about
other aspects of MLD in previous posts.
So, have a look at those if this is a topic which you find interesting. Without
further ado, let’s start for today.
Last week Matthias and I went to Singapore to teach our workshop on
Hypervisor Exploitation at
SyScan. After a very unpleasant Lufthansa strike (which
made us arrive late in Singapore) and two intense workshop days, we were free to
attend the “last” SyScan. There are few IT security conferences that have such a
great reputation in the community and so we had high expectations, which were
definitely not disappointed. This year had a lot of really interesting talks so
I will just summarize some of the ones I liked the most.
As TROOPERS15 has come to an end, I’ve finally got the time and energy to give
you a deeper insight into the TR15 badge. As most of you have probably heard
during the conference, this year’s badge was based on the
OpenPCD2. The
OpenPCD 2 is a 13.56MHz NFC Reader, Writer and Emulator under the GNU GPL v2. As
NFC is, yet again, on an uprise, a badge with NFC simply gives you the chance to
fiddle around and hack stacks of stuff in the real world. Adding some TROOPERS
spirit and a few little secrets we hope we’ve designed a pretty nice badge!
We’ve just published the videos from TROOPERS15. The playlist can be found
here.
Thanks!
again to everybody for joining us in Heidelberg. We had a great time with you 😉
During one of our latest web application code review projects I came across a
vulnerability for which I think it is worth to speak about. It is an injection
based attack against XML parsers which uses a rarely required feature called
external entity expansion. The XML specification allows XML documents to define
entities which reference resources external to the document and parsers
typically support this feature by default. If an application parses XML input
from untrusted sources and the parsing routine is not properly configured this
can be exploited by an attacker with a so called XML external entity (XXE)
injection. A successful XXE injection attack could allow an attacker to access
the file system, cause a DoS attack or inject script code (e.g. Javascript to
perform an XSS attack).
Additionally to Wifi, Troopers is also offering a GSM network.
If you want to use it, simply ask your phone to scan for available mobile
networks. There you should see the usual T-Mobile D, Vodafone.de, E-Plus, O2-de
operators, but also the unusual D 23 or 262 23. Just select this one, and your
are done. You also can use the Troopers SIMs which you get on the welcome desk
on the ground floor.
Admitted, we’re a bit late this time, but here we go with the agenda of this
year’s TelcoSecDay.
Given the high number of quality contributions overall there’s more talks than
in the previous years and we’ll hence start more early (and finish later 🙂 ),
so please plan accordingly.
This is the agenda, details for the invididual talks can be found in the
respective links:
In my
last blog post,
I gave an overview about recent vulnerabilities discovered in the x86 emulation
layer of Xen. While both of the discussed vulnerabilities only allow for guest
privilege escalation, the complexity of the involved code seemed to indicate
that even more interesting bugs could be discovered. So I spent some time
searching for memory corruption issues and discovered a very interesting bug
that resulted in XSA 123 . This
post gives an overview about the root cause of the bug and a short description
of exploitation challenges. A follow-up post will describe possible exploitation
strategies in more detail.