Last week I had the pleasure to give you my impressions regarding my experience
about
hacking for b33r at Ghent,
that is, my participation at BruCON 2014 hacking
conference. As I said among else, the reason that I was there was to present
Chiron, my IPv6 penetration
testing/security assessment framework, which was supported by the
Brucon 5×5
program. The first version of Chiron had been presented at
Troopers 14,
during the
IPv6 Security Summit.
This week I had the pleasure to attend BruCON 2014.
While participating at the Brucon 5×5 program, I had also the chance to attend
this well-known European Con which is held in the beautiful city of Ghent.
The main event took place two days (on 25th and 26th of September), while some
very interesting trainings were given in the previous days. There was mainly one
track, plus some workshops that you could also attend, if you wished. You could
book your seat at one of the workshops using an
on-line scheduling system.
Today we had the opportunity at ERNW to have a full-day discussion about MLD.
The discussion was led by Jayson Salazar who writes his thesis on the topic.
For the newcomers to IPv6 world, the purpose of MLD, a subprotocol of IPv6, as
defined in RFC 2710, is “to enable each
IPv6 router to discover the presence of multicast listeners (that is, nodes
wishing to receive multicast packets) on its directly attached links, and to
discover specifically which multicast addresses are of interest to those
neighboring nodes.” MLD was updated by MLDv2 in
RFC 3810 in order to “add the ability for
a node to report interest in listening to packets with a particular multicast
address only from specific source addresses or from all sources except for
specific source addresses.”
In the context of an internal evaluation, we recently had a look at most of the
burp plugins available from the BApp store. The following overview represents
our personal top 9 plugins, categorized in “Scanner Extensions”, “Manual
Testing” and “Misc” in alphabetic order:
once again, we welcomed Michael Ossmann at the ERNW headquarters for fun with
SDR. This time with Mike´s advanced SDR workshop. And to be up front about it…it
was plain awesome. For everybody who is not familiar with Software Defined Radio
(SDR): Let’s regard it as the ultimate tool when working with radio signals.
Take a look a
this to learn
more.
Mike showed us the new revision of his HackRF One and explained us some more
advanced techniques when it comes to Radio Frequnecies hacking. Compared to last
time, the workshop focused on reversing signals and how to synthesize them. So
this time we were crafting RF packets ourselves instead of just replaying a
capture. This introduces different attack types which can be carried out over
the air for example bruteforcing or fuzzing of radio devices.
Taking the chance from
a discussion
on the
IPv6 hacker’s mailing list
and the
freshly proposed draft RFC
regarding
the deprecation of the generation of IPv6 Atomic Fragments,
I decided to test very quickly what is the current status related with the
latest and some of the most poplar Operating Systems (OS) status (whether they
send Atomic Fragments in response to Packet Too Big messages, or not). The
motivation behind this was to check which one of them is potentially vulnerable
to the DoS attack using the technique described in the above proposed RFC and
taking it for granted that Atomic Fragments are blocked in the real world (but
more about this, in another blogpost in the near future).
Information security conferences are known to be attended because of several
reasons. For some it’s the technical content, for others the networking
potential and for some others simply meeting old friends. Pinpointing our
motives is clearly a challenging task, but the following wrap-up ought to share
our personal highlights of the week we spent visiting Black Hat USA 2014 and
DEFCON 22 in Las Vegas.
After somewhat 18 hours of flight, some sleep and with the beautiful scenery of
perpetual clear skies above Las Vegas we began what was to be an incredible
week.
Last week we had the opportunity and pleasure to present some of our research
results at BlackHat US 2014 (besides of meeting a lot of old friends and having
a great researchers’ dinner).
Enno and Antonios gave their presentation on IDPS evasion by IPv6 Extension
Headers, described
here.
The material can be found
here: Slides,
tools (the main tool used was Chiron,
authored by Antonios) &
whitepaper.
Ayhan and me presented our results of the security analysis of Cisco’s
EnergyWise protocol. The protocol enables network-wide power monitoring and
control (ie turning servers off or on, putting phones to standby — basically
controlling the power state of all EnergyWise-enabled or PoE devices). The main
problem (besides a DoS vulnerability we found in IOS, see
official Cisco advisory)
is its PSK-based authentication model, which enables an attacker to cause
large-scale blackouts in data centers if the deployment is lacking certain
controls (for example our good old favorite, segmentation…). There will be a
longer blogpost/newsletter on this topic soon.
The material can be found
here: Slides &
tools