In the context of an internal evaluation, we recently had a look at most of the
burp plugins available from the BApp store. The following overview represents
our personal top 9 plugins, categorized in “Scanner Extensions”, “Manual
Testing” and “Misc” in alphabetic order:
once again, we welcomed Michael Ossmann at the ERNW headquarters for fun with
SDR. This time with Mike´s advanced SDR workshop. And to be up front about it…it
was plain awesome. For everybody who is not familiar with Software Defined Radio
(SDR): Let’s regard it as the ultimate tool when working with radio signals.
Take a look a
this to learn
more.
Mike showed us the new revision of his HackRF One and explained us some more
advanced techniques when it comes to Radio Frequnecies hacking. Compared to last
time, the workshop focused on reversing signals and how to synthesize them. So
this time we were crafting RF packets ourselves instead of just replaying a
capture. This introduces different attack types which can be carried out over
the air for example bruteforcing or fuzzing of radio devices.
Taking the chance from
a discussion
on the
IPv6 hacker’s mailing list
and the
freshly proposed draft RFC
regarding
the deprecation of the generation of IPv6 Atomic Fragments,
I decided to test very quickly what is the current status related with the
latest and some of the most poplar Operating Systems (OS) status (whether they
send Atomic Fragments in response to Packet Too Big messages, or not). The
motivation behind this was to check which one of them is potentially vulnerable
to the DoS attack using the technique described in the above proposed RFC and
taking it for granted that Atomic Fragments are blocked in the real world (but
more about this, in another blogpost in the near future).
Information security conferences are known to be attended because of several
reasons. For some it’s the technical content, for others the networking
potential and for some others simply meeting old friends. Pinpointing our
motives is clearly a challenging task, but the following wrap-up ought to share
our personal highlights of the week we spent visiting Black Hat USA 2014 and
DEFCON 22 in Las Vegas.
After somewhat 18 hours of flight, some sleep and with the beautiful scenery of
perpetual clear skies above Las Vegas we began what was to be an incredible
week.
Last week we had the opportunity and pleasure to present some of our research
results at BlackHat US 2014 (besides of meeting a lot of old friends and having
a great researchers’ dinner).
Enno and Antonios gave their presentation on IDPS evasion by IPv6 Extension
Headers, described
here.
The material can be found
here: Slides,
tools (the main tool used was Chiron,
authored by Antonios) &
whitepaper.
Ayhan and me presented our results of the security analysis of Cisco’s
EnergyWise protocol. The protocol enables network-wide power monitoring and
control (ie turning servers off or on, putting phones to standby — basically
controlling the power state of all EnergyWise-enabled or PoE devices). The main
problem (besides a DoS vulnerability we found in IOS, see
official Cisco advisory)
is its PSK-based authentication model, which enables an attacker to cause
large-scale blackouts in data centers if the deployment is lacking certain
controls (for example our good old favorite, segmentation…). There will be a
longer blogpost/newsletter on this topic soon.
The material can be found
here: Slides &
tools
While fairytales often start with “Once upon a time…”, our blogposts often start
with “During a recent security assessment…” — and so does this one. This time we
were able to spend some time on VMware’s
vCenter Operations Manager
(herein short: VCOPS). VCOPS is a monitoring solution for load and health of
your vSphere environment. In order to provide this service, two virtual machines
(analytics engine and Web-based UI) must be deployed (as a so-called vApp) that
are configured on startup by various scripts (mainly
/usr/lib/vmware-vcops/user/conf/install/firstbootcommon.sh) to match the actual
environment and communicate via an OpenVPN tunnel that is established directly
between the two machines. To gather the monitoring data, read-only access to the
vCenter is required.
In the
“A Novel Way of Abusing IPv6 Extension Headers to Evade IPv6 Security Devices”
blogpost I described a way to evade a high-end commercial IDPS device, the
Tipping Point IDPS (TOS Tipping Point, Package 3.6.1.4036 and vaccine 3.2.0.8530
digital), by abusing a minor detail at the IPv6 specification. As I promised at
the end of that blogpost, this is not the end. In this blogpost I am going to
describe several new and different ways of evading another popular IDPS, an
open-source one this time, Suricata.
In the light of the recent release of version 5.0 of Microsoft’s Enhanced
Mitigation Experience Toolkit (EMET) on July 31, it seems to be more than
appropriate to talk a bit about the new features and some general things to take
into account when using EMET (for the new certificate pinning feature of EMET
4.0, see
Friedwart’s comment).
For all of you who don’t know EMET, in short, it’s a free mitigation tool for
Windows developed by Microsoft, helping the user by preventing vulnerabilities
in software from being successfully exploited. The tool works by protecting
applications via a number of security mitigation technologies, vastly extending
Windows operating system mitigation capabilities as Data Execution Prevention
(DEP) and Address Space Layout Randomization (ASLR).
Recently we started playing around with Cisco’s virtual router, the CSR 1000V,
while doing some protocol analysis. We found Cisco offering an BIN file for
download (alternatively there is an ISO file which contains a GRUB boot loader
and the BIN file, or an OVA file which contains a virtual machine description
and the ISO file) and file(1) identifies it as DOS executable:
$ file csr1000v-universalk9.03.12.00.S.154-2.S-std.SPA.bin
csr1000v-universalk9.03.12.00.S.154-2.S-std.SPA.bin: DOS executable (COM)
We didn’t manage to get the file running, neither in a (Free-)DOS environment,
nor in a wine virtual DOS environment, except using the boot loader from the ISO
file. So we became curious as for the structure and ingredients of the file.