As it is well known to the IPv6 enthusiasts, one of the most significant changes
that IPv6 brings with it, apart from supporting a really huge address space, is
the improved support for Extensions and Options, which is achieved by the usage
of IPv6 Extension headers. According to
RFC 2460, “changes in the way IP
header options are encoded allows for more efficient forwarding, less stringent
limits on the length of options, and greater flexibility for introducing new
options in the future.” So, by adding IPv6 Extension headers, according to the
designers of the protocol, flexibility and efficiency in the IP layer is
improved.
I recently stumbled over a
document from
Microsoft which lists all services/applications that support IPv6. Most of the
content wasn’t new for me, but one item caught my attention. Windows Update. I
haven’t heard before that Windows Update can be done over IPv6 (but this could
just be me not looking hard enough ;)), so I was eager to test it out seeing if
this is really the case. I was also curious why Microsoft referenced this
document
in the respective column.
In the course of a recent penetration test, we came across an Image validation
vulnerability in Django when using the
Python-Imaging-Library (PIL) which we
want to explain in this post.
Everybody who doesn’t know what Django and/or
the PIL is:
Django is a framework to create web applications with Python (comparable to
Rails or Zend). The PIL is a powerful standard python library which provides a
toolset to modify, display and verify images of many different formats.
This is the third – and hence presumably last – part of the series of posts on
IPv6 address planning (first part can be found
here,
second one
here).
It’s split into three main pieces. In the beginning I will lay out some general
objectives to be considered when designing an address plan. Then I’ll have a
look at potential hierarchy levels and finally I’ll discuss some real-life
samples we’ve seen recently.
On Saturday, April 26 Microsoft announced that Internet Explorer version 6 until
version 11 is under potential risk against drive-by attacks from malicious
websites, regardless of the underlying Microsoft operating system and the
associated memory protection features integrated with the operating system.
Microsoft has assigned CVE-2014-1776 to this unknown use-after-free
vulnerability, which in the worst case could allow remote code execution if a
user views a specially crafted website. If an attacker successfully exploits
this vulnerability, s/he will gain the same rights and privileges as the current
user (once again, activated User Account Control [UAC] helps keeping
privileges of the user low).
As we historically have a strong connection to network technologies (not
surprising, given the “NW” in “ERNW” stands for “Networks”), I developed a small
script to create RFC-style ASCII representations of protocol schemes. The
following listing shows an example created for a fictitious protocol:
a few weeks ago I held a talk at UnFUCK, a
small University con from students for students. I had decided to give a short
talk on “Owning Stuff via USB” aka how to use our TR14
Badge! During
the preparations and while building my demos, I tested my new
USB RubberDucky.
One rather “trivial” demo was actually to use it as a keyboard on an Android
phone.
Android has been able to use the
USB OTG features for
quite a while now, where most people enjoy being able to connect a USB stick to
a phone, some others might have already used a keyboard on a tablet. OTG enables
a USB device to play master and hence connect two USB devices to each other. For
this the fifth PIN on a micro USB cable is used (it’s simply pulled down to
ground). To be able to use USB OTG you both need a special cable (micro USB to
female USB A) and a master device with all the necessary drivers. Depending on
the Android device and the client (USB stick/HDD, keyboard) you want to connect
you might need a rooted phone.When trying the RubberDucky on Android for the
first time, I had a S3, a Nexus 4, a Nexus 5 and an SE Xperia Z1. All of these
devices detected the Ducky as a keyboard and I was able to write stuff on the
phone. But I hadn’t aimed at “just typing text”, I wanted to type numbers or
rather PINs –> One can use the external keyboard while unlocking the device.
The Ducky’s user guide contains an example script for bruteforcing PINs on
Android. But how?
Just type!
and thanks for a great time at HES14! A nice
venue (a museum), sweet talks and
stacks of spirit carried us through the three day con. It all set off with a
keynote byTROOPERs veteran Edmond ‘bigezy’ Rogers, who stuck to a quite simple
principle: “People do stupid things” and I guess every single one of you has
quite a few examples for that on offer. Next to every speaker referenced that
statement at some point during her/his talk. Furthermore we presented an updated
version of our talk
LTE vs. Darwin,
covering our research of security in LTE networks and potential upcoming
problems.
TROOPERS14 has come to an end, and it’s finally time to let you have a go at the
Badge’s source code. As promised, it was slightly modified and extended, to show
you the full potential of your new gadget. I’ve added some nice payloads from
Nikhil Mittal and a few own ones. Above that, for those who took their parts for
soldering home, I’ve also added a few quick instructions on how to do the
soldering.
Greetings from the Print Media Academy in Heidelberg. Just in time for
TROOPERS14, I’ve got the great honor to present this years badge!
Being a TROOPER is tough: You need to know loads of information, learn even more
and be able to work fast.
This year we decided to increase your efficiency and speed when collecting data
from computer systems and, let’s say, hacking them! Your newest gadget is based
on a plain
Arduino Leonardo,
modded with one of our famous shields. After adding a few LEDs and buttons, it
will power up to full functionality.
