Given we’ve received a number of inquiries as for the agenda of this year’s
TelcoSecDay here’s a first preliminary agenda. To get an idea of the event’s
character you might have a look at the agenda of the
2012 edition
or the
2013 edition.
Pls note that there might be changes/additions to the following outline as we’re
currently discussing potential contributions with two European operators. Here
we go, for today:
9:00: Opening Remarks & Introduction
9:15: Ravi Borgaonkor – Evolution of SIM Card Security
10:15: Break
10:45: Adrian Dabrowski
11:45: Collin Mulliner – PatchDroid – Third Party Security Patches for Android
12:30: Lunch
13:45: Philippe Langlois
14:45: Break
15:15: Haya Shulman – The Illusion of Challenge-Response Authentication
16:00: Christian Sielaff & Daniel Hauenstein – Breaking Network Monitoring Tools
Used in Telco Space
16:30: Closing Remarks
19:00: Joint dinner (hosted by ERNW) in Heidelberg Altstadt for those interested
and/or staying for the main conference
Some of you may already know (the ones who are following Enno on
Twitter) that Enno and I had our lab day
in preparation for the
IPv6 Security Summit
at Troopers. We had a brand new and shiny Cat4948E
as our lab device to do some testing of the current generation of Cisco’s IPv6
First Hop Security (FHS) mechanisms. The Catalyst was running the latest image
available (15.1(2)SG3).
In this small blog post, we will take a look at the configuration and behavior
of IPv6 Snooping and DHCPv6 Guard. So let’s start with IPv6 Snooping:
Hey guys,
as some of you may have noticed, just recently at ShmooCon we gave our talk “LTE
vs. Darwin” (Slides
here).
There we presented some results of our research in 4G telco network security.
Some of those originate from our research contribution to
ASMONIA, but we expanded the scope and also took a look at the
air interface. Both the air interface and the backend links & protocols must be
secured appropriately; otherwise communication may be eavesdropped or sensitive
information may be compromised. In the following we want to provide an overview
of LTE main components and potential attack vectors.
Last weekend, from 17 to 19 January, ShmooCon was
held in Washington, DC. A number of different topics was covered in great talks
and we want to give you a short overview of the conference. In the following our
favorite talks are briefly summarized.
Privacy Online: What Now?
Ian Goldberg, one of the designers of the
OTR Protocol, gave the
keynote on the first day. His talk was quite interesting and he presented some
really nice approaches, one of those being an attack against PGP. He described
the attack as follows: an attacker could copy a key server by downloading all
the stored keys. If this is done it is possible to create new key pairs with
exactly the same settings as the keys downloaded. The third step is to create
all the signing links between the keys as they exist on the real key server.
Finally, the attacker uploads these new keys including the signing links to the
original key server.
Now, in case Alice wants to retrieve the public key of Bob, Alice would find two
keys with seemingly identical properties. If choosing the wrong key for
encryption the message will be decipherable by the attacker and in case of MitM
situation be accessed. Furthermore, if Alice then signs the “mirror key”, the
cloned keys and the original would merge, resulting in further problems.
This was just one consideration discussed in Goldberg’s talk. For the full
content, watch the recording, available soon on ShmooCon page.
We just got
credits
for a flaw we found in SAP Netweaver. The issue is a reflected
Cross-Site Scripting
(XSS). It can be triggered in the administrative interface for the Internet
Communication Manager (ICM) and Web Dispatcher. This means that the targets for
this XSS will definitely be users with administrative privileges. This makes it
especially juicy for an attacker.
SAP rated the vulnerability with CVSS and a Base Score of 4.3 having a Base
Vector of AV:N/AC:M/AU:N/C:N/I:P/A:N. Which again opens the discussion on how
to rate the impact of XSS by using CVSS. CVSS
states that XSS
“should be scored with no impact to confidentiality or availability, and
partial impact to integrity“, which is clearly arguable. Especially when
thinking of the impact on confidentiality. As you might know by now, we tried to
tackle the problem of rating vulnerabilities ourselves with the
ERNW Rapid Rating System
(ERRS) and it was not an easy task. 😉 However, SAP states that this is a
correction with high priority, so you should apply the patches as soon as
possible.
This is the second part of the – presumably – three-part series on IPv6 address
planning which I started
here.
Before an enterprise organization (strictly speaking “their internal service
provider acting as LIR”, as laid out in the first part) starts assigning
prefix[es]/lengths to their networks usually another discussion has to be
undertaken & solved: “go with one /32 [PI space] from one RIR or apply for
/32s from several RIRs”.
Today we have to pleasure to announce another round of
Troopers talks.
Here we go:
Noam Liram: Vulnerability Classification in the SaaS Era FIRST TIME
MATERIAL
Abstract: In this talk we will thoroughly analyze two major SaaS vulnerabilities
that were found by Adallom (one of which is still in responsible disclosure
stages at the time of writing). By demonstrating this new class of exploits
which we have nick-named “Ice Dagger” attacks, we aim to change the current
industry-wide criteria for vulnerability classifications, which were developed
in the Desktop/Server world, are inadequate when classifying SaaS
vulnerabilities. We will specifically discuss the details of MS13-104.
In the course of our virtualization research, we came across a certain technical
issue we couldn’t find an easy solution on knowledge bases and the like.
However, as we found the question several times on the web, the following post
gives just a short hint on a technical detail.
If you want to connect two virtual machines in VMware Fusion using a serial port
(e.g. for debugging purposes), Fusion doesn’t provide you an GUI option to
configure that. However, if you just add the following config to the debugger
system’s VMX file:
During a recent research project we performed an in-depth security assessment of
Microsoft’s virtualization technologies, including Hyper-V and Azure. While we
already had experience in discovering security vulnerabilities in other virtual
environments (e.g.
here and
here), this was
our first research project on the Microsoft virtualization stack and we took
care to use a
structured evaluation strategy
to cover all potential attack vectors.
Part of our research concentrated on the Hyper-V hypervisor itself and we
discovered a critical vulnerability which can be exploited by an unprivileged
virtual machine to crash the hypervisor and potentially compromise other virtual
machines on the same physical host. This bug was recently patched, see
MS13-092 and
our
corresponding post.