In the course of our virtualization research, we came across a certain technical
issue we couldn’t find an easy solution on knowledge bases and the like.
However, as we found the question several times on the web, the following post
gives just a short hint on a technical detail.
If you want to connect two virtual machines in VMware Fusion using a serial port
(e.g. for debugging purposes), Fusion doesn’t provide you an GUI option to
configure that. However, if you just add the following config to the debugger
system’s VMX file:
During a recent research project we performed an in-depth security assessment of
Microsoft’s virtualization technologies, including Hyper-V and Azure. While we
already had experience in discovering security vulnerabilities in other virtual
environments (e.g.
here and
here), this was
our first research project on the Microsoft virtualization stack and we took
care to use a
structured evaluation strategy
to cover all potential attack vectors.
Part of our research concentrated on the Hyper-V hypervisor itself and we
discovered a critical vulnerability which can be exploited by an unprivileged
virtual machine to crash the hypervisor and potentially compromise other virtual
machines on the same physical host. This bug was recently patched, see
MS13-092 and
our
corresponding post.
continuing our tradition from last year (see
here and
here), we
summarized more of our hardening recommendations for you. This guide is covering
Tomcat 7 and is supposed to provide a solid base of hardening measures. It
includes configuration examples and all necessary commands for each control,
specifically for the most recent branch of Tomcat as there were some significant
changes.
Download: ERNW_Checklist_Tomcat7_Hardening.pdf
In an upcoming series of blog posts I will discuss some principles &
considerations on developing an IPv6 address plan. In (hopefully) rather quick
succession there will be three posts:
the first on some general rules as for IPv6 address planning which we regard
instrumental in the process.
the second covering the “PI space from a single RIR or PI space from each
(relevant, as for $ORG) RIR?” debate.
the third on actual approaches to structuring/grouping each region’s /32 (or
/36) into subdivisions like sites, VRFs, facilities, use types, buildings,
whatever. I understand that this part is probably the one quite some readers
are most interested in; still for a reasonable line of thought the others have
to be covered in advance.
As you might have already spotted from the prefix lengths mentioned above, the
presumed setting (read: the main audience) of this piece is a sufficiently large
enterprise organization with sites/subsidiaries/plants all over the globe,
potentially mainly in the EMEA, APAC and Americas regions. So if you’re [with]
a service provider organization, a university or small[er] organization, some
of the recommendations I lay out might not apply to you. This focus (or
restriction thereof) is for the simple reason of ignorance. Given I haven’t been
involved in many address planning efforts in such organizations I don’t feel
qualified to advance opinions on their settings.
We wish you a happy new year and a good start to 2014. A new year has begun and,
just before that, 30C3 took place. I think almost all of you have heard about
the congress and its topics. In particukar there was Glenn Greenwald’s
keynote or
there were new
publications/revelations
by Jacob Appelbaum, which you will probably have heard about from main media.
But besides of all that, there were really a lot of other interesting talks we
want to give you a short introduction to. Overall it was a really good
conference this year and a lot of awesome talks. But, like always, it is not
possible to see all of them, so here is a short summary of some of our
favorites:
First of all, I hope you all had a good start to 2014. Having some time off
“between the years” (which is a German saying for the time between Christmas and
NYE), I caught up on several virtualization security topics.
While virtualization is widely accepted as a sufficiently secure technology in
many areas of IT operations (also for sensitive applications or exposed systems,
like
DMZs)
by 2014, there are several recent vulnerabilities and incidents that are worth
mentioning.
At first a very happy new year to all our readers!
Today we announce the third round of Troopers 2014 talks (first round
here,
second
here).
Here we go:
===
Daniel Mende: Implementing an USB Host Driver Fuzzer FIRST TIME
MATERIAL
Abstract: The Universal Serial Bus (USB) can be found everywhere these days, may
it be to connect a mouse or keyboard to the computer, transfer data on a flash
drive connected via USB or to attach some additional hardware like a Digital
Video Broadcast receiver. Some of these devices use a standardized device class
which are served by an operating system default driver while other, special
purpose devices, do not fit into any of those classes, so vendors ship their own
drivers. As every vendor specific USB driver installed on a system adds
additional attack surface, there needs to be some method to evaluate the
stability and the security of those vendor proprietary drivers. The simplest way
to perform a stability analysis of closed source products is the fuzzing
approach. As there have been no publicly available tools for performing USB host
driver fuzzing, I decided to develop one ;-), building on Sergey’s and Travis’
legendary
Troopers13 talk.
Be prepared to learn a lot about USB specifics, and to see quite a number of
blue screens and stack traces on major server operating systems…
We’re very happy to announce the second round of Troopers 2014 talks today
(first round
here).
Some
(well, actually most 😉 ) of these talks haven’t been presented before, at any
other occasion, so this is exciting fresh material which was/is prepared
especially for Troopers.
Andreas Wiegenstein & Xu Jia: Risks in Hosted SAP Environments.FIRST TIME
MATERIAL
**Synopsis: **Many SAP customers have outsourced the operation of their SAP
systems in order to save cost. In doing so, they entrust their most critical
data to a hosting provider, potentially sharing the same SAP server with a
number of companies and organizations unknown to them. These companies and
organizations virtually sit in the same boat, without knowing each other and
without trusting each other. They all trust in the ability of their hosting
provider to run their operating environment in a secure way, though.
It’s been a long time… we just published an
ERNW Newsletter. Here’s
the abstract:
In order to protect sensitive data on corporate laptops, most companies are
using full disk encryption solutions. While native encryption products like
Microsoft Bitlocker, Apple FileVault and open source solutions like TrueCrypt
were already heavily scrutinized by security researchers, many popular
commercial third party products are to some point still black boxes.
In this paper, we discuss Check Point Full Disk Encryption (FDE) with active
“Windows Integrated Logon”. Checkpoint FDE is a software package that is part of
Check Point Endpoint Security and offers full disk encryption on Microsoft
Windows and Mac OS X systems. The “Windows Integrated Logon” feature reduces
total cost of ownership by disabling pre-boot authentication. Check Point
themselves warn about security risk associated with using this feature.
Such was the title of a talk I gave yesterday at
ACSAC 29. It was an updated and shortened version of a
similar talk I had given at the Troopers IPv6
Security Summit (btw:
this
is the preliminary agenda of the 2014 event).