Having just finished the second
“Advanced Attack Techniques against IPv6 Networks” workshop (some
of the course material can be found
here),
organised and hosted by ERNW and their partner
HM Training Solutions, I would like to
take this opportunity to release publicly one of my scripting tools, an IPv6
scanner. This tool is based on Scapy (so you have to install Scapy and its
prerequisites before using it). It should not be considered as a replacement or
a competitor of nmap against IPv6 or of the scanners incorporated into the great
IPv6 toolkits already released by Marc Heuse
and Fernando Gont,
but, instead, as a tool released mainly for educational purposes. Specifically,
this scanner, apart from supporting some of the most well known port scanning
techniques, from ping scanning to SYN, RESET, ACK, XMAS, etc., etc., TCP or UDP
scanning, it also combines, by using the suitable switches, some IDS/IPS evasion
techniques. As I have found out up to now, at least two of them, if used
“properly”, can be effective against a very popular IDS/IPS software used by
many “Fortune 100” companies out there. This means that you can launch actually
any type of the supported network-scanning techniques while flying under the
radar of this specific IDS software (and perhaps some other too, who knows…).
But first of all, as always please check the corresponding README file.
Its been a long time, since i released the last version of pytacle, but now the
time has come. Here is alpha2 with some new features:
– Support of RTLSDR sticks
– Possibility to scan for cells around you
– Changed the code to generate real KCs (but as nobody noticed the wrong KCs i
guess you were good with the others 😉
Im also planning to address hopping channels in the future, but ive not made it
far enough in my DSP lecture, yet 😉
Michael Thumann and me had the chance to give a talk at this year’s
ISSE conference in Brussels, Belgium. ISSE was
founded in 1999 as an initiative of the European Commission Directorate General
Information Society. The con had a focus on eGovernment, electronic business
processes and the corresponding security issues.
We talked about the ERRS, the
ERNW Rapid Rating System,
that can be used to perform a vulnerability rating for findings that result from
different kinds of sources. Audits and Pentests will find a vast amount of
vulnerabilities in the infrastructure. To deal with these vulnerabilities, you
have to use some kind of prioritization in order to use resources effectively.
We tried to adopt the strengths from metrics like CVSS and developed our own set
of parameters to calculate the metric, focussing on the relevant customer
questions concerning vulnerabilities from all kinds of sources.
I recently had a discussion with some practitioners about requirements to IP
Address Management (IPAM) solutions which are specific for IPv6 networks. We
came up with the following:
Mandatory: Track all dynamic IPv6 assignments (SLAAC + PrivExtensions, DHCP
etc.), by polling neighbor caches from network devices. Support SNMPv3 for this
task.
Optional (read: nice-to-have): support other methods than SNMP to gather this
info (e.g. SSH-ing into devices and execution of appropriate “show” commands).
A few weeks ago I gave a presentation with the above title at some corporate
infosec event. Given I’ve been asked for the slides many times now, I’ve
converted them to a PDF which can be found
here.
We hope to contribute to the necessary debate thereby…
Some of us had the pleasure to participate in this year’s
Daycon VII, three days of Real Hacking and Relevant
Content, in Dayton, OH. The event began on September 16th with the Packetwars
bootcamp. We had the chance to teach some really promising young students and to
prepare them for the Packetwars battle that was scheduled four days later. The
students had to go through topics like Windows security, network security and
web application security both practical and in theory.
today we welcomed Michael Ossmann at the
ERNW headquarter for an exclusive workshop on his
HackRF
gadget. Everybody was quite excited to get hands-on with this shiny piece of
hardware, which is currently
crowd-funded on Kickstarter.
For everybody who’s not familiar
with Software Defined Radio (SDR):
Let’s regard it as the ultimate tool when working with radio signals.
Michael Ossmann in the house.
Let’s quote Michael’s campaign website:
Transmit or receive any radio signal from 30 MHz to 6000 MHz on USB power
with HackRF. HackRF is an open source hardware project to build a Software
Defined Radio (SDR) peripheral.
With HTML 5 the current web development moves from server side generated content
and layout to client side generated. Most of the so called HTML5 powered
websites use JavaScript and CSS for generating beautiful looking and responsive
user experiences. This ultimately leads to the point were developers want to
include or request third-party resources. Unfortunately all current browsers
prevent scripts to request external resources through a security feature called
the Same-Origin-Policy. This policy specifies that client side code could only
request resources from the domain being executed from. This means that a script
from example.com can not load a resource from google.com via
AJAX(XHR/XmlHttpRequest).
I’m currently catching up on a lot of papers and presentation from the
Usenix Security Symposium
in order to finish the blog post series I started last week (summarizing
WOOT and
LEET). One presentation, which
unfortunately is not available online [edit: see also update,
videos
are available now], included several particularly relevant messages that I want
to share in this dedicated post. Chris Evans, the head of the Google Chrome
security team (herein short: GCST), described some new approaches they employed
for their security team operations, some lessons learned, and how others can
benefit from it as well (actually the potential of these messages to make the
world a safer place was my motivation to write this post, even though I got
teased for supposedly being a Google fanboy 😉 ):
SUSE Linux Enterprise Server (SLES) has been around since 2000. As it is
designed to be used in an enterprise environment the security of these systems
must be kept at a high level. SLES implements a lot of basic security measures
that are common in most Linux systems, but are these enough to protect your
business? We think that with a little effort you can raise the security of your
SLES installation a lot.
