a) if you’re interested in the technical details of these attacks (and
mitigation advice), pls see
this excellent technical
report the Broadband Internet Technical Advisory Group published last year
(apparently Comcast
had observed
such attacks before).
b) Daniel and I gave a
talk on attacking SNMP
at HITB Dubai 2007 (Hi Amy & Dhillon! 😉) laying
out the basic idea for that type of attack and we later described it in a bit
more detail at ShmooCon 2009 where we
even demoed it publicly (camera recording stopped at that point, for obvious
reasons). We used (a slightly modified version of)
this tool.
From the research we did at the time we can confirm this was/presumably still is
a huge problem, at least for European carriers’ broadband segments (acting as
amplifiers).
Reading
this article from
the Guardian, on this guy apparently being
banned from fully discussing research results in
his talk
at upcoming
USENIX Security, leaves me
scratching my head once more. Things might (as so often) be more complex than
they seem, but this looks like yet-another misconception as for the contribution
of security research (and its public discussion) to the greater good of us all.
Which is unfortunate for the speakers (I’ve been in a similar situation once,
receiving a threatening legal letter from a very large organization one day
before one of our Black Hat presentations and can tell you that stuff like that
doesn’t add to one’s anticipation of the talk or the event…), for the audience
(including some ERNW guys who will be a USENIX-SEC, so, btw, expect a summary
post here) and for the whole community of security researchers.
Next to IETF 87 going on in Berlin
in a few days there will be an
informal meeting of the “IPv6 Hackers”
on Tuesday. We really look forward to personally meet a number of people who we
(so far) only know from the associated
mailing list or
similar machine-enhanced exchange. We hope to contribute as well. Based on the
stuff of
this workshop from
the
IPv6 Security Summit
at Troopers13 we might give a short project
presentation along the lines of “Some Notes on Testing the Real-World IPv6
Capabilities of Commercial Security Products”, providing an overview of some
testing done on commercial gear, together with a discussion of testing
approaches, tools and key aspects.
So we got these shiny new BlackBerry Q10 and Z10 device laying on the desk one
morning. It’s my first BlackBerry, I have to admit, but never the less, the hole
wushy GUI and touchy glass stuff wasn’t my main concern, instead i
took a look at the stuff
going on while you connect the phone (do i have to call it blackberry? its a
phone, isn’t it?) to your computer.
in this post I’d like to share some reflections on the (potentially inefficient)
way some security controls can be observed to be deployed in complex
organisations and what this may mean for the future of those controls.
In general the space of security controls can be categorized according to
different schemes, such as:
By fundamental principle (preventive, detective, reactive, corrective,
deterrent, compensating etc. security controls. see for example this
overview
or this one or
some illustration
here).
By “state of matter” (e.g. components, implementation, operations. again, for
some supplemental information look at
this one).
By type of admission: whitelisting vs. blacklisting (some general discussion
here,
the respective Schneier-Ranum Face-Off to be found
here,
and this
is only Bruce’s half, but with a number of comments).
Related to the overall architecture of implementation: centralized vs.
distributed.
For today’s topic I’ll just focus on the latter two and will introduce those
shortly.
“Nein! Ein von unbeugsamen Galliern bevölkertes Dorf hört nicht auf, dem
Eindringling Widerstand zu leisten.”
This is a famous quote pretty much every German kid used to know. Not sure if
this still applies though, my three haven’t touched Asterix comics so far.
Anyhow, you might ask why I cite this.
Simple answer: see
this recent article
from the Guardian on a Utah-based ISP “resisting some pressure”. That’s the
spirit…
When teaching courses on topics like Reverse Engineering or Malware Analysis we
always emphasize the need to minimize unneeded work. Because reversing an
unknown binary is a time consuming and complex process, tools that simplify the
RE process are invaluable when working under time pressure. In this blogpost
series I will present multiple tools and techniques that can help to reverse an
unknown binary. Please note that these articles do not contain cutting edge
research but rather target at newcomers. However, I hope to also provide some
useful and interesting information for moreexperienced practitioners.
Microsoft released
EMET v4.0 with
a new (security) feature that enables protection against fraudulent websites or
compromised root certification authorities (do you remember Comodo, DigiNotar,
DigiCert, Turktrust et al. ;-)?)
EMET defines via “certificate trust“ a trust chain between the domain name of a
website (and its associated website certificate) and a root CA certificate. This
is done through so called “pinning rules”. Here is one of the default pinning
rules of EMET 4.0 for the domain name login.live.com:
**Dear blog followers, TROOPERS speakers & attendees,
**we hope you’re doing fine! Today we have a couple of great things to share
with you:
TROOPERS14
Let’s start with a date. Get your calendar and mark March 17th – 21st 2014.
It’s your TROOPERS14 holidays. One week full of high-end education, workshops,
talks, reconnecting with friends, action, delicious food and one or the other
party. You know the drill – more details further down.