Some days ago a security advisory related to web application firewalls (WAFs) was published on Full Disclosure. Wendel Guglielmetti Henrique found another bug in the IBM Web Application Firewall which can be used to circumvent the WAF and execute typical web application attacks like SQL injection (click here for details). Wendel talked already (look here) at the Troopers Conference in 2009 about the different techniques to identify and bypass WAFs, so this kind of bypass methods are not quite new.
Continue reading Continue readingThe Story Continues – Another IPv6 Update
TROOPERS12 came to an end last week on Friday; needless to say it was an
awesome event. 😉
The first two days offered workshops on various topics. On Monday Enno,
Marc “Van Hauser” Heuse and I gave a one day workshop on
“Advanced IPv6 Security”. I think attendees as well as trainers had a real good
time during and after the workshop fiddling around with IPv6. Especially Marc
had quite some fun as he discovered that we provided “global” IPv6 Connectivity
for the conference network, and according to one of his tweets, TROOPERS12 was
the first security conference he visited, offering this kind of connectivity.
A Comment on Android PIN bypass
Lately there have been some rumors on the full-disclosure mailing list referring
to a blogpost of Hatforce about a new method to bypass the PIN/password lock on
Android Gingerbread phones.
The approach was to boot into the Recovery Mode and execute a reset to factory
state. The ideal result should be a reliable wipe of the /data partition.
However, the author managed to recover data after the wiping process. This has
been stated as a method on extracting sensitive date without knowing the actual
pin or passcode.
Troopers TelcoSecDay
As there has been some public demand for that, here we go with the final agenda for the Troopers “TelcoSecDay“. The workshop is meant to provide a platform for research exchange between operators, vendors and researchers. The slides of the talks will potentially be made available as well.
- 8:30: Opening Remarks & Introduction
- 9:00: Sebastian Schrittwieser (SBA Research): Guess Who’s Texting You? Evaluating the Security of Smartphone Messaging Applications.
- 10:00: Peter Schneider (NSN): How to secure an LTE-Network: Just applying the 3GPP security standards and that’s it?
- 10:45: Break
- 11:00: Kevin Redon (T-Labs): Weaponizing Femtocells – The Effect of Rogue Devices on Mobile Telecommunications
- 11:45: Christian Kagerhuber (Group IT Security, Deutsche Telekom AG): Security Compliance Audit Automation (SCA, TeleManagementForum TMF528)
- 12:30: Lunch
- 13:45: Philipp Langlois (P1 Security): Assault on the GRX (GPRS Roaming eXchange) from the Telecom Core Network perspective, from 2.5G to LTE Advanced.
- 15:00: Break
- 15:15: Harald Welte (sysmocom): Structural deficits in telecom security
- 16:30: Closing Remarks
- 17:00: End of workshop
- 19:00: Joint dinner (hosted by ERNW) in Heidelberg Altstadt for those interested and/or staying for the main conference
====
Continue reading Continue readingERP Platforms Are Vulnerable
This is a guest post by the SAP security expert Juan Pablo Perez-Etchegoyen, CTO of Onapsis. Enjoy reading:
At Onapsis we are continuously researching in the ERP security field to identify the risks that ERP systems and business-critical applications are exposed to. This way we help customers and vendors to increase their security posture and mitigate threats that may be affecting their most important platform: the one that stores and manages their business’ crown jewels.
Continue reading Continue readingApplying the ERNW Seven Sisters Approach to VoIP Networks
Hi,
if you’re following this blog regularly or if you’ve ever attended an ERNW-led workshop which included an “architecture section” you will certainly remember the “Seven Sisters of Infrastructure Security” stuff (used for example in this post). These are a number of (well, more precisely, it’s seven ;-)) fundamental security principles which can be applied to any complex infrastructure, be that a network, a building, an airport or the like.
As part of our upcoming Black Hat and Troopers talks we will apply those principles to some VoIP networks we (security-) assessed and, given we won’t cover them in detail there, it might be helpful to perform a quick refresher of them, together with an initial application to VoIP deployments. Here we go; these are the “Seven Sisters of Infrastructure Security”:
Continue reading Continue readingSell Your Own Device – A Field Study on Decommissioning of Mobile Devices
On Friday we released our latest technical newsletter with the fancy title “Sell Your Own Device – A Field Study on Decommissioning of Mobile Devices”. It is the result of a field study on decommissioned mobile business devices bought on eBay and about how stored data may be extracted in different ways.
As always we love to share plenty of practical advise: At the end of the newsletter you will find the mitigating controls to securely handle mobile devices at the end of their life cycle process.
Continue reading Continue readingGroundhog Day: Don’t Pay Money for Some Else’s Calls, Still
Hi everyone,
it’s me again with another story of a toll fraud incident at one of our
customers (not the same as
the last time
of course ;-)).
The story began basically like the last one: We received a call with an urgent
request to help investigating a toll fraud issue. Like the last time I visited
the site in order to get an idea on what was going on exactly. The customer has
a VoIP deployment consisting of the whole UC Suite Cisco offers: Call Manager,
Unity Connection for the voice mailboxes, Cisco based Voice-Gateways and of
course, IP phones.
Assesment of Visual Voicemail on iPhones
VVM on iOS 5.0.1
Visual Voicemail (VVM) is a common feature of phone providers which allows accessing the good old voice-mailbox through the phone’s visual interface. In contrast to the classical voicemail approach, VVM allows intuitive navigation through voice-messages without dealing with an automated voice which tells you about message count and possible options. However, this implies the need of actually loading the messages of missed calls on the phone. The VVM-app displays missed calls and downloads corresponding messages which have been left by the initial caller. The software comes with your iPhone and is not intended for uninstallation. However, providers have to support it and will have to activate it for supporting clients. This feature is available on iPhones since August 2009 and became available on BlackBerrys and few Nokia phones later. Android doesn’t implement VVM in general. However some telecommunication providers offer their own apps to add this feature. Since version 4.0, Android offers an official Voicemail Provider API enabling better integration for the mobile OS.
Continue reading Continue readingA Structured Approach to Handling External Connections, Part 1
I’m currently involved in creating an up to date approach to handling external connections (read: temporary/permanent connections with external parties like business partners) of a very large enterprise. Currently they have sth along the lines of: “there’s two types of external connections, trusted and untrusted. the untrusted ones have to be connected by means of a double staged firewall”.
Which – of course – doesn’t work at all in a VUCA world, for a number of reasons (the demarcation between trusted and untrusted is quite unclear – just think of mergers & acquisitions –; “business doesn’t like implementing 2-staged firewalls in some part of the world where they just signed the memorandum for a joint venture to build windmills in the desert”; firewalls might not be the appropriate control for quite some threats anyway – see for example slide 46 of this presentation– and so on). Not to mention that I personally think that the “double staged firewall” thing is based on an outdated threat model, in particular when implemented with two different vendors (for the simple reason that the added operational effort usually is not worth the added security benefit. see this post for some discussion of the concept of “operational feasibility”…).
Continue reading Continue reading