One of our customers called us recently and asked for some support in
investigating a toll fraud issue they encountered in one of their sites. Their
telecommunications provider had contacted them informing them that they had
accumulated a bill of 30.000€ over the last ten days.
Without knowing anything more specific, I drove to the affected site to get the
whole picture.
They have a VoIP deployment based on Cisco Unified Communications Manager (CUCM,
aka Call Manager) as Call Agent. The CUCM is connected via a H.323 trunk to a
Cisco 2911 ISR G2 which is acting as a voice gateway. The ISR has a primary rate
ISDN (PRI) Interface which is connected to the PBX of the telco. Furthermore
they use a feature called Direct-inward Dial (DID) or Direct Dial-in (DDI) which
is offered by Telco’s to enable calling parties to dial directly to an extension
on a PBX or voice gateway.
This is a guest post by the SAP security experts of BIZEC. Enjoy reading:
On March 20^(th), the first BIZEC workshop will be held
at the amazing Troopers conference in Heidelberg, Germany. For those still
unfamiliar with BIZEC: the business application security initiative is a
non-profit organization focused on security threats affecting ERP systems and
business-critical infrastructures.
The main goals of BIZEC are:
Raise awareness, demonstrating that ERP security must be analyzed
holistically.
Analyze current and future threats affecting these systems.
Serve as a unique central point of knowledge and reference in this subject.
Provide experienced feedback to global organizations, helping them to increase
the security of their business-critical information.
Organize events with the community to share and exchange information.
The
“BIZEC workshop at Troopers 2012”
will dive into the security of SAP platforms. Still to this day, a big part of
the Auditing and Information Security industries believe that Segregation of
Duties (SoD) controls are enough to protect these business-critical systems.
By attending this session, InfoSec professionals and SAP security managers will
be able to stop “flying blind” with regards to the security of their SAP
systems. They will learn why SoD controls are not enough, which current threats
exist that could be exploited by evil hackers, and how to protect their
business-critical information from cyber-attacks.
Once moreShmooCon is the place to be for some days in late
January. Great con, great people and five ERNW guys amongst them 😉
We regard Shmoo(Con) as one of the most important community events at all and it
allows us to meet fellow researchers from the US who we can’t easily sit down
with to chat very often.
And some lucky guys from ERNW will even continue the trip to head to San Diego
(!) for NANOG and
NDSS. Not to
mention they stay in some fancy beach resort ;-), while I myself fly back today.
(Getting older I don’t enjoy staying away from home for a week anymore and I
have been missing my kids since some days…)
It’s done. The exciting (and demanding) process of selecting talks for Troopers
is complete (for the record: second round of talk selection was
here,
the first
here).
We’re quite happy and looking forward to the event 😉
==================
Rodrigo Branco: Into the Darkness – Dissecting Targeted Attacks
The current threat landscape around cyber attacks is complex and hard to
understand even for IT pros. The media coverage on recent events increases the
challenge by putting fundamentally different attacks into the same category,
often labeled as advanced persistent threats (APTs). The resulting mix of
attacks includes everything from broadly used, exploit-kit driven campaigns
driven by cyber criminals, to targeted attacks that use 0-day vulnerabilities
and are hard to fend off – blurring the threat landscape, causing confusion
where clarity is most needed.
after having announced the first round of Troopers
speakers
here,
we’re happy to publish the second round today 😉
Here we go:
==================
Dmitry Sklyarov – “Secure Password Managers” and “Military-Grade Encryption” on
Smartphones: Oh Really?
Abstract: The task of providing privacy and data confidentiality with mobile
applications becomes more and more important as the adoption of smartphones and
tablets grows. As a result, there are a number of vendors and applications
providing solutions to address those needs, such as password managers and file
encryption utilities for mobile devices.
During a recent penetration test, we evaluated the security of a typical
corporate employee notebook. It was to be assessed whether employees with a
default corporate user account would be able to gain administrative access and
subsequently abuse the system for attacks against a certain high value database
system. When evaluating this problem set, the first step is to find ways to
bring tools and exploit code on the system. Usually this task requires the
bypassing of the malware protection agent of the system. At some point, we
thought we figured a way to
encode
exploits and payloads in a way that would not be detected by the malware
protection solution.
In a .NET environment WCF services can use the proprietary WCF binary XML
protocol described
here.
Microsoft uses this protocol to save some time parsing the transmitted XML data.
If you have to (pen-) test such services, it would be nice to read (and modify)
the communication between (for example) clients and servers. One possibility is
Fiddler.
Fiddler’s strengths include its extensibility and its WCF binary plugins. Sadly,
these plugins can only decode and display the binary content as XML text.
One of our favorite tools for conducting penetration tests (especially, but not
only, web application tests) is
Portswiggers’s Burp Suite. Burp
allows to extend its features by writing own plugins. But because Burp is
written in Java, it only supports Java classes as plugins. Additionally, Burp
only allows to use one plugin at the same time which has to be loaded on
start-up.
Now we have written a Burp-Python proxy (called pyBurp) which adds some
features to the plugin system:
About
two months ago the Bluetooth SIG
renamed their latest standard,
which was previously known as “Bluetooth v4.0”. When version numbers get higher
and higher marketing likes to interfere and try something new. In this case:
Bluetooth Smart.
Sounds smart, but is it?
Without getting into too much detail, let me quickly quote Wikipedia to get
started:
“Cost-reduced single-mode chips, which enable highly integrated and
compact devices, feature a lightweight Link Layer providing
ultra-low power idle mode operation, simple device discovery, and
reliable point-to-multipoint data transfer with advanced power-save
and secure encrypted connections at the lowest possible cost.”
During one of our pentests in some corporate environment we were to analyze an
application-server called
Liferay. Liferay
comes with a lot of functionalities, runs on top of Apache Tomcat and includes a
nice API that makes it very easy to add components or further functionality that
are not part of the core. These (potentially selfmade) “addons” are called
“portlets” and they can be inserted in any place in the frontend.
About
two months ago the Bluetooth SIG