Everybody who is interested in our newest tool ‘Loki’ is welcomed to head over to ERNW’s tool section and download it. Take this monster for a spin and let us know in the comments how you like it. Loki’s coding father Daniel is more than happy to answer your questions and criticism.
You don’t even know what Loki is?
In short: An advanced security testing tool for layer 3 protocols.
Continue reading Continue readingOne of the biggest pains in the ass of most ISOs – and subsequently subject of fierce debates between business and infosec – is the topic of “Browser Security”, i.e. essentially the question “How to protect the organization from malicious code brought into the environment by users surfing the Internet?”.
Commonly the chain of events (of a typical malware infection act) can be broken down to the following steps:
1.) Some code – no matter if binary or script code – gets transferred (mostly: downloaded) to some system “from the Internet”, that means “over the network”.
Continue reading Continue reading… recently published
here.
While
I certainly agree with those comments stating that there’s a fishy element in
the – conspiracy theory nurturing – story itself, this reminds me that Graeme
Neilson (who gave the
“Netscreen of the Dead”
talk at Troopers, discussing modified firmware on
Juniper and Fortinet devices) and I plan to give a talk on “Supply Chain
(In-)Security” at this year’s Day-Con event. We still
have to figure out with Angus if it fits into the agenda (and if we have enough
material for an interesting 45 min storyline ;-)) though. Stay tuned for news on
this here.
Back on track as for one of our favorite rant subjects: desktop security. This stuff, commonly called the “LNK vulnerability”, has gained quite some momentum in the last days, including the release of a Metasploit module and a temporary raise of SANS Internet Storm Center‘s Infocon level to yellow (it’s back on green in the interim).
CVE-2010-2568 has been assigned and some technical details can be found here and here.
To give you a rough idea how this piece works, here’s a quote from the US-CERT advisory:
Continue reading Continue readingAccording to SANS NewsBites Vol. XII, Issue 53 recently published there’s a lack of 3rd party developer support for some security features Microsoft introduced already years ago. We at ERNW have made similar observations when performing security assessments of COTS [commercial off-the-shelf] software. We therefore created a methodology, a proof of concept tool and a metric to test and to rate closed source software, where (amongst other approaches) these security features are checked and their (non-) presence contributes to an overall evaluation as for the trustworthiness of the applications in question. The concept “How to rate the security in closed source software” was presented to the public at Troopers10 and at Hack in the Box 2010 in Amsterdam. The slides can be found here.
Continue readingInteresting research from Stuart Schechter et.al.
here.
They evaluated the effect that the removal or modification of online banking
sites’ security features had on the users’ behavior (as for entering or
withholding their passwords). Maybe for some of you not too surprising it turned
out that the vast majority of users entered their passwords even if obviously
alarming clues were present on the websites.
This, again, shows how important it is to understand how users behave, what
their motives and incentives are and how to build environments that help them
acting securely. This even more applies to corporate space. At times, bringing
an industrial/organizational psychologist in might be a much better investment
than writing yet-another-ignored-piece-of-policy.
Some days ago my old friend Pete Herzog from ISECOM
posted a blog entry titled “Hackers May Be Giants with Sharp Teeth”
here
which – along with some quite insightful reflections on the way kids perceive
“bad people” – contains his usual rant on (the uselessness of) risk
assessment.
Given that this debate (whether taking a risk-based infosec approach is a wise
thing or not) is a constant element of our – Pete’s and mine – long lasting
relationship I somehow feel enticed to respond 😉
Yesterday we made our way to Vienna to participate and contribute to NinjaCon (formerly known as PlumberCon, before Nintendo Inc. claimed their rights ;)).
After our arrival Oliver held a five hour workshop on Penetration Testing and did the finishing touches on his slides about ‘Attacking Cisco Enterprise WLANs‘, which he will deliver later today together with Daniel. And last but not least Daniel will be the Packet Master of PacketWars™ Vienna taking place in the evening.
Continue reading Continue readingI’m happy to announce that the presentations and a majority of the videos from TROOPERS10 are finally available to you.
You’ll find the slides at the conference’s website troopers.de, more precisely here. Plenty of videos were uploaded and are now ready for streaming at viddler.com/TROOPERS. Enjoy!
Please excuse the long waiting time – this is a big point on our ‘improvements for upcoming events’ list. Talking about improvements: If you have any suggestions, criticism or even praise for past or upcoming events – let us know in the comment section.
Continue reading Continue readingThis is the first post of a – potential – series of rants on ubiquitous pieces
of crap (security-wise), bothering pretty much every ISO I know.
I’m talking about “common desktop applications” and today’s topic is going to be
the beloved Adobe Flash Player. Some of you who had the opportunity (or
imposition 😉 to listen to one my talks covering “modern enterprise security
space” (e.g.
this one)
might remember me saying sth like “If a fairy godmother turned up and asked me
for three things to get rid of in order to enhance overall corporate information
security in a sustainable way, my answers would be…” and then giving Adobe Flash
as the first mention. (before you ask: amongst the other candidates are Apple
Quicktime, Windows GDI and “Javascript in Acrobat Reader”).