The
1-day training from last TROOPERS
has become a 2-day training, featuring even more real-world attacks and defenses
as well as new hands-on sessions! We’ll teach you, step by step, how to spot and
exploit crypto vulnerabilities, how to use the strongest forms of
state-of-the-art cryptography to secure modern systems (like IoT or mobile
applications), and bring you up to speed on the latest and greatest developments
in the world of cryptography, such as TLS 1.3, blockchains, and post-quantum
crypto.
Recently I’ve started some research on MikroTik’s RouterOS, the operating system
that ships with RouterBOARD devices. As I’m running such a device myself, one
day I got curious about security vulnerabilities that have been reported on the
operating system and the running services as it comes with tons of
features. Searching
for known vulnerabilities in RouterOS on Google doesn’t really yield a lot of
recent security related stuff. So I thought, there is either a lack of (public)
research or maybe it is super secure… 🙂
Yesterday the US-CERT released a
Technical Alert (TA16-144A)
about the recently found WPAD Name Collision Vulnerability. We will give you a
summary about the vulnerability as well as the basic mechanisms here.
WPAD
The Web Proxy Auto-Discovery Protocol is used to auto-configure the proxy for
web browsers. So when joining the according network the browser can use DHCP and
DNS methods to find a specific configuration file (typically named wpad.dat),
which is loaded and applied to the browser’s settings. Therefore, there is no
need to configure each browser in your environment individually/manually.
This blog post will give a brief overview about how a simple IoT device can be
assessed. It will show a basic methodology, what tools can be used for different
tasks and how to solve problems that may arise during analyses. It is aimed at
readers that are interested in how such a device can be assessed, those with
general interest in reverse engineering or the ones who just want to see how to
technically approach an unknown device.
After being on the market for a few months now, Microsoft started quite a large
advertising campaign in Germany for its new Surface RT . We had a
comprehensive look at the new tablet PC and here are a few thoughts and
impressions:
Running a slightly reduced ARM version of Windows 8, I heard somebody calling it
“Windows 8 Home”, which in comparison to older versions hits the spot, Microsoft
offers an easily usable interface. Software is reduced to market apps (the
minimal run level on a plain Windows is 0, any, and 8, Microsoft, on Windows
RT), so you can’t just install your favourite app, or can you?