On Thursday the 20^(th) Enno, Jayson and I had the pleasure to present our
latest research results regarding MLD at
Deepsec 2014, both from vendors’
implementation perspective as well as regarding protocol design flaws (some
preliminary results as well as our testing methodology were discussed
here and
here).
For refreshing out memory, in a nutshell, the purpose of MLD, a subprotocol of
IPv6, is to inform routers about the presence of nodes which are interested in
receiving specific multicast traffic
(RFC 2710). The newer version of MLD,
MLDv2 adds the ability for source address selection
(RFC 3810).
Next week, at DeepSec, we’re going to give a
talk about Multicast Listener Discovery
(MLD), a component of IPv6 which is realized by means of ICMPv6 messages. There
are two versions of MLD (mainly specified in RFC 2710 and RFC 3810 respectively)
and while MLD is technically implemented by ICMPv6 exchanges, these
specifications describe a whole set of rules and communication formats, hence we
can safely talk about “the MLD protocol”.
Now, you might ask: how does one tackle the task of examining the security “of a
protocol”?
Last week Florian and I participated at this year’s DeepSec in Vienna. We had a
really good time, thanks again to the DeepSec staff for a nice conference.
Although it might be a bit late, I want to share some impressions about various
talks I enjoyed.
## spin: Static Instrumentation For Binary Reverse-Engineering
This talk primarily covered a technique called binary instrumentation, which
is used e.g. for performance evaluation, CPU emulation, tracing and profiling
but also for malware- and threat-analysis. David Guillen Fandos proposed the
application of this technique in the field of reverse engineering. Binary
instrumentation is a technique which allows to modify and rewrite binaries
during their execution by injecting instructions into the original code (pretty
much like virtual machines do too). Therefore one could easily wrap instructions
with logging/tracing functions, to observe the execution status before and after
easy instruction step (and/or dump the output into a file). For the purpose of
reversing, one could also create complex conditional breakpoints (retaining
status across executions), which makes it possible to characterize functions.