Insinuator


Some outright rants from a bunch of infosec practitioners.

As we promised some days ago here’s the third round of Troopers15 speakers (first one here, second here). It’s going to be awesome!

(more…)

, , | Post your comment here.

Dec/14

19

Getting 20k Inline-QR-Codes out of Burp

Lately we had to analyze QR-Codes in a pentest. Those held some random data which was used as a token for login and we wanted to know if that data was really random.

(more…)

, , , , | Post your comment here.

We were recently approached by a customer asking us for support along the lines of “do you have any recommendations as for strict hardening of IPv6 parameters on Linux systems?”. It turned out that the systems in question process quite sensitive data and are located in certain, not too big network segments with very high security requirements.

(more…)

, , | Post your comment here.

We just released a white paper authored by Antonios Atlasis that provides an overview which pentesting tools currently support IPv6 and how to (still) use them if that’s not the case. It can be found in our newsletter section.

Best

Enno

| Post your comment here.

As we promised some days ago when we published the first round, here we go with the second:

(more…)

, , | Post your comment here.

When planning for IPv6 addressing, many organizations – rightfully & wisely – decide to go with global unicast addresses (GUAs) only (hence not to use unique local addresses/ULAs as of RFC 4193 at all), in order to avoid address selection hell or just for simplicity & consistency reasons. This post discusses security implications and complementary security controls of such an approach.

(more…)

, | Post your comment here.

Nov/14

28

IPv6 in RFIs/Tendering Processes

In one of our customer environments each vendor offering an IT product/solution is asked to fill out a questionnaire collecting information on a number of technical parameters with regard to their product[s]. We were recently asked to come up with a proposal of 8 to 10 IPv6-related questions to be added to the questionnaire/process. Here’s what we suggested:

(more…)

, | Post your comment here.

Nov/14

27

MLD Considered Harmful?

This is a guest post from Antonios Atlasis.

On Thursday the 20th Enno, Jayson and I had the pleasure to present our latest research results  regarding MLD at Deepsec 2014, both from vendors’ implementation perspective as well as regarding protocol design flaws (some preliminary results as well as our testing methodology were discussed here and here).

For refreshing out memory, in a nutshell, the purpose of MLD, a subprotocol of IPv6, is to inform routers about the presence of nodes which are interested in receiving specific multicast traffic (RFC 2710). The newer version of MLD, MLDv2 adds the ability for source address selection (RFC 3810).

(more…)

, | Post your comment here.

Nov/14

22

Scal(e)ing down Privacy

As you might know we are continuously doing research on medical devices. I presented some of the new results at Power of Community 2014 last week and we thought we would share some of the details with you here. The focus of the previous work was testing medical devices that are used in hospitals like patient monitors, syringe pumps or even MRIs. This time we looked at a device that every user can use at home and which is available to anyone on the market: A smart scale.

The scale implements some basic features as you might have guessed, that is measuring your weight. In this case there are a lot more additional features that you can use, e.g. measuring the air quality, the room temperature, your heart rate and your fat mass. The latter makes testing this device quite hard, because somebody has to step on it and the results were not funny at all and will be kept secret! ;)

(more…)

| Post your comment here.

We’re delighted to provide the first announcement of talks of next year’s Troopers edition. Looks like it’s going to be a great event again ;-).
Here we go:

(more…)

, , | Post your comment here.

Older posts >>

Contact


Mail | Twitter | Imprint

©2010-2013 ERNW GmbH
To top