As TROOPERS15 has come to an end, I’ve finally got the time and energy to give you a deeper insight into the TR15 badge. As most of you have probably heard during the conference, this year’s badge was based on the OpenPCD2. The OpenPCD 2 is a 13.56MHz NFC Reader, Writer and Emulator under the GNU GPL v2. As NFC is, yet again, on an uprise, a badge with NFC simply gives you the chance to fiddle around and hack stacks of stuff in the real world. Adding some TROOPERS spirit and a few little secrets we hope we’ve designed a pretty nice badge!
Continue reading “Troopers 15 Badge”
Month: March 2015
Syscan 2015
Last week Matthias and I went to Singapore to teach our workshop on Hypervisor Exploitation at SyScan. After a very unpleasant Lufthansa strike (which made us arrive late in Singapore) and two intense workshop days, we were free to attend the “last” SyScan. There are few IT security conferences that have such a great reputation in the community and so we had high expectations, which were definitely not disappointed. This year had a lot of really interesting talks so I will just summarize some of the ones I liked the most.
Continue reading “Syscan 2015”
Continue readingTroopers15 Videos Online
We’ve just published the videos from TROOPERS15. The playlist can be found here.
Thanks! again to everybody for joining us in Heidelberg. We had a great time with you 😉
Have a good weekend,
Enno
Continue reading
XML External Entity (XXE) Injection in Apache Batik Library [CVE-2015-0250]
During one of our latest web application code review projects I came across a vulnerability for which I think it is worth to speak about. It is an injection based attack against XML parsers which uses a rarely required feature called external entity expansion. The XML specification allows XML documents to define entities which reference resources external to the document and parsers typically support this feature by default. If an application parses XML input from untrusted sources and the parsing routine is not properly configured this can be exploited by an attacker with a so called XML external entity (XXE) injection. A successful XXE injection attack could allow an attacker to access the file system, cause a DoS attack or inject script code (e.g. Javascript to perform an XSS attack).
Continue reading “XML External Entity (XXE) Injection in Apache Batik Library [CVE-2015-0250]”
GSM@Troopers
Additionally to Wifi, Troopers is also offering a GSM network.
If you want to use it, simply ask your phone to scan for available mobile networks. There you should see the usual T-Mobile D, Vodafone.de, E-Plus, O2-de operators, but also the unusual D 23 or 262 23. Just select this one, and your are done. You also can use the Troopers SIMs which you get on the welcome desk on the ground floor.
Continue reading “GSM@Troopers”
Continue readingRevisiting Xen’s x86 Emulation: Xen XSA 123
In my last blog post, I gave an overview about recent vulnerabilities discovered in the x86 emulation layer of Xen. While both of the discussed vulnerabilities only allow for guest privilege escalation, the complexity of the involved code seemed to indicate that even more interesting bugs could be discovered. So I spent some time searching for memory corruption issues and discovered a very interesting bug that resulted in XSA 123 . This post gives an overview about the root cause of the bug and a short description of exploitation challenges. A follow-up post will describe possible exploitation strategies in more detail.
Continue reading “Revisiting Xen’s x86 Emulation: Xen XSA 123”
Continue readingFinal Agenda of Troopers15 TelcoSecDay
Admitted, we’re a bit late this time, but here we go with the agenda of this year’s TelcoSecDay.
Given the high number of quality contributions overall there’s more talks than in the previous years and we’ll hence start more early (and finish later 🙂 ), so please plan accordingly.
This is the agenda, details for the invididual talks can be found in the respective links:
8:30-9:00 Opening & Intro
9:00-9:45 Luca Bruno: Through the Looking-Glass, and What Eve Found There
9:45-10:30 Dieter Spaar: How to Assess M2M Communication from an Attacker’s Perspective
Break
11:00-11:45 Tobias Engel: Securing the SS7 Interconnect
11:45-12:30 Ravishankar Borgaonkar: TelcoSecurity Mirage: 1G to 5G
12:30-13:00 Hendrik Schmidt: Security Aspects of VoLTE
Lunch
14:00-14:45 Rob Kuiters: On her majesty’s secret service – GRX and a Spy Agency
14:45-15:30 “Watching the Watchers”
Break
16:00-16:45 Markus Vervier: Borrowing Mobile Network Identities – Just Because We Can
16:45-17:15 Shahar Tal: I hunt TR-069 admins – CWMP Insecurity
Refreshment
17:30-18:00 Sébastien Roche (Orange): tba
19:30 Dinner (it will be hosted by us, location & details will be provided during workshop and from @WEareTROOPERS).
See you all there, have a safe trip everybody
Enno
Continue reading
IPv6 Router Advertisement Flags, RDNSS and DHCPv6 Conflicting Configurations
We’ve just released a whitepaper discussing the behavior of different operating systems once they receive IPv6 configuration parameters from different sources. For that purpose a number of lab tests were conducted. Continue reading “IPv6 Router Advertisement Flags, RDNSS and DHCPv6 Conflicting Configurations”
Continue readingPractical IPv6 Troubleshooting while Setting up the Troopers Network
Hello Everyone,
Troopers is right around the corner and as I am responsible for the whole conference network I wanted to make sure that everything is working as expected. I went to the venue on Friday because of two things I wanted/needed to setup. Compared to last year’s setup we had a couple of changes in regards to the provider connection (resulting in some changes for our network setup). First, we now have a rather big pipe for the uplink and more importantly (well that depends on the point of view ;)) there is a native IPv6 connection. Before that I had to tunnel all IPv6 traffic from the venue to one of our gateways and to forward it out (as native IPv6) from there. As this step isn’t necessary anymore, and the staff on the venue isn’t that experienced with IPv6, I had in mind to setup and verify that IPv6 is working as desired. The router used over there is a Mikrotek Routerboard. As I haven’t worked with these devices before, I was curious whether everything works as it should ;).
After configuring the IPv6 address on the WAN interface I tried to install a default route pointing to the uplink’s Global Unicast Address. But to my surprise, the Mikrotek router kept stating that the next hop was unreachable. This was odd, as the provider’s device was happily answering to pings from the Mikrotek’s command line. Additionally, the Mikrotek router does not install a route when it can’t reach the next hop configured (which is actually not that bad as it at least prevents fat fingering the address). It still didn’t make any sense. After googling around (I found the Mikrotek documentation a little bit lackluster) and trying some other things it still didn’t work. As a last resort, I told myself “screw it and let’s try with the link local address of the provider router”, but how do I get this address as I only was provided with the GUA? Right, looking at the Neighbor Cache of the Mikrotek router I was able to quickly find the link local address of the next hop.
After using this address (together with the interface) as the next hop it started working, by magic. At least I can now sleep better as it is one less thing I have to worry about ;).
Moral of the story: Still in 2015 don’t expect a device to behave like it should when it comes to IPv6. Unfortunately, I wasn’t able to follow this strange behavior up due to time constraints, but it is working and you can enjoy for the first time native IPv6 in the conference network.
If you want to know more about the general conference setup please stop by for my talk at the IPv6 Security Summit.
See you all in a week!
Best,
Christopher
Continue readingAn MLD Testing Methodology
Based on recent research in the ERNW IPv6 lab and with our MLD talk looming we’ve put together a (as we think) comprehensive document discussing how to thoroughly test MLD implementations in various components (network devices or servers/clients). We hope it can contribute to a better understanding of the protocol and that it can serve as either a checklist for your own environment or as a source of inspiration for researchers looking at MLD themselves.
Continue reading “An MLD Testing Methodology”
Continue reading