0404, 2022

Translated Article: EU Control Committee Blocks Regulation on Chat Surveillance

Sanna/ April 4, 2022/ Stories/ 0 comments

EU-Kontrollausschuss blockt Verordnung zur Chat-Überwachung by Erich Moechel for fm4.orf.at [We have translated this article, because we have criticised client side scanning and introducing backdoors to circumvent encryption in past articles. Erich Möchel has an update on the current EU initiative to make encryption useless.]. A leaked report from the Commission’s control committee shows that officials from the Commission’s interior department have not presented a legally compliant draft in two years. The publication of the ordinance on the automated monitoring of chats, which was announced at the end of March, has already been postponed again. This ordinance, ostensibly aimed at combating child abuse, is now 18 months behind schedule. A recent leak now shows the reason for this series of postponements. The officials responsible for the Commission’s draft could not come up with a text

1703, 2022

Translated Article: Internet Traffic in Russia will be Rerouted

Sanna/ March 17, 2022/ Stories/ 0 comments

Der Internetverkehr Russlands wird umgeroutet by Erich Moechel for fm4.orf.at With Lumen and Cogent, the leading transit carrier and the number three are just exiting the Russian market. Apparently, this doesn’t happen voluntarily and, above all, not as quickly as announced. After the media sector and the stock exchange, the western sanctions are now hitting the Russian IT industry with full force. With Cogent and Lumen, two of the top five international Internet carriers are in the process of cutting off their major customers in Russia one after the other. Market leader Rostelecom, all mobile phone companies and the Internet group Yandex are losing their strongest connections to the world. On Friday, the London Internet Exchange announced that Rostelecom traffic would no longer be routed. All of this is a first in the history of

0203, 2022

Translated Article: CIA Data Mining in SWIFT Financial Data from Europe

Sanna/ March 2, 2022/ Stories/ 0 comments

[Editor’s note: This article was translated before the invasion of Russian troops into Ukraine. It features SWIFT, and the discussed data mining methods still apply regardless of the sanctions.] Data-Mining der CIA in SWIFT-Finanzdaten aus Europa by Erich Moechel for fm4.orf.at Massive financial datasets are constantly being delivered from the EU to the US as part of the TFTP treaty against terrorist financing. The CIA receives this data. The fog is slowly clearing around the huge datasets in which the CIA claims to be data mining. The “foreign financial data platforms” from which the CIA “collects large amounts of structured financial data” to stop ISIS terrorist funding are the databases of payment processor SWIFT. Around 11,000 banks from 200 countries process their payment transactions via the SWIFT system, which currently processes around 40 million

1711, 2021

DeepSec 2021 Talk: Analyzing Radicalization on the Internet – Method and Results of the COMRAD-Project – Dr. Andreas Enzminger & Dr. Jürgen Grimm

Sanna/ November 17, 2021/ Conference, Internet

Incitement, radicalization, and terror are the buzzwords that currently concern us the most. Right-wing and left-wing extremist groups or religious fundamentalists act as fire accelerators for extremist tendencies, even leading to the use of political violence. In this way, they can also endanger the value-based foundations of democracy in the medium and long term. Although much discussed, the role of the media, especially social media, in radicalization within society remains conceptually and empirically unclear. While there are several case analyses based on violent events, systematic studies have yet to be conducted. To fill this gap, the COMRAD project is dedicated to researching radicalization tendencies in cyberspace, focusing on psychosocial, ideological, and communicative conditioning factors. The focus is on the “open space” of politically left-wing, right-wing, or Islamic Facebook groups, in which recruitment strategies and

1611, 2021

DeepSec2021 Talk: QKD-based Security for 5G and Next Generation Networks – Sergiy Gnatyuk, PhD. DSc.

Sanna/ November 16, 2021/ Conference, Security

Modern information and communication technologies (ICT) implementation in all spheres of human activity, as well as the increasing number and power of cyber-attacks on them make the cyber security of the developed digital state vulnerable and weak. Cyber-attacks become targeted (so-called APT-attacks) and attackers carefully prepare them, analyzing the identified vulnerabilities and all possible ways of attack. The security and defense capabilities of the state are considered in an additional fifth domain titled cyberspace (after land, air, water and space). World`s leading states develop strategies to protect cyberspace, create cyber troops, develop and test cyber weapons. A significant number of cyber-attacks today are aimed at critical infrastructures and government organizations. Traditional security methods (in particular, cryptographic algorithms) do not fully protect against all currently known attacks, they are potentially vulnerable to attacks based on

2910, 2021

DeepSec 2021 Talk: Running an AppSec Program in an Agile Environment – Mert Coskuner

Sanna/ October 29, 2021/ Conference

Application security in an enterprise is a challenge. We can see this when we look at the statistics: There have been 16648 security vulnerabilities (CVEs) published so far in 2020 and the average severity is 7.1 out of 10. In this talk, you will find various solutions such as – Development team risk scoring based on maturity and business aspect, – SAST/DAST at CI/CD pipeline without blocking the pipeline itself, – How to leverage bug bounty program, – When to employ penetration testing, – When to employ code review, – Platform developments to remove dependency for developers to implement features, i.e. internal authorization. Most important of all, you will see these solutions lead to minimal friction within the team, which creates a fine-tuned security program. We asked Mert a few more questions about his

2910, 2021

DeepSec2021 Talk: On Breaking Virtual Shareholder Meetings: How Secure is Corporate Germany? – Andreas Mayer

Sanna/ October 29, 2021/ Conference

The Covid-19 pandemic has had a major impact on annual general meetings (AGMs) of shareholders worldwide. Due to existing gathering restrictions the vast majority of AGMs shifted from physical to online voting events. Therefore, purely virtual AGMs emerged to the new normal where shareholders approve critical company decisions. But how secure are those virtual events really? In this talk, I will present a systematic large-scale study on the security of 623 virtual AGMs held by German companies in 2020 including corporations listed in stock indices such as DAX and MDAX. In 72% of all virtual AGMs analyzed, at least one of the three CIA triad security goals was compromised. Join my talk and I will take you on an enthralling journey through the nitty gritty details and pitfalls that lead to the severe vulnerabilities

2510, 2021

DeepSec 2021 Press Release: Organized Espionage on Digital Devices. DeepSec Conference Warns: Searching for “Forbidden” Data on Clients Compromises Information Security.

Sanna/ October 25, 2021/ DeepIntel, Press

A basic principle of information security is access control. We are all used to the fact that data is only available to people and systems with the right authorizations. The discussion about the search for prohibited image files on Apple systems sparked the discussion about the so-called Client-Side Scanning (CSS) technology. Searching for specific content past access restrictions has always been an appealing shortcut. It is now clear that CSS leads to serious problems that endanger the basis of information security and do not bring the hoped-for benefits. Instead, there are additional security loopholes. Search of end devices Lately, the EU Commission and law enforcement authorities have repeatedly addressed the issue of circumventing secure encryption. In mathematical terms, we cannot carry strong encryption out without stored duplicate keys or deliberately weakening the technologies used.

2310, 2021

DeepSec 2021 Talk: Building a Cybersecurity Workforce: Challenges for Organizations – Matthieu J. Guitton

Sanna/ October 23, 2021/ Conference

The shift of human activities from offline to online spaces has major impacts on organizations – either public or corporate – in terms of security, therefore creating a constantly growing need for cybersecurity experts. Although for small companies, expertise can come from external providers, large organizations need to build their own cybersecurity workforce. The limited number of higher education formations result for companies in tension in the employment market, and in the recruitment of people whose expertise is not primarily on cybersecurity. Furthermore, cybersecurity often focuses on technical aspects, and does not always deal enough with the human factor – while the human factor is critical for companies and other large organizations. This presentation will explore the challenges related to building a workforce in cybersecurity from the point of view of organizations. We will

2210, 2021

DeepSec 2021 Talk: SSH spoofing attack on FIDO2 Devices in Combination with Agent Forwarding – Manfred Kaiser

Sanna/ October 22, 2021/ Conference

Since OpenSSH 8.2 there is the possibility to secure a private key with a with a FIDO2 token (Nitrokey, Yubikey, …). A key protected by FIDO2 must be manually confirmed each time the key is used and prevents misuse of the key if an SSH agent is compromised. Although it is known that agent forwarding is a security risk and should not be used, support has been extended with OpenSSH 8.5 (Released: 3.3.2021). Prior to OpenSSH 8.5, it was not possible to forward an SSH agent during file transfers (SCP/SFTP) to another server. This was one of the reasons why AUT-milCERT (BMLV) took a closer look at the SSH protocol. The goal was to find out whether a FIDO2 protected key can provide sufficient protection against misuse in case of a leaked agent. During

2110, 2021

DeepSec 2021 Talk: Releasing The Cracken – A Data Driven Approach for Password Generation – Or Safran & Shmuel Amar

Sanna/ October 21, 2021/ Conference

By now, it should be well known that passwords are like underwear, they should be changed often, the longer the better and it’s better not to leave them lying around. While the big players advocating for passwordless authentication, passwords are still the most common authentication method. In the wild, we’ve seen thousands of organizations experiencing password spraying and bruteforce attacks on their users. Although MFA should mitigate some of the threats, it’s still not implemented on all protocols and in some cases was bypassed by security flaws in the IDP. In this talk, we’ll present a new concept for password security – smartlists, built on a new data driven approach that utilizes recent advancements in NLP. Together with this talk, we are proud to release a new FOSS tool that makes these new concepts

2010, 2021

DeepSec 2021 Talk: Firmware Surgery: Cutting, Patching and Instrumenting Firmware for Debugging the Undebuggable – Henrik Ferdinand Nölscher

Sanna/ October 20, 2021/ Conference

Embedded systems can be challenging to analyze. Especially on automotive systems, many things that we take for granted on other software such as debugging and tracing do not always work. This is further complicated by watchdogs and peripheral processors, that go haywire when strict timing and communication requirements are violated. On some systems, debugging is even impossible because debugging resources such as pins are either used for something else or they don’t exist at all! Assuming that code can be dumped, the solution for this can be emulation, however emulating a rich automotive system can be painful and many times, only few aspects of the system can be sufficiently modeled. What if there was an in-between? How can we debug, fuzz and tamper embedded firmware without access to real-time debugging or emulation? In this

1910, 2021

DeepSec 2021 Talk: When Ransomware fails – Sreenidhi Ramadurgam

Sanna/ October 19, 2021/ Conference

Ransomware is a piece of code that is written by an attacker to encrypt the victim’s files. Even though it has been around for many years, its popularity has increased since the outbreak of Wannacry which shook the whole cyber world. When the logic of the ransomware code is observed we can see a common pattern here. It is similar to how humans interact with the system. I.e, to access the files, the code has to access the logical drive first. Here each logical drive is assigned a letter by the operating system. For example, when a code has to access the files in D drive, it has to access the drive ‘D’ first. What if there is a logical drive in the system which doesn’t have any letter assigned to it? Well, now

1510, 2021

DeepSec 2021 Talk: Large-scale Security Analysis Of IoT Firmware – Daniel Nussko

Sanna/ October 15, 2021/ Conference

Today, the number of IoT devices in both the private and corporate sectors are steadily increasing. IoT devices like IP cameras, routers, printers, and IP phones have become ubiquitous in our modern homes and enterprises. To evaluate the security of these devices, a security analysis has to be performed for every single device. Since manual analysis of a device and reverse engineering of a firmware image is very time-consuming, this is not practicable for large-scale analysis. To be able to conduct a large-scale study on the security of embedded network devices, an approach was applied that allows a high number of firmware images to be statically analyzed. For data acquisition, a crawler was used to identify and retrieve publicly available firmware images from the Internet. In this way, more than 10,000 individual firmware images

1310, 2021

DeepSec 2021 Talk: Post-quantum Encryption System for 5G – Maksim Iavich

Sanna/ October 13, 2021/ Conference

Nowadays, many leading scientists and experts are actively working on the creation of quantum computers. On October 23 2019, Google announced that it has achieved quantum supremacy. This means the great speedup of the quantum processors compared to the fastest classic computer. On December 06 2020, scientists in China also announced that they also achieved quantum supremacy. Quantum computers will probably destroy most cryptosystems that are widely used in practice. A variety of “resistant to quantum attacks,” alternatives are developed. These alternatives are hash-based, code-based, lattice-based and multivariate crypto schemes. However, to date a number of successful attacks is recorded on the given system. It is also shown that these schemes have efficiency problems. The amount of traffic carried over wireless networks and the number of mobile devices (including IoT) are growing rapidly and

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this: