0311, 2013

DeepSec 2013 Talk: Cracking And Analyzing Apple iCloud Protocols: iCloud Backups, Find My iPhone, Document Storage

René Pfeiffer/ November 3, 2013/ Conference

The „Cloud“ technology is a wonderful construct to hide anything, because the „Cloud“ itself is no technology. Instead it is constructed out of a variety of different protocols, storage systems, applications, virtualisation and more. So „Clouds“ provide a good cover. Ask any fighter pilot. They will also confirm that the „Cloud“ is a great hunting ground. A lot of companies and individuals store their data there. A security flaw, stolen access credentials, compromised servers/clients, or bugs in the implementation can do harm. Information security researchers have long since explored the „Cloud“ infrastructure. The task is difficult for few providers have a fully open infrastructure; some do, some don’t. Plus you don’t know what’s going on between data centres. At DeepSec 2013 Vladimir Katalov will shed some light on the internals of the iCloud. He

Read More

0211, 2013

DeepSec 2013 Talk: Hack The Gibson – Exploiting Supercomputers

René Pfeiffer/ November 2, 2013/ Conference

Compromising and controlling a large number of computers is a big advantage for attackers. The best example are the botnets consisting of hundreds, thousands or millions of systems infected by malicious software. These herds of compromised nodes receive commands from Command & Control (C&C) servers. In a sense this is massive parallel computing, but unfortunately it isn’t used for scientific purposes. Instead these nodes send unsolicited e-mails (a.k.a. spam), perform Distributed Denial of Service (DDoS) attacks, or do other tasks for their masters. The infection process is highly automated. Scripts looks for promising targets, attack them, install the botnet software, and add them to the herd’s network. Great. But what about infecting whole networks of nodes instead of nodes one by one? Modern supercomputers are based on a multi-node architecture. Individual nodes are part

Read More

0111, 2013

DeepSec 2013 Talk: Prism Break – The Value Of Online Identities

René Pfeiffer/ November 1, 2013/ Conference, Internet

We all have identities. We use them on a daily basis in our off-line world. Colleagues greet us at work, because they know who we are. Of course our family members know who we are. When it comes to the digital life-style our identity becomes a lot more complex and diverse. Web shops know what we like and suggest products we do not yet have. Social media sites suggest contacts that might match our interest (as do dating web sites). Frequently used search terms are processed to refine the results our favourite search engine presents us. Customisation and targeting is the key. Everything you do and communicate is processed like ore and the Big Data server farms refine your daily trails through the Internet and produce your online identity – which is a good

Read More

3110, 2013

DeepSec 2013 Talk: Easy Ways To Bypass Anti-Virus Systems

René Pfeiffer/ October 31, 2013/ Conference, Security, Stories

The Joys of Detecting Malicious Software Malicious software is all around us. It permeates the Internet by riding on data transmissions. Once you communicate, you risk getting in touch with malware (another name for malicious software). This is why every single one of us, be it individual, company or organisation, runs anti-virus software. The idea is to have specialised software detect malware, so all the bad things are kept out of your network and away from your end-points. So much for the theory. In practice any self-respecting attacker can evade anti-virus filters by a variety of means, depending on their skills and resources. Security researchers know about this fact. Stuxnet and Flame were a proof for sceptics (and a failure of the whole anti-virus industry). How can this be? Well, Attila Marosi (GovCERT Hungary)

Read More

3010, 2013

DeepSec 2013 Talk: Uncovering your Trails – Privacy issues of Bluetooth Devices

René Pfeiffer/ October 30, 2013/ Conference, Security

Bluetooth has been around for a while. Hackers and security researchers (such as trifinite.org and others) immediately investigated the weaknesses of protocol and implementations – The specifications have evolved, but so has the proliferation of Bluetooth-capable devices. Smartphones, dumb phones, computers, bulletin boards, media players, tablets, game consoles, headsets, and many more support Bluetooth wireless communication. Even though bugs of the past were fixed, the widespread capabilities of devices allow for a lot of creative use by adversaries. At DeepSec 2013 Verónica Valeros and Garcia Sebastian will give you an update about Bluetooth hacking and your exposure to attackers. When we think about our own privacy, we usually think of our private data, passwords, personal stuff, web pages we have accessed or phone calls we have made. Information about our behaviour in real life (where

Read More

2510, 2013

DeepSec 2013 Talk: Hacking Medical Devices

René Pfeiffer/ October 25, 2013/ Conference, Security

Modern information technology has already entered the field of medical technology. Few hospitals can operate without power and network connectivity. This is why information security has followed the deployment of hardware and software. Next to the infrastructure present there exists a multitude of communication protocols that increase the attack surface. Hospitals and other medical facilities have to address this issue. News of compromised systems are bad for the administration and the patients. Securing systems enters a new dimension once you consider equipment such as medical pumps, diagnostic systems and anaesthesia machines which directly interact with the patient. Tampering with the dosage of the medication can result in very serious consequences, regardless if on purpose or by accident. Dick Cheney had the wireless capabilities of his pacemaker disabled in 2007 for fears of attacks against his

Read More

2310, 2013

DeepSec 2013 Talk: Psychology of Security – a Research Programme

René Pfeiffer/ October 23, 2013/ Conference

Have you ever considered the impact of the human mind on information security? Since our brain also deals with information,it should be an integral part of defence. Let’s take a look at psychology:  At DeepSec 2013 Stefan Schumacher will give you an introduction into the psychology of security and why we need to improve scientific research in this particular field. Most research about security is done in Computer Science, Electrical Engineering and Mathematics and is about technology, algorithms and computability. However, all security issues can be traced back to human behaviour. Be it Social Engineering, the choice of weak passwords, users leaving the password on a note-it attached to the TFT, admins using MD5 as a password hash or developers ignoring testing regulations. Humans are making decisions, not computers. Therefore, security is defined by

Read More

1910, 2013

DeepSec 2013 Talk: Finux’s Historical Tour Of IDS Evasion, Insertions, and Other Oddities

René Pfeiffer/ October 19, 2013/ Conference, Security, Stories

The SANS Institute offers the article The History and Evolution of Intrusion Detection in its Reading Room. The article was published in 2001. It starts with the phrase „during the past five years…“. We now have 2013. Why is it important to examine the history of a technology which certainly is well established and widely deployed in information security? Well, first of all even to this day many people have a problem with what intrusion detection really is. Detecting an intrusion is not the same as intrusion detection. Secondly not everything marketed as intrusion detection system really detects intrusions. How can this be? The answer can be found by attending Arron „Finux“ Finnon‘s Historical Tour Of IDS Evasion, Insertions, and Other Oddities at DeepSec 2013. He will address the history of intrusion detection along the lines

Read More

1710, 2013

DeepSec 2013 Talk: Pivoting In Amazon Clouds

René Pfeiffer/ October 17, 2013/ Conference, Internet

The „cloud“ infrastructure is a crucial part of information technology. Many companies take advantage of outsourced computing and storage resources. Due to many vendors offering a multitude of services, the term „cloud“ is often ill-defined and misunderstood. This is a problem if your IT security staff needs to inspect and configure your „cloud“ deployment with regards to security. Of course, virtualisation technology can be hardened, too. However the „cloud“ infrastructure brings its own features into the game. This is where things get interesting and where you have to broaden your horizon. Andres Riancho will show you in his talk Pivoting In Amazon Clouds what pitfalls you can expect when deploying code and data in the Amazon Cloud. Classical security tests won’t be enough. The Amazon Elastic Compute Cloud (EC2) is more than just virtual

Read More

1610, 2013

DeepSec 2013 Talk: From Misconceptions To Failure – Security And Privacy In The US Cloud Computing FedRAMP Program

René Pfeiffer/ October 16, 2013/ Conference, Security

The „Cloud“ doesn’t stop when it comes to government data. Once government authorities play with outsourcing a lot more regulations need to be reviewed. Mikhail Utin talks about new results and a continuation of his last presentation at DeepSec conference: Our second presentation at DeepSec on so named “Cloud Computing” (CC) and associated services (CCS) considers practical implementation of the “concept” by US government in its FedRAMP program, which is expected to convert all the government IT services into “cloud” based ones. Our first (DeepSec 2012) presentation considered whether such “concept” is useful to protect privacy and implement such regulation as EU General Data Protection Regulation (GDPR) proposal. In fact, we have shown that CC is a misleading terminology, providing a confusing name to describe well-known IT infrastructure, which is little more than a

Read More

1510, 2013

DeepSec 2013 Talk: The Economics Of False Positives

René Pfeiffer/ October 15, 2013/ Conference

Ever since networks got attacked the victims have thought of ways to detect and prevent attacks. Packet filters were the first idea. Closing a port meant to worry less about applications listening on them. So the trouble of protecting moved to the services that were still exposed. Filtering got more complex, protocols were inspected, signatures were introduced, intrusion detection systems were born. Great – but the attacks didn’t disappear. Instead you got alerts, a lot of them. Some were caused by real attacks, some were false alerts. Enter false positives. Setting off false alarms is a tried and true military tactic. After a couple of false alarms the sentries will probably be less alert. Translated to information security this means that alerts (and log files) will be ignored after a couple of false alerts.

Read More

1010, 2013

Changes to the DeepSec 2013 Schedule – two new Talks

René Pfeiffer/ October 10, 2013/ Administrivia, Conference

We had to change the schedule for the DeepSec 2013 conference slightly. Unfortunately two talks were cancelled, because the speakers could not confirm their presence. We are sorry to hear that, but every one of us know Real Life Interference™ can bust the best of plans. We have replaced the talk slots with submissions by other speakers. We will hear about Uncovering your trails – Privacy issues of Bluetooth Devices by Verónica Valeros & Garcia Sebastian. Bluetooth capabilities are pretty widespread and can be found in devices all over the world – and your workplace, of course. To quote Sheldon Cooper: „Everything is better with Bluetooth.“ And so is attacking devices and leaking information about users and devices. The second talk is pending a description and will be announced in short on our Twitter

Read More

1010, 2013

DeepSec 2013 Talk: The Boomerang Effect – Using Session Puzzling To Attack Apps From The Backend

René Pfeiffer/ October 10, 2013/ Conference, Security

In past centuries attackers used battering rams to break down doors and siege artillery to blast holes into solid fortification walls. These were very tedious undertakings, so using alternate routes – possibly back-doors – were always highly regarded. Nowadays wonderful World of „Cyber“™ is no exception. The modern web-obsessed infrastructure has seen web browsers in local networks being compromised to access web-based back-end systems (through DNS rebinding attacks for example). Management consoles are a prime target, because once you gain access you probably can make the most out of elevated privileges. What about turning the back-end around and attack applications by it? Shay Chen has explored this attack vector and will present details in his talk at DeepSec 2013. Applications security mechanisms, secure software development processes, web application firewalls – collections of countermeasures that turn hacking

Read More

0310, 2013

DeepSec 2013 Keynote: Geopolitics and the Internet – the Meaning of “Hegemony”

René Pfeiffer/ October 3, 2013/ Conference, Discussion, Internet

Most of us think of the Internet as a place where the world virtually gathers and communicates without boundaries. It is regarded as a „virtual“ space where the confinement by borders of nation states is blurred by digital connectivity. People from all over the globe communicate with each other and form a truly cosmopolitan community. The trouble in paradise starts when countries switch off access to the Internet or prosecute whistle-blowers. Given the ever present notion of „cyber“ war we need to discuss geopolitics. It seems that the USA heavily dominates the Internet and regards it as its territory. Marcus Ranum will address the idea of hegemony and the USA with regards to the Internet in his keynote for the DeepSec 2013 conference: So, the topic is “the meaning of hegemony” – what does

Read More

2109, 2013

DeepSec 2013 Talk: Europe In The Carna Botnet – Telnet’s Threat To The Largest Economy

René Pfeiffer/ September 21, 2013/ Conference, Security

Botnets have been around since 1999. These herds of networked and compromised systems (called zombies) are the tool of the trade for many groups. It’s the  zombie outbreak of the information age. The analysis of existing botnets is an important task of security researchers around the globe. The study of the malware involved, the infection process and the inter-node communication of the infected systems is crucial for the dismantling of the botnet. Therefore we are happy to present Parth Shukla’s talk on the Carna botnet. It was created by an anonymous hacker to create a census of the (IPv4) Internet. Parth has been analysing the devices that formed part of the Carna Botnet. The data concerning the devices was provided by the anonymous researcher. He has distributed the relevant data to many CERTs and

Read More