After a long time in the making, our calendars finally aligned and this week I shared the stage co-training the class: “Assessing and exploiting control systems & IIoT”, with Justin Searle ?.
Keep Reading →
BSides Luxembourg 2019 Write-up
This was my second BSides event of this year. I must say I really like this type of events and I hope I can attend more of them next year. I don’t think I can cover as many as Cooper (@ministrator), but I would love to.
For those of you who haven’t attended one before I ‘ll run you through the basics. Community organized, very nice people, great content (normally delivered by non Rockstar speakers) and non-profit. Keep Reading →
Hack in the Box Amsterdam and Haxpo 2019
I like attending conferences, they provide a front row seat to the lastest research and other people in your area are doing and thinking. For me they are inspiring. They also provide a great space for networking and getting to know great people, especially in our security community.
Around the conference, there is normally a lot going on, and I normally miss out on most of it because I’m focused on the talks. So this time, I decided to skip the conference all together and just visit the Haxpo (or the program around the main conference)
Hack in the Box (Amsterdam) is a great event, I’ve attended a couple of times: trainings and talks. They also organize a great Expo, it runs parallel to the conference and always has a lot to offer. This piece covers my day at the Haxpo.
My impressions of the Digital Demo Day 2019
Yesterday I participated at the #DigitalDemoDay19 in Düsseldorf, Germany. My overall impression: great event. A nice mix of talks, pitches and fair grounds. I was not able to hear any of the talks, because we had our first stand ever.
We got to share our stand / booth with 5 other start-ups () and #CGI, which was kind enough to select us and sponsor our presence. The CGI team was great from before the event. It was a pleasure partnering with them. They had a really cool chocolate kiosk that was a people magnet!
For the event we prepared some roll-ups, which did a great job attacking people. But the biggest hit was the IoT Security Hacking Kit. I took one of the boxes and used it as a stand for the presentation tablet. Lots of people where interested in it, even today I got some pings via LinkedIn. Next time I need to prepare a full box for show and tell 😉
Entering SevenShift
I’ve been working as a freelancer for a while now and lately been wanting to grow and attempt bigger things. That is why starting today I have officially founded SevenShift.
This new company will be the place I will be doing all my work from. The main idea is to have a legal entity that can enable me to work on any future endeavors.
The main focus will be on IoT Security, which is what I have been working on lately, but we will see where the road takes us.
I hope I find some time to post here as well, now that I will be responsible for an additional site.
IoT Makerthon
At the end of March 2017, I participated in an IoT Makerthon (Hackathon) at my co-working space in Cologne.
The turnout was not what I expected, we were only approx. 15 participants. Considering it was planned on a Monday in working hours the only people who could attend were those who were either sent by their day job or those who could take the day off.
Links of the week
I’ve been sending myself emails with links at the end of the week for some time now and I’ve decide to share this list of curated links. These links are to articles that I have run by during the week, that at least when I decided to set them aside, had the value for them to be revisited, shared or stored.
The topics vary a lot, depending on what I ‘m working on or am interested at a given point or what I run into.
So without further delay here is the first edition
Who signed the .apk file?
After a while searching for an older version of an App from the Play Store, I finally found the version I wanted and downloaded it.
In order to install it, you have to “Allow the installation from unknown sources”. So there goes the chain of trust for the app.
So how do you know:
- Where did the app came from ?
- Did someone plant Malware in it?
- Can I trust it?
These are cases for your trusted cryptographer or in the case your certificates.
Basically you need fo follow these steps:
# Dump the apk information $ANDROID_HOME/build-tools/23.0.0_rc2/aapt dump badging www.apks.org-de.hafas.android.db.apk |grep package # verify the signer jarsigner -verbose -verify www.apks.org-de.hafas.android.db.apk |less
# Verify that all files have been signed with the same key jarsigner -verbose -certs -verify www.apks.org-de.hafas.android.db.apk |less
Error -505 while installing Android App
I’ve had the DB Navigator app trying to update itself for the last 3 to 12 months, but hadn’t really put some time into figuring out why it didn’t work. If figured I was not the only one affected so they would fix it themselves someday. Since that never happens, I took some time and wrote this post.
In a nutshell the problem is that the ticket database was owned by another DB app: de.bahn.dbtickets. I uninstalled it and then could update / re-install the DB Navigator app.
How did I figure this out?, you say
- Enabled developer mode on my phone
- Connected to it and used adb logcat to see the logs
- Tried to install the app
- Found this in the logs
E/Finsky (28878): [1] PackageInstallerImpl.handleCommitCallback: Error -505 while installing de.hafas.android.db: INSTALL_FAILED_DUPLICATE_PERMISSION: Package de.hafas.android.db attempting to redeclare permission de.bahn.dbtickets.permission.WRITE_DB already owned by de.bahn.dbtickets
W/Finsky (28878): [1] 3.installFailed: Install failure of de.hafas.android.db: -505 null
So the highlighted part is what told me the problem.
Have fun.
Security mindset reviewed by Matty Beddoes
I normally try to post only original content, but I ran into an interview with Matty Beddoes at Tripwire THE STATE OF SECURITY which is worth sharing. It is a good reminder that security is not just about controls and suits but also about hacking (learning driven by interest) and having the correct mindset really helps.
Here is the money quote:
"
It’s never a good idea to mess with a 16-year-old, especially one who can use a computer to cause chaos. Honestly, if they had said “Thank you,” things might have turned out differently. But they didn’t.
Sadly, that’s not a unique reaction in today’s industry. In fact, I find that IT staffs generally do not want their managers to know of a vulnerability for fear of looking bad at their jobs. This creates an unhealthy environment where no one wants to hear about vulnerabilities. If you talk to the staff, they will just ignore you, and if you contact the manager, they will take it personally and think you’re criticizing their staff. You’re blocked either way.
This problem is found all over the place but it usually changes after a company has been hacked. And that’s where I came in.
"
I have also seen this attitude a lot, although I welcome the people that find themselves at the other side of the engagement and see the opportunity that it being given to them to learn and grow.. event make a business or career out of the experience.
