In previous blogposts on the “rom-0” bug in 2014 and earlier this year, I first explained its nature and gave instructions on its patching.
CSIRT tools
No larger team can work with one data source and one incident management system today(at least we don’t know such team yet). That’s why every team is engaged in the development of their own tools or at least their own upgrade for already existing tools.
Who’s poking at our Turris SSH honeypot
The Turris SSH honeypots are definitely not idle. There are currently 168 active honeypots that daily record 1000 to 2000 and on some days even up to 5000 SSH sessions containing at least one command.
Overview of multiplatform password managers
The news about LastPass hack broke recently. If the user had strong password, the password is not brute-forcable. However dictionary passwords along with passwords that are guessable with mutation and Markov chains can be broken up to length of 12 characters on one GPU even though LastPass’s key derivation function (KDF) using 100000 iterations. This means that if the attacker can crack user’s simple password, the attacker can download the encrypted blob containing passwords from LastPass and use the cracked password to decrypt them. The weakest link here is the password strength.
How we let a router get “cracked”
In the previous two blog posts about project Turris, we described how a telnet “minipot” helped us to uncover a possible botnet consisting mainly of home routers from ASUS (1, 2). In this article, we will describe one possible way how these devices might have been compromised.
More about the honeypot for Telnet and botnets
Three weeks ago we published preliminary results of data analysis of the honeypot for the Telnet protocol, which we have launched in test mode. Today we will look at the situation change after we installed the tool on all the Turris routers.
Botnet from compromised routers
In the next release of Turris OS, we would like to give our users the possibility to play a more active part in detection of network attacks. The first of the new functions is SSH honeypot which lures the attacker into a virtual environment where we can then observe his activity. This method will be more thoroughly described in a separate blog post planned for the near future. The second addition is less ambitious, but much simpler and still very useful. It is stripped down version of a honeypot which we internally call a “minipot”. In contrast to the normal honeypot which lets any attacker in with any password, our minipot just pretends that there is the possibility of logging in, and collects the supplied user names and passwords.
Successful termination of the exercise Cyber Europe 2014
The CSIRT.CZ team has since summer of the year 2013 actively participated in the preparation and later also in the realization of the so far biggest European cybernetic exercise Cyber Europe 2014 which was already for the third time organized by the European Network and Information Security Agency – ENISA.
Kleptography – a renovated method of how to get to your data is on the increase
We would considerably enjoy it if the cryptography crises limited themselves to one per day. We know, however, that it is only a wishful thinking.
Unintentional exfiltration of keys
The Chinese manufacturer of electronics Lenovo went in his greed so far that he not only pre-installs the display of advertisement on newly installed notegooks but the installed adware of third parties called Superfish even injects javascript into the code of the page being browsed; the goal is to analyze the page and to target the advertisement better. While doing this it does not limit itself only on non-coded HTTP connection.
Cyber attacks against handicapped
Window-Eyes is the so-called screen reader (reader of screen) for Microsoft Windows which is used by visually handicapped users, above all by totally blind and seriously visually handicapped users. Such software converts the content of the screen, e.g. of web pages, into the form of alternative output, most frequently as voice or Braille.