0x03 Serial Killer

Beschreibung:

In dieser Folge unterhalten wir uns über Florians Vortrag auf der
Hack.lu 2018. In seinem Vortrag zeigt er einige Schwachstellen
von sogenannten Serial Devicer Servers und erzählt wo diese
Geräte überall eingesetzt werden.
Shownotes:

Segfault.fm Episode 0x01 ACM WiSec

Homepage der Hack.lu 2018

CIRL.lu: Computer Incident Response Center Luxembourg

WP: Capture the Flag

CTF Time

Serial-Killer: Security Analysis of Industrial Serial Device
Servers

Slides (PDF)

Aufzeichnung des Talks von der Hack.lu

WP: RS-232

WP: RS-422

WP: RS-485

Digi - Tank Monitoring Products

Lantronix EDS-MD

WP: Hackerangriff auf die ukrainische Stromversorgung 2015

Whitepaper: Analysis of the Cyber Attack on the Ukrainian
Power Grid

WP: Supervisory control and data acquisition (SCADA)

WP: H. D. Moore

Serial Offenders: Widespread Flaws in Serial Port Servers

Internet Census 2012

34C3: SCADA - Gateway to S(hell) von Thomas Roth

The ZMap Project

Censys.io

Shodan.io

CVE-2016-9366 — Bruteforce attack against the session ID

CVE-2017-14028 — TCP SYN flooding on Moxa NPort 5110/5130
devices

WP: SYN flood

CVE-2017-16715 — Exposing kernel memory by Etherleaking

EtherLeak: Ethernet frame padding information leakage

RFC 894 — A Standard for the Transmission of IP Datagrams
over Ethernet Networks

CVE-2017-16719 — TCP Initial Sequence Number (ISN) prediction

WP: TCP sequence prediction attack

Teardown: Moxa NPort 5110 Serial Device Server

WP: Wired Equivalent Privacy (WEP)

Lantech IDS-2102

CVE-2018-8869 — Several cross-site scripting vulnerabilites

WP: Cross-Site Scripting

Binwalk: Firmware Analysis Tool

Ser2Net — Serial to Network Proxy

Radare2 — Portable Reversing Framework

QEMU — Generic and Open Source machine emulator and
virtualizer

CVE-2018-8865 — a stack-based buffer overflow vulnerability

ICS-CERT — Industrical Control Systems Cyber Emergency
Response Team

Securityweek.com — Moxa NPort Devices Vulnerable to Remote
Attacks

Securityweek.com — Unpatched Flaws Expose Lantech Industrial
Device Servers to Attacks