Tag Archives: black

For Sale – 4k + 1080p monitors

Hi all,

I have the following for sale:

Fractal Design Define MINI C Case, black with Corsair CX550W 80+ Bronze PSU – complete and immaculate – £45 collected. SOLD

LG 24UD58 4k IPS freesync monitor, boxed and as new £110 collected.

HP 22es 1080p IPS monitor, boxed, as new, lovely ultra slim monitor £45 collected

Price and currency: As listed
Delivery: Goods must be exchanged in person
Payment method: Cash on Collect
Location: Wellingborough/Northants
Advertised elsewhere?: YES
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

ICS security fails the Black Hat test

The news at Black Hat 2018 wasn’t great when it came to industrial control systems. But while numerous sessions added up to sweeping condemnation of ICS security, there was at least the occasional saving grace that some vendors will correct some problems — at least some of the time. Still, the apparent lack of a security-conscious culture within these organizations means they’ll only fix the minimum, leaving similar products with the same underlying hardware, firmware and fatal bugs untouched and unsecured.

Speaking in a session, called “Breaking the IIoT: Hacking Industrial Control Gateways,” Thomas Roth, security researcher and founder of Leveldown Security, an embedded and ICS security consulting and research company based in Esslingen, Germany, walked through the security faults of a series of five gateway devices he’d found at prices he could afford on eBay. He wanted to look at commonly deployed, relatively current devices — things you find in the real world.

“If you go out on the network and start scanning, you’ll find thousands of these devices. In fact, you’ll find entire network ranges that are used almost exclusively for these devices,” he said.

“Often, they use static IP addresses with no VPN protection.” One device he looked at had a proprietary protocol for its wireless communications. But if you could break it — and he did — you had access to every one of those devices in the field, because the network addressing architecture was flat and unsegmented.

The first device he looked at was typical of his various experiments, tackling a Moxa W2150A which connects ICS devices to wireless networks via an Ethernet port on the device side and a wireless interface on the other side. In between the two interfaces is an easily opened case that reveals a circuit board with pads for connecting to a debugging port. Roth discovered, in a common theme across many of the devices discussed at the conference, the port was a serial terminal connection that booted directly to a root shell in Linux.

“This is a design decision, not a bug,” Roth said. But he noted that if you have the device and you can access a root shell, then as you are writing exploits, you can debug them directly on the device, “which is a pretty nice situation to be in.”

Roth noted the firmware for the device was available on the internet from the Moxa website, but it was encrypted. At first, this seemed like a dead end. But in looking at earlier firmware versions, he noticed one of the upgrades included adding the feature of encrypting the firmware.

This led him to an unencrypted update version, which included a package called “upgrade_firmware.” This, in turn, led to a function called “firmware_decrypt” — a function name that gave the audience a chuckle — which gave him plaintext access to the current version of the software. The decryption key was, needless to say, included in the upgrade code.

Roth raised an issue that hasn’t been much discussed in ICS security: supply chain security issues caused by the wide prevalence of openly accessible terminal access ports on devices. You can change the firmware, he said, write the changed version back to the device, return it to your distributor without mentioning the change, “and they will happily resell it to someone else.” In fact, he knows this because he conducted an experiment and was sold a device with firmware he had previously rewritten.

Roth discussed four more devices in some detail, with two of them still in the process of disclosure, “and there are a lot of fun issues.”

Beyond Roth’s pathway strewn with pwned gateways, there were other such sessions, including ones that found significant vulnerabilities in medical devices, cellular gateways, smart city infrastructure and satellite communications.

Jonathan Butts, CEO of security consultancy QED Secure Solutions, located in Coppell, Texas, noted in a press conference at the event that dealing with vendors around ICS security disclosure had been particularly frustrating. In the case of a pacemaker made by Medtronic, a protracted process leading to the company deciding that changes in the product weren’t necessary led Butts and co-speaker Billy Rios, founder of WhiteScope LLC, a cybersecurity company based in Half Moon Bay, Calif., to demonstrate their attack live and let the audience judge for themselves.

“To be honest,” Butts said, “after about the one-and-a-half-year mark, and you see stuff like [Medtronic’s response], you get fed up.”

ICS security: Protection? Not

While it’s theoretically possible to protect at least the devices that aren’t implanted in human bodies by placing the ICS equivalents of a firewall at strategic network junction points, a session by Airbus security evaluators Julien Lenoir and Benoit Camredon showed a widely deployed ICS firewall made by Belden could be remotely exploited.

The Tofino Xenon device is typically situated between the IP-based control network and local ICS assets that use Modbus, EtherNet/IP or OPC protocols. Interestingly, the device itself doesn’t have an IP address; it is essentially invisible to ordinary interrogation on the network.

A custom protocol allows a Windows machine running a configurator to discover and then send configuration data to a Xenon device. The configurator knows the addresses of protected ICS devices and knows the Xenon is somewhere between the configurator and the devices. The Xenon knows to watch for packets that carry a specific payload and recognizes them as packets from a configurator.

The two researchers were able to reverse-engineer the protocol enough to understand the arrangement that was used for encryption keys. The configurator discovers devices using a common key and then generates two additional keys that are unique to the particular pairing of that configurator and that specific firewall. All of these keys could be extracted from the discovery session, and then the keys unique to the device were used to establish a connection with the device.

“We were able to get a root shell,” Lenoir told the audience, heralding the familiar theme that almost all ICS devices are actually outdated Linux kernels. “Once everything was running as root, now the appliance was no longer a black box, but was instead a Linux kernel.”

From here, they settled on an attack model that used the devices’ ability to be updated from files on a USB stick. Camredon explained the updates comprised two files, both encrypted. “One is an update script, and one is a data file that is an image, including an image of the kernel.”

It turned out that all configurators and all Tofino Xenon devices used the same key for decrypting the update files. Because they had access to root on the Xenon, they were able to extract this key, at which point they further discovered there were no checks in the update script to ensure the data file hadn’t been tampered with since it was created.

Thus, a breached Xenon could be modified in whatever way the attackers wanted, an image of that system made, and the image could be encrypted and included in an update package without the separate installation script detecting the change.

The Xenon has been updated to correct these problems since the researchers disclosed their findings. So, in theory, the firewall is back in business. One problem Roth noted, though, is these systems often come in dozens of variants, with different names and model numbers.

“If you report a bug to some of these vendors,” Roth said, “the vulnerability gets fixed, but then there are 10 different devices which run the same firmware, and they are left completely unpatched.”

Roth suggested this was a clear indication of the lack of security culture at many ICS vendors.

“It’s like exploiting in the ’90s,” he concluded. “We have no integrity protections on any of these devices.”

At another moment, he made a sweeping generalization: “Everything runs as root; everything runs on outdated Linux kernels; everything runs on outdated web servers. If any of these components fails, you have root permission.”

For Sale – 2 x Monitors – Case/PSU

Hi all,

I have the following for sale:

Fractal Design Define MINI C Case, black with Corsair CX550W 80+ Bronze PSU – complete and immaculate – £50 collected.

LG 24UD58 4k IPS freesync monitor, boxed and as new £130 collected.

HP 22es 1080p IPS monitor, boxed, as new, lovely ultra slim monitor £50 collected

Price and currency: As listed
Delivery: Goods must be exchanged in person
Payment method: Cash on Collect
Location: Wellingborough/Northants
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – 2 x Monitors – Case/PSU

Hi all,

I have the following for sale:

Fractal Design Define MINI C Case, black with Corsair CX550W 80+ Bronze PSU – complete and immaculate – £50 collected.

LG 24UD58 4k IPS freesync monitor, boxed and as new £130 collected.

HP 22es 1080p IPS monitor, boxed, as new, lovely ultra slim monitor £50 collected

Price and currency: As listed
Delivery: Goods must be exchanged in person
Payment method: Cash on Collect
Location: Wellingborough/Northants
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – 2 x Monitors – Case/PSU

Hi all,

I have the following for sale:

Fractal Design Define MINI C Case, black with Corsair CX550W 80+ Bronze PSU – complete and immaculate – £50 collected.

LG 24UD58 4k IPS freesync monitor, boxed and as new £130 collected.

HP 22es 1080p IPS monitor, boxed, as new, lovely ultra slim monitor £50 collected

Price and currency: As listed
Delivery: Goods must be exchanged in person
Payment method: Cash on Collect
Location: Wellingborough/Northants
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

Infosec mental health support and awareness hits Black Hat 2018

LAS VEGAS — Rather than continue being reactive to social issues, Black Hat 2018 took steps to be more proactive in addressing and bringing awareness to the topic of infosec mental health.

The Black Hat conference set up a “self-care” lounge for attendees and included two complementary sessions covering the negative infosec mental health issues of depression and burnout and how the cybersecurity community can prove to be a source of aid for those suffering from post-traumatic stress disorder (PTSD).

During “Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community,” speakers Christian Dameff, emergency medicine physician and clinical informatics fellow at the University of California, San Diego, and Jay Radcliffe, cybersecurity researcher at Boston Scientific, shared personal stories of depression and burnout, as well as ways to identify symptoms in oneself or in co-workers.

Radcliffe noted that the widely acknowledged skills gap could be a contributing factor of infosec mental health issues. 

“With global staffing shortages in information security, we’re seeing departments that should have 10 people work with five. And that increases stress,” said Radcliffe, adding that infosec workers can even have a “hero complex” that leads to taking on more work than is healthy.

Radcliffe said workers and employers should keep an eye out for common symptoms, including, “feeling cynical, no satisfaction from accomplishments, dreading going to work and no work-life balance.” He suggested options such as speaking to counselors, therapists and psychologists, and also being mindful that workers take vacations and managers ensure time off is encouraged.

In the talk, “Demystifying PTSD in the Cybersecurity Environment,” Joe Slowik, adversary hunter at Dragos Inc., expanded on those topics and talked about how working in the infosec community helped him deal with PTSD from his military service in Afghanistan.

Slowik was careful to point out that PTSD should not be confused with burnout, depression or other infosec mental health issues because, as he wrote via email, certain “solutions or mitigations that may be appropriate for one, [may not be for] others.”

“For example, it is likely advisable to tell someone to step away from work for a bit to combat burnout — but in the case of PTSD where an individual may gain empowerment or agency from doing work they love/are successful at, such a step may in fact be counterproductive (it is for me),” Slowik wrote. “Similarly, for depression, treatment may simply be a combination of taking time away, medication, and some degree of therapy, whereas successful treatment of PTSD requires more intensive interventions and likely must be ongoing and continuing to be effective. Combining all of these into the same category means very real mistakes can be made, which at best leave a situation unresolved, and at worst exacerbate it.”

Slowik added that being in the infosec community was “empowering” because it allowed him “to do well at doing good.”

Information security work has allowed me to reclaim a sense of agency by having direct, measurable, recognizable impact in meaningful affairs.
Joe Slowikadversary hunter, Dragos Inc.

“One of the more pernicious aspects of PTSD is a loss of agency deriving from a moment of helplessness when one’s life/integrity was placed in severe danger or risk — re-experiencing this event leaves one feeling worthless and helpless in the face of adversity,” Slowik wrote. “Information security work has allowed me to reclaim a sense of agency by having direct, measurable, recognizable impact in meaningful affairs, and at least for me has been instrumental in moving beyond past trauma.”

The talks showed two sides of the security community that don’t often get talked about: how the work can be both the cause of — and the remedy for — infosec mental health issues.

The attendance for the two talks was noticeably lower than for the more technical talks. It is unclear if this was due to poor marketing, unreasonable expectations for attendance, or the social stigmas surrounding mental health issues.

Slowik said he was grateful for those who attended and noted that the lower attendance could also be attributed to his talk being “the first scheduled talk the morning after Black Hat’s infamous parties.”

“Numbers are irrelevant, as conversations after the presentation made it clear this really reached members of the audience,” Slowik wrote. “My only hope is that this talk, along with other items from the Black Hat Community track, are made publicly available since so many good lessons and observations were made in this forum and these should be shared with the wider information security community.”

For Sale – 2 x Monitors – Case/PSU

Hi all,

I have the following for sale:

Fractal Design Define MINI C Case, black with Corsair CX550W 80+ Bronze PSU – complete and immaculate – £50 collected.

LG 24UD58 4k IPS freesync monitor, boxed and as new £140 collected.

HP 22es 1080p IPS monitor, boxed, as new, lovely ultra slim monitor £50 collected

Price and currency: As listed
Delivery: Goods must be exchanged in person
Payment method: Cash on Collect
Location: Wellingborough/Northants
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – Alphacool 120mm and 240mm radiators.

Im having a bit of a clear out and found these. I have for sale some Alphacool Black Ice Xtreme radiators.

[​IMG]

3x 240mm

[​IMG]

2x 120mm

[​IMG]

I dont really know what they are worth as i’m out of the custom PC community now.

Was thinking.

120mm = £18inc each Now £14inc each
240mm = £22inc each Now £19inc each

Can do discount if more than one is wanted. Postage will just be first class and delivery will take around a week due to having to pass through the MOD postal system.

Price and currency: See Below
Delivery: Delivery cost is included within my country
Payment method: PPG or BT
Location: Powys
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – 2 x Monitors – Case/PSU

Hi all,

I have the following for sale:

Fractal Design Define MINI C Case, black with Corsair CX550W 80+ Bronze PSU – complete and immaculate – £60 collected.

LG 24UD58 4k IPS freesync monitor, boxed and as new £160 collected.

HP 22es 1080p IPS monitor, boxed, as new, lovely ultra slim monitor £60 collected

Price and currency: As listed
Delivery: Goods must be exchanged in person
Payment method: Cash on Collect
Location: Wellingborough/Northants
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – NZXT Phantom Enthusiast Full Tower Gaming PC Case RED

Used NZXT Phantom Enthusiast full size ATX tower gaming pc case in red and black. In good working condition overall, bit dusty and some wear and tear from usage but all together. Comes with instructions and an array of spare nuts and screws. Everything included is pictured. Served me great just empty/not in use now.

Excellent for making a gaming rig or a server tower.

Collection from Portsmouth, Hampshire.

Price and currency: £40
Delivery: Goods must be exchanged in person
Payment method: Cash or Bank Transfer
Location: Portsmouth
Advertised elsewhere?: Advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.