Fuzzing Optical Smart Meters with ProtoPredator

PPClawsWords1

Our team has been working hard in the lab, once again testing the optical implementations of a variety of smart meters. Using our proprietary in-house developed tool, called ProtoPredator for Smart Meters, we have been doing full fuzzing of optical protocol implementations. 

Our tool makes this process easy and reproducible. It also provides for easy regression testing and fix validation through session replays. 

One of the things that makes ProtoPredator so cool is that it includes both arbitrary conversations with the meters in addition to canned sessions, making much more flexible in the hands of a knowledgeable user. You can easily use this feature to perform more nuanced validation of the protocols, testing things like sequence errors, poor trust, error recovery, etc. 

While ProtoPredator is still tied to the optical coupler speed and the inherent speed of the protocols in use, testing with it makes validation of the optical ports more effective than other more traditional approaches. Additionally, you can use multiple seats of ProtoPredator in parallel to decrease the overall testing and validation time, especially since the “brain files” and packet sessions are easily interchangeable amongst installations.

The easy to use GUI also means less frustration and more time on task for most users. It lets the testers spend less time on mundane tasks like serial configuration and hand crafting packets and more time on security testing, protocol analysis and bug hunting.

To find out more about ProtoPredator, or to discuss having our lab give your smart meters a look over, get in touch. Info(at)micro solved(dot)com will get you a prompt response. As always, thanks for reading! 

64 Bit OS Reminder for HoneyPoint

Just a quick note to help folks who are using HoneyPoint, regardless of version. If you are having trouble with execution on a 64 bit operating system, remember that HoneyPoint binaries are 32 bit. To run them on 64 bit OS’s, you need ensure that you have the 32 bit compatibility tools installed.

For Windows, read this.

For Ubuntu, read this.

For other operating systems, please consult your operating system vendors’ documentation. If we can be of any assistance, please contact your HoneyPoint support person.

Thanks!

Aaron Bedra on Building Security Culture

Our good friend, Aaron Bedra, posted a fantastic piece at the Braintree Blog this morning about building a security culture. I thought the piece was so well done that I wanted to share it with you.

Click here to go to the post.

The best part of the article, for me, was the content about finding creative ways to say yes. IMHO, all too often, infosec folks get caught up in saying no. We are the nay sayers, the paranoid brethren and the net cops. But, it doesn’t have to be that way. It might take a little (or even a LOT) of extra work, but in many cases ~ a yes is possible ~ IF you can work on it and negotiate to a win/win point with the stakeholders.

Take a few minutes and think about that. Think about how you might be able to get creative with controls, dig deeper into detection, build better isolation for risky processes or even make entirely new architectures to contain risk ~ even as you enable business in new ways.

In the future, this had better be the way we think about working with and protecting businesses. If not, we could find ourselves on the sideline, well outside of the mainstream (if you aren’t there already in some orgs). 

Great work Aaron and thanks for the insights.

Cyberattacks on Rise Against U.S. Corporations

See on Scoop.itChinese Cyber Code Conflict

Officials said the aim in a new wave of attacks was not espionage but sabotage, and that the source seemed to be in the Middle East.

Red-DragonRising‘s insight:

ICS-CERT issued this alert that cyber attacks are now trending towards sabaotage instead of cyber espionage…combine cyber jihaist activity, e.g.; Shamoon, with cyber criminality and you have a very potent and violatile mix   directly impacting and affecting both commercial enterprises and the United States critical infrastructure…

 

Standby to standby…

 

Semper Fi,

 

謝謝您

紅龍

See on www.nytimes.com

Top U.S. admiral, Chief of Naval Optimism (CNO), puts cyber security on the Navy’s radar | Reuters

See on Scoop.itChinese Cyber Code Conflict

SINGAPORE (Reuters) – Cyber security and warfare are on par with a credible nuclear deterrent in the defense priorities of the United States, the U.S.

Red-DragonRising‘s insight:

Wait a second…didn’t the US Navy CNO say the People’s Republic of China (中華人民共和國) was not a threat according to the defensetech report just a few days ago… "Chief of Naval Operations (CNO) Admiral Jonathan Greenert told the House Appropriations Defense Subcommittee yesterday that the Asia Pivot Policy is working and China’s Military is NOT a threat…" and that the United States shuodl send in the Marines…albeit on US Navy Amphibs…

 

Today, 13 MAY, the same US Navy General Officer and Chief of Naval Optimism (CNO)….say Chinese cyber espionage is a THREAT…can we please make up our minds…Admiral Greenert, hello?? LOL…

Semper Fi;

謝謝您

紅龍

See on uk.reuters.com

Does China have a stealth drone? [Foreign Policy] #RisingChina #Stealth #Hardpower

See on Scoop.itChinese Cyber Code Conflict

Rising China, achieving symmetrical hard power and information fidelity. – – – Does China have a stealth drone? Posted By John Reed Source – Foreign Policy, published Friday, May 10, 2013 While Ira…

Red-DragonRising‘s insight:

After the Daily Mail in the UK broke the story about Chinese hackers stealing Lockheed Martin’s stealthy secrets, http://www.dailymail.co.uk/news/article-2323067/Chinese-hackers-caught-trying-steal-secrets-new-stealth-fighter-tens-thousands-cyber-attacks-launched-jet-manufacturer-week.html?ito=feeds-newsxml

It should be no surprise the People’s Republic of China has a stealth drone…

 

Semper Fi,

 

謝謝您

紅龍

See on wanderingchina.org

War of words intensifies as Beijing rejects Washington claims of ‘cyber attacks’ |Business |chinadaily.com.cn

See on Scoop.itChinese Cyber Code Conflict

The war of words over cyber attacks escalated this week with an official Chinese newspaper branding the US the real hacking empire, two days after the Pentagon explicitly accused China of spying on the computer networks of US companies and…

Red-DragonRising‘s insight:

Oh the irony…and to think these stories come out on a weekend when they think no one is paying attention….tsk, tsk…

See on www.chinadaily.com.cn

Chinese hackers caught trying to steal secrets of our new stealth fighter as tens of thousands of cyber attacks are launched on jet manufacturer every week

See on Scoop.itChinese Cyber Code Conflict

A covert unit within the Chinese Army has been using highly sophisticated cyber weapons in a desperate attempt to acquire classified information about the stealthy Joint Strike Fighter (JSF).

See on www.dailymail.co.uk

People’s Republic China Trademark Theft…

See on Scoop.itChinese Cyber Code Conflict

China Trademark. Do you really know what you have?

Red-DragonRising‘s insight:

People’s Republic of China and trademark infringement/theft…besides this story about a Chinamen who created/manufactured ownership in a US Bank… there are many other stories of Chinese related theft of trademarks – look at the beating Apple, Inc has had over the iPad, SIRI and other innovations that Chinese have claimed ownership for…at significant Communist Party of China economic extortion sponsorship…want more details and the facts – contact me here…

 

Semper Fi,

 

謝謝您

紅龍

See on www.chinalawblog.com

China China China hack hack hack | Beyond The Beyond | Wired.com

See on Scoop.itChinese Cyber Code Conflict

*In espionage, patience and persistence will beat shiny James Bond gadgets any day. *You have to wonder who in China is actually going through this stol

Red-DragonRising‘s insight:

Yes – even on Mother’s Day here the reports of Hacking and the People’s Republic of China do not take a break…I wonder how many Federal law enforcement agents are paying attention to the news on a Sunday? Or how many of the Pentagon’s so-called ‘China gurus" are working issues related to the Middle Kingdom on a Sunday…the answer is none, 0…..

 

Semper Fi,

 

謝謝您

紅龍

See on www.wired.com