Upload File

1 control de versiones - amazon s3 … · 7 análisis ssl heartbleed cve-2014-0160 no vulnerable...

  • Home
  • Documents
  • 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure
23

Upload: others

Post on 26-Jun-2020

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure
https://nivel4.com/
https://nivel4.com/
Page 2: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

1 Control de versiones

https://nivel4.com/
https://nivel4.com/
Page 3: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

........................................................................................... 2

......................................................................................................... 5

................................................................................................................ 6

......................................................................................................... 6

.................................................................................................................. 7

................................................................................ 8

............................ 8

..................... 9

..................... 10

.......................................................................................................... 10

......................................................................................................... 10

................................................................................... 10

........................................................................... 11

....................................................................................................................... 11

....................................................................................................... 12

.................................................................. 12

.......................................................................................................... 14

...................................................................................... 15

................................................ 15

......................................................................................................... 16

........................................................................................................ 16

....................................................................................... 16

..................................................................................................... 17

.......................................................................................................... 17

.......................................................................................................... 17

....................................................................................... 17

............................................................................ 17

............................................................................................ 18

............................................................................ 22

.......................................................................................................... 22

https://nivel4.com/
https://nivel4.com/
Page 4: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

................................................................................................................ 23

https://nivel4.com/
https://nivel4.com/
Page 5: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

2 Introducción

https://nivel4.com/
https://nivel4.com/
Page 6: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

3 Objetivo

4 Metodología

https://nivel4.com/
https://nivel4.com/
Page 7: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

5 Ámbito

https://nivel4.com/
https://nivel4.com/
Page 8: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

6 Análisis de tráfico de datos

https://nivel4.com/
https://nivel4.com/
Page 9: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure
https://nivel4.com/
https://nivel4.com/
Page 10: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure
https://nivel4.com/
https://nivel4.com/
Page 11: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

192.168.254.155 50.22.89.18 TLS v1.2 Sitio web khipu

192.168.254.155 23.14.70.224 TLS v1.2 Sitio web Santander

192.168.254.155 200.29.162.187 TLS v1.2 Sitio web Banco Estado

192.168.254.155 200.14.130.2 TLS v1.2 Sitio web Banco Chile

IOS

Origen Destino Tipo de Tráfico Descripción

192.168.254.112 50.22.89.18 TLS v1.2 Sitio web khipu

192.168.254.112 23.14.70.224 TLS v1.2 Sitio web Santander

192.168.254.112 170.233.152.16 TLS v1.2 Sitio web Banco Es-

tado

192.168.254.112 200.14.130.2 TLS v1.2 Sitio web Banco Chile

https://nivel4.com/
https://nivel4.com/
Page 12: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

7 Análisis SSL

Heartbleed CVE-2014-0160 No vulnerable

CCS CVE-2014-0224 No vulnerable

Secure Renegotiation CVE-2009-3555 No vulnerable

Secure Client-Initiated

Renegotiation CVE-2011-1473 No vulnerable

CRIME CVE-2012-4929 No vulnerable

BREACH CVE-2013-3587 No vulnerable

POODLE CVE-2014-3566 No vulnerable

TLS_FALLBACK_SCSV RFC 7507 No vulnerable

SWEET32 CVE-2016-2183 No vulnerable

FREAK CVE-2015-0204 No vulnerable

DROWN CVE-2016-0703 No vulnerable

LOGJAM CVE-2015-4000 No vulnerable

BEAST CVE-2011-3389

LUCKY13 CVE-2013-0169

https://nivel4.com/
https://nivel4.com/
Page 13: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

RC4 CVE-2013-2566

CVE-2015-2808 No vulnerable

https://nivel4.com/
https://nivel4.com/
Page 14: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure
https://nivel4.com/
https://nivel4.com/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
http://breachattack.com/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2566
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2107
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2107
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169
Page 15: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

8 Ethical Hacking Mobile

Desempaquetado

Decompilación

Análisis de integridad

Análisis de metadatos

Análisis de strings

Búsqueda con expresiones regulares

Análisis en VirusTotal (malware)

https://nivel4.com/
https://nivel4.com/
Page 16: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

SHA256 3389e93d42d229276738a6eca184770b19b4904f289bda2a1c0178e6d09

2fcba

Tamaño 5.32 MB

Tipo Android

URLs Interesantes 5

IPs encontradas 0

Emails encontrados 0

1. https://khipu.com/payment/simplified/

2. https://khipu.com/payment/show/

3. https://khipu.com/payment/end/

4. https://khipu.com/cerebro/

5. https://khipu.com/app/2.0/automaton

https://nivel4.com/
https://nivel4.com/
Page 17: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

SHA256 bf7f1360f92dc9f5f6c4b845fa4bcc240754410638b4acb92ca4161

82b132949

Tamaño 13.91 MB

Tipo iPhone

URLs Interesantes 0

IPs encontradas 0

Emails encontrados 0

https://nivel4.com/
https://nivel4.com/
Page 18: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

Ad-Aware

Ad-Aware

AegisLab

AegisLab

AhnLab-V3

AhnLab-V3

Alibaba

Alibaba

ALYac

ALYac

Antiy-AVL

Antiy-AVL

Arcabit

Arcabit

Avast

Avast

AVG

AVG

Avira

Avira

AVware

AVware

Baidu

Baidu

BitDefender

BitDefender

Bkav

Bkav

https://nivel4.com/
https://nivel4.com/
Page 19: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

CAT-QuickHeal

CAT-QuickHeal

ClamAV

ClamAV

CMC

CMC

Comodo

Comodo

Cyren

Cyren N/A

DrWeb

DrWeb

Emsisoft

Emsisoft

eScan

eScan

ESET-NOD32

ESET-NOD32 N/A

F-Prot

F-Prot

F-Secure

F-Secure

Fortinet

Fortinet

GData

GData

Ikarus

Ikarus

Jiangmin

Jiangmin

K7AntiVirus N/A K7AntiVirus N/A

K7GW

K7GW

Kaspersky

Kaspersky

Kingsoft

Kingsoft

https://nivel4.com/
https://nivel4.com/
Page 20: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

Malwarebytes

Malwarebytes

MAX

MAX

McAfee

McAfee

McAfee-GW-Edition

McAfee-GW-Edition

Microsoft

Microsoft

NANO-Antivirus

NANO-Antivirus

nProtect

nProtect

Panda

Panda

Qihoo-360

Qihoo-360

Rising

Sophos AV

Sophos AV N/A SUPERAntiSpyware N/A

SUPERAntiSpyware

Symantec

Symantec

Tencent

Symantec Mobile Insight

TheHacker

Tencent N/A VBA32 N/A

TheHacker

VIPRE

TrendMicro

ViRobot

TrendMicro-HouseCall

Webroot

Trustlook

WhiteArmor

https://nivel4.com/
https://nivel4.com/
Page 21: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

VBA32

Yandex

VIPRE

Zillya

ViRobot

ZoneAlarm

Webroot

Zoner

WhiteArmor

Yandex

Zillya

ZoneAlarm

Zoner

https://nivel4.com/
https://nivel4.com/
Page 22: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

9 Vulnerabilidades declaradas

https://nivel4.com/
https://nivel4.com/
https://www.openssl.org/blog/blog/2016/08/24/sweet32/
http://www.isg.rhul.ac.uk/tls/
https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
https://cipherli.st/
Page 23: 1 Control de versiones - Amazon S3 … · 7 Análisis SSL Heartbleed CVE-2014-0160 No vulnerable CCS CVE-2014-0224 No vulnerable Secure Renegotiation CVE-2009-3555 No vulnerable Secure

10 Anexos

android_septiembre.cap fdcb60b2053b0f4a194e48cb1bfb93cd

ios_septiembre.cap 552251c591b798113dec187cdb2b2689

https://nivel4.com/
https://nivel4.com/

Common Vulnerabilities and Exposures (CVE) Numbering ...cve.mitre.org/cve/cna/CNA_Rules_v2.0.pdf · Common Vulnerabilities and Exposures (CVE) Numbering ... The Common Vulnerabilities

Exchange rate statistics · Praia Cabo Verde escudo B USD 1 = CVE 98.564 CVE 101.27346 CVE 99.99432 CVE 97.61701 247 = 100 centavos S USD 1 = CVE 98.766 CVE 101.47546 CVE 100.19632

MANUAL DE LA SERIE CVE · MANUAL DE LA SERIE CVE Manual de Instrucciones (Español) CVE-10, CVE-12, CVE-15 y CVE-18s Altavoces alimentados

SECURE FILE TRANSFER - Safe-T Data · basis” only, while eliminating the need to rely on insecure file permissions and vulnerable SMB protocols. SFA acts as a secure file gateway

FAOCGIARWMO A food-secure future for those most vulnerable to environmental stress. GECAFS Vision

NetHide: Secure and Practical Network Topology Obfuscation · NetHide hides the vulnerable physical topology and shows a secure virtual topology Deriving a secure and practical topology

Secure communication based on noisy input data ... › courses › ss11 › noisy › Slides_SecurityW… · GetResponse Problem: Random number generators often vulnerable to attacks

CVE Glossary

Hacking Demonstration - BCS · Google Hacking Database The Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software, developed for use

CVE ENHANCED COMMUNITY POLICING & ACCELERATING CVE · 2019-09-20 · U.S. CVE National Strategy on Countering Radicalization to Violence BUILDING safe, secure, resilient, crime-resistant

Préparée par · Steven Seeley de Source Incite (CVE -20167265, CVE 7290, CVE 7291) Steven Vittitoe de Google Project Zero (CVE-2016-7257, CVE-2016-7276) Weibo Wang de Qihoo 360

Cve. Alumno

Advisory: APT29 targets COVID-19 vaccine development · 2020. 9. 30. · • CVE-2019-11510 Pulse Secure [2] • CVE-2018-13379 FortiGate [2] • CVE-2019-9670 Zimbra [3] The group

An Automated Security Testing Framework for I …...Dirty COW Vulnerability Patch (CVE-2016-5195) •Hmark –how to collect vulnerable functions II. IoTcube: an Automated Security

THE UNFORTUNATE REALITY OF INSECURE LIBRARIES OWASP Libraries.pdf · What’s More Secure: Vulns or No Vulns? Library A Library B CVE-2007-1234 OSVDB 12345 OSVDB 31337 CVE-2009-5678

Cve Mentor

CYBER THREAT MONITOR - k7computing.com Threat Monitor Report Q1 19-20.pdf · Attacker scans internet for WebLogic servers vulnerable to CVE - 2019-2725, gains unauthorised control

Vulnerable plaque vulnerable patient

andy clemenko - @clemenko - Docker BUILDING A SECURE ... A Secure Su… · What is a Secure Supply Chain? •Known good source - Source of truth? •Known good path? •CVE Scanned?

Secure Hash Algorithm 3 - GitHub Pages...Secure Hash Algorithm Family SHA1 - 1995, NSA. 160 bits. Somewhat vulnerable to collisions and length-extension attacks SHA2 - 2001, NSA. 224,

Urban development induced displacement creating secure or vulnerable urban communities through relocation of underserved settlers- A study of select forced

Secure Your VMs with vSphere and AppDefense...CVE2015 4979-20191003 CVE 20177187 CVE -20153660 CVE -2018 9807 2015 9912 2019 2388 2016 8742 20177887 2018 3270 9391 CVE -2019 6207 2019123912

Catálogo – Capa (Frente)diacovirtual.com.br/imagens/catalogo.pdf · 2019. 3. 15. · CVE 200 X 22 CVE 200 X 28 CVE 250 X 31 CVE 250 X 38 CVE 300 X 47 PERFIL ASTM A57 FY>350 Nipa

리눅스악성코드연구동향 - GitHub Pages* CVE-2017-7308, CVE-2017-6074, CVE-2017-5123, CVE-2017-1000112, CVE-2016-9793, CVE-2016-8655, CVE-2016-5195, CVE-2016-0728, CVE2015-1328,

Secure Software Development with OWASP SAMM...2020/04/20  · Secure software is the result of a security aware SDLC Security must be addressed at every stage Failure results in vulnerable

M!DGE/MG102i Release notes - · PDF fileCVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE- ... Only offer download button if IPsec clients are enabled

Helping Orphans and Vulnerable Children Be Secure ● Be Healthy ● Be Connected ● Be Prepared Helping Children Help Themselves

cve xpJ08kIn90 Verificaciónnoticias.clubmarusia.com/.../2019/05/ESTATUTOS-MARUSIA.pdf · 2019. 5. 17. · CVE: xpJ08kIn90 Verificación: . CVE: xpJ08kIn90 Verificación: . CVE: xpJ08kIn90

API design for cryptography - Hack.luarchive.hack.lu/2017/hacklu-crypto-api.pdf · Focused on high-speed cryptography ... CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080

Honeypots - The Art of Building Secure Systems by Making them Vulnerable

Cve % mais leve CA2 Modelo existente Cve CvS

McAfee Foundstone FSL Update · CVE-2015-5296, CVE-2015-5299, CVE-2015-5330, CVE-2015-5370, CVE-2015-7560, CVE-2016-2110, CVE-2016-2111, CVE- ... exploitation could allow a remote

Apunte cve

THE RANSOMWARE - Microsoft...CVE-2012-1054, CVE-2015-0204, CVE-2015-1637, CVE-2003-0818, CVE-2002-0126, CVE-1999-1058 Start out by patching those and you can drastically reduce your

CVE FERRERO