Inside Juki Net

1
Inside Juki Net

• Ejovi Nuwere
• SecurityLab Technologies, Inc.

2
About Ejovi Nuwere

• Who Am I
• My Involvement in Testing
• My Previous Opinion of Juki

3
Nagano Test Limitations
4
Limits on Testing
5
Constraints

• Media
• Time
• Physical environment

6
Our Findings

• Technical findings
• Windows based vulnerabilities
• Findings limited to systems we could touch
• Vulnerabilities found in JUKI application

7
Dangers

• Lack of Accountability
• Multiple Points of Abuse

8
Multiple Points of Abuse
9
Our Results

• Several Critical Flaws
• Flawed trust relationship
• Previous test results
• Good Defenses

10
Improving Juki Security

• Accountability
• Network design and trust relationship
• Disaster recovery
• IDS and Firewalls are not the answer
• Code audit of applications
• Consider Peer to Peer for local government
  communications