This is a guest post from Vladimir Wolstencroft, to provide some details of his
upcoming
#TR15 talk.
What do you get when you combine a security appliance vendor, a bug bounty
program, readily available virtualised machines, a lack of understanding of best
security practices and broken crypto?
Ownage, a good story and maybe even that bounty…
Focusing on Barracuda’s numerous security appliances, this talk will detail bug
hunting methods and the principles used to examine these machines:
Starting with a black box test and the challenges that this approach poses, to
decrypting the firmware, getting system root, bricking the box, fighting the
(de)activation methods, getting system root again, DOS’ing the VM host and
finally using Barracuda’s own source code to find those vulnerabilities that
otherwise would be invisible or impossible to find! There were also some
unexpected outcomes that followed…
Developing a secure and feature rich hypervisor is no easy task. Recently, the
open source Xen hypervisor was affected by two interesting vulnerabilities
involving its x86 emulation code:
XSA 110 and
XSA 105. Both bugs show that the
attack surface of hypervisors is often larger than expected. XSA 105 was
originally reported)
by Andrei Lutas from BitDefender. The patch adds missing privilege checks to the
emulation routines of several critical system instructions including LGDT and
LIDT. The vulnerable code can be reached from unprivileged user code running
inside hardware virtual machine (HVM) guests and can be used to escalate guest
privileges. XSA 110 was reported by Jan Beulich from SUSE and concerns
insufficient checks when emulating long jumps, calls or returns.
During our blogpost regarding
DHCPv6 Guard evasion,
one of the side-effects was that Access Control Lists (ACLs) configured to block
access to UDP ports 546 can be evaded by abusing (again) IPv6 Extension headers.
Having that in mind, we decided to check the effectiveness of Cisco IPv6 ACLs
under various scenarios. Our goal was to examine whether the IPv6 ACLs of Cisco
routers can be evaded, as well as under which conditions this can take place. To
this end, several representative scenarios from enterprise environments or other
potential ones are examined.
Simple everyday work dialog:
“The heater in the basement is still missing a proper thermostat, the ‘binary
solution’ isn’t that effective”
– “Buy one…”
– “Ok”
– “Get one you can break…”
– “Ok, but then I’d like a few tools, too”
– “Go for it.”
(That’s the way work should be!)
Result of the dialog: a
Danfoss Living Connect Z ( 014G0013 )
and a
TI CC1100 Wireless Mini Dev Kit plus
a copy of Z-Force to start with. Goal: Talk to the thermostat!
During our first year of testing Windows Phone 8 applications we had yet
another, let’s say: “surprising” finding. It all started with the first
approaches on pentesting mobile applications on that new and rather closed
platform. Lacking jailbreak, root, and similar approaches we had a closer look
at alternate approaches to have a look at an apps interior. We quickly hooked
onto using modified firmwares (with deeper system access) and found a perfect
solution in a little flaw concerning the handling of SD cards in WP8.1. A flaw
that was, sadly for us, fixed silently….
As follow up of our 2014 talk
“LTE vs. Darwin”
I want to inform you about our telco research in 2015. We are currently dealing
with the so called IP Multimedia Subsystem (IMS), which handles the call and
media logic of 4G telecommunication networks. This network part provides
functions like VoIP (or VoLTE) and takes care of the interconnection to other
call or media related networks.
One interesting observation we make when testing complex environments is that at
the bottom of huge technology stacks, there is usually a handful of shell
scripts doing interesting stuff. More often than not these helper scripts are
started as part of cron jobs running as root and perform basic administrative
tasks like compressing and copying log files or deleting leftover files in
temporary directories. Of course, these high privileges make them an interesting
target for privilege escalation attacks and one class of vulnerability we
reliably encounter in shell scripts is unsafe handling of globbing or filename
expansions.
Lately we had to analyze QR-Codes in a pentest. Those held some random data
which was used as a token for login and we wanted to know if that data was
really random.
If you ever worked with the Burp Suite you may know the Burp Sequencer, which
offers some statistical analysis regarding the randomness of tokens which appear
in requests (you just have to tell Burp what or where the token is). In our case
the QR-Code was delivered as an inline-image in HTML to the browser, like this:
We just released a white paper authored by
Antonios Atlasis that provides an
overview which pentesting tools currently support IPv6 and how to (still) use
them if that’s not the case. It can be found
in our newsletter section.
As you might know we are continuously doing
research on medical devices.
I presented some of the new results at
Power of Community 2014
last week and we thought we would share some of the details with you here. The
focus of the previous work was testing medical devices that are used in
hospitals like patient monitors, syringe pumps or even MRIs. This time we looked
at a device that every user can use at home and which is available to anyone on
the market: A smart scale.
