First, a few words regarding my experience at Black Hat: for me, it was the
first time attending the conference and then directly as a speaker. I thoroughly
enjoyed Black Hat. It took a while to get used to the size of the conference and
the vibe of Las Vegas. What was especially interesting for me was connecting
with other researchers. One thing that stood out was meeting with the team from
MSRC and putting faces to the team itself. It feels way more personal to know
who you’re talking to when you know the people handling your cases. During
TROOPERS I typically have the chance to connect with many researchers, mainly
from Europe. At Black Hat US, on the other hand, it is possible to connect more
with the US scene and meet people you haven’t seen in a long time! Seeing
familiar faces again is always nice, as opposed to putting them into your
biometric template database. One nice detail was that some international
researchers are aware of the research BSI (German: “Bundesamt für Sicherheit in
der Informationstechnik” – “German federal office for IT security”) is
facilitating. The results of our presentation stem from the “Windows Dissected”
project we are performing on behalf of the BSI.
In the
last blog post,
we discussed the full authentication flow using Windows Hello for Business
(WHfB) with face recognition to authenticate against an Active Directory with
Kerberos and showcased existing and new vulnerabilities. In this blog post, we
dive into the architectural challenges WHfB faces and explore how we can exploit
them.
The majority of the work was conducted in the context of the “Windows Dissected”
project. This project, funded by the BSI (German: “Bundesamt für Sicherheit in
der Informationstechnik” – the German Federal Office for Information Security),
has the goal to perform ” various in-depth security analyses of
security-critical components and functions in Windows.” Over the next years we
will discuss these results here once they are published.
Important note: Some media coverage on this topic falsely or inaccurately
depicts the attack conditions. To be clear: Any vulnerable device can be
compromised if the attacker is in Bluetooth range. That is the only
precondition.
During our research on Bluetooth headphones and earbuds, we identified several
vulnerabilities in devices that incorporate Airoha Systems on a Chip (SoCs). In
this blog post, we briefly want to describe the vulnerabilities, point out their
impact and provide some context to currently running patch delivery processes as
described at this year’s
TROOPERS Conference.
The X11 Window System has been used since September 1987 for Unix desktop
systems, allowing applications to display their windows. Today, one of the
server implementations of the protocol is the X.Org X server and XWayland, which
both use the same codebase. While reviewing the X server, several legacy
security issues were identified. These appear to originate from earlier design
stages when security considerations were less prominent. Despite the project’s
maturity and widespread use, some of these issues have persisted.
In a recent customer project, we discovered vulnerabilities in Microsoft
Bookings, an online appointment scheduling tool integrated into Microsoft 365,
allowing companies to have customers book meetings in available times
themselves. The findings originate from insufficient input validation on the
public meeting scheduling endpoint. Although Microsoft has largely mitigated
this vulnerability, our analysis provides important insights into potential
risks and areas for improvement.
Introduction & Context
Microsoft Bookings is a service that allows organizations to manage appointments
and meetings via a web interface. With integration to services such as Microsoft
Teams, the security of the booking process is critical. This blog post outlines
our technical analysis of the vulnerability, including proof-of-concept details
and an overview of the vendor response.
During a red-teaming-style customer project, we managed to get access to an
Rundeck API token. Rundeck is a job scheduler and
runbook automation platform designed to automate routine IT tasks across
multiple systems. At first, we were excited about this API token because if we
could create new Rundeck jobs, we could execute arbitrary code on the Rundeck
nodes and move laterally from there. However, it turned out that with this token
we only had permissions to run existing jobs.
We discovered a private key for accessing an IBM Hardware Management Console
(HMC) during a recent red team engagement. The IBM Hardware Management Console
(HMC) is a dedicated management system used to control and manage IBM servers,
especially those running on Power Systems (like IBM Power9/Power10) and
mainframes (z Systems). After brief research, we identified two security
vulnerabilities that can be leveraged to gain root access to the HMC.
Access for most users via SSH is limited through the hmcbash, a restricted
shell environment. Using LD_PRELOAD, attackers can break out of the restricted
bash and gain access to additional binaries installed on the system. With the
restrictions lifted, attackers can use a setuid binary, copysshkey, to
elevate privileges to root.
We recently conducted a security assessment of VMware Carbon Black Cloud, a
unified SaaS solution that integrates endpoint detection and response (EDR),
anti-virus, and vulnerability management capabilities. As part of our
evaluation, we tested the solution’s ability to detect and prevent malicious
activity on Windows and Linux systems. Our analysis focused on the Carbon Black
agents for these platforms, and although we did not identify any critical
vulnerabilities, we want to share some of the findings in this blog post.
As part of our research into
the Auracast feature set in Bluetooth, we also started looking into vendor
implementations. At the time we started with our research, there weren’t a lot
of products on the market yet. But new products are coming out pretty frequently
now.
One of the vendors that had Auracast implemented pretty early was Samsung. At
the time the Samsung Galaxy S23 and S24 phones were able to broadcast Audio,
while the Galaxy Buds were able to join these broadcasts.
Auracast, the new Bluetooth LE Broadcast Audio feature has gained some publicity
in the past months. The Bluetooth SIG has introduced the LE Audio feature-set to
the Bluetooth 5.2 Specification in 2019 and vendors are only now starting to
implement it. Auracast facilitates broadcasting audio over Bluetooth LE to a
potentially unlimited number of devices. It does not require pairing or
interaction between the sender and the receivers.
We also presented this topic
at 38c3.
This blog post will contain similar contents albeit with some more details.