As part of our research into
the Auracast feature set in Bluetooth, we also started looking into vendor
implementations. At the time we started with our research, there weren’t a lot
of products on the market yet. But new products are coming out pretty frequently
now.
One of the vendors that had Auracast implemented pretty early was Samsung. At
the time the Samsung Galaxy S23 and S24 phones were able to broadcast Audio,
while the Galaxy Buds were able to join these broadcasts.
Auracast, the new Bluetooth LE Broadcast Audio feature has gained some publicity
in the past months. The Bluetooth SIG has introduced the LE Audio feature-set to
the Bluetooth 5.2 Specification in 2019 and vendors are only now starting to
implement it. Auracast facilitates broadcasting audio over Bluetooth LE to a
potentially unlimited number of devices. It does not require pairing or
interaction between the sender and the receivers.
We also presented this topic
at 38c3.
This blog post will contain similar contents albeit with some more details.
While conducting security research, I identified a critical vulnerability in
Kemp’s LoadMaster Load Balancer. This vulnerability is a
Command Injection
and allows full system compromise. It requires no authentication and can be
exploited remotely by having access to the Web User Interface (WUI). Kemp found
that all LoadMaster versions up to and including version 7.2.60.0 and also the
multi-tenant hypervisors up to and including version 7.1.35.11 are affected.
Kemp LoadMaster is a widely used Load Balancing Application that can commonly be
seen in customer engagements. Therefore, we decided to take a closer look as
part of our regular research projects.
During a penetration test for a customer, we briefly assessed
Vaultwarden, an open-source online
password safe. In June 2024, the German Federal Office for Information Security
(BSI) published results1 of a static and dynamic test of the Vaultwarden
server component. Therefore, only a partial source code audit was performed
during our assessment. However, a quick look was needed to find some glaring
issues with the authentication.
Vaultwarden
Vaultwarden is an alternative
online password safe server to Bitwarden and exposes the same API so that
Bitwarden clients can connect to the Vaultwarden server. Since Bitwarden has a
Browser client and Mobile clients, they can all connect to Vaultwarden, too.
Apple Automated Device Enrollment (ADE) is presented as a way to automate and
simplify the enrollment process of Apple devices within Mobile Device Management
(MDE) solutions. This blog post is aimed at organizations currently planning or
even already using this feature and making you, the reader, aware of potential
limitations of this process that might otherwise not be clearly addressed in
your companies’ device management process.
How Apple ADE Is Presented
Looking at the Apple Support pages today, Automated Device Enrollment is
described as a process that
Mobile Device Management (MDM) solutions are used to centrally manage mobile
devices in corporate environments. This includes the monitoring of the device,
automatic installation/removal of apps or certificates and restrict the
functionality. Even though MDM solutions exist for multiple vendors, we will
look specifically on Apple devices enrolled via Intune. When an Apple device is
registered for Automated Device Enrollment (ADE), it will automatically download
and apply these policies during the initial setup and prior to the first boot.
During my Bachelor’s thesis, I identified several XSS vulnerabilities and a PHP
Code Execution vulnerability via an insecure file upload in the learning
management system (LMS) ILIAS. The XSS vulnerability can be chained with the
code execution vulnerability so that attackers with tutor privileges in at least
one course can perform this exploit chain.
The Bachelor’s thesis was motivated by the ever-increasing number of compromised
universities in Germany1^(,)2^(,)3^(,)4^(,)5. The thesis analyzed
the importance of LMS systems in that context, as those services are often
exposed to the internet.
During a customer project, we identified a logic flaw in
Jitsi Meet, an open-source video conferencing and
messaging platform for secure video conferencing, voice calls, and messaging.
The vulnerability affects password protected Jitsi meetings that make use of a
lobby. This logic flaw leads to the disclosure of the meeting password when a
user is invited to the call after waiting in the lobby.
Jitsi offers two security options to meeting moderators. Firstly, the meeting
can be assigned a password that must be entered when joining. Secondly, a lobby
mode can be activated, which first adds joining users to a lobby, from where
they can then be added to the meeting by a user with moderation permissions.
Recently, we held a talk at the Winterkongress1 of the Digitale Gesellschaft
Schweiz in Winterthur, Switzerland, about our research project on breaking
German parcel tracking sites. We could not name all the parcel services for
which we identified vulnerabilities respecting disclosure timelines. Today, we
describe our findings at GLS, another player in the German parcel market, and
the disclosure process of corresponding vulnerabilities.
Findings
Similar to the vulnerabilities previously disclosed for DHL2 and DPD3, and
UPS4, we identified that the GLS parcel tracking website discloses the
recipient’s geographic area by showing the name of the destination parcel
center. Furthermore, the recipient’s ZIP code was used to unlock personal
information (including the exact coordinates of the address) and features that
influence the parcel delivery process. The website did not implement
rate-limiting or other techniques to prevent brute-forcing ZIP codes using the
API.
Today, we describe our findings at United Parcel Service of America, Inc. (UPS),
another German parcel market player, and the corresponding vulnerabilities’
disclosure process.
Findings
Only a valid tracking number is needed to get the personal information of a
parcel’s receiver, including the sender’s location, the recipient’s name, and
the recipient’s location (city and country). It was possible to enumerate
numerous tracking numbers during testing by iterating from known ones. Since the
last digit of a tracking number is a checksum, it can be calculated. Also,
certain businesses have a predefined prefix in their tracking numbers. This
schema allows the enumeration of every parcel sent from a particular business.