We reported a possible Man-in-the-Middle (MitM) attack scenario in which
a VirtualService can redirect or intercept traffic within the service mesh.
This affects Namespace-based Multi-Tenancy clusters where tenants have the
permissions to deploy Istio resources (networking.istio.io/v1).
This blog post highlights the risks of using Istio in multi-tenant clusters and
explains how users can mitigate these risks and safely operate Istio in their
deployments.
There is a growing landscape of security products promising to protect an
organization’s IT infrastructure from attacks. Solutions referred to as EDR, and
sometimes also as XDR, are designed to protect endpoints from all malicious
activity. The ever-increasing cases of breaches and the associated costs,
especially in the realm of
ransomware attacks,
raise the question of whether there is more that can be done to add an
additional layer to traditional endpoint protection concepts. That is why a
customer of ours commissioned us to evaluate whether EDR supplementing solutions
provide extended protection against ever-evolving threats, as well as to shine a
light on the performance overheads those solutions might introduce.
When conducting pentests of Bluetooth devices or whilst working on Bluetooth
related research, we often use Bumble. In
this Blogpost I will present a solution to capture a live stream of Bumble
Bluetooth traffic in Wireshark.
Bumble is a fully featured Bluetooth stack, written entirely in Python. What
makes it extremely powerful for security assessments and research is the level
of control it provides. It can simulate certain conditions, including errors,
with a level of precision that most Bluetooth stacks don’t offer. However,
sometimes you not only need control, you also need visibility.
We are regularly offering a
GCP Incident Response and Analysis
training. In this training, we analyze resources in GCP cloud together with our
trainees that were successfully compromised by attackers, e.g., GCE instances
and Cloud Build projects. Therefore, we need tooling that quickly detects
misconfiguration of resources that helped the attacker during the compromise.
During the analysis of different tools and different kinds of misconfiguration
we realized that GCE instance access scopes are a blind spot of many (in fact
all that we tested) security audit tools. In this blog post, we want to
elaborate on the problems that arise from this behavior.
About six months ago we released a
security advisory
on this blog about vulnerabilities in Airoha-based Bluetooth headphones and
earbuds. Back then, we didn’t release all technical details to give vendors more
time to release updates and users time to patch their devices. Around the time
of the initial partial disclosure in the beginning of June, Airoha put out an
SDK release for their customers that mitigates the vulnerabilities. Now, half a
year later, we finally want to publish the technical details and release a tool
for researchers and users to continue researching and check whether their
devices are vulnerable.
Windows Hello for Business is a key component of Microsoft’s passwordless
authentication strategy. It enables user authentication not only during system
sign-in but also in conjunction with new and advanced features such as Personal
Data Encryption, Administrator Protection, and Recall. Rather than depending on
traditional passwords, Windows Hello leverages a PIN or biometric methods – such
as fingerprint or facial recognition – to unlock cryptographic keys protected by
the Trusted Platform Module (TPM).
During our recent research, we experimented with different Bluetooth USB
dongles. There are tons of options, and sometimes, it’s challenging to determine
what chipset a dongle actually contains, what Bluetooth features it supports,
and whether it works on Linux. Inspired by the recent
ESP32 Bluetooth research,
we wondered whether we could turn our Raspberry Pi Pico Ws into a functioning
Bluetooth dongle. We had a few lying around, and the advantage here is that we
know exactly which
Bluetooth controller it uses
– the Infineon CYW43439. It’s also very easy to get one. You can just buy the
Pico W for a few bucks, even cheaper than some Bluetooth dongles. You also have
a controller family that has been researched quite a bit in the
internalblue project. However,
there was one disadvantage. We did not find any code that exposes the CYW43439’s
HCI interface via USB. So we had to write that on our own.
Recently, one of our customers contacted us to investigate the extent of some
unwanted and unexpected behavior regarding browsing data of employees.
Employees started contacting IT support because private browser bookmarks,
private login credentials etc. showed up on their work machines. All affected
employees stated that they never created these bookmarks on work systems. And
interestingly, the data seemed to have been collected over quite some time.
Our customer wanted to understand how private data ended up in their
environment. Obviously, private employee data in the enterprise landscape could
cause some data privacy trouble (GDPR).
In a recent incident response project, we had the chance to virtually look over
the attackers’ shoulder and observe their activities. The attackers used the
Remote Desktop Protocol (RDP) for lateral movement within the compromized
environment and beyond (MITRE techniques
T1570,
T1021). As a matter of fact,
RDP creates cache files that contain tiles of the transferred screen recording
data. While this fact is well-known and there are existing tools, we found it
worth reporting because of two different aspects:
Auracast, the new Bluetooth LE Broadcast Audio feature has gained some publicity
in the past months. The Bluetooth SIG has introduced the LE Audio feature-set to
the Bluetooth 5.2 Specification in 2019 and vendors are only now starting to
implement it. Auracast facilitates broadcasting audio over Bluetooth LE to a
potentially unlimited number of devices. It does not require pairing or
interaction between the sender and the receivers.
We also presented this topic
at 38c3.
This blog post will contain similar contents albeit with some more details.