In this blog post, we are sharing summaries of talks from the Hack in the Box
Conference in Amsterdam (HITBSecConf2023), the final HITB conference in
Amsterdam. Before we do that, however, we would like to extend a heartfelt thank
you to the organizers of the conference for putting together such an insightful
and engaging event.
Dr. Bramwell Brizendine – Windows Syscalls in Shellcode: Advanced Techniques for Malicious Functionality
The talk by Bramwell Brizendine covered the topic of syscall usage in shell
code. The general idea here is to hide from AV/EDR systems by not using APIs
such as CreateProcessA, which may be monitored, but to directly call into the
corresponding kernel functions. This can be accomplished for example with the
syscall CPU instruction (see 1, 2 and 3 for more information). While
this technique is not perfectly stealthy and can still be detected (e.g., with a
kernel driver), it circumvents at least inline-hooks in user space. Another
downside is the effort of building shell code that directly uses syscalls.
Besides more overhead in preparing everything for the syscall (for example
manually creating appropriate structs), the correct syscall ID must be gathered,
which can change between kernel versions.
I am going to disclose two bug classes I found a while ago in CheckPoint R77.30:
Two buffer overflows in the username (no shit) and HTTP method of a request to
the administrative UI pre-auth and some interesting injections into the TCL web
interface.
Let’s start with the TCL part. The web interface reacted pretty weird when a
payload contained a colon. Diving deeper into this it became clear that a colon
would actually cause an error from the TCL interpreter. By going down this
rabbit hole and learning some TCL (:D) you could see that injecting a colon
breaks some part of the application code, probably because colons are control
characters in TCL e.g. preceding a global variable in TCL (::MyVar) or
separating namespaces.
Spymax is a mobile Remote Administration Tool (RAT) that enables an attacker to
control victims’ devices through an Android malware. Once the malware is
installed on a phone, the attacker can execute many attacks that highly impact
the confidentiality and integrity of the victim’s data, as well as the victim’s
privacy. It is powerful, widely available, and does not require root privileges
on the victim’s device. In this blogpost, I show the capabilities of this RAT
and analyze how its Android malware works.
Over the course of the last 2 years we performed vulnerability research on
several Endpoint Management & Monitoring Solutions. The results were already
partially presented in security advisories which were published on this blog
during the last two years. The advisories can be found here:
We also recently presented the results on
Troopers 2022.
Now the results have been published in a more in-depth manner in the form of a
technical whitepaper. The whitepaper can be found
here.
Updated on 20.06.22 with CVEs and link to Broadcom Security Notice.
In April 2021 we reported seven vulnerabilities in Broadcom Automic Automation
(UC4) 12.3.5+hf.3. CVE IDs were assigned on 16.06.22, the corresponding Broadcom
Security Notice can be found
here.
The vulnerabilities have been found in the course of a research project, in
which we analyzed the security of multiple Endpoint Management solutions.
Similar vulnerabilities have been found in other solutions as we pointed out in
previous posts about the
Ivanti DSM Suite,
Nagios XI,
and
Solarwinds N-Central.
The outcome of the research project will be published as a whitepaper and a
conference talk at
Troopers 2022.
Missing server-side validation consistently scores a place in the
OWASP Top 10. Browsers nowadays offer
a lot of ways to easily implement client-side controls, increasing the usability
by a lot. They automatically detect missing fields or invalid characters in your
input fields and may even validate user input against a regular expressions.
However, these controls should only be considered as usability features. When
sending data to a back-end system the application must always ensure data
integrity by implementing encodings, validations and filters. Even for small
applications this is a painful and tedious process. For each possible input,
developers together with security experts have to carefully identify the context
of each field, how the input is going to be used and what data requirements are
present.
In my ordinary life, I teach computer science at the University of Applied
Sciences in Mannheim but for some months, I was an intern at ERNW learning a lot
about IT security and penetration testing. One of these learnings is that old
protocols can be fun and breaking them even more. But let’s start at the
beginning of the story…
Using a static passkey for Bluetooth Low Energy pairing is insecure. Recent
versions of the Bluetooth specification contain an explicit warning about this.
However, in practice, we often see static passkeys being used. Moreover, there
are no public implementations of proofs-of-concept that can practically show why
using a static passkey is an issue. This is why we implemented one.
In a recent assessment, we were testing a device that offered a Bluetooth
interface for data export and configuration. This device uses Bluetooth Low
Energy (BLE), and a static passkey (or PIN) is required to pair with it. This
passkey is displayed for a few seconds when the device is booted and stays the
same on each reboot. In fact, it is derived from static, device-specific data.
I recently stumbled upon a strange behavior in my Firefox: I visited an
HTTPS-enabled website that I had visited before and saw that my Firefox
connected insecurely via HTTP. I found that strange because nowadays, most
websites set the
HSTS
header, which is supposed to force the browser to connect via HTTPS. I checked
whether this website set the HSTS header – and it did. This means my Firefox was
ignoring/forgetting about the HSTS header right after my visit.
In this post, we are discussing a bug we came across in Mesas llvmpipe Gallium3D
graphics driver. This bug was accessible through Chromium’s WebGL implementation
and can provide control of the program counter (pc) within Chromium’s GPU
process if llvmpipe is used. Llvmpipe is a software rasterizer that is used on
Linux if no hardware acceleration (graphics card) is available. This is a pretty
rare edge case as llvmpipe has no widespread use. An estimate by Google is that
approx 0.06% of the Chromium users are affected by this. However, as this is a
simple but valid Chromium bug, we want to give you a quick walkthrough. The
issue is tracked as
CVE-2021-21153
and was fixed in February 2020.