Taking a look at the
CVE List for WordPress,
most vulnerabilities aren’t found within the WordPress core but inside of
third-party plugins and themes.
Today, let’s talk about WordPress.
Performing a WordPress assessment might seem boring at first as core
functionality [tested] and configuration does not allow for extensive security
misconfigurations. Luckily, most instances use plugins and themes to add
features not offered by the WordPress core.
In this blog post I would like to discuss the findings and how I discovered
them. Also, I will describe different vendor responsiveness reaching from not
responding at all, to not understanding the issue to fast and professional
responses kindly asking for a review of the updated code ready for deployment.
This blogpost is about the release of a plugin for Binary Ninja that allows you
to run a Python Kernel inside the Binary Ninja GUI environment to which you can
attach a Jupyer (QT) console, formerly known as IPython shell. The first section
is about why this is useful, the second is about some issues I encountered and
how to solve them, and the third contains everything you need to know to set it
up.
Gender equality in the Infosec world as a topic of discussion comes with a lot
of heated arguments and differences in opinion.
So let me start with some disclaimers on the target audience for this post. If
you are in the category who believes everything about gender is perfect in the
infosec world, this post is not for you. If you are in the category who believes
gender and bringing diversity is not your area of interest, then this post is
not for you either. There are so many interesting problems that the world offers
you. Climate change, poverty, diseases, unemployment, addiction, science
problems and what not. Everybody has the freedom to choose their area of
interest and contribute towards it. If you are in the category who thinks gender
equality in infosec needs some attention and would like to explore more on the
topic without prejudices, then this post may be interesting to you.
Some weeks ago, I tweeted about grabbing clipboard content from KeePass with
some PowerShell. From some reactions to this tweet, and after reading it a
couple of times again, I realize it was sending the wrong message, and I would
like to take a bit more than 280 chars to clarify what I meant when I posted
that tweet…
TLDR: Password managers are a must, not using one exposes you to far more risks
than using one. Do it.
When I recently joined the Windows Security team at ERNW, Enno asked me if I
wanted to write a ‘welcome’ blogpost on a topic of my choosing… Up for the
challenge, and since I had been playing with BloodHound & Cypher for the last
couple of months, I first thought I would do something on that topic.
However, after gathering my thoughts and some Cypher I had collected here and
there, I realized that the topic of Bloodhound Cypher might actually require
several blog posts… And so I changed my mind. I will keep the joys of Cypher for
later, and in this post, I will talk about a tiny tool I wrote to query the
Mitre ATT&CK™ knowledge base from the comfort of a PowerShell prompt.
In Mai 2018, Tobias and me were in Cologne at the Building IoT conference. The
topics of the talks covered a broad spectrum of the Internet of Things field.
There were three tracks covering different topics ranging from the jungle of IoT
protocols, secure Linux hypervisors specially developed for IoT modules to
machine learning and blockchain.
In “How to secure over the air updates” the speaker showed how to securely
deploy updates over the standard communication channel to the target device.
Many consumer IoT devices have a short support for updates if they get any
updates at all. This leads and in the future will lead to bad news like botnets,
bricked devices and exploited IP cameras streaming publicly. Therefore, a patch
and vulnerability management is required – especially in industrial Internet of
Things devices. Some updates have to be performed over the air due to the
physical inaccessibility of some IoT devices in production environments. There
are two possibilities to update such systems: First, a rescue OS (Operating
System) boots and overwrites the existing production OS. The second option is a
redundant OS, which copies the updates to the inactive OS and reboots to that.
I had the pleasure to give a presentation at the
Security Interest Group Switzerland Technology Conference
about modern application stacks and how they can be used to improve
infrastructure and application security posture – the slides can be found
here.
Besides seeing a lot of old friends, I
particularly enjoyed a round table discussion on security integration into CI/CD
pipelines. There was a relevant exchange on approaches that actually work and
were tested in environments beyond just recommending some container scanner
(product). One participant had an interesting case study on how they enabled
developers to maintain WAF policies in configuration files in their code
repository including automated deployment to the WAF. He also emphasized that
the environments with actual security benefits resulted from a close cooperation
between development and security team (were domain knowledge was combined 😉 ).
After quite some time and work, I’m happy to announce the new release of the
LinuxHeapAnalysis
Plugins, which are now part of the Rekall
project, but not yet part of an official Rekall release, so you have to grab
them manually.
This release fixes several bugs and adds the following features:
Support for Glibc version 2.26 (tcache chunks) and 2.27
Heapsearch now includes Rekall’s yara scan functionality
x86 Glibc versions with a modified MALLOC_ALIGNMENT value of 16 (as done in
arch’s glibc package 2.26) are now supported
Improved retrieval of main_arena and new automated retrieval of malloc_par
struct; so for the majority of cases, the corresponding cmd line options are
not necessary anymore and hence no debug information have to be retrieved.
main_arena and malloc_par struct retrieval now also applies for statically
linked binaries; there might however be cases, where it is necessary to
specify the malloc_par struct offset and the used glibc version number
While Glibc version 2.27 does not really change much for the heap from a
forensics point of view, version 2.26 introduced a new feature called tcache
(per thread cache). Those caches are essentially just a new type of bin, holding
freed chunks, but
seem to improve the performance.
Sadly,
only two days after its
first commit,
there was already a blog post explaining
the functionality (not so sad 😉 ) and also some discovered vulnerabilities
(here we go with the sad part).
Besides introducing a new landscape for attackers, this feature added two new
heap management structs and one additional chunk per thread-heap (each thread
has its own heap, up until an upper limit). This chunk is located at the
beginning of each heap and hence, part of a raw heap dump (so be aware of that,
if you are doing a raw analysis without the plugins).
The chunk holds the content of the tcache_perthread_struct, which has to
members:
IoT is everywhere right now and there are a lot of products out there. I have
been looking at an IP Gateway lately and found some serious issues. The
Busch-Welcome IP-Gateway from Busch-Jaeger
is one of the devices that bridges the gap between sensors and actors in your
smart home and the network/Internet. It enables the communication to a door
control system that implements various smart home functions. The device itself
is offering an HTTP service to configure it, which is protected by a username
and password. Some folks even actually expose the device and its login to the
Internet. I tried to configure one of these lately and stumbled upon some
security issues that I would like to discuss in this blog post.