Hey there, for those of you that roll your eyes when writing the nth Information Disclosure Finding in a report, here is a short story of how such information helped compromising a system.
In a recent penetration we found a hidden debug page which disclosed information about internal parameters. Along with database connection strings and key material there was a username and a user home parameter disclosed on said debug page.
Continue reading Continue readingDuring a recent customer project we identified several vulnerabilities in the VMware vRealize Automation Center such as a DOM-based cross-site scripting and a missing renewal of session tokens during the login. The vulnerabilities have been disclosed to VMware on November 20th, 2017. A security advisory for the vulnerabilities has been made available here on April 12th, 2018.
Just a few words regarding the cross-site scripting vulnerability. This vulnerability is present within a GET request to the URL /vcac/gadgets/ifr because of certain URL parameters whose values are directly passed to an eval function call. The vulnerable parameters are gwt:onLoadErrorFn and gwt:onPropertyErrorFn. It seems that these parameters are actually never used by the application and we only found them by looking at the source code.
Continue reading Continue readingThis blogpost contains summaries of talks from this year’s TROOPERS18 Attack & Research Track.
USB is everywhere, your phone, gaming consoles, IoT waffle irons, you name it. Due to its’ widespread use in everyday life it is typically trusted by the user. And even if one wanted to find out what’s happening behind the scenes, surely digging into USB communication is too much of a chore to be worth the hassle, right? This talk by Kate Temkin and Dominic Spill are about to prove that very wrong with an impressive display of their tools GreatFET and Facedancer.
Continue reading Continue readingThis blogpost contains summaries of talks from this year’s TROOPERS18 Defense & Management Track.
The talk “All Your Cloud Belong Are Belong to Us” was held by
Nate Warfield, who is a Senior Security Program
Manager for the Microsoft Security Response Center (MSRC).
Before Microsoft he worked as a network engineer about 18 years and 10 of this
for a large amount of cell phone companies.
Nate gives an overview about the state of the cloud solution provided by
Microsoft, Azure, and how he hunts vulnerabilities in this environment.
Finally he concludes that the giving up your infrastructure to the cloud doesn’t
mean that you give up your responsibility.
This blogpost contains summaries of talks from this year’s TROOPERS18 Next Generation Internet Event.
Before his infosec career Graeme was a street performer, then security researcher, now he calls himself a defender. The talk was built around the following sentence: “The infosec industry and community have completely failed to create meaningful change in the behavior of people”.
The following example is a resume of how hacking worked from 1988 to 2017:
Continue reading Continue readingThis blogpost contains summaries of talks from this year’s TROOPERS18 SAP Security Track.
The Internet Graphics Server (IGS) is used to generate Web Based graphics from the SAP Web AS. Yvan Genuer looked at the security of an ancient component with very few public vulnerabilities available so far. In his talk he gave us insights on the structure of the IGS, its services, and problems he had when looking for documentation of the IGS and its components.
Continue reading Continue readingThis is the first post discussing talks of the Active Directory Security Track of this year’s Troopers which took place last week in Heidelberg (like in the last nine years ;-). It featured, amongst others, a new track focused on Microsoft AD and its security properties & implications. This was the agenda.
The idea for this special track was born out of two considerations:
As this was the first Troopers since its creation where I didn’t have any official roles and out of personal interest (in a very distant past I happened to be the co-author of the first German book on Windows NT4 Security) I decided to spend the majority of conference day 2 in the AD track. In hindsight I’m tempted to say that the track was a huge success: brilliant talks, pretty much always a packed room, and quite good discussions after the talks. (yes, of course I’m biased, what makes you think that?).
Continue reading Continue readingBirk an me basically fully disclosed a 0day in Squirrelmail yesterday. This is a short Q&A to answer the most common questions about the issue to calm you all down a little bit. 😉
What is the punchline, what do I need to know?
An attacker able to exploit this vulnerability can extract files of the server the application is running on. This may include configuration files, log files and additionally all files that are readable for all users on the system. This issue is post-authentication. That means an attacker would need valid credentials for the application to log in or needs to exploit an additional vulnerability of which we are not aware of at this point of time.
Continue reading Continue readingTROOPERS has a long history of theming the conference every year. Usually we pick a surreal topic, a fun story which we think is worth to pick up on. Some of it starts as a crazy thought, others have been the result of long discussions. Most of them are online, only our master piece from 2016 is securely stored in the company’s vaults.
However, this year was different. Traveling across the globe, speaking at and attending other conferences, connecting with our peers and the community, we felt that 2017 was a particularly tough year for many of us, both professionally and personally. There was this doom and gloom baseline to it.
Continue reading Continue readingRelated to our new TROOPERS workshop “Jump-Starting Public Cloud Security”, this post is going to describe some relevant components which need to be taken care of when constructing and auditing an Amazon Web Services (AWS) cloud environment. Those include amongst others the general AWS account structure, Identity and Access Management (IAM), Auditing and Logging (CloudTrail and CloudWatch), Virtual Private Cloud (VPC) networks, as well as S3 buckets.
The AWS IAM service is responsible for identity and access management (surprise!). This includes managing user accounts, defining password policies, and – most importantly – creating, defining, and assigning groups and roles.
Continue reading Continue reading