this blog post is about Server Side Template Injections for the Apache
Freemarker Template Engine, how to detect them, how to craft an exploit and what
countermeasures can be implemented. Server Side Template Injections are critical
because they often allow even Remote Code Execution, like the exploit of Apache
OFBiz 13.07.03 that triggered this post in the first place. It is fair to note,
that the exploit of Apache OFBiz requires a valid session with the server, but
often this is just an inconvenience for an attacker.
Ever got a backdoor installed on your computer by your beloved mouse? Here’s the
story of a poor mouse that got really, really sick.
Agent “Danger Mouse”
Do you remember the times where people put Teensy-boards and USB hubs in their
mouses? [Chris? ;)] Their aim was to attach an additional
Human Interface Device
(HID, like keyboards or mouses) with some payload in kind of e.g. keystrokes or
mouse movements. Also, there are devices available like the USB Rubber Ducky in
the housing of a USB thumb drive.
The principle is easy: The tools are using a programmable microcontroller with
the capability to emulate USB HID. That’s it. Just program your board of choice
with the payload fitting your needs and plug it in at the target computer. The
latter will recognize it as a keyboard/mouse and the payload-keystrokes will be
entered.
But why should external hardware be used? Many modern gaming peripherals provide
functions to store macros on them, including enough onboard memory for little
payloads.
In the context of a customer project, we examined a new variant of the Locky
ransomware. As in the meantime stated by a law enforcement agency, this has been
part of a large wave of attacks hitting various enterprises in the night from
Tuesday (2016-07-26) to Wednesday.
As an initial attack vector, the attackers use emails with an attachment that
probably even uses a 0day exploit, that enables the payload to be executed
already when displayed in the MS Outlook preview.
Some of us had the pleasure to visit this year’s REcon in
Montreal, Canada. Unfortunately, work caught us just when we arrived back in
Germany, so I haven’t had time to sit down and write down a few words so far.
However, we think that what we’ve experienced at REcon is worth writing about.
The overall quality of the speakers and talks were very nice. What really amazed
me was the art work of REcon:
As shown in previous blogposts we regularly work with GSM/GPRS basestations for
testing devices with cellular uplinks
or to simply run a
private network during TROOPERS.
Here the core difference between a random TROOPERS attendee and a device we want
to hack is the will to join our network, or not! While at the conference we hand
out own SIM cards which accept the TROOERPS GSM network as their “home network”
some device need to be pushed a little bit.
Every SIM card has it’s own home network, which is encoded in the fist five
(European standard) or six (North American standard) digits of its IMSI –
International Subscriber Number. The first three digits are the MCC, the Mobile
Country Code, the next two/three the MNC, Mobile Network Code. International
network overview are publicly available and for example
can be found >here<.
For instance, Germany has the MCC 262 and Vodafone Germany uses MNC 02. So a SIM
card with an IMSI starting with 26202 belongs to them.
Sticking to the settings in its own SIM card a device will always prefer to
connect to it’s own home network above all others. If the home network is not
available it will usually go for the strongest signal. To protect users from
unnecessary costs, an operator will usually add certain rules to prevent the
device from connecting to other networks in the same country. So if you’re an O2
customer in Germany, visit a shopping center and only have reception for a
T-Mobile cell, your phone will not directly jump into this network, even though
it’s the strongest signal source.
The moment, when your team leader asks you to cheat at Pokémon GO…everyone knows
it, right? No? Well, I do 😉
GPS Spoofing Setup
As I’m not a gamer, the technical part was of much more interest – that’s the
real gaming for me.
So, challenge accepted!
In the past I was often fiddling around with SDR (Software Defined Radio),
started with DVB-T sticks some years ago. When I came to ERNW in 2014 I got in
touch with
Michael Ossman’s great HackRF One for
the first time, and subsequently my thesis was based on SDR.
Jenkins is a continuous integration server, widely
used in Java environments for building automation and deployment. The project
recently disclosed an unauthenticated remote code execution vulnerability
discovered by Moritz Bechler. Depending on the development environment, a
Jenkins server can be a critical part of the infrastructure: It often creates
the application packages that later will be deployed on production application
servers. If an attacker can execute arbitrary code, s/he can easily manipulate
those packages and inject additional code. Another scenario would be that the
attacker stealing credentials, like passwords, private keys that are used for
authentication in the deployment process or similar.
This year I had the pleasure to join the guest day of BT’s SnoopCon. There were
quite a number of interesting talks throughout the day such as
Saumil Shah‘s presentation on Stegosploit
(as well as his rant about the state of information security)
Dr. Grigorios Fragkos‘ talk on airplane
security (where he presented some maybe not-so-pleasant but also some
good-to-hear facts on the security posture of airplanes)
Dominic Spill‘s demonstration of tools and
methods used to reverse engineer RF protocols
Hacker Fantastic‘s talk on how to use
the AX.25 protocol to bounce radio signals off the ISS to communicate with
systems around the world
Kostas Litovois’ and Vincent Yiu’s presentation on #WePWNise, a tool that can
be used to efficiently create malicious VBA macros (by taking EMET
configuration details into account)
Bryan Fite‘s talk on how we have to think
about Safety, Security, and Privacy in the IoT age.
I really enjoyed the talks and had a great time! Thanks to all the organizers
and speakers!
On the 8th of March SAP released the security note for a vulnerability we
reported during an assessment of a SAP landscape. The issue affects the SAP
NetWeaver Web Administration Interface. By knowing a special URL a malicious
user can acquire version information about the services enabled in the SAP
system as well as the operating system used. We wanted to share some details on
the issue.
The vulnerability is a bypass of the HTTP Basic Authorization for the
SAP Web Administration Interface.
It discloses version information about the system respectively operating system,
a brief SAP patch level overview and running services including their
corresponding ports.
In our talk
IMSEcure – Attacking VoLTE
Brian and me presented some theoretical and practical attacks against IP
Multimedia Subsystems (IMS). Some of the attacks already have been introduced in
a former
blogpost
and Ahmad
continued
with a deeper analysis of the Flooding and targeted DoS scenario. But still,
there are some open topics I’d like to continue with now. The methods I am
demonstrating here also help to get a better understanding of VoLTE/IMS and how
it is implemented on modern smartphones.
