This article is about the massive BSOD triggered by CrowdStrike worldwide on
July 19. Analysis and information from CrowdStrike or other sources are
regularly published, completing what is expressed here. Updates may also be
provided in the future.
Friday, July 19, is a day to be remembered in computing history as the day of
one of the biggest BSODs (Blue Screens of Death). We have seen air traffic come
to a standstill over the USA and people climbing ladders with USB sticks to
update giant screens. The impact was still measurable over many days. The
question on everyone’s lips is how that all happened. CrowdStrike provided, on a
regular basis, an explanation for people to understand what happened. But
explanations can be hard to understand, especially for one who would like to
read directly within CrowdStrike’s internal wording in their publications and
regarding technical driver implementation details. Also, the analysis misses
some points we consider relevant for secure software development. This article
discusses conclusions from this massive crash, especially the necessity to
change our mindset about software. This means we should understand, document,
and evaluate independently software provided by vendors to know exactly what we
install on our systems and to figure out the risk that may be taken by using the
software. The time of naive belief in software magic must end with a third
party’s independent review of the software, analysing its reliability, security,
and stability. This is an activity we have been doing at ERNW for years,
especially for e.g. the German Federal Office for Information Security
(BSI)1.
Mobile Device Management (MDM) solutions are used to centrally manage mobile
devices in corporate environments. This includes the monitoring of the device,
automatic installation/removal of apps or certificates and restrict the
functionality. Even though MDM solutions exist for multiple vendors, we will
look specifically on Apple devices enrolled via Intune. When an Apple device is
registered for Automated Device Enrollment (ADE), it will automatically download
and apply these policies during the initial setup and prior to the first boot.
For the realization and introduction of autonomous vehicles, the safe
interaction of functions, systems and services as well as their monitoring over
the entire product life cycle is essential. An exclusive security-by-design
approach is no longer sufficient and must be continuously supported by feedback
obtained from in-the-wild operation. This is where the recently successfully
completed joint project BMBF UNCOVER comes into play, which targets the
requirements of the standards ISO/SAE 21434 (Road vehicles – Cybersecurity
engineering) and ISO 21448 (Road vehicles – Safety of the intended
functionality (SOTIF)).
are you curious about the agenda of the Active Directory- & Entra ID security
track at TROOPERS24? Here’s a sneak peak of the already published tracks:
The full conference agenda including timeslots will be published soon at
TROOPERS24. The trainings are
already sold out, but
a handful of tickets is currently left. Stay
tuned & make the world a safer place!
During my Bachelor’s thesis, I identified several XSS vulnerabilities and a PHP
Code Execution vulnerability via an insecure file upload in the learning
management system (LMS) ILIAS. The XSS vulnerability can be chained with the
code execution vulnerability so that attackers with tutor privileges in at least
one course can perform this exploit chain.
The Bachelor’s thesis was motivated by the ever-increasing number of compromised
universities in Germany1^(,)2^(,)3^(,)4^(,)5. The thesis analyzed
the importance of LMS systems in that context, as those services are often
exposed to the internet.
In this blog post, we quickly look into issues involving character devices. As
is typical for Linux, everything is a file, so character devices are referenced
as files, such as pseudo terminals (pts) under /dev/pts/. man pty briefly
introduces the topic. Essentially, it is used to connect a program, such as a
terminal emulator, to a shell. In the end, a pty can read and write like a
regular file. A colleague already brought up the topic of ptys and character
devices. But more recently a
Twitter post and
the
accompanying advisory
piqued my interest.
Google Play Protect is a built-in Android solution that enhances devices’
security. Its main job is to detect and block malware on Android devices.
Several malware families were known for bypassing Play Protect checks in recent
years. This brings us to an important question: “Is Google Play Protect a
Reliable Malware Detector?”. This blog post shows how Play Protect deals with
various Android malware in different scenarios. I deal with Play Protect as a
black box.
During a customer project, we identified a logic flaw in
Jitsi Meet, an open-source video conferencing and
messaging platform for secure video conferencing, voice calls, and messaging.
The vulnerability affects password protected Jitsi meetings that make use of a
lobby. This logic flaw leads to the disclosure of the meeting password when a
user is invited to the call after waiting in the lobby.
Jitsi offers two security options to meeting moderators. Firstly, the meeting
can be assigned a password that must be entered when joining. Secondly, a lobby
mode can be activated, which first adds joining users to a lobby, from where
they can then be added to the meeting by a user with moderation permissions.
Recently, we held a talk at the Winterkongress1 of the Digitale Gesellschaft
Schweiz in Winterthur, Switzerland, about our research project on breaking
German parcel tracking sites. We could not name all the parcel services for
which we identified vulnerabilities respecting disclosure timelines. Today, we
describe our findings at GLS, another player in the German parcel market, and
the disclosure process of corresponding vulnerabilities.
Findings
Similar to the vulnerabilities previously disclosed for DHL2 and DPD3, and
UPS4, we identified that the GLS parcel tracking website discloses the
recipient’s geographic area by showing the name of the destination parcel
center. Furthermore, the recipient’s ZIP code was used to unlock personal
information (including the exact coordinates of the address) and features that
influence the parcel delivery process. The website did not implement
rate-limiting or other techniques to prevent brute-forcing ZIP codes using the
API.
The German Federal Office for Information Security (BSI – Bundesamt für
Sicherheit in der Informationstechnik) has published several papers ERNW created
as part of the long-term
SiSyPHuS Win10-Project.
This project focuses on system analysis of selected parts of the Windows 10
operating system performed by ERNW.
Analysis of the Application Compatibility Infrastructure (ACI):
In this work we present an overview of the ACI technology along with a technical
analysis of the compatibility protocol which is used first to determine if a
compatibility solution needs to be applied, and second, to apply said
compatibility solution. Furthermore, threats and mitigation in the context of
the technology are presented a long with a monitoring approach. Finally,
configuration and logging capabilities are discussed.