For the realization and introduction of autonomous vehicles, the safe
interaction of functions, systems and services as well as their monitoring over
the entire product life cycle is essential. An exclusive security-by-design
approach is no longer sufficient and must be continuously supported by feedback
obtained from in-the-wild operation. This is where the recently successfully
completed joint project BMBF UNCOVER comes into play, which targets the
requirements of the standards ISO/SAE 21434 (Road vehicles – Cybersecurity
engineering) and ISO 21448 (Road vehicles – Safety of the intended
functionality (SOTIF)).
are you curious about the agenda of the Active Directory- & Entra ID security
track at TROOPERS24? Here’s a sneak peak of the already published tracks:
The full conference agenda including timeslots will be published soon at
TROOPERS24. The trainings are
already sold out, but
a handful of tickets is currently left. Stay
tuned & make the world a safer place!
During my Bachelor’s thesis, I identified several XSS vulnerabilities and a PHP
Code Execution vulnerability via an insecure file upload in the learning
management system (LMS) ILIAS. The XSS vulnerability can be chained with the
code execution vulnerability so that attackers with tutor privileges in at least
one course can perform this exploit chain.
The Bachelor’s thesis was motivated by the ever-increasing number of compromised
universities in Germany1^(,)2^(,)3^(,)4^(,)5. The thesis analyzed
the importance of LMS systems in that context, as those services are often
exposed to the internet.
In this blog post, we quickly look into issues involving character devices. As
is typical for Linux, everything is a file, so character devices are referenced
as files, such as pseudo terminals (pts) under /dev/pts/. man pty briefly
introduces the topic. Essentially, it is used to connect a program, such as a
terminal emulator, to a shell. In the end, a pty can read and write like a
regular file. A colleague already brought up the topic of ptys and character
devices. But more recently a
Twitter post and
the
accompanying advisory
piqued my interest.
Google Play Protect is a built-in Android solution that enhances devices’
security. Its main job is to detect and block malware on Android devices.
Several malware families were known for bypassing Play Protect checks in recent
years. This brings us to an important question: “Is Google Play Protect a
Reliable Malware Detector?”. This blog post shows how Play Protect deals with
various Android malware in different scenarios. I deal with Play Protect as a
black box.
During a customer project, we identified a logic flaw in
Jitsi Meet, an open-source video conferencing and
messaging platform for secure video conferencing, voice calls, and messaging.
The vulnerability affects password protected Jitsi meetings that make use of a
lobby. This logic flaw leads to the disclosure of the meeting password when a
user is invited to the call after waiting in the lobby.
Jitsi offers two security options to meeting moderators. Firstly, the meeting
can be assigned a password that must be entered when joining. Secondly, a lobby
mode can be activated, which first adds joining users to a lobby, from where
they can then be added to the meeting by a user with moderation permissions.
Recently, we held a talk at the Winterkongress1 of the Digitale Gesellschaft
Schweiz in Winterthur, Switzerland, about our research project on breaking
German parcel tracking sites. We could not name all the parcel services for
which we identified vulnerabilities respecting disclosure timelines. Today, we
describe our findings at GLS, another player in the German parcel market, and
the disclosure process of corresponding vulnerabilities.
Findings
Similar to the vulnerabilities previously disclosed for DHL2 and DPD3, and
UPS4, we identified that the GLS parcel tracking website discloses the
recipient’s geographic area by showing the name of the destination parcel
center. Furthermore, the recipient’s ZIP code was used to unlock personal
information (including the exact coordinates of the address) and features that
influence the parcel delivery process. The website did not implement
rate-limiting or other techniques to prevent brute-forcing ZIP codes using the
API.
The German Federal Office for Information Security (BSI – Bundesamt für
Sicherheit in der Informationstechnik) has published several papers ERNW created
as part of the long-term
SiSyPHuS Win10-Project.
This project focuses on system analysis of selected parts of the Windows 10
operating system performed by ERNW.
Analysis of the Application Compatibility Infrastructure (ACI):
In this work we present an overview of the ACI technology along with a technical
analysis of the compatibility protocol which is used first to determine if a
compatibility solution needs to be applied, and second, to apply said
compatibility solution. Furthermore, threats and mitigation in the context of
the technology are presented a long with a monitoring approach. Finally,
configuration and logging capabilities are discussed.
Today, we describe our findings at United Parcel Service of America, Inc. (UPS),
another German parcel market player, and the corresponding vulnerabilities’
disclosure process.
Findings
Only a valid tracking number is needed to get the personal information of a
parcel’s receiver, including the sender’s location, the recipient’s name, and
the recipient’s location (city and country). It was possible to enumerate
numerous tracking numbers during testing by iterating from known ones. Since the
last digit of a tracking number is a checksum, it can be calculated. Also,
certain businesses have a predefined prefix in their tracking numbers. This
schema allows the enumeration of every parcel sent from a particular business.
Dennis and I already published blog posts about our research project dealing
with vulnerabilities in parcel tracking implementations at
DHL
and DPD. At the
Winterkongress (winter
congress) in Winterthur, Switzerland, we had the great opportunity to give a
talk about the matter. The talk was recorded and can be watched
here.
DigiGes held the Winterkongress, which
took place in Winterthur on 01.03. till 02.03.2024. The main topics are ethics,
threats, and opportunities of IT. This year, many talks looked at AI in some
way.