During a customer project, we identified a logic flaw in
Jitsi Meet, an open-source video conferencing and
messaging platform for secure video conferencing, voice calls, and messaging.
The vulnerability affects password protected Jitsi meetings that make use of a
lobby. This logic flaw leads to the disclosure of the meeting password when a
user is invited to the call after waiting in the lobby.
Jitsi offers two security options to meeting moderators. Firstly, the meeting
can be assigned a password that must be entered when joining. Secondly, a lobby
mode can be activated, which first adds joining users to a lobby, from where
they can then be added to the meeting by a user with moderation permissions.
Recently, we held a talk at the Winterkongress1 of the Digitale Gesellschaft
Schweiz in Winterthur, Switzerland, about our research project on breaking
German parcel tracking sites. We could not name all the parcel services for
which we identified vulnerabilities respecting disclosure timelines. Today, we
describe our findings at GLS, another player in the German parcel market, and
the disclosure process of corresponding vulnerabilities.
Findings
Similar to the vulnerabilities previously disclosed for DHL2 and DPD3, and
UPS4, we identified that the GLS parcel tracking website discloses the
recipient’s geographic area by showing the name of the destination parcel
center. Furthermore, the recipient’s ZIP code was used to unlock personal
information (including the exact coordinates of the address) and features that
influence the parcel delivery process. The website did not implement
rate-limiting or other techniques to prevent brute-forcing ZIP codes using the
API.
The German Federal Office for Information Security (BSI – Bundesamt für
Sicherheit in der Informationstechnik) has published several papers ERNW created
as part of the long-term
SiSyPHuS Win10-Project.
This project focuses on system analysis of selected parts of the Windows 10
operating system performed by ERNW.
Analysis of the Application Compatibility Infrastructure (ACI):
In this work we present an overview of the ACI technology along with a technical
analysis of the compatibility protocol which is used first to determine if a
compatibility solution needs to be applied, and second, to apply said
compatibility solution. Furthermore, threats and mitigation in the context of
the technology are presented a long with a monitoring approach. Finally,
configuration and logging capabilities are discussed.
Today, we describe our findings at United Parcel Service of America, Inc. (UPS),
another German parcel market player, and the corresponding vulnerabilities’
disclosure process.
Findings
Only a valid tracking number is needed to get the personal information of a
parcel’s receiver, including the sender’s location, the recipient’s name, and
the recipient’s location (city and country). It was possible to enumerate
numerous tracking numbers during testing by iterating from known ones. Since the
last digit of a tracking number is a checksum, it can be calculated. Also,
certain businesses have a predefined prefix in their tracking numbers. This
schema allows the enumeration of every parcel sent from a particular business.
Dennis and I already published blog posts about our research project dealing
with vulnerabilities in parcel tracking implementations at
DHL
and DPD. At the
Winterkongress (winter
congress) in Winterthur, Switzerland, we had the great opportunity to give a
talk about the matter. The talk was recorded and can be watched
here.
DigiGes held the Winterkongress, which
took place in Winterthur on 01.03. till 02.03.2024. The main topics are ethics,
threats, and opportunities of IT. This year, many talks looked at AI in some
way.
This is the first blog post in a series about issues we think are currently
relevant in the field of AI-Security. The intention is not to get full coverage
of the topic, but to point out things that seem practical and relevant. We will
base some of our statements on lab setups and real-life examples. The technology
that we will focus on is chat bots based on generative AI, mainly OpenAI’s
ChatGPT. Right now, this specific application of AI in the wild seems to be the
best way to demonstrate issues and pitfalls when it comes to IT security.
In 2021, ERNW collaborated with
Hochschule Mannheim for their CEP (Cyber Security
Entwicklungsprojekt) to build an auditing framework for testing operating system
configurations against security procedures. This project is part of the
education program of the university to give the students the chance to utilize
the knowledge gained throughout the first semesters in a real world project.
ERNW posed as the fictitious customer, providing a requirements document and
regular meetings with all project groups for feedback. We planned to process and
adapt the results for an open source auditing framework. Unfortunately, we were
not able to finish this project yet, but we think the students should get some
attention for their work independent from our side. So here is a short summary
of what the students created and the corresponding repositories.
Two weeks ago, I was at the c0c0n conference in
Cochin (India). This conference is quite special for at least two
considerations. At first, this is – to the best of my knowledge – one of the few
conferences which officially brings together hackers, industrials, politics, and
security forces. This is not always obvious for all these different persons to
talk together, may be due to a lack of mutual understanding ?. But for a couple
of days, all of them meet, talk, exchange, and they share mutual needs and
appropriate solutions. And this may explain the second consideration, why c0c0n
is one of the oldest cyber security conferences in India (more than 15 years).
And yes, this is the conference where police forces directly pick you up from
the gates of your plane at airport, sitting you at the back of a police car to
drive you to your hotel with emergency lights ?
I was writing some challenges for PacketWars at
TROOPERS22. One was intended to be a JWT key confusion
challenge where the public key from an RSA JWT should be recovered and used to
sign a symmetric JWT. For that, I was searching for a library vulnerable to JWT
key confusion by default and found lua-resty-jwt. The original repository by
SkyLothar is not maintained and different from the library that is installed
with the LuaRocks package manager. The investigated library is a
fork of the original repository,
maintained by cdbattags in version 0.2.3 and was downloaded more than
4.8 million times
according to LuaRocks.
This blog post is the continuation of our parcel research. We already reported
about how we broke parcel tracking at
DHL
and the disclosure process of the identified problems. As DHL is not the only
parcel service in Germany, we also investigated the other available parcel
services. In this blog post, we want to talk about DPD, also called Geopost,
which belongs to the French Post Office.
Efficient Guessing of Tracking Numbers
DPD uses the recipient’s ZIP code to unlock detailed shipment information and
additional options. After trying some ZIP codes manually, we received CAPTCHA
prompts in the web interface (more on this later).