Harald Eilertsen

Sun, 20 Jan 2019 23:40:33 +0100 last edited: Sun, 20 Jan 2019 23:41:23 +0100

In the end I had a list of a little over 60 certificates that all used the same compromised key. These certificates were valid for DNS names of seemingly-unrelated customers, which ruled out the possibility that one customer simply reused their private key in different certificates. This made me curious to figure out the source of the compromise.

https://koen.io/2019/01/17/a-tale-of-private-key-reuse/

An interesting little detective story.

#security #pki #tls

Edit: Link!

Security

Debacle

Mon, 21 Jan 2019 08:53:08 +0100 from Diaspora

How about a link?

Harald Eilertsen

Mon, 21 Jan 2019 08:55:33 +0100

@Debacle It's in the edit (probably a separate post in diaspora.) And now also here: https://koen.io/2019/01/17/a-tale-of-private-key-reuse/

Debacle

Mon, 21 Jan 2019 22:09:11 +0100 from Diaspora

Thanks!

Security flaw in libssh leaves thousands of servers at risk of hijacking

Harald Eilertsen

Wed, 17 Oct 2018 09:09:29 +0200

https://www.zdnet.com/article/security-flaw-in-libssh-leaves-thousands-of-servers-at-risk-of-hijacking/#ftag=RSSbaffb68

An attacker can do this by sending the SSH server "SSH2_MSG_USERAUTH_SUCCESS" message instead of the "SSH2_MSG_USERAUTH_REQUEST" message that a server usually expects (...)

The vulnerability, which is tracked as CVE-2018-10933, was introduced in libssh 0.6.0, released in January 2014. The libssh team released versions 0.8.4 and 0.7.6 yesterday to address this bug.

Come on!

This is what happens when you don't test your protocol implementation. Good thing it only took four and a half year to discover. Sadly, that's two and a half years less than the average for zero-day exploits.

#security #zeroday #ssh #libssh

Security

Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489]

Harald Eilertsen

Mon, 03 Sep 2018 10:40:05 +0200

System broadcasts by Android OS expose information about the user’s device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, DNS server information and the MAC address. Some of this information (MAC address) is no longer available via APIs on Android 6 and higher, and extra permissions are normally required to access the rest of this information. However, by listening to these broadcasts, any application on the device can capture this information thus bypassing any permission checks and existing mitigations.

https://wwws.nightwatchcybersecurity.com/2018/08/29/sensitive-data-exposure-via-wifi-broadcasts-in-android-os-cve-2018-9489/

#android #vulnerability #security #privacy

Security

How I Hacked BlackHat 2018

Harald Eilertsen

Tue, 21 Aug 2018 21:47:15 +0200 last edited: Sun, 14 Oct 2018 19:47:17 +0200

During training at BlackHat this year I was getting frustrated with my badge and lanyard making noise around my neck in training, so I took it off and set it down on the table next to me. Later I set my phone on top of it and saw a notification to read the NFC tag. Out of curiosity I downloaded a tag reader app, looked at the data stored on my tag and made a few observations(...)

https://ninja.style/post/bcard/

Good thing it's fixed now, but you would expect BlackHat to be a bit more proactive with it's own security.

#blackhat #hacking #privacy

Security

Hardware back door in x86 cpus

Harald Eilertsen

Fri, 10 Aug 2018 09:28:44 +0200

The rosenbridge backdoor is a small, non-x86 core embedded alongside the main x86 core in the CPU. It is enabled by a model-specific-register control bit, and then toggled with a launch-instruction. The embedded core is then fed commands, wrapped in a specially formatted x86 instruction. The core executes these commands (which we call the 'deeply embedded instruction set'), bypassing all memory protections and privilege checks.

https://github.com/xoreaxeaxeax/rosenbridge

Seems to only affect a small number of cpus from VIA, but still interesting research.

#security #backdoor #cpu #hardware #x86

Security Hardware

Harald Eilertsen

harald@hub.volse.no