Shreddy2 – Ein Raspberry Pi als Löschstation für USB-Sticks

"Delete early, delete often" ist das leicht abgewandelte Motto, dass daran erinnert, Datenlecks durch verlorene oder gestohlene USB-Sticks mittels regelmäßigem Löschen zu minimieren. Sind Sie es leid, beim Formatieren eines USB-Sticks auf Ihrem lokalen Computer darauf zu achten, nicht versehentlich das falsche Gerät zu löschen? Um den Vorgang zu vereinfachen, haben wir eine USB-Löschstation als Software auf einem Raspberry Pi implementiert. Die Software wartet drauf, dass ein USB-Stick angeschlossen wird. Der wird dann bereinigt. Also: shreddy, ready, go!


Password reset code brute-force vulnerability in AWS Cognito

The password reset function of AWS Cognito allows attackers to change the account password if a six-digit number (reset code) sent out by E-mail is correctly entered. By using concurrent HTTP request techniques, it was shown that an attacker can do more guesses on this number than mentioned in the AWS documentation (1587 instead of 20). If the attack succeeds and the attacked accounts do not have multi-factor authentication enabled, a full take-over of the attacked AWS Cognito user accounts would have been possible. The issue was fixed by AWS on 2021-04-20.


Burp Suite - solving E-mail and SMS TAN multi-factor authentication with Hackvertor custom tags

Why bother investing time to automate work when doing IT security testing? On one hand, manual testing is a tedious work, where you spend time doing vulnerability tests that could be done by a machine. On the other hand, letting a machine decide fully on its own on how to do tests will mostly result in the machine doing nothing useful. This is especially true for security testing, where manually checking every parameter for injection attacks is very laborious and automated security scanners go on scanning for hours while a human would have aborted the scan for various reasons. However, if we teach automated tools to do things correctly each time, we get the sweet middle spot of semi-automated security testing, where the tools do the automatic and systematic security tests and the analyst can focus on the parts of a security test, where the tools are likely insufficient.

Burp Suite Pro is one of the main tools to do all kind of HTTP related security analysis and that supports a semi-automated testing. But now and then it lacks certain features. Burp extensions can again add some of them. In this post we would like to show how to use one of the most powerful extensions, Hackvertor by Gareth Hayes and its relatively new feature of Python scripting.


"SCS in a nutshell"-Interview über Penetrationstests versus Bug-Bounty-Programme

Christian Folin vom Swiss Cyber Storm lud den freiberuflichen Bug-Bounty-Jäger Raphaël Arrouas und den IT-Sicherheitsanalysten Tobias Ospelt von der Pentagrid AG zu einem Interview über Vor- und Nachteile von Penetrationstests und Bug-Bounty-Programmen ein. Das Interview fand im Rahmen des Formats "SCS in a nutshell" statt. Während beide Ansätze valide Methoden für das Testen auf Sicherheitsproblemen sind, unterscheiden sie sich auch in vielen Aspekten.


Local Privilege Escalation in many Ricoh Printer Drivers for Windows (CVE-2019-19363)

Pentagrid has been asked to manage the coordinated disclosure process for a vulnerability that affects several Windows printer drivers for a wide range of printers by the printer manufacture Ricoh. Due to improperly set file permissions of file system entries that are installed when a printer is added to a Windows system, any local user is able to overwrite program library files (DLLs) with own code.


Fuzzing Java with JQF

As we mentioned in our our last blog post, Tobias Ospelt of Pentagrid AG lately broke down the idea of Java fuzzing with JQF into simple steps and presented it at Swiss Cyber Storm in Bern, Switzerland and at the Black Alps conference in Yverdon-Les-Bain, Switzerland. The recordings of the talks are not online, yet. (Update: Now they are vailable via the Swiss Cyber Storm channel on YouTube.)

We wanted to describe our work in written form as well, so you get a better idea of what can be done by fuzzing Java with JQF. It also allows you to copy and paste commands if you want to try it yourself. We also uploaded the talk slides as a PDF and the video with the JQF tutorial and Bouncycastle ASN.1 parser fuzzing run, which were shown during the talks.


Fuzzing Java with the Help of JQF Talks

Lately at Pentagrid AG we have been doing research into Java fuzzing. While the ideas of what kind of security vulnerabilities can be found came up already before Pentagrid AG was founded (blog post over in Tobias Ospelt's blog: Java Bugs with and without Fuzzing – AFL-based Java fuzzers and the Java Security Manager), a lot of new research was done in the meantime. While most fuzzers that Tobias evaluated back then didn't really move on until today, the JQF fuzzer took a big leap forward. We strongly recommend trying JQF.

Tobias broke down the process of Java fuzzing into simple steps and presented it at Swiss Cyber Storm mid October 2019 in Bern, Switzerland. While the recording is not published on Youtube yet, you can still grab a ticket for the Black Alps 2019 security conference in Yverdonne-Les-Bain, Switzerland during 07 and 08 November 2019, where he is going to present his findings as well.

JQF's capabilities are really impressive. Stay tuned for a more detailed blog post here after the Blackalps talk.

Update: The recording of the talk at Blackalps is now online.