Credit card statement disclosure vulnerability in Viseca's eXpense portal

As a security company we try to use services that are solid, trustworthy and secure and therefore we do our due diligence if we find the time for it. Checking products for IT security issues in a non-intrusive way is a part of that. You can call it supply chain security if you like.

To avoid scanning credit card paper statements sent by snail mail every month, Pentagrid was looking for an option to receive them electronically. For our bank though, the only option was to sign up for Viseca's eXpense platform, which allows access to business credit card statements in PDF format. However, uppon login into the portal for the first time, our experienced analyst's gut feeling told us something is not right. For example, the second-factor authentication when doing a login on the eXpense platform was simply typing the last four digits of our telephone number. And that's definitely not state-of-the-art security.

We decided to have a quick look. Our experience in web application security analysis told us that the download function for PDF statements was a good candidate to have a look at. We've seen this kind of functionality fail in many applications before. You may guess, what happened.

Read more…

An open source SMS gateway for pentest projects

Accounts for mobile applications are often bound to phone numbers and working with multiple people on a project may make it necessary at some point to share mobile phone numbers for receiving SMS. Also, when testing mobile applications protected by a SMS-based second-factor authentication, sharing phone numbers among the testing team is sometimes necessary and also acceptable regarding security, when the scope is only a test system. At Pentagrid, we therefore operate a small SMS Gateway, which we hereby publish as open source.

Read more…

Shreddy2 – The Raspberry Pi storage scrub station for USB thumb drives

"Delete early, delete often" is the slightly adapted slogan reminding to minimize data leakage via lost or stolen USB thumb drives by frequently cleaning them. Are you tired of being focused to not accidentally erase the wrong USB device on your local computer when formatting an USB stick? To simplify the process, we implemented an USB eraser station software, which runs on a Raspberry Pi and that cleans USB sticks. Therefore, shreddy, ready, go!

Read more…