HackDefense Publications.

In this blogpost Stan Plasmeijer and Jony Schats will describe the vulnerabilities discovered in the AK-EM100 controller. This blogpost won’t include a proof of concept of the atttacks since there are still devices connected to the internet and the vulnerabilities discussed are of high risk. The AK-EM100 is a physical device and provides a web based graphical user interface of a store which allows a range of daily users to monitor data, alarms and reports, either locally or remotely, regarding all of their refrigeration equipment.

A possible first step for a cybercriminal is to gain access to a user’s workstation or laptop. Cybercriminals use various attack vectors to do so. To reduce the chances of a successful attack, Microsoft introduced Attack Surface Reduction (ASR) rules. These rules improve the security of a system, making it harder for an attacker to gain access.

The Windows operating system includes by default an administrator account for management purposes whose password is the same in many environments on multiple systems.

When testing Windows environment, we regularly see the encrypted password of a user with high privileges being sent accros the network. In combination with systems where SMB signing is disabled, an attacker or malicious person can, by performing an NTLM relay attack, increase the privileges within the network. Depending on the network environment an attacker may be able to increase privileges to the highest level. 

What is missing in much of the advice about how to remediate/​mitigate the Log4J vulnerability Log4Shell (CVE-2021 – 44228) is firewalling. If you apply proper filtering on outgoing traffic, your problem becomes a lot less urgent.

A lot of modern web applications still use XML for transportation and storage of data. In 1996 the World Wide Web Consortium (W3C) created this standard and to this day, it is used for a wide variety of implementations. XML has many features that developers are not always familiar with, offering hackers an opportunity for abuse.

I’ve been looking into the MySQL authentication protocol for my thesis. In this research I looked into the implementation used in OpenCanary. This is a honeypot written in Python created by Thinkst. During testing I noticed a small difference in the error returned by Mysql and by OpenCanary which made me curious.

A first step any hacker has to take in an attack on a company network is to get access to a regular user account. Sadly, we often see that this is not very difficult due to the insecure use of passwords in customer networks. We even see bad passwords on administrative and service accounts. In short: organisations — all of them — struggle with the use and management of passwords. What can be done?

Wei Liu (刘炜) of Tencent Security Xuanwu Lab discovered an interesting issue in libexif: the code checked for an integer overflow when handling a field in EXIF files, but that check was silently removed by the compiler.

System administrators frequently store passwords for non-personal accounts in the Description field of the account. Very convenient — other administrators will be able to use this account too. However, this field is readable by all users by default in Active Directory.

At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three (severe) vulnerabilities. We reported these vulnerabilities to the vendor. Unfortunately, the DAViCal project itself was not able to fix these vulnerabilities. As DAViCal is an open source project we decided to contribute patches for these vulnerabilities ourselves. DAViCal has accepted our patches in the 1.1.9.2 release. If you use DAViCal as a calendaring server, we recommend upgrading to version 1.1.9.2 immediately to remediate the issues we’ve discovered.

At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three (severe) vulnerabilities. We reported these vulnerabilities to the vendor. Unfortunately, the DAViCal project itself was not able to fix these vulnerabilities. As DAViCal is an open source project we decided to contribute patches for these vulnerabilities ourselves. DAViCal has accepted our patches in the 1.1.9.2 release. If you use DAViCal as a calendaring server, we recommend upgrading to version 1.1.9.2 immediately to remediate the issues we’ve discovered.

At HackDefense, we were evaluating various calendaring solutions, and during installation and configuration of DAViCal we discovered three (severe) vulnerabilities. We reported these vulnerabilities to the vendor. Unfortunately, the DAViCal project itself was not able to fix these vulnerabilities. As DAViCal is an open source project we decided to contribute patches for these vulnerabilities ourselves. DAViCal has accepted our patches in the 1.1.9.2 release. If you use DAViCal as a calendaring server, we recommend upgrading to version 1.1.9.2 immediately to remediate the issues we’ve discovered.

On January 2020, official security support for Windows 7 and Windows Server 2008 will end. This poses major security risks. Therefore, make the switch to Windows 10 and Windows Server 2019 now.

Most vulnerability scans and pentests produce many findings related to SSL (TLS). Because cryptograhpy is complex and the requirements change quickly. But how do you set up your server so that at least no outdated versions or weak encryption is running? And what is reasonable compromise to not lose visitors with slightly older browsers?

During his research on the potential use of DCOM for lateral movement in Windows networks, our very talented intern Axel Boesenach discovered that the Apache UNO API (used by both OpenOffice and LibreOffice in so-called ​‘office server’ mode) allows anyone to send it system commands, without any form of authentication, and it will execute the command with the rights of the user running OpenOffice or LibreOffice in ​‘office server’ mode.

During my internship at HackDefense I researched lateral movement techniques using the Distributed Component Object Model (DCOM), the built-in system to call software over the network from one Windows system to another. During my research I was looking at the Apache LibreOffice project to see if they had any DCOM functionalities implemented. What I found was not a DCOM functionality but an API with functionalities to remotely execute code.

Research project into lateral movement techniques using the Distributed Component Object Model (DCOM), the built-in system to call software over the network from one Windows system to another. Part of this project was creating a script to enumerate DCOM objects that can be abused for lateral movement.

Recently we came across some Linux systems still supported by Long Term Support (LTS) but running a weak Secure Shell (SSH) server configuration. By further digging into this matter, we discovered that this is the default setup for these systems. In this blog we’ll show you how you can harden the SSH daemon running on these systems.

Recently we’ve recommended to more and more of our customers that they set up a Content Security Policy alongside the usual security headers. In this blog we dive deeper into that topic: where does this new standard originate from? Why would you like to use one? How do you set one up? And how does CSP relate to other, similar standards?

Today, details were rushed out regarding two serious vulnerabilities that might enable a determined attacker to decrypt users’ encrypted e‑mails. Not just current ones, but older e‑mails too. Doesn’t that sound alarming?

On a pentest for a client we discovered a way to obtain information about a web application’s internal structure from the network. We reported the issue to the vendor and a fix was released. The following security advisory details the vulnerability and how to resolve it.

Voor de viering van Leids Ontzet zette de politie o.a. een speciale app in om de drukte in de stad onder controle te houden. Het publiek werd gevraagd om de app te installeren op de smartphone en om de app toegang te geven tot locatiegegevens. Het lijkt erop dat dezelfde app is ingezet voor Koningsdag, de Gay Pride in Amsterdam en de Vierdaagse in Nijmegen — de app bevat van dit laatste ook nog sporen. QCSec testte de privacy en veiligheid van de app en vond opmerkelijke resultaten. Derden kunnen eenvoudig ​‘meelezen’ met de communicatie tussen de app en de politie, en kunnen zelfs de berichten manipuleren die aan het publiek worden verzonden. De privacy is niet gewaarborgd, en er kunnen gevaarlijke situaties ontstaan als iemand hier misbruik van zou maken.