SEC Consult is a security consultancy whose blog publishes vulnerability research on email, embedded devices, certificates, Windows tricks and fuzzing.
HN links it for the SMTP smuggling research and device vulnerabilities; one commenter criticizes its handling of a disclosure by deferring to Cisco and CERTs.
"Generating Software Tests" (https://www.fuzzingbook.org/) is pretty great (independent of your programming language) - arguably a must read for anyone interested in software testing.
John Regehr (the author of the blog post) has written more great posts:
- How to Fuzz an ADT Implementation - https://blog.regehr.org/archives/896
- Better Random Testing by Leaving Features Out - https://blog.regehr.org/archives/591
- Tricking a Whitebox Testcase Generator - https://blog.regehr.org/archives/672
- Fuzzers Need Taming - https://blog.regehr.org/archives/925
- Levels of Fuzzing - https://blog.regehr.org/archives/1039
- API Fuzzing vs. File Fuzzing: A Cautionary Tale - https://blog.regehr.org/archives/1269
- Reducers are Fuzzers - https://blog.regehr.org/archives/1284
In terms of software, DeepState (https://github.com/trailofbits/deepstate) may be a good place to start for C and C++. Relevant links:
- Fuzzing an API with DeepState: https://blog.trailofbits.com/2019/01/22/fuzzing-an-api-with-deepstate-part-1/, https://blog.trailofbits.com/2019/01/23/fuzzing-an-api-with-deepstate-part-2/
- NDSS 18 paper, "DeepState: Symbolic Unit Testing for C and C++": https://www.cefns.nau.edu/~adg326/bar18.pdf
In terms of choosing among fuzzing solutions,
https://blog.trailofbits.com/2018/10/05/how-to-spot-good-fuzzing-research/ is also worth a read -- as well as the article it refers to, http://www.pl-enthusiast.net/2018/08/23/evaluating-empirical-evaluations-for-fuzz-testing/. For a…
In a world where users should have control over their own computers, it is the customer who should have SSH access, not AT&T. But as you all know, most times the customer does not own the modem. One well-known workaround is for the customer to use their own modem or to use their own router as a gateway to the modem. But does this really give the user more contorl over the modem/router?
These user-owned modems/routers usually do not encourage SSH access by the user, if they even provide it. Instead they promote a "web interface". Indirect control of the settings. Better than SSH? That is for you to decide.
The "market" seems to love the "web interface". But this often the easiest vector for successful attacks. Less control, and less safety. Is the tradeoff still worth it? That is for you to decide.
https://threatpost.com/vulnerability-disclosed-in-ubquiti-networks-admin-interface/124392/
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170316-0_Ubiquiti_Networks_authenticated_command_injection_v10.txt
http://www.securityweek.com/worm-infects-many-ubiquiti-devices-old-vulnerability
Relying on "Keep up to date with patches" or "Enable updates" as a strategy to improve the safety of a product that was unsafe to begin with is a bit of cognitive dissonance given that its safety was deemed "good enough" for the renter/purchaser at the time of rental/purchase. To achieve a safer product requires not only manufacturers to set new priorities…
The article doesn't mention possible security implications. However, we already get lots of vulnerabilities exactly _because_ implementations disagree on delimiters. Examples for this are HTTP request smuggling[1, 2, 3] and SMTP smuggling[4].
As the references show, this is already a big source of vulnerabilities - trying to push for a change in standards would likely make the situation much worse. At the very least, old unmaintained servers will not change their behavior.
I think we should accept that this ship has sailed and leave existing protocols alone. Mandate LF and disallow CRLF in new protocols, that's fine, but I don't think we should open this particular Pandora's Box.
[1] Simple example that doesn't use CRLF/LF disagreement: https://portswigger.net/web-security/request-smuggling
[2] Complex example that uses CRLF/LF disagreement: https://portswigger.net/web-security/request-smuggling/advanced (see heading 'Request smuggling via CRLF injection')
[3] Random report on HackerOne I found where allowing LF created a vulnerability in NodeJS: https://hackerone.com/reports/2001873
[4] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
> Has Level 2 been cracked?
It's tricky because you have to chain multiple exploits, but yes. You can temporarily downgrade from RDP2 to RDP1 via glitching. At that point, you have to move directly into RDP1 techniques without causing a reset.
The protection levels are set in the RDP register. [listed out of order...] Level 0 = 0xAA, Level 2 = 0xCC, Level 1 = anything else. Flip just a single bit and you get out of RDP2.
Edit:
https://sec-consult.com/blog/detail/secglitcher-part-1-reproducible-voltage-glitching-on-stm32-microcontrollers/
https://www.usenix.org/system/files/conference/woot17/woot17-paper-obermaier.pdf
I'll do better than a second case, here's three:
Barracuda Networks: https://krebsonsecurity.com/2013/01/backdoors-found-in-barracuda-networks-gear/
Fortinet: https://community.spiceworks.com/t/hard-coded-password-backdoor-found-in-fortinet-firewalls/464379
Korenix: https://sec-consult.com/vulnerability-lab/advisory/backdoor-account-in-korenix-technology-jetport-series/
The fact that the password is "rzadmin" makes it a lot more likely that this is just run of the mill stupidity, and not something more nefarious: you'd want a backdoor that isn't blindingly obvious and usable by the CIA.
SEC Consult added an update to their page [1]. They are basically hiding behind Cisco, CERT-Bund and CERT.at.
I mean, c'mon... They did all that research and they expect me to believe they didn't understand the potential impact so they deferred to someone else's judgement? That's the excuse, seriously?
Besides, what would have been the harm in reaching out to projects like Sendmail and Postfix and ask them for their opinion? I'm more inclined to trust the judgement of the Postfix project then of Cisco.
[1] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/