insinuator.net Open in urlscan Pro
2a03:a920:1000:1000::a  Public Scan

Form analysis
1 forms found in the DOM

GET https://insinuator.net/

<form role="search" method="get" class="search-form" action="https://insinuator.net/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Search …" value="" name="s">
  </label>
  <button type="submit" class="search-submit"> Search </button>
</form>

Text Content

INSINUATOR.NET

Bold Statements

Primary Menu
 * About

 * RSS Feed
 * Follow us


CATEGORIES

 * Breaking
 * Building
 * Events
 * Misc


TAGS

4G Active Directory advisory Android Black Hat blackhoodie Bluetooth C3 Cisco
cloud Day-Con disclosure Docker ERNW white paper exploit forensics fuzzing GSM
hardening hardware HITB iOS IoT IPv6 Linux malware medical network pentest
reversing RIPE risk SAP SDR Telco TelcoSecDay tool TROOPERS trust virtualization
VMware VoIP vulnerability web application Windows


ARCHIVES

Archives Select Month February 2024  (1) October 2023  (3) September 2023  (2)
August 2023  (1) July 2023  (1) June 2023  (2) May 2023  (3) December 2022  (1)
September 2022  (2) August 2022  (1) June 2022  (1) April 2022  (1) March 2022
 (1) December 2021  (1) October 2021  (1) July 2021  (1) May 2021  (4) April
2021  (2) March 2021  (1) February 2021  (3) January 2021  (5) December 2020
 (4) November 2020  (6) October 2020  (2) September 2020  (5) July 2020  (3)
June 2020  (1) May 2020  (1) April 2020  (2) March 2020  (3) February 2020  (3)
January 2020  (2) December 2019  (2) November 2019  (6) October 2019  (4)
September 2019  (3) August 2019  (3) July 2019  (6) June 2019  (6) May 2019  (7)
April 2019  (7) March 2019  (2) February 2019  (4) January 2019  (14) December
2018  (4) November 2018  (11) October 2018  (6) September 2018  (1) August 2018
 (4) July 2018  (3) June 2018  (3) May 2018  (3) April 2018  (5) March 2018  (8)
February 2018  (12) January 2018  (2) December 2017  (2) November 2017  (3)
October 2017  (7) September 2017  (5) August 2017  (3) July 2017  (3) June 2017
 (6) May 2017  (5) April 2017  (3) March 2017  (8) February 2017  (6) January
2017  (8) December 2016  (12) November 2016  (14) October 2016  (12) September
2016  (12) August 2016  (9) July 2016  (9) June 2016  (7) May 2016  (10) April
2016  (23) March 2016  (29) February 2016  (14) January 2016  (12) December 2015
 (15) November 2015  (6) October 2015  (9) September 2015  (7) August 2015  (5)
July 2015  (6) June 2015  (14) May 2015  (9) April 2015  (9) March 2015  (13)
February 2015  (10) January 2015  (18) December 2014  (10) November 2014  (10)
October 2014  (7) September 2014  (3) August 2014  (9) July 2014  (5) June 2014
 (1) May 2014  (9) April 2014  (1) March 2014  (3) February 2014  (5) January
2014  (13) December 2013  (5) November 2013  (5) October 2013  (4) September
2013  (1) August 2013  (10) July 2013  (10) June 2013  (5) May 2013  (4) April
2013  (10) March 2013  (4) February 2013  (12) January 2013  (6) December 2012
 (2) November 2012  (4) October 2012  (1) September 2012  (3) July 2012  (3)
June 2012  (3) May 2012  (8) April 2012  (2) March 2012  (5) February 2012  (6)
January 2012  (4) December 2011  (7) November 2011  (7) October 2011  (6)
September 2011  (3) August 2011  (3) July 2011  (6) June 2011  (4) May 2011  (4)
April 2011  (5) March 2011  (5) January 2011  (2) December 2010  (6) November
2010  (5) October 2010  (3) September 2010  (4) August 2010  (5) July 2010  (6)
June 2010  (2) December 2009  (1) November 2009  (1) October 2009  (3) 0  (1)
Search for: Search
 * ERNW
 * ERNW Research

Misc
February 6, 2024 by Florian Grunow


CONSIDERATIONS ON AI-SECURITY – PART I: INTRODUCTION AND NONDETERMINISM

Hey there!

This is the first blog post in a series about issues we think are currently
relevant in the field of AI-Security. The intention is not to get full coverage
of the topic, but to point out things that seem practical and relevant. We will
base some of our statements on lab setups and real-life examples. The technology
that we will focus on is chat bots based on generative AI, mainly OpenAI’s
ChatGPT. Right now, this specific application of AI in the wild seems to be the
best way to demonstrate issues and pitfalls when it comes to IT security.

Continue reading “Considerations on AI-Security – Part I: Introduction and
Nondeterminism”

Continue reading

Building
October 20, 2023 by Florian Grunow


STUDENT PROJECT – AUDIT FRAMEWORK


INTRODUCTION

In 2021, ERNW collaborated with Hochschule Mannheim for their CEP (Cyber
Security Entwicklungsprojekt) to build an auditing framework for testing
operating system configurations against security procedures. This project is
part of the education program of the university to give the students the chance
to utilize the knowledge gained throughout the first semesters in a real world
project. ERNW posed as the fictitious customer, providing a requirements
document and regular meetings with all project groups for feedback. We planned
to process and adapt the results for an open source auditing framework.
Unfortunately, we were not able to finish this project yet, but we think the
students should get some attention for their work independent from our side. So
here is a short summary of what the students created and the corresponding
repositories.
Continue reading “Student Project – Audit Framework”

Continue reading
auditstudentsuniversity
Misc
October 17, 2023 by Baptiste David


C0C0N 2023 – A SHORT RETROSPECTIVE

Two weeks ago, I was at the c0c0n conference in Cochin (India). This conference
is quite special for at least two considerations. At first, this is – to the
best of my knowledge – one of the few conferences which officially brings
together hackers, industrials, politics, and security forces. This is not always
obvious for all these different persons to talk together, may be due to a lack
of mutual understanding . But for a couple of days, all of them meet, talk,
exchange, and they share mutual needs and appropriate solutions. And this may
explain the second consideration, why c0c0n is one of the oldest cyber security
conferences in India (more than 15 years). And yes, this is the conference where
police forces directly pick you up from the gates of your plane at airport,
sitting you at the back of a police car to drive you to your hotel with
emergency lights

During this event, we provided a workshop and a talk (slides), both talking
about the security of device drivers in Windows. For short, a device driver is a
piece of software that is used to manage a given device (whatever the notion of
device covers, from removable ones such as USB sticks to those definitively set
to your motherboard). In an organization, it is perfectly possible to control
the list of software and potentially the list of devices allowed on machines.
But there is sometimes a blind spot to know exactly which device drivers are
really used (from those setups by the OEM to the ones installed automatically
when a device is plug in the system). In addition, the security issues
associated with this kind of drivers is sometimes a real concern. Why? Because
some device vendors do not provide enough security (not to say basic quality) in
their software. A lot of the vulnerabilities exploited in drivers are always the
same: exploiting a feature that “should not be here” and whose access is not
“enough secure”, at least far from our today’s standards, to say the few. In
fact, a lot of device drivers are unfortunately written reusing part of some
public but highly deprecated projects, including codes coming from the Windows
Driver Kit (WDK) initially distributed with Windows NT 4.0, back in the good old
days where Windows 98 was the norm and the security was the exception . In some
cases, it is not hard to find samples reusing code coming from 1993 in modern
drivers.

The point is not to blame the past. Some pieces of code are still relevant to be
used, even nowadays. But some software architectures and system security of that
legacy time are nowadays totally deprecated. And some drivers keep using
dangerous features from that time, when they do not directly provide security
bypasses, for dubious reasons. The reasons have as much to do with the fact that
some drivers have never been updated (“why changing something since it works?”)
in the past as with the fact that some drivers may simply never be updated (by
design issue, no update capabilities, signed drivers still exploitable, software
provider bankrupted, …). The fact is that driver vulnerabilities are not close
to disappear.

Answering the problem is half technical and half organizational. On the first
hand, on the technical side, there is the ability to analyze the vulnerabilities
in drivers, mostly with reverse engineering, understanding the potential
consequences and deploying some technical mitigations. On the other hand, there
is a real topic about how to deal with existing drivers, potentially vulnerable.
From the strict management of device and security policies improvement for
clients to the enhancement of drivers’ code quality for software providers,
there are plenty of aspects to consider. And that was exactly the point we
highlighted during this conference, first in details during the workshop with
more than twenty participants [] and then during the talk. By the way, we will
give a similar online workshop (but focus on malware) in the end of November,
where “seats” are still available .

Last but not least, the c0c0n conference is also the place where there is a
track regarding Counter Child Sexual Exploitation, talking about this highly
humanitarian topic. I met very experienced police officers from different
nationalities and other people involving in protecting children from abuse.
These persons do such a hard job to make the world a safer place for our
children. I also wanted to stress the importance of this conference, which also
helps to protect children.

All the best,

Baptiste.



 

Update #1: Slides added .

Continue reading

Breaking
October 10, 2023 by Nils Emmerich


LUA-RESTY-JWT AUTHENTICATION BYPASS

I was writing some challenges for PacketWars at TROOPERS22. One was intended to
be a JWT key confusion challenge where the public key from an RSA JWT should be
recovered and used to sign a symmetric JWT. For that, I was searching for a
library vulnerable to JWT key confusion by default and found lua-resty-jwt. The
original repository by SkyLothar is not maintained and different from the
library that is installed with the LuaRocks package manager. The investigated
library is a fork of the original repository, maintained by cdbattags in version
0.2.3 and was downloaded more than 4.8 million times according to LuaRocks.

While looking at the source code I found a way to circumvent authentication
entirely.

Continue reading “Lua-Resty-JWT Authentication Bypass”

Continue reading
advisorydisclosureTROOPERS
Misc
September 12, 2023 by Florian Bausch


BREAKING DPD PARCEL TRACKING

This blog post is the continuation of our parcel research. We already reported
about how we broke parcel tracking at DHL and the disclosure process of the
identified problems. As DHL is not the only parcel service in Germany, we also
investigated the other available parcel services. In this blog post, we want to
talk about DPD, also called Geopost, which belongs to the French Post Office.

Continue reading “Breaking DPD Parcel Tracking”

Continue reading
disclosureDPDParcelstalk
Misc
September 6, 2023 by Frank Block


IDENTIFICATION OF (MALICIOUS) MODIFICATIONS IN MEMORY-MAPPED IMAGE FILES

I’m happy to announce the publication of the paper Windows memory forensics:
Identification of (malicious) modifications in memory-mapped image files at this
years DFRWS USA, and the release of the corresponding volatility plugin. With
this research came also an update to the Ptenum family (affecting especially the
ptemalfind plugin), which makes the plugins reliable in identifying modified
pages despite memory combining, so make sure to grab the newest version from the
Github repository.

This blog post will mainly cover the imgmalfind plugin and some use cases. For
detailed information on the theory behind the plugins, see the paper.

Continue reading “Identification of (malicious) modifications in memory-mapped
image files”

Continue reading
forensicshookingincident analysisinjectionmalwarememory forensics
Misc
August 2, 2023 by Gregor Debus


SELECT * FROM OPENSTACK – A STEAMPIPE PLUGIN FOR OPENSTACK

Although, more and more companies start to move their IT-Infrastructure from
on-premise to public cloud solutions like Amazon Web Services (AWS) and
Microsoft Azure, public cloud providers are not an option for every
organization. This is where private cloud platforms come into play as they give
organizations direct control over their information, can be more energy
efficient than other on-premise hosting solutions, and offer companies the
possibility to manage their data centers efficiently. OpenStack is a widely
deployed, open-source private cloud platform many companies and universities
use.

With companies and organizations moving their resources to the cloud, the
security of the cloud deployment moves into focus. To ensure security in private
and public cloud deployments, cloud security benchmarks are developed. The
Center for Internet Security (CIS) maintains several benchmarks for public cloud
providers like the AWS Foundations Benchmark or the Azure Foundations Benchmark.

As the number of deployed resources in cloud deployments can be extensive, tools
for automated checking of these benchmarks are needed. Steampipe is such a tool.
It offers automated checks for various cloud providers with good coverage of
security standards and compliance benchmarks.

Since for OpenStack no Steampipe plugin existed, we implemented it. This blog
post aims to provide a deeper understanding of how OpenStack and Steampipe work
and how the Steampipe plugin for OpenStack can be used to query deployed cloud
resources for insecure configuration via SQL.

TL;DR; In this blog post we present our Steampipe plugin for Openstack we’ve
just released as open source. It can help you to automate checking your
OpenStack resource configuration for common security flaws.

Continue reading “Select * from OpenStack – A Steampipe Plugin for OpenStack”

Continue reading
cloudOpenStackSteampipe
Misc
July 11, 2023 by Florian Bausch


ALL YOUR PARCEL ARE BELONG TO US – TALK AT TROOPERS 2023

At Troopers 2023, we gave a talk on how to attack DHL parcel tracking
information based on OSINT. Since we previously had an exemplary disclosure
process about this attack with DHL, Mr. Kiehne (from DHL) joined us to provide
interesting background information and insights on how they addressed our
findings.

Continue reading “All your parcel are belong to us – Talk at Troopers 2023”

Continue reading
DHLParcelstalkTROOPERS
Misc
June 21, 2023 by Matthias Hamann


THE DRACO STREAM CIPHER

In symmetric-key cryptography, we typically distinguish two types of encryption
schemes: block ciphers and stream ciphers. Block ciphers divide a plaintext into
blocks of a fixed size (e.g., 64 or 128 bits) and encrypt one such block of data
as a whole. Stream ciphers, on the other hand, consider the plaintext as a
continuous stream of data. The stream cipher maintains an internal state and in
each step it outputs one bit or several bits and updates its internal state. The
output bit stream is then combined with the plaintext, usually using the XOR
operation. One advantage of stream ciphers is that their resource requirements
are lower than those of block ciphers in many application scenarios. This makes
them particularly useful in lightweight cryptography targeting resource
constrained devices such as low-cost RFID tags.

In this blog post, we provide an overview over current developments in this area
and introduce our new lightweight stream cipher DRACO, which was developed in
cooperation with the Universität Mannheim (Alexander Moch, Matthias Krause) and
the Universität Siegen (Vasily Mikhalev) and has recently been presented at FSE
2023 in Kobe, Japan.

Continue reading “The DRACO Stream Cipher”

Continue reading
Lightweight CryptographyRFIDStream Ciphers
Breaking
June 13, 2023 by Dennis Heinze


JASPER REPORTS LIBRARY CODE INJECTION

During the past year we had several projects where our target application used
Jasper Reports in some way. In a few of the cases we found an API that offered
to render a template along with some arguments into a PDF file. This was done
with the help of the Jasper Reports Java library. Due to the way the library and
the expression mechanism works, this endpoint gave us the possibility to inject
Java code and gain remote code execution on the target systems.

In this blog post we want to provide an overview over the Jasper Reports Java
library in terms of security especially with regard to expression injection
attacks.

TL;DR; If you come across an API that lets you freely define a Jasper Report
template you very likely have code execution. Or to put it differently: Never
let Jasper Report templates be user or attacker controlled.

Continue reading “Jasper Reports Library Code Injection”

Continue reading
exploitinjectionJava


POSTS NAVIGATION

1 2 3 4 … 83 Next
 * RSS Feed
 * Follow us


CATEGORIES

 * Breaking
 * Building
 * Events
 * Misc


TAGS

4G Active Directory advisory Android Black Hat blackhoodie Bluetooth C3 Cisco
cloud Day-Con disclosure Docker ERNW white paper exploit forensics fuzzing GSM
hardening hardware HITB iOS IoT IPv6 Linux malware medical network pentest
reversing RIPE risk SAP SDR Telco TelcoSecDay tool TROOPERS trust virtualization
VMware VoIP vulnerability web application Windows


ARCHIVES

Archives Select Month February 2024  (1) October 2023  (3) September 2023  (2)
August 2023  (1) July 2023  (1) June 2023  (2) May 2023  (3) December 2022  (1)
September 2022  (2) August 2022  (1) June 2022  (1) April 2022  (1) March 2022
 (1) December 2021  (1) October 2021  (1) July 2021  (1) May 2021  (4) April
2021  (2) March 2021  (1) February 2021  (3) January 2021  (5) December 2020
 (4) November 2020  (6) October 2020  (2) September 2020  (5) July 2020  (3)
June 2020  (1) May 2020  (1) April 2020  (2) March 2020  (3) February 2020  (3)
January 2020  (2) December 2019  (2) November 2019  (6) October 2019  (4)
September 2019  (3) August 2019  (3) July 2019  (6) June 2019  (6) May 2019  (7)
April 2019  (7) March 2019  (2) February 2019  (4) January 2019  (14) December
2018  (4) November 2018  (11) October 2018  (6) September 2018  (1) August 2018
 (4) July 2018  (3) June 2018  (3) May 2018  (3) April 2018  (5) March 2018  (8)
February 2018  (12) January 2018  (2) December 2017  (2) November 2017  (3)
October 2017  (7) September 2017  (5) August 2017  (3) July 2017  (3) June 2017
 (6) May 2017  (5) April 2017  (3) March 2017  (8) February 2017  (6) January
2017  (8) December 2016  (12) November 2016  (14) October 2016  (12) September
2016  (12) August 2016  (9) July 2016  (9) June 2016  (7) May 2016  (10) April
2016  (23) March 2016  (29) February 2016  (14) January 2016  (12) December 2015
 (15) November 2015  (6) October 2015  (9) September 2015  (7) August 2015  (5)
July 2015  (6) June 2015  (14) May 2015  (9) April 2015  (9) March 2015  (13)
February 2015  (10) January 2015  (18) December 2014  (10) November 2014  (10)
October 2014  (7) September 2014  (3) August 2014  (9) July 2014  (5) June 2014
 (1) May 2014  (9) April 2014  (1) March 2014  (3) February 2014  (5) January
2014  (13) December 2013  (5) November 2013  (5) October 2013  (4) September
2013  (1) August 2013  (10) July 2013  (10) June 2013  (5) May 2013  (4) April
2013  (10) March 2013  (4) February 2013  (12) January 2013  (6) December 2012
 (2) November 2012  (4) October 2012  (1) September 2012  (3) July 2012  (3)
June 2012  (3) May 2012  (8) April 2012  (2) March 2012  (5) February 2012  (6)
January 2012  (4) December 2011  (7) November 2011  (7) October 2011  (6)
September 2011  (3) August 2011  (3) July 2011  (6) June 2011  (4) May 2011  (4)
April 2011  (5) March 2011  (5) January 2011  (2) December 2010  (6) November
2010  (5) October 2010  (3) September 2010  (4) August 2010  (5) July 2010  (6)
June 2010  (2) December 2009  (1) November 2009  (1) October 2009  (3) 0  (1)

Imprint | Privacy Policy | ©2024 ERNW Enno Rey Netzwerke GmbH

 * 
 *