Context Information Security Blog

Well, not so. https://www.contextis.com/us/blog/webgl-more-webgl-security-flaws https://www.hpcwire.com/2018/05/31/gpus-excellent-performance-but-what… https://www.cs.utexas.edu/users/witchel/pubs/zhu17gpgpu-security.pdf

Worth noting that this general category of render-timing-based pixel-reading has been around for a while. e.g. https://www.contextis.com/media/downloads/Pixel_Perfect_Timing_Attacks… is from 2013, uses svg instead, and I could swear I've seen a CSS one from a few years ago. I really suspect there's only one fix, and it seems reasonable to me: don't allow sites to place content over iframes, period. Allowing it opens all kinds of exploits like this and various flavors of clickjacking, all basically un-preventable since there's no limit to the techniques possible.

Assuming you trust your hosting company (maybe that's another discussion?) I don't think it's possible to leak memory contents VPS-to-VPS but I could be wrong. In any case, if I had a pile of Bitcoin (unfortunately I do not) I wouldn't put it all in one wallet on one server. From what I've heard, paper wallets are the safest. That said, maybe "zero out" your wallet before switching VPS providers, changing plans, etc. This is from 2012 but probably still relevant as we saw with the recent Digital Ocean outrage. http://www.contextis.com/research/blog/dirty-disks-raise-new-questions… "It is worth noting that the data was not live, in that it was not due to sharing of disk contents between running instances of virtual servers. It is understood that the data is due to disk and swap data not being zeroed after use."

Context Information Security | Python Developer and Penetration testers | London, UK, Germany, NY, AUS | INTERNS | ONSITE | VISA | https://ctx.is/ Context provides solutions to our clients most complex information security challenges, in order to protect their most critical resources. Our customers trust us with this great responsibility because of the quality of our people; leaders in their field, inquisitive and capable of rising to the most complex of challenges. Alongside our employees drive and determination to be the best at what they do is Context’s company ethos. We are passionate about developing our staff, through provision of continuous training and development opportunities. We also pride ourselves on our flexible and social working environment. Context is always looking for smart people to join our company, whether you have formal information security training and experience or not. A passion and a willingness to learn is key: If you are an excellent developer or sysadmin or working in another technical role and have a keen and demonstrable interest in information security, then we would love to hear from you. We are looking for people who can transfer technical skills from other areas into penetration testing and can support you in doing this. If you're interested but not sure, have a go at our challenges[1][2]. We are also looking for full-time Python/Django developers (including junior roles) to join our in-house development team, to work on exciting…

> the vuln was not that the JS was bad or untrustworthy, but that the passphrase was sent to the server. Which is one of the most commonly cited vulnerabilities with web-based crypto. The fact that no JS was involved doesn't really change anything. > If the entire connection to the server is secure, and the JS is loaded from the secure server and is auditable/checksummed, then the risk is minimal. You either trust the code or you get out. I assume you're referring to client-side, JS-based encryption. The problem is that the server can always slip a backdoor into the webpage, and your browser will dutifully execute it. It doesn't matter if the JS is sent via SSL. A compromised server can deliver compromised JS, and SSL provides no protection against that. You can't practically audit for this. You could theoretically read the JavaScript. But performing a thorough audit on a cryptosystem is a big undertaking. And then how do you know it hasn't changed the next time you visit the page? You mentioned checksums, but how are you going to do that? Are you going to manually MD5 the JS file on every visit? Even if you did, the JS file is just one of many ways a compromised server can backdoor your browser. For example, we recently learned about HTML5 timing attacks (http://www.contextis.com/files/Browser_Timing_Attacks.pdf). And that's just the tip of the iceberg. Checksums aren't going to tell you if these sorts of things are happening. A compromised server can compromise any…

It looks like Flash SMS is handled differently. Here’s a post from 2020 on the differences within Android to handle flash SMS: https://github.com/moezbhatti/qksms/issues/1536#issuecomment-577678851 Here’s an app, pre-4.3, for sending Flash SMS: https://github.com/romankh/gat-app There appear to be a couple online services that will let you send Flash SMS (Type 0) but Twilio is not one of them. Edit: The terminology is confusing! I wrote “type 0” above when in fact it’s a “class 0” sms. Type 0 means a silent SMS, Class 0 means an SMS that’s display-only and not stored. See also https://www.contextis.com/en/blog/binary-sms-the-old-backdoor-to-your-… for a brief overview, though I’m sure there are other, better sources.

Reminds me of “pixel perfect attacks with html5” from several years ago. That attack used css/svg filters + timing. https://www.contextis.com/media/downloads/Pixel_Perfect_Timing_Attacks…

Will this API be opt-in, or can we expect another security disaster like with WebGL? https://news.ycombinator.com/item?id=16457791 , https://www.contextis.com/en/blog/webgl-a-new-dimension-for-browser-ex… , https://www.contextis.com/en/blog/webgl-more-webgl-security-flaws Edit I should have given a quote from one of the articles covering the issue, so here's one: > anyone running Firefox 4 with WebGL support is vulnerable to having malicious web pages capture screenshots of any window on their system

Here's some stuff you used to be able to do by combining UI-redressing (clickjacking) with cross-origin drag and drop. https://www.contextis.com/media/downloads/Context-Clickjacking_white_p… There have also been plenty of UXSS bugs in various browsers caused by cross-origin drag-and-drop.

Frankly, might not be such a bad idea. https://www.contextis.com/blog/webgl-more-webgl-security-flaws etc

In case of SDR you should not forget to get a license to transmit in GSM spectrum: Legalities and options The GSM spectrum is very expensive private property. You may not transmit (or even receive) in GSM bands without permission. In the UK, it is an offence under the Wireless Telegraphy Act to transmit on licensed bands without permission and furthermore intercepting GSM without a warrant is an offence under the Regulation of Investigatory Powers Act.You should apply for a licence (example from OFCOM below) before commencing GSM testing and will also need a faraday cage to suppress radiation. (For these reasons, GSM interfaces get less scrutiny than TCP/IP for example). https://www.contextis.com/blog/binary-sms-the-old-backdoor-to-your-new…

Yes, this isn't even the first cross-domain leakage attack on iframes using CSS. [0] There were similar issues with how hit testing was implemented for `document.elementFromPoint()`[1], and probably tons of other things I'm forgetting. Ideally cross-origin framing would have been disallowed by default but frames were added to the spec before people spent a lot of time thinking about the same-origin-policy implications. [0]: https://www.contextis.com/resources/white-papers/pixel-perfect-timing-… [1]: http://blog.saynotolinux.com/blog/2014/02/05/whats-that-smell-sniffing…

Unrelated to the article, but when I zoomed in to 150%+ in Chrome, this image [1] turned into this image [2]: https://www.contextis.com/media/images/made/media/images/content/RF_bo… https://www.contextis.com/media/images/made/media/images/content/RF_bo…

They could put in a backdoor that opens when a magic packet is passed. These things exist[1]. Your cell phone likely has one in the radio[2]. The problem with this existing, other than the privacy issues, is that the packet can eventually be discovered by fuzzing[3] the hardware. [1]https://github.com/elvanderb/TCP-32764 [2]https://www.contextis.com/resources/blog/binary-sms-old-backdoor-your-… [3]https://www.owasp.org/index.php/Fuzzing

By sending binary SMSs. There are multiple classes of SMS, including binary messages through which operators can access and change data directly on your SIM. Since that's also your crypto chip, yeah ... TLDR: https://www.contextis.com/resources/blog/binary-sms-old-backdoor-your-… If you have a few days: http://www.tamps.cinvestav.mx/~vjsosa/clases/redes/Mobile%20Messaging%… Edit: You might find them referenced as silent SMSs, because you never see any indication of receiving it.

They are arbitrary code, they just have to be written in GLSL. One of the vectors is the fact that less effort has been put into isolating and securing GPU memory, since previously, it was not considered sensitive. This is compounded by the fact that WebGL shader code and API calls are often processed by a layer with escalated privileges, written in C or C++, completely opaque, with lots of unknown bugs. http://www.kitguru.net/gaming/security-software/carl/webgl-exploit-ope… http://www.contextis.com/resources/blog/webgl-more-webgl-security-flaw… http://www.pcworld.com/article/227438/dangerous_webgl_flaw_puts_firefo…

Reminds me of Doom on a printer: http://www.contextis.com/resources/blog/hacking-canon-pixma-printers-d…

>I thought that browser venders we're having the :visited selector lie to you when you call getComputedStyle on them? It's possible to probe the users history even though getComputedStyle doesn't give it away anymore. See page 6 of this article: http://www.contextis.com/documents/2/Browser_Timing_Attacks.pdf Obviously turning off Javascript prevents these types of things to some extent, but even then there are ways: https://www.nds.rub.de/media/nds/veroeffentlichungen/2014/07/09/DSN_pa… The web is just not designed with preventing information leaks in mind.

> There is a class of crypto implementation bugs that arises from how you feed data to your MAC, so, if you're designing a new system from scratch, Google "crypto canonicalization bugs". I get a whole bunch of links about javax.xml.crypto.dsig throwing exceptions, which wasn't terribly illuminating. I think the reference is to the bugs discussed on page 21 here: http://www.contextis.com/documents/33/Exploiting_XML_Digital_Signature… but I'm not sure.

It's difficult, because you cannot see the pixels in an HTML element's rendering with JavaScript. If you could copy a link to a canvas, then you could see if it has been previously visited, for example. So, canvases would not work. I may be possible with SVG filters or WebGL, but that also has security implications. It's possible to read cross-origin content using timing attacks and filters. http://www.contextis.com/files/Browser_Timing_Attacks.pdf

Thank you, these sorts of timing attacks are very interesting. I was asking for clarification because I am curious about vectors such as these; vulnerabilities in JS runtime or in HTML/CSS. This thinking was spurred by an article posted here not to long ago[1] about timing attacks on CSS and SVG shaders through requestAnimationFrame. [1] http://www.contextis.com/files/Browser_Timing_Attacks.pdf

//Black hat on The main concern for me with native client is webgl and the exposure of 3D device drivers to the Internet. These drivers were not written with this use in mind there have been webgl vulnerabilities in the past: http://www.contextis.com/research/blog/webgl2/ While Google will be aware of these and actively working to provide a buffer with via validation and sandboxing, with pessimistic hat on, I can see this leading to a lot more security vulnerabilities.

Read these papers: http://www.contextis.com/resources/blog/webgl/ http://www.contextis.com/resources/blog/webgl2/ To learn more about WebGl and security. Goes into more depth than that article.

If you are interested in studying during you own time have a look at the links and suggestions provided on this subreddit. https://www.reddit.com/r/netsec/comments/g6r71/getting_started_in_netw… This has links to many useful resources such as books and many tools that used such as nmap, Nessus, burp suite etc. Remember if you don’t have permission to attack something it is against the law, which is why there are the following resources that can be used: Damn Vulnerable Web App (http://www.dvwa.co.uk/) and https://www.hackthebox.eu/ Also check out OWASP (The Open Web Application Security Project) https://www.owasp.org/ There are quite a few universities offering cyber security courses in the UK. I have listed a few below: https://www.abertay.ac.uk/schools/school-of-design-and-informatics/div… https://www.ncl.ac.uk/undergraduate/degrees/i190/#courseoverview https://www.kingston.ac.uk/undergraduate-course/cyber-security-compute… https://www.plymouth.ac.uk/courses/undergraduate/bsc-computer-and-info… https://www.gre.ac.uk/undergraduate-courses/ach/gf54 There are quite a few companies that have graduate schemes as well. https://www.nccgroup.trust/uk/about-us/careers/graduates/ https://www.mwrinfosecurity.com/assets/resourceFiles/Recruitment-Broch… http://www.aonearlycareers.co.uk/graduates-9 - The application period will open again later this year for Cyber…