Pen Test Partners

Using HTTP meta-headers is actually something we seem to have forgotten how to do. The one that annoys me most is the accept-language header which is almost entirely ignored in favour of GeoIP lookups to figure out regionality... which I find super odd; as if people are walking around using a browser in a language they don't speak. (or, an operating system configured for a language they don't speak). ETAG's though, are a bit fraught- if you're a company, a security scan will fire if an etag is detected because you might be able to figure out the inode on the filesystem based on it... which, idk why that's a security problem eitherway[0], but it's common for there to be false-positives[1]... which makes people not respect the header. Last-Modified should work though, I love the idea of checking headers and not content. I think people don't care to imagine the computer doing as little as possible to get the job done, and instead use the near unlimited computing power to just avoid thinking about consequences. [0]: https://www.pentestpartners.com/security-blog/vulnerabilities-that-are… [1]: https://github.com/sullo/nikto/issues/469

Interesting - just found this: https://www.pentestpartners.com/security-blog/reverse-engineering-the-… Not had a chance to read it properly but definitely will be!

Wardriving for sex toys! https://www.pentestpartners.com/security-blog/screwdriving-locating-an…

Tesla is. Failed updates are non-destructive, they also have an RTOS gateway isolating entertainment software from the software needed to drive the vehicle. https://www.pentestpartners.com/security-blog/reverse-engineering-tesl… And this is their decade old architecture. If you watch some cybertruck videos you’ll see it is much more elegant now.

related https://www.pentestpartners.com/security-blog/security-alarm-round-up/

That was FUD[1] spread by Chris Roberts who has been called out for it. He claimed he was able to issue climb commands from the IFE to the CAN bus. Apart from this being technologically impossible, if he would have really done it he would have been charged for endangering an aircraft and prosecuted. (So the only explanation why he isn't in prison is that it didn't happen). The technical reason is Data diodes are common in aviation to separate IFE and CAN bus or position data. (e.g in the ARINC) [1] https://www.pentestpartners.com/security-blog/a-pen-testers-first-solo…

Apparently it is a 128Mb stick, with a pdf on it. "The stick comes loaded with a 25 page PDF version of the material from 5GbioShield ‘s website. It included a Q&A of distances for the “bubble” and how to know if it is working. It’s an “always on” system apparently, is always working, powered or not, so no visual checks needed. A review of the stick’s properties revealed nothing more that what you’d expect from a regular 128MB USB key. We weren’t even sure that 128s are still in production!" https://www.pentestpartners.com/security-blog/reverse-engineering-a-5g…

should probably point to source URL: https://www.pentestpartners.com/security-blog/reverse-engineering-a-5g…

Ships are full of holes: https://www.pentestpartners.com/security-blog/pen-testing-ships-a-year…

It's particularly in systems like these where they usually leave SSH w/ password login, or an oudated Teamviewer install. [1] Realistically, I can see this working. For Disney. For use in action movies. In fact, "23 tons of cyber capabilities" is exactly the thing I would expect to hear from an action movie. [1]: https://www.pentestpartners.com/security-blog/pen-testing-ships-a-year…

The page with the most technical content is https://www.pentestpartners.com/security-blog/breaking-bad-firmware-en… with a title of "Breaking (bad) firmware encryption. Case study on the Netgear Nighthawk M1". Non-technical Forbes summary and headline is good for discovery (e.g. search/bots), technical overview links threads of research, and case study enables replication. Each page has a role.

Here's the original source, it's not linked directly in the article: https://www.pentestpartners.com/security-blog/reverse-engineering-4g-h…

The original blog post with more details can be found here: https://www.pentestpartners.com/security-blog/eyedisk-hacking-the-unha…

This is a political article. If you're interested in the technicals read this linked one instead (far shorter, and actually talks about the technical problems in detail): https://www.pentestpartners.com/security-blog/tic-toc-pwned/ I think the mods should leave it pointed to the Hunt article since seems people want to discuss the politics more anyway.

I guess it’s referring to this post: https://www.pentestpartners.com/security-blog/steal-your-wi-fi-key-fro…

They're just mass scanning for known IoT ports. UPnP opens up the port for everyone. My port number is an example. This blogger found his camera opening up port 80 via UPnP: https://www.pentestpartners.com/blog/hacking-the-aldi-ip-cctv-camera-p… Also Brian Krebs examined that Foscam camera and found it enabled a P2P protocol and opened a port on the firewall using UPnP as well: https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-intern…

They had a gaping security hole in the product for who knows how long (revealing the configured WiFi SSID+PSK to anyone with physical access to the back of the unit): https://www.pentestpartners.com/blog/steal-your-wi-fi-key-from-your-do…

Hopefully they use the money to fix nonsense like this: https://www.pentestpartners.com/blog/steal-your-wi-fi-key-from-your-do… An attacker at your door has physical access to your Ring device, which can be leveraged into access to your wifi network (unless they fixed this already).

However your IOMMU may not actually be in use. It's not in use by default on Linux and on most Linux distros as it tends to break things on random hardware that isn't setup right. It tends to work most of the time on servers. Ubuntu 22.04 tried to turn it on by default but switched it off again due to random mostly graphics related regressions on random hardware: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1971699 Some other history: https://www.phoronix.com/news/Intel-IOMMU-Gfx-Default-Try We really do need it though. I am always reminded of the very old Apple "Firewire Memory Bypass" which rendered flames to the screen just by plugging a firewire device in - because firewire had direct and originally unprotected DMA access: https://www.pentestpartners.com/security-blog/hack-demo-video/firewire… It is for this reason that even without IOMMU, as a workaround, you have to often give permission to thunderbolt devices to connect. Some details on that here: https://wiki.archlinux.org/title/Thunderbolt There is also a small but noticable performance hit to using the IOMMU, not so noticable on a general setup but if you are doing high-speed disk & network I/O like ceph storage in excess of 10Gbit/s or millions of IOPS you will notice it. You can Google that. You can also run into other weird behaviour, for example when using kdump to create a kernel crash dump it will kexec from the old kernel into a new kernel to produce the crash dump.…