SEC Consult Blog

SMTP pipelining was actually the cause of fairly recently discovered vulnerability. https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-wo… https://www.postfix.org/smtp-smuggling.html Probably the main reason it is recommended against.

In a world where users should have control over their own computers, it is the customer who should have SSH access, not AT&T. But as you all know, most times the customer does not own the modem. One well-known workaround is for the customer to use their own modem or to use their own router as a gateway to the modem. But does this really give the user more contorl over the modem/router? These user-owned modems/routers usually do not encourage SSH access by the user, if they even provide it. Instead they promote a "web interface". Indirect control of the settings. Better than SSH? That is for you to decide. The "market" seems to love the "web interface". But this often the easiest vector for successful attacks. Less control, and less safety. Is the tradeoff still worth it? That is for you to decide. https://threatpost.com/vulnerability-disclosed-in-ubquiti-networks-adm… https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt… http://www.securityweek.com/worm-infects-many-ubiquiti-devices-old-vul… Relying on "Keep up to date with patches" or "Enable updates" as a strategy to improve the safety of a product that was unsafe to begin with is a bit of cognitive dissonance given that its safety was deemed "good enough" for the renter/purchaser at the time of rental/purchase. To achieve a safer product requires not only manufacturers to set new priorities…

I'll do better than a second case, here's three: Barracuda Networks: https://krebsonsecurity.com/2013/01/backdoors-found-in-barracuda-netwo… Fortinet: https://community.spiceworks.com/t/hard-coded-password-backdoor-found-… Korenix: https://sec-consult.com/vulnerability-lab/advisory/backdoor-account-in… The fact that the password is "rzadmin" makes it a lot more likely that this is just run of the mill stupidity, and not something more nefarious: you'd want a backdoor that isn't blindingly obvious and usable by the CIA.

> Has Level 2 been cracked? It's tricky because you have to chain multiple exploits, but yes. You can temporarily downgrade from RDP2 to RDP1 via glitching. At that point, you have to move directly into RDP1 techniques without causing a reset. The protection levels are set in the RDP register. [listed out of order...] Level 0 = 0xAA, Level 2 = 0xCC, Level 1 = anything else. Flip just a single bit and you get out of RDP2. Edit: https://sec-consult.com/blog/detail/secglitcher-part-1-reproducible-vo… https://www.usenix.org/system/files/conference/woot17/woot17-paper-obe…

SEC Consult added an update to their page [1]. They are basically hiding behind Cisco, CERT-Bund and CERT.at. I mean, c'mon... They did all that research and they expect me to believe they didn't understand the potential impact so they deferred to someone else's judgement? That's the excuse, seriously? Besides, what would have been the harm in reaching out to projects like Sendmail and Postfix and ask them for their opinion? I'm more inclined to trust the judgement of the Postfix project then of Cisco. [1] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-wo…

> 2023-11-29: CERT/CC allows public release of SMTP smuggling, since no software vulnerabilities were identified ("it's not a bug, it's a feature") https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-wo…

The original blog can be found here: https://sec-consult.com/en/blog/2018/06/pentesters-windows-ntfs-tricks… The author of the above blog copy & pasted the full article, explicitly removed the author names and references to the original source. That's pretty disappointing.

how about using the original website of the researcher who identified all of this and not just a cheap copy? https://www.sec-consult.com/en/blog/2018/06/pentesters-windows-ntfs-tr…

The initial report from last year has interesting, if sadly unsurprising, background on how/why so many of these embedded devices have wound up this way. http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.…

Perhaps you missed the link in the article to https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt…

> Workaround: > ----------- > Sometimes NetUSB can be disabled via the web interface, but at least on NETGEAR devices this does not mitigate the vulnerability. NETGEAR told us, that there is no workaround available, the TCP port can't be firewalled nor is there a way to disable the service on their devices. https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt… Eeesh

The article doesn't mention possible security implications. However, we already get lots of vulnerabilities exactly _because_ implementations disagree on delimiters. Examples for this are HTTP request smuggling[1, 2, 3] and SMTP smuggling[4]. As the references show, this is already a big source of vulnerabilities - trying to push for a change in standards would likely make the situation much worse. At the very least, old unmaintained servers will not change their behavior. I think we should accept that this ship has sailed and leave existing protocols alone. Mandate LF and disallow CRLF in new protocols, that's fine, but I don't think we should open this particular Pandora's Box. [1] Simple example that doesn't use CRLF/LF disagreement: https://portswigger.net/web-security/request-smuggling [2] Complex example that uses CRLF/LF disagreement: https://portswigger.net/web-security/request-smuggling/advanced (see heading 'Request smuggling via CRLF injection') [3] Random report on HackerOne I found where allowing LF created a vulnerability in NodeJS: https://hackerone.com/reports/2001873 [4] https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-wo…

"Generating Software Tests" (https://www.fuzzingbook.org/) is pretty great (independent of your programming language) - arguably a must read for anyone interested in software testing. John Regehr (the author of the blog post) has written more great posts: - How to Fuzz an ADT Implementation - https://blog.regehr.org/archives/896 - Better Random Testing by Leaving Features Out - https://blog.regehr.org/archives/591 - Tricking a Whitebox Testcase Generator - https://blog.regehr.org/archives/672 - Fuzzers Need Taming - https://blog.regehr.org/archives/925 - Levels of Fuzzing - https://blog.regehr.org/archives/1039 - API Fuzzing vs. File Fuzzing: A Cautionary Tale - https://blog.regehr.org/archives/1269 - Reducers are Fuzzers - https://blog.regehr.org/archives/1284 In terms of software, DeepState (https://github.com/trailofbits/deepstate) may be a good place to start for C and C++. Relevant links: - Fuzzing an API with DeepState: https://blog.trailofbits.com/2019/01/22/fuzzing-an-api-with-deepstate-… https://blog.trailofbits.com/2019/01/23/fuzzing-an-api-with-deepstate-… - NDSS 18 paper, "DeepState: Symbolic Unit Testing for C and C++": https://www.cefns.nau.edu/~adg326/bar18.pdf In terms of choosing among fuzzing solutions, https://blog.trailofbits.com/2018/10/05/how-to-spot-good-fuzzing-resea… is also worth a read -- as well as the article it refers to, http://www.pl-enthusiast.net/2018/08/23/evaluating-empirical-evaluatio… For a…