[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Security Advisories from TEHTRI-Security at HITB Europe


TEHTRI-Security was invited to give a talk called "Web In The Middle, Attacking Clients", at the first Hack In The Box Europe, Amsterdam ( http://conference.hackinthebox.org/hitbsecconf2010ams/ ).

During our talk, we released multiple advisories and we explained many issues related to some vulnerabilities. You can find more public information through the slides available online. Here are some related details that we wanted to share with you through this mailing list :

o CVE-2010-1752: TEHTRI-Security inside the iPhone iOS4
TEHTRI-Security found a stack overflow in CFNetwork API, through the code used to handle URL. By visiting a maliciously crafted website, we found that it might lead to an unexpected application termination or arbitrary code execution. This issue has been addressed by Apple through improved memory handling. CFNetwork is shared by most applications from the App Store, that need to talk over the web. Check the User-Agent of your applications to be sure (example: Facebook/3.12 *CFNetwork/459* Darwin/10.0.0d3 ). Update to iOS4 to improve your security.
More information here:
CVE-2010-1752 in http://support.apple.com/kb/HT4225

o Security-Advisory: TEHTRI-SA-2010-028 - 0day on BlackBerry
TEHTRI-Security found a security issue, and created a client-side attack 0day for BlackBerry cellphone devices (Hotspot Browser). The code was shared with RIM who handled this vulnerability quickly, so that a fix might be added in a future release. It allows an attacker to crash the remote web application. This was scored with a CVSS of 5.

o Security-Advisory: TEHTRI-SA-2010-027 - 0day on HTC
TEHTRI-Security found a security issue, and created a client-side attack 0day for HTC Windows Mobile cellphone devices (Opera). HTC was contacted.

o Security-Advisory: TEHTRI-SA-2010-026 - 0day on iPad
TEHTRI-Security found a security issue, and created a client-side attack 0day for the (awesome) iPad device. The code was shared with Apple who handled this vulnerability quickly, so that a fix might be added to a future release. A demo was done during our talk, without giving dangerous details to the attendees. It was only shown for attendees of HITB Europe. No further information will be shared to the public before Apple release a patch.

o Security-Advisory: TEHTRI-SA-2010-026 - 0day on ThalysNet
TEHTRI-Security found some security issues on Thalys European trains, with the Internet access on board. To us, many Internet access shared on airports, stations, trains, in-flights, hotels, etc, are full of security vulnerabilities, because no penetration test were organized with IT Security experts before the service is open to the public. Dealing with ThalysNet, it concerns half a million of end-users. ThalysNet was contacted.

We also glanced at the differences related to the use of http and https on worldwide web services like hotmail, yahoo, twitter, facebook, linkedin, google mail, apple mobile me... A table on slide 32 might help beginners who would like to check the current situation. Dealing with https issues, as we said, we encourage you to have a look at initiatives like the one from the EFF: https://www.eff.org/https-everywhere

Some of our security advisories were already covered by the local press from NL:

The HITB crew have put slides of our conference on their web site:

If you want to get more details & technical secrets from TEHTRI-Security, feel free to join us "in real life" during our next trainings sessions & talks, or feel free to contact us for specific needs. We have public events planned next months (Asia, Europe).
Check-out our public agenda here:

See you soon.
Thanks. Take care.

Laurent Oudot, founder & CEO of TEHTRI-Security
TEHTRI-Security, "This is not a game".