Hey @viss see this? CISA says you're wrong!

https://www.theregister.com/2025/03/13/cisa_red_team_layoffs/

Call For Papers! #BlueTeamCon
https://blueteamcon.com/blue-team-con-2025-call-for-papers/

Hey #redteam and #pentest ers, what security controlsnon endpoints and servers make your life miserable on an engagement?

App allow listing?
DEP?
Powershell execution policies?
Hostbased firewall?

Last week, I finally finished my writeup of a vulnerability based on a misuse of #Cryptography that we found a while back in a penetration test. It's my favorite vulnerability so far, as it relies on abusing basic properties of unauthenticated encryption and shows, in a real-world scenario, how such seemingly theoretical issues can compromise an entire system. In the end, it's a teachable moment about both cryptography and secure software architecture.

I had the draft lying around for more than a year, but reading the articles by @soatok finally reminded me that I should really wrap this up and post it. So, here it is: https://blog.maass.xyz/encryption-isnt-enough-compromising-a-payment-processor-using-math

Apparently I am getting one more #CVE this year, and this one is kind of cool :)

Earlier this year, I found a critical vulnerability in the Microsoft Update Catalog (https://catalog.update.microsoft.com ). This is the site where you go to download individual update packages for Microsoft products.

I #redteam for #microsoft and I pulled off that exploit as part of my normal work. Previously Microsoft hasn't issued CVE's for service vulnerabilities, but now as part of the expanded Secure Future Initiative, critical vulnerabilities in Microsoft service get CVE's. I think 9.3/8.4 is the highest CVSS I've ever gotten.

This is a "no action" CVE, because there's nothing for you do to make yourself safer. Microsoft already patched the service.

I don't know if I can say more about the exploit than what's in the official disclosure. You can read that here:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49147

@hack_lu thanks for an awesome conference, keep up the FANTASTIC work you all do.

Here's the ramblings of a tired old man who loved being there.

https://www.infosecworrier.dk/blog/2024/10/hacklu2024.html

@ministraitor @claushoumann @grumpy4n6 (let's go together 2025) #hacklu2024 #Cryptography #Defender #Attacker #RedTeam #KubeHound #Copilot #Microsoft #BlueTeam #OT #Kunai #Zeek #Galah

Mini Pen Test Diaries Story:

The target of the test was an enterprise web app, designed to be hosted and accessed from within a trusted network - like an enterprise LAN. Most customers would login to the app with SSO, or AD-integrated authentication, but it also supported a local login mechanism, so it could have its own accounts.

Although this app was designed to never go near the dirty dirty internet, we all know how companies be, so as part of the test, I decided to go looking around for any instances of it that may be out there. Plan wasn't to test them of course, not in scope, but I was curious to see how this software was actually being deployed in the real world.

After about 15 seconds on Shodan, I found dozens of instances of this thing out there on the Internet. From the screenshots of the login page, I could see that all of them were in local authentication mode - meaning, no third party or federated auth was being used.

I raised this as a finding in the report, mentioning that, "hey, although this isn't directly your issue, there are plenty of examples of your customers using your app like this, so...perhaps consider adding MFA to the local authentication provider, to add that layer of protection to the app? Lest one of your customers expose themselves in the same way that so many apparently have done so."

At report review time, the dev team was furious about this finding - "why, would you put this finding in our pentest report? It's not our issue whatsoever!"

So I calmly explained to them, "you're correct, not your direct issue, but you're the folks in the best position to fix it, right? The customers can't add MFA to your code, and clearly theres a reason your customers keep putting these things on the Internet? Have you asked them about it?"

They still weren't convinced at all.

Now, I've been doing this for a while, so used to push back from dev teams on certain things occasionally, but you know, this one seemed like a no-brainer, really.

I asked, who's gonna get the blame when these things get compromised by cred stuffing?

Who's IP is out there for other malicious actors to find and play with?

But still, they weren't having it.

There's no real magical ending to this one unfortunately. The software sits out there to this day, no MFA to be seen. But this one is a perfect example of why we often find ourselves in the situations we do in this industry.

An unwillingness to just do the right thing, simply because doing that thing doesn't exactly fall within your direct purview.

Even if, in this example, you didn't want to do MFA - just take the finding, and go ask your customers to take their instances of the internet. Be proactive. It would give your account execs a reason to talk to customers - they'd love it.

It's not always this way, but when it is, you can very easily understand the chain of decisions that lead to a number of the major breaches we seen on a daily basis. Don't be like these devs, think outside of the box. Or LAN, I suppose.

Want to read more, slightly less mini stories like this: https://infosecdiaries.com

Burp Suite is all of a sudden leaving a dozen temp files out every time I close. Sometimes there are one, or two when I open it in the morning, these days it's more like 12 or 14 every time.

Anyone else seeing that?

Ok. I think I've given them enough of a rest...

The greater security team asked me to chill for a bit because they were overloaded with findings. That makes perfect sense. I gave them enough to chew on and I try to rotate findings that various teams can work on.

This one specific team remediated a lot of my findings. It took a long time and they worked very hard and worked with multiple multiple multiple ops teams to get it done.

And I gave them ample time to rest afterwards. I announced their success to the CISO and give them major kudos.

But I'm about to be that guy who rewards good work with more work.

I'm going to do the dreaded "Full Security Audit".

I think I'll stretch before I send off these initial enumeration scans. I've got my custom scripts ready. I might step out to buy an energy drink.

Eris damned, even the anticipation has my dopamine and adrenaline flowing.