I am developing a tool to check cryptographic public keys for known vulnerabilities called badkeys . During the Q&A session of a presentation about badkeys at the German OWASP Day , I was asked whether I had ever used badkeys to check cryptographic keys in OpenID Connect setups. I had not until then. OpenID Connect is a single sign-on protocol that allows web pages to offer logins via other…
A few days ago, a download link for a leak of configuration files for Fortigate/Fortinet devices was posted on an Internet forum. It appears that the data was collected in 2022 due to a security vulnerability known as CVE-2022-40684. According to a blog post by Fortinet in 2022 , they were already aware of active exploitation of the issue back then. It was first reported by heise , a post by Kevin…
I recently needed to create a random password in a piece of JavaScript code. It was surprisingly difficult to find instructions and good examples of how to do that. Almost every result that Google, StackOverflow, or, for that matter, ChatGPT, turned up was flawed in one way or another. Let s look at a few examples and learn how to create an actually secure password generation function. Our goal is…
Noticing that my old blog still gets considerable traffic and has a substantial number of people accessing its feeds, I thought I should announce a project I recently started. When discussing climate change and solutions, we often consider actions like replacing coal power plants with clean energy sources. But while these are important, they are the easy part. There is a whole range of emission…
I want to highlight a common misconfiguration in the DNS records for e-mail servers. When a domain is configured to receive mails usually a DNS record of the type MX is configured pointing to the host name of the mail server. Notably, according to the respective RFC 1035 the MX record must contain a domain name and may not directly point to an IP address. However some mail servers do configure an…
BigBlueButton is a free web-based video conferencing software that lately got quite popular, largely due to Covid-19. Earlier this year I did a brief check on its security which led to an article on Golem.de (German) . I want to share the most significant findings here. BigBlueButton has a feature that lets a presenter upload a presentation in a wide variety of file formats that gets then…
For a small web project I recently had to consider how to generate secure tokens to prevent Cross Site Request Forgery (CSRF). I wanted to share how I think this should be done, primarily to get some feedback whether other people agree or see room for improvement. I am not going to discuss CSRF in general here, I will generally assume that you are aware of how this attack class works. The standard…
I would like to point out a security problem with a classic variant of web space hosting. While this issue should be obvious to anyone knowing basic web security, I have never seen it being discussed publicly. Some server operators allow every user on the system to have a personal web space where they can place files in a directory (often ~/public_html ) and they will appear on the host under a…
Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising. When you see something like this with an IT security background you start to wonder if this can be abused for an attack. While I couldn t come up with anything, I started to wonder what else you could include. As you can basically include arbitrary…
In discussions around the PGP ecosystem one thing I often hear is that while PGP has its problems, it s an important tool for package signatures in Linux distributions. I therefore want to highlight a few issues I came across in this context that are rooted in problems in the larger PGP ecosystem. Let s look at an example of the use of PGP signatures for deb packages, the Ubuntu Linux installation…
HackerOne is currently one of the most popular bug bounty program platforms. While the usual providers of bug bounty programs are companies, w while ago I noted that some people were running bug bounty programs on Hacker One for their private projects without payouts. It made me curious, so I decided to start one with some of my private web pages in scope. The HackerOne process requires programs…
I recently wrote down my thoughts about why I think deprecated cryptographic standards are to blame for the Efail vulnerability in OpenPGP and S/MIME. However I promised that I ll also cover the other huge part that made a bug like Efail possible: HTML mails. Just a quick recap of the major idea of Efail: It s a combination of ways to manipulate encrypted messages and use active content in mails…
I have a lot of thoughts about the recently published efail vulnerability, so I thought I d start to writeup some of them. I d like to skip all the public outrage about the disclosure process for now, as I mainly wanted to get into the technical issues, explain what I think went wrong and how things can become more secure in the future. I read lots of wrong statements that "it s only the mail…
A few days ago I figured out that several blogs operated by T-Mobile Austria had a Git repository exposed which included their wordpress configuration file . Due to the fact that a phpMyAdmin installation was also accessible this would have allowed me to change or delete their database and subsequently take over their blogs. Git Repositories, Private Keys, Core Dumps Last year I discovered that…
I discovered a couple of more or less minor security issues in Firefox lately. None of them is particularly scary, but they affect interesting corner cases or unusual behavior. I m posting this mainly hoping that other people will find it inspiring to think about unusual security issues and maybe also come up with more realistic attack scenarios for these bugs. I d like to point out that Mozilla…