[FD] Firefox FindMyDevice Critical ClickJacking Security Vulnerability

Author Name Mohamed Abdelbasset Elnouby Abouelwaffa Contact Details: https://twitter.com/SymbianSyMoh http://ift.tt/1ZSa90C Vulnerability Details: Firefox FindMyDevice Critical ClickJacking Security Vulnerability Vulnerability: ClickJacking Info: http://ift.tt/J8smSf Affected URL(s): http://ift.tt/1sSIwWw PoC Screenshot: Included as an attachment For non email receptionist "https://goo.gl/FUkFVm" In-depth analysis of the Vulnerability: Regardless The security protection mechanism which is that that attacker definitely can't guess or brute force the Device id "8fcXXXXc40de04b3803945XXXXXXXXXX" which is a part of the URL to the victim's profile to make a successful clickjacking attack iframe, in fact this protection mechanism is too low coz all the attacker to do is just to point the logged in user to his iframe source http://ift.tt/1sSIwWw and Mozilla will care about the rest "redirect the victim to the correct logged in active device id. What attacker can do: 1-"Erase the victim's device data" With just only 3 clicks by the victim himself if he tricked with "click here to win a 50 BTC for Example 2-"Lock The victim device or change his lock code" if it is the first time to be set "4 clicks" 3-"Makes the Device ringing" 2 clicks" Expected results: Find My Device web interface mustn't be iframed Apply XFO or Frame Busting techniques More Details About clickjacking: Because of No Frame Busting Techniques or X-Frame-Options header, the whole website is vulnerable to Clickjacking attacks which could lead to a full account takeover considering such scenario: 1. Attacker will iframe any sensitive the website page and adjust the iframe size and add a "divs" as a layers on the unwanted-to-show parts of the original web page to fool and trick the user. 2. User get tricked by the crafted page and followed the attacker's instruction to do a specific clicks to the iframed page 3. Unwanted actions happened in the logged in user's session in result to the attack's clicks. Remedy: 1- Add an X-Frame-Options HTTP Header and set it's value to "Deny" or "Sameorigin" as you can see it suitable to mitigate such attacks 2- Use iframe busting techmiques in JS code like this: or Actual results: Find My Device web interface is iframable which makes it vulnerable to ClickJacking Attacks References: http://ift.tt/1fGFb7T Original Report: http://ift.tt/1QNoe9w Thanks​

Source: Gmail -> IFTTT-> Blogger

Re: [FD] WinRAR SFX v5.21 - Remote Code Execution Vulnerability

[FD] Seagate Central NAS vulnerabilities

I have contacted Seagate regarding the following and was twice informed of a 90-day window for disclosure. I followed up to no response and have decided, following the culmination of those 90-days, to publish. The fact that embedded devices are vulnerable is not new. This is really not newsworthy, but perhaps we can aim higher? The Central NAS is not Seagate’s most popular model, but it does share code with other, more popular products such as the BlackArmor range. Vulnerabilities: - Web application allows unauthorized modification of IP address and hostname. - World-writable system files allow local users to compromise configuration and perform local privilege escalation. (I’ve been informed an updated firmware patch “somewhat” mitigates this, but is unconfirmed) - Common root password is set on all devices and /etc/shadow is world-readable. - Firmware updates are vulnerable to a MITM attack. These are performed over plain HTTP and are not signed, allowing attackers to readily deliver malicious payloads. - The NAS supports multi-user / multi-tenant operation. The files of these users are all set, by default, to mode 777. Users are given SSH access and may readily access and modify each other’s files. - The device exposes a phpinfo() page to unauthorized users (information disclosure). These issues were really low-hanging-fruit. I’m certain a number of remaining issues have yet to be discovered here, but for myself, I’m done. Finally, see the following blog post for more detail and a timeline of communications with the vendor:

Source: Gmail -> IFTTT-> Blogger

[FD] Western Digital - My Passport / My Book self-encrypting external hard drive series - Multiple vulnerabilities

Research overview: ========================== Research on Western Digital wide-spread self-encrypting hard drive series "My Passport" / "My Book". Devices researched utilizes mandatory HW AES encryption. Authors: ========================== Gunnar Alendal Christian Kison modg Paper and presentation links: ========================== Full paper at Cryptology ePrint Archive: http://ift.tt/1ReRhCS Presentation slides, based on research paper: http://ift.tt/1LrN3HX Vulnerabilities disclosed: ========================== Multiple vulnerabilities, including: * Multiple authentication backdoors, bypassing password authentication * AES factory key recovery attacks, exposing user data on all affected devices, regardless of user password * Exposure of HW PRNGs used in cryptographic contexts * Unauthorized patching of FW, facilitating badUSB/evil-maid attacks Vendor notification: ========================== The vendor has been informed of the research. Patches: ========================== The authors are not aware of any fixes. Architectures researched: ========================== USB Bridge Vendor - Chip model - Architecture =============== JMicron - JMS538S - Intel 8051 Symwave - SW6316 - Motorola M68k PLX - OXUF943SE - ARM7 Initio - INIC-1607E - Intel 8051 Initio - INIC-3608 - ARC 600 JMicron - JMS569 - Intel 8051 ===============

Source: Gmail -> IFTTT-> Blogger

Sporting rallies for 3-3 draw against 9-man Granada in Spain

GIJON, Spain (AP) Sporting Gjion scored two late goals after Granada had been reduced to nine men to claim a dramatic 3-3 draw in the Spanish league on Monday.

from FOX Sports Digital http://ift.tt/1XfXz9g
via IFTTT