Secfault Security GmbH

In-depth IT security consulting

[Secfault Security GmbH @secfaultsec]

The other day, our colleague Oliver decided to play around with Syzkaller to fuzz the FreeBSD Kernel. He added some support for the Bluetooth stack and indeed found an OOB read. If you're interested, check our blog post here: https://t.co/spfvizWozJ

[Secfault Security GmbH @secfaultsec]

We recently did some internal research and took a look at the JavaScript runtime Deno. We found a couple of interesting bypasses for their permission system. If you'd like to learn more, please feel free to check out our blogpost at https://t.co/worNH0qJ4G.

[Secfault Security GmbH @secfaultsec]

We've taken (another) look at the OpenOlat learning management solution and found an XXE issue, which can be turned into an arbitrary file read and an SSRF problem. In case you're interested, make sure to read our blog post at https://t.co/iJmS8VPtR3!

[Secfault Security GmbH @secfaultsec]

We recently decided to take a look at LibreOffice, and found an (almost) arbitrary file write issue, which is now public (CVE-2023-1183). If you're interested, check out https://t.co/aRQta0XrHM for details :)

[Secfault Security GmbH @secfaultsec]

Last year we did a number of projects for AgileBits, focusing on the 1Password ecosystem. The reports have now been made public, so in case you're interested to get an impression feel free to check https://t.co/rbWpdIWUuX.

[Secfault Security GmbH @secfaultsec]

Recently, @OldM4nHunting took a look at the Visual Studio App Center SDK for iOS and macOS and found an insecure object deserialization issue. Here's a write-up on her journey of identifying and exploiting the issue: https://t.co/EE6kReELPP.

[Secfault Security GmbH @secfaultsec]

As one of our internal research projects, we've recently taken a look at some self-powered wireless 433MHz light switches, particularly on reverse-engineering the used radio protocol and building a custom receiver. If you're interested, make sure to check https://t.co/tmBj1sG8ix.

[Secfault Security GmbH @secfaultsec]

We have recently conducted a review of the 1Password developer tools. Our report is now public, so please feel free to check it out: https://t.co/KQvudlUFdH

[Secfault Security GmbH @secfaultsec]

Some time ago, we've had a look at the F*EX file exchange solution (https://t.co/UdW40fsXJL), and found a pre-auth RCE. We now published a small write-up on this: https://t.co/x47OUrOUcM

[Karsten @gr4yf0x]

I dived into iOS kernel exploitation recently and have written a kernel exploit for chain 3 of @i41nbeer blog post series from last August. Check out the post at the @secfaultsec blog :) https://t.co/jQWgsqhsKg Feedback highly appreciated!

[Secfault Security GmbH @secfaultsec]

Our colleague @gr4yf0x did a research project on re-creating a custom iOS exploit. You can read about his adventures here https://t.co/Vw3NYUhDOP :)

[X41 D-SEC GmbH @X41Sec]

All applications for the Pro-bono Pentests for COVID-19-related Apps & Software have been reviewed and the committee has chosen the winners. More info to follow soon 🙂

[X41 D-SEC GmbH @X41Sec]

Today is the last day to apply for a FREE pentest on your application that helps fight COVID-19! Since the closure of schools requires good tools for educational learning, we would love to see last minute submissions from this field.

[Secfault Security GmbH @secfaultsec]

We're proud to announce that together with our partners from @SecureLayer7, @cure53berlin and @X41Sec, we are offering pro-bono pentests for COVID-19 related apps/software: https://t.co/Frn8zG2bqt

[confidenceconf @CONFidenceConf]

#TalkAnnouncement

Karsten König will be joining #CONFidence2020 with a talk about Exploiting Reference Counter Vulnerabilities Inside The FreeBSD Kernel ⚡️

👇Check out the details of his talk and get your ticket here 👇
https://t.co/I7WkksiOPD

[Jan Muenther @janmuenther]

@teh_gerg @koehntopp Ah indeed, that’s another important point, especially in complex high risk projects. Particularly meaningful with all this microservice salad and abstraction layers.

[greg @teh_gerg]

@janmuenther @koehntopp Well, it also provides an end-to-end view of a product at a certain stage, which can help identifying issues emerging from the interplay of its components. But that's another focus than the classical pentest before release idea.

[Jan Muenther @janmuenther]

@koehntopp @teh_gerg to be fair though, I still use in pen testing - as a wake up call for teams in denial, and as a verification of assumptions in a very dedicated, targeted fashion as @teh_gerg outlined. Ideally, you consider pen test targets when you conceptualize your mitigations.