@llorobrillo@jimdmaaa@moonsuggsr@m1_0__0 “tudbo papeada jijijiji ai ke disa aoda voi a fdexead ke me gdoomeadon en twiter i desidle insed a dod ombded ke no lod viodadon pdostituiedon y deventadon seksuadmente komo aminmuhhh”
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
https://t.co/AYUgNsrA0f
¿Saben que es lo verdaderamente grave?
Que se pueda ver la cabecera con la versión exacta. Más allá de que haya versiones viejas.
Una de las medidas más básicas de hardening es justamente apagar la exposición de versión.
Desde el vamos que cualquiera pueda escanear y ver la versión exacta habla de la nula ciberseguridad de los organismos estatales.