The Smartwares C935IP is an IP surveillance camera with night vision and motion detection. The camera can be configured to send an alarm email when motion is detected. Enabling this option makes it possible for an attacker to obtain login information from the used account.
Die Curesec GmbH berät Unternehmen bei der Umsetzung sicherer IT-Systeme. Wir bieten Schwachstellenanalysen von Umgebung und Applikationen, z.B. in Onlineshops, Firmennetzwerken, Applikationen und externen Devices, um Unternehmens- und Kundendaten vor schädlichem Zugriff abzusichern.
This bug is similar to CVE-2013-6272 but is only exploitable on older Android versions. The bug exists in the component com.android.contacts.
We conducted a deep investigation of android components and created some CVEs plus reporting Bugs to the Android Security Team in late 2013. Today we want publish one reported and one similar vulnerability.
Marco went to Miami to give two talks at the Be Mobile Conference of Blackberry.
On may 7th, Marco gave a presentation at the BSI Cyber-Alliance conference about heartbleed.
The Heartbleed bug is a programming error in the versions 1.0.1 to 1.0.1f of the open-source OpenSSL cryptography library. Curesec has published hbad, a Heartbleed client side tool to check for this critical security gap.
Two days ago a critical security gap in one of the most common encryption protocolls (SSL) named „Heartbleed“ was published. We offer a free checkup to our clients!
Nsdtool is a toolset of scripts used to detect netgear switches in local networks.
Various components of the LiveZilla application are vulnerable to cross site scripting. An attacker can hijack an operator with cross site scripting.
An 1click file that allows an admin to log into LiveZilla using a mouse click is saved in a xml representation. This xml file includes the admin username and password in plaintext.
This vulnerability enables any rogue app at any time to remove all existing device locks activated by a user. Furthermore we have created an app to demonstrate the issue. You can choose two options, remove all locks right away or remove them at a defined time.
On Windows systems with PHP versions installed that allow null bytes in the URL it is possible to turn a local file inclusion vulnerability to a full remote code execution vulnerability.
We are back with a great blogpost. This time about data exfiltration using ping, packed together as a simple backdoor-like code. The technique may work in generell for linux and windows as well, however the main target and interest was Android.
This vulnerability can be used to get payment credentials for Google Wallet and Paypal by abusing the popular application Whatsapp.
Today, we will show a bug concerning OpenSSH. OpenSSH is the most used remote control software nowadays on *nix like operating systems. Legacy claims it replaced unencrypted daemons like rcp, rsh and telnet. Find a version at: https://www.openssh.com.
In Part 1 of the analysis we have seen a first description of the dropper and how to extract the executeable placed in the file. To move forward with work we dumped the memory with the decrypted virus body and continued the analysis.
Some days ago we received an email with a double zipped dropper agent included. We decided to start an analysis. This is the first part with our results, in this blogpost we only focus on the dropper itself.
This time I will focus on FreeBSD kernel developement. The recent stable version of FreeBSD is 9.0, but for this example we will use a version 8.1 with i386 architecture.
Wir bei Curesec haben uns mit Direct Memory Access (DMA) als Angriffsvektor auf Rechner beschäftigt. Dies haben wir vor allem getan, um die Sicherheit unserer eigenen Rechner entsprechend sicherstellen zu können. Dieser Blogartikel stellt die Ergebnisse dieser Untersuchung vor.
