Security Advisories from TEHTRI-Security at HITB Europe Jul 03 2010 09:05AM
Laurent OUDOT at TEHTRI-Security (laurent oudot tehtri-security com)

TEHTRI-Security was invited to give a talk called "Web In The Middle,
Attacking Clients", at the first Hack In The Box Europe, Amsterdam (
http://conference.hackinthebox.org/hitbsecconf2010ams/ ).

During our talk, we released multiple advisories and we explained many
issues related to some vulnerabilities. You can find more public
information through the slides available online. Here are some related
details that we wanted to share with you through this mailing list :

o CVE-2010-1752: TEHTRI-Security inside the iPhone iOS4
TEHTRI-Security found a stack overflow in CFNetwork API, through the
code used to handle URL. By visiting a maliciously crafted website, we
found that it might lead to an unexpected application termination or
arbitrary code execution. This issue has been addressed by Apple through
improved memory handling. CFNetwork is shared by most applications from
the App Store, that need to talk over the web. Check the User-Agent of
your applications to be sure (example: Facebook/3.12 *CFNetwork/459*
Darwin/10.0.0d3 ). Update to iOS4 to improve your security.
More information here:
CVE-2010-1752 in http://support.apple.com/kb/HT4225

o Security-Advisory: TEHTRI-SA-2010-028 - 0day on BlackBerry
TEHTRI-Security found a security issue, and created a client-side attack
0day for BlackBerry cellphone devices (Hotspot Browser). The code was
shared with RIM who handled this vulnerability quickly, so that a fix
might be added in a future release. It allows an attacker to crash the
remote web application. This was scored with a CVSS of 5.

o Security-Advisory: TEHTRI-SA-2010-027 - 0day on HTC
TEHTRI-Security found a security issue, and created a client-side attack
0day for HTC Windows Mobile cellphone devices (Opera). HTC was contacted.

o Security-Advisory: TEHTRI-SA-2010-026 - 0day on iPad
TEHTRI-Security found a security issue, and created a client-side attack
0day for the (awesome) iPad device. The code was shared with Apple who
handled this vulnerability quickly, so that a fix might be added to a
future release. A demo was done during our talk, without giving
dangerous details to the attendees. It was only shown for attendees of
HITB Europe. No further information will be shared to the public before
Apple release a patch.

o Security-Advisory: TEHTRI-SA-2010-026 - 0day on ThalysNet
TEHTRI-Security found some security issues on Thalys European trains,
with the Internet access on board. To us, many Internet access shared on
airports, stations, trains, in-flights, hotels, etc, are full of
security vulnerabilities, because no penetration test were organized
with IT Security experts before the service is open to the public.
Dealing with ThalysNet, it concerns half a million of end-users.
ThalysNet was contacted.

We also glanced at the differences related to the use of http and https
on worldwide web services like hotmail, yahoo, twitter, facebook,
linkedin, google mail, apple mobile me... A table on slide 32 might help
beginners who would like to check the current situation. Dealing with
https issues, as we said, we encourage you to have a look at initiatives
like the one from the EFF: https://www.eff.org/https-everywhere

Some of our security advisories were already covered by the local press
from NL:

The HITB crew have put slides of our conference on their web site:

If you want to get more details & technical secrets from
TEHTRI-Security, feel free to join us "in real life" during our next
trainings sessions & talks, or feel free to contact us for specific
needs. We have public events planned next months (Asia, Europe).
Check-out our public agenda here:

See you soon.
Thanks. Take care.

Laurent Oudot, founder & CEO of TEHTRI-Security
TEHTRI-Security, "This is not a game".

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus