22
Jul
2019
A month after the end of Hack In Paris 2019, it's time to have a retrospective about the Wargame and announce the writeups winners.
A month after the end of Hack In Paris 2019, it's time to have a retrospective about the Wargame and announce the writeups winners.
We had seen many and many papers about attacking alarm systems. Most of the targets had been cheap, insecure and easily breakable.
At the beginning of this year (2019), we decided to look at something more robust. Thus, we purchased a better and quite expensive alarm, granted with a certification from the French standard, level 2 (NF&A2P**).
The NF&A2P certification (Norme Française Alarme Prévention Protection, sometimes spelled NF A2P or NFA2P) designates a French standard that assesses the level of efficiency and resistance of alarm systems. The two stars indicate one of the most secure level against burglars (NF&A2P Referential).
But how does it stand against digital attacks?
Chashell is a Go reverse shell that communicates over DNS. It can be used to bypass firewalls or tightly restricted networks.
Two XSS vulnerabilities have been discovered in Zimbra Collaboration (initially in version 8.8.8). Zimbra Collaboration is an open source messaging and collaboration solution.
Organisé par Sysdream, Division Cybersécurité de Hub One, l’événement Hack In Paris réunira, du 16 au 20 juin 2019, les grands noms de la sécurité informatique et les experts techniques du hacking, autour de formations, conférences et workshops de haut niveau.
En mars 2018, Sysdream a découvert plusieurs vulnérabilités sur le téléphone IP AudioCodes 420HD (version du logiciel embarqué : 2.2.12.126).
Ces vulnérabilités ont été publiées et chacune d'entre elles est associée à un identifiant CVE :
Dans cet article, nous allons nous concentrer sur la vulnérabilité d'injection de commandes.
In March 2018, Sysdream have discovered several vulnerabilities in the 420HD IP phone (firmware version: 2.2.12.126). This article describes the exploitation steps.
The AudioCodes 400HD series of IP phones is a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and contact center markets.
Most of user inputs in the CGI interface are not protected against XSS injections.
These vulnerabilities have only been tested on the 420HD phone.
The AudioCodes 400HD series of IP phones consists in a range of easy-to-use, feature-rich desktop devices for the service provider hosted services, enterprise IP telephony and contact center markets.
The CGI scripts used on the 420HD phone (web interface) do not filter user inputs correctly. Consequently, an authenticated attacker could inject arbitrary commands (Remote Code Execution) and takes full control over the device. For example, it is possible to intercept live communications.
Hack In Paris, l’évènement de sécurité informatique aura lieu, pour la 9ème année consécutive, du 16 au 20 juin prochain à la Maison de la Chimie. Participez au Call For Paper !