IoT Part 3: Fire!
June, 2020, Dan McInerney, Senior Security Consultant, Coalfire
When we left off in Part 2 of our blog series, we had just identified the max temperature variable and set it to a much higher number. Our celebrations quickly ended, however. Upon flashing the firmware with the new edited max temperature variable, we realized that the printer would get up to around 261o Celsius then suddenly stop heating and cool back down to room temperature. At least one more security feature must have been implemented to prevent thermal runaway. Tracking this down was significantly harder than tracking down a variable with a known value.
Am I doing it right? An introspective look at "why it's like this"
May, 2020, Mike Weber, Vice President, Coalfire Labs
Cybersecurity, as a practice within organizations, has existed for decades. Larger (or government) organizations have had dedicated cybersecurity functions in place since at least the ‘90s. By the early 2000s, organizations were appointing CISOs, and by the end of that decade over 85% of large organizations had a CISO, and by 2017, over 85% of ALL organizations have appointed a CISO.
The Basics of Exploit Development 3: Egg Hunters
May, 2020, Andy Bowden, Consultant, Coalfire Labs
Hello dear reader. If you have read the other articles in this series, welcome back! If not I encourage you to read the previous installments before proceeding with this post. This post covers a surprisingly useful technique in exploit development called Egg Hunters. In order to demonstrate how Egg Hunters function, we will write an exploit for a 32 bit Windows application vulnerable to a SEH overflow. However, due to how the application handles input, we will be required to use an Egg Hunter to locate our payload in memory move execution to it.
Part Two: Reverse Engineering and Patching with Ghidra
April, 2020, Dan McInerney, Senior Security Consultant, Coalfire
In the first installment of our three-part blog series we learned how to root the Flashforge Finder 3D printer and acquire its firmware. In this post, we will delve into reverse engineering and patching the software using the new open source NSA tool Ghidra, which rivals its expensive competitors such as IDA Pro in value and ease of use.
The Cloud is Beige - The demise of black box testing
April, 2020, Mike Weber, Vice President, Coalfire Labs
Black-box penetration testing is dead. I’d question why it is even a consideration. It’s of limited and dubious value in almost any context. Wait, wait… I didn’t mean that. Put down the pitchforks and torches, development and QA teams, I’m only talking about black-box penetration testing. Yes, traditional software functional or regression testing in a black-box manner does have a purpose. Validating the functional requirements of the code has a place, and it’s valuable. Non-functional black-box testing has a place as well, when evaluating the sturdiness of an application such as load testing and the like. Settle down.