4 ms·
"Security" through obscurity vs. the spotlight of the BBC! Both sides are pretty much true: the simplistic proof-of-concept XSS requires the target device's int
by j_s 10y ago
"Security" through obscurity vs. the spotlight of the BBC! Both sides are pretty much true: the simplistic proof-of-concept XSS requires the target device's internal IP address. This product winds up accomplishing its intended purpose simply because of how few active users it has.
It is unfortunate the takeaway from the initial post was a "works on my machine" XSS attack rather than emphasizing that there is only one widely shared public/private key pair "securing" all communication all of the devices. There is plenty of precedent demonstrating that not-private private keys is a serious issue eg. https://isc.sans.edu/diary/22076 https://isc.sans.edu/diary/22076
Speculatively, all that old software is a juicy target as well (obscured by ARM vs. x86). However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. I'm most curious about how this person was selected by the BBC to review the device. Imagine if Matthew Garrett had done it!
- MichaelGG 10y agoIt publishes the internal IP address in public DNS under localmail.domain.
- j_s 10y agoNice, I missed that in the big list at the end! That should have allowed the security researcher to make significant progress in the bogus security test with ease. [Edit: Didn't see this before; thanks!]
- pritambaral 10y agoWhere are you getting that the takeaway was an XSS attack? There's a whole host of things wrong that the researcher finds — it almost reads like a how-to of bad security. When you say: > However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. It seems like you haven't read the original report. The researcher does NOT specialize in XSS (can one?), and is even lent a hand at the XSS portion. Here, read the original: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ https://scotthelme.co.uk/nomx-the-worlds-most-secure-communi...
- j_s 10y agoI agree a number of things wrong were listed. The one concrete attack demonstrated in the post (the one author put the effort into demonstrating), and thus directly addressed in the response (the takeway chosen by the vendor), was an example XSS [edit:CSRF] attack. Scott Helme has released a pair of tools focused on making sure websites anti-XSS/security headers are correct. (https://securityheaders.io/ https://securityheaders.io/ https://report-uri.io/ https://report-uri.io/ ) The bulk of his public messaging prior to this gigantic luck surface area boost could be categorised as XSS-related (website security headers). I was suprised that he needed help but good on him for being honest. I am sure this entire process has been a learning experience for Scott and will be a tremendous positive for him in his future endeavors. I remain curious how the BBC chose him; I'd guess he is one of the most polished/presentable security guys in the UK when it comes to network protocols. Edit: I need to clarify my terminology; when I say XSS above I basically mean everything under the "Web app testing" portion of the original article. (So basically s/XSS/web app testing/ please. In fact it is CSRF that is demonstrated, in my mind they've wound up classified as similar enough to get the idea across.) The security researcher chose to dive deepest into the vulnerabilities that most benefitted his side projects - which makes perfect sense! Is remote root possible with all that old software on an RPi? Feels possible to me.
- deleted 10y ago[deleted]