5 ms·
One such "interesting finding" is that the VPN software is run with admin privileges, including the parts that deal with concepts which would not need admin pri
by Izmaki 4y ago
One such "interesting finding" is that the VPN software is run with admin privileges, including the parts that deal with concepts which would not need admin privileges, such as debug logging, because this increases the attack surface for a hacker who already has limited control of the machine, to potentially elevate their privileges, if they manage to find vulnerability.
This is one of their medium findings. This report smells like "Guys, we MUST find something, give me something, anything!"... :P
- jeffbee 4y agoYeah, I love the finding that an attacker in possession of your unlocked iOS device could discover your email address. Big news!
- bri3d 4y agoThese reports usually start from a baseline template/checklist. I'm sure the "unobfuscated binary" and "admin" findings that everyone on this thread is making fun of are part of the SOP for NCC Group audits of native applications. We laugh and argue that this makes pentests a joke (which plenty are!), but at the end of the day that "admin" note resulted in a material improvement, however tiny, in the system. Google reacted by removing the need for escalation from the application and now an attacker needs one more exploit to build a full chain.
- nibbleshifter 4y agoThey are SOP/standard findings. You work through a checklist for arse covering, which generates a lot of meaningless/low value findings. If you omit a lot of those issues, the client thinks you didn't do the work sufficiently. If you put in too many of those findings, the report gets made fun of for containing "filler".