Martin Schobert - @[email protected]

We occasionally review our clients' internal processes to identify IT security risks. When we discovered large sums of money being transferred with just a few clicks and no transaction verification, we helped and wrote a tool #itsecurity #infosec pentagrid.ch/en/blog/pain00…

A story about looking at the effectiveness of web application firewalls and finding bypasses for the filter ruleset. pentagrid.ch/en/blog/airloc… #WAF #OWASP #coreruleset #ergon #airlock

Pentagrid published two @hackvertor tags for #EAN13 (also Swiss AHV numbers) and #TOTP for #2FA. These tags are available via the Hackvertor Tag Store by @garethheyes . Our blog post explains what these tags do and how they can be used. pentagrid.ch/en/blog/hacker… #pentest #OWASP

If you want to protect your IT #infrastructure against #MITM attacks where an attacker bypasses domain verification to obtain valid certificates, you may want to use #CAA and #accountURI binding, which is easy to set up. pentagrid.ch/en/blog/domain… #hardening

It happened again. We accidentally broke another #hotel check-in #terminal. This time Mr O'Yolo triggered a problem, crashed the #Ariane Allegro Scenario Player and escaped the #kiosk mode, which enabled access to the Windows Desktop: pentagrid.ch/en/blog/ariane… #itsecurity #infosec

Self check-in kiosks at Ibis Budget hotels were affected by a vulnerability that exposed keypad codes that could be used to enter rooms. securityweek.com/hotel-self-che…

IBIS (Accor Hotels) Door Codes Could Easily Be Hacked via Faulty Check-In Terminals avgeeks.aero/ibis-door-code… avgeeks.aero/ibis-door-code…

This is not a late April Fool's joke: After #37C3, we accidentally dumped the keypad codes of almost half of an IBIS hotel's rooms by entering some dashes into a check-in terminal: pentagrid.ch/en/blog/ibis-h… #itsecurity #infosec #ibis #accor #terminal #hotel

#SQLinjection in login dialog of web-based #YABOOK harbour administration allows authentication bypass pentagrid.ch/en/blog/sql-in… #pentest #sailing #hafenverwaltung #imonaboat

@droemfloet Bist Du Zweistein aus Karlshorst?

Multiple vulnerabilities in Lantronix EDS-MD IoT gateway for medical devices: pentagrid.ch/en/blog/multip… #itsecurity #infosec #pentesting #lantronix #iot #medical

♫ Ground control to Major Tom, take the patch and put secure mode on. ♫ github.com/pentagridsec/o… #openstage #openscape #unify

RCE and LPE in a wide range of Mitel Unify #OpenStage and #OpenScape VoIP phones with default config: pentagrid.ch/en/blog/rce-an… #itsecurity #infosec #pentesting #voip #unify

A few email-related Python libraries do not check server certificates. It is nothing new, but a bit surprisingly in 2023 and not everyone got the memo. pentagrid.ch/en/blog/python… #itsecurity #infosec #pentesting #python #email #bugbounty

@KimZetter Erm, ... it is the yearly external audit. #scnr

Hackers stole access tokens from Okta's support unit. "Okta says the incident affected a 'very small number' of customers, however it appears the hackers...had access to Okta’s support platform for at least two weeks" krebsonsecurity.com/2023/10/hacker…

The #Liferay Portal software < 7.4.3.88 respectively < 7.4.3.92 is affected by persistent cross-site-scripting vulnerabilities. pentagrid.ch/en/blog/stored… #itsecurity #infosec #pentesting

@starbug_pub If your are using them, you better use one of the toes while leaving enough fingerprints to confuse attackers.

6 out of 6 FIDO2 fingerprint sticks “broken” with a dummy from a direct mold. so its possible to make dummies from sneaky sources as well. but its a lot harder than last time I did those test. so its going to be hard to really break all.

We wrote a tool in Python to create file archives such as zip, tar and cpio that include path traversal attacks: pentagrid.ch/en/blog/archiv… #itsecurity #infosec #pentesting

@ustayready @bl4sty Do many people used qpopper back than :-)

@bl4sty This tweet reminds me of the late 90s with imapd and qpopd.

EHLO mailserver AUTH AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARRRGGGHHHHHH.. any actual details? 🙃