Pinned post
John Althouse
Verified account This account is verified. Learn more@4A4133
Founder & CTO at FoxIO
Inventor of the JA4+ network fingerprinting suite.
Also,
JA3/S (TLS)
HASSH (SSH)
CYU (QUIC)
JARM (TLS Servers)
Inventor of the JA4+ network fingerprinting suite.
Also,
JA3/S (TLS)
HASSH (SSH)
CYU (QUIC)
JARM (TLS Servers)
226 Following 4.9K Followers 1K Posts
Latest posts 5
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-yo…
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-yo…
foxio.io Choose Your Backend: Three TLS Bugs in GoAhead - FoxIO | Cyber Innovation We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything. Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-ac…
foxio.io/blog/header-ac…
foxio.io Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything. The private keys for the eMudhra CA were compromised yesterday. Here's all the IPs likely hosting fake eMudhra certificates. These were found using JA4X on hunt.io but you can do the same thing on Censys, Xpanse, Validin, or any other tool running JA4+
Introducing JA4Scan, the latest addition to JA4+
JA4Scan is available now and built into (or coming soon to) all of the tools you already use including Censys, Palo Alto Networks, Hunt, SecurityScorecard, Modat, Validin, and more.
foxio.io/blog/introduci…
JA4Scan is available now and built into (or coming soon to) all of the tools you already use including Censys, Palo Alto Networks, Hunt, SecurityScorecard, Modat, Validin, and more.
foxio.io/blog/introduci…
foxio.io Introducing JA4Scan: Active Server Fingerprinting for TLS and QUIC - FoxIO | Cyber Innovation We solve the world’s toughest cyber challenges—creating breakthrough technology and embedding it into the systems that run everything.