add: DES-08

2026-11-04 09:35:27 +01:00
parent f15e261346
commit 2e62320a9e
46 changed files with 15516 additions and 3 deletions
@@ -3,7 +3,7 @@
 | DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. | 
 | DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code  | Open | Test not yet performed. |
 | DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. |
-| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | Open | Test not yet performed. |
+| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl |  PASS (with findings) | Device: no outdated software on the bridge's exposed interface. Ecosystem (LOQED/Shelly cloud): TLS broadly strong, but low/medium hardening issues, client-initiated renegotiation on `shelly-120:6113` (DoS), TLS 1.3 absent on 2 hosts, outdated nginx 1.21.6 on integrations, version/OS & Express banners, shared `*.shelly.cloud wildcard cert`, missing HSTS, BREACH preconditions on 2 hosts. |
 | DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | PASS | No unnecesarrily open ports on the bridge |
 | DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. | 
 | DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. |
@@ -28,7 +28,57 @@

 ### DES-08

- **Verdict: Open**
+The DES considered for this test are:
+- `mqtt.production.loqed.com:8883`
+- `integrations.loqed.com:443`
+    - No HSTS header
+    - Outdated nginx 
+- `api.production.loqed.com:443`
+    - No HSTS header
+- All of the above:
+    - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
+
+
+And the shelly cloud services:
+- `control.shelly.cloud:443`
+    - No HSTS header
+    - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
+    - Potentially vuln. to CVE-2013-3587
+        - Google’s/Shelly’s hosting config
+- `shelly-120-eu.shelly.cloud:443`
+    - No HSTS header
+    - Exposes nginx and Ubuntu OS
+- `:6113`
+    - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
+    - **Vulnerable to secure client-initiated renegotiation**
+- `shelly-101-eu.shelly.cloud:31234`
+    - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
+    - No HSTS header
+- `shelly-infra1-eu.shelly.cloud:443`
+    - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
+    - No HSTS header
+    - Exposes nginx and Ubuntu OS
+    - **No TLS 1.3**
+- `:9443`
+    - Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
+    - Exposes application banner x-powered-by express
+    - No HSTS header
+- `changelog-backend.shelly.cloud:443`
+    - **No TLS 1.3**
+    - Exposes nginx and Ubuntu OS
+    - Potentially vuln. to CVE-2013-3587
+        - Google’s/Shelly’s hosting config
+- `repo.shelly.cloud:443`
+    - Exposes nginx and Ubuntu OS
+- All `*.shelly.cloud` use wildcard cert.
+
+```bash
+testssl -oA <output> <target>
+```
+
+- **Results**: [testssl reports](test_case_evidence/DES/DES08/)
+
+- **Verdict: PASS (with findings)**

 ### DES-09

@@ -46,7 +96,7 @@ In our network it currently has the address `10.12.2.30`.
 > After the factory reset I had to reconfigure the bridge to determine its new IP.
 > The procedure was captured [here](network/captures/init_after_reset.pcapng) and re-run through the PreTester [here](network/pretester_reports/init_after_reset_report.md).

- **Result**: [nmap report](network/nmap/des09_bridge.nmap)
+- **Result**: [nmap report](test_case_evidence/DES/DES09/des09_bridge.nmap)

 Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext).
 All other ports are filtered.