Shelly-Loqed-Touch/Document1-Network.md

Test-ID	ISTG Reference	Name	Tools	Status	Finding
DES-02	ISTG-DES-AUTHZ-001	Unauthorized Access to Data Exchange Services	nmap, mitm, adb	Open	Test not yet performed.
DES-06	ISTG-DES-INFO-001	Disclosure of Implementation Details (DES)	nmap, jadx, smali code	Open	Test not yet performed.
DES-07	ISTG-DES-INFO-003	Disclosure of User Data	Wireshark, tcpdump, mitm	Open	Test not yet performed.
DES-08	ISTG-DES-CONF-001	Usage of Outdated Software	testssl.sh, openssl	PASS (with findings)	Device: no outdated software on the bridge's exposed interface. Ecosystem (LOQED/Shelly cloud): TLS broadly strong, but low/medium hardening issues, client-initiated renegotiation on shelly-120:6113 (DoS), TLS 1.3 absent on 2 hosts, outdated nginx 1.21.6 on integrations, version/OS & Express banners, shared *.shelly.cloud wildcard cert, missing HSTS, BREACH preconditions on 2 hosts.
DES-09	ISTG-DES-CONF-002	Presence of Unnecessary Software (Network Services)	nmap	PASS	No unnecesarrily open ports on the bridge
DES-10	ISTG-DES-SCRT-001	Access to Confidential Data	adb/root, Frida, SQLCipher, sqlite3	Open	Test not yet performed.
DES-11	ISTG-DES-CRYPT-001	Usage of Weak Cryptographic Algorithms (Transport Encryption)	testssl.sh, openssl	Open	Test not yet performed.
DES-12	ISTG-DES-INPV-001	Insufficient Input Validation (Network API)	mitm	Open	Test not yet performed.
DES-13	ISTG-DES-INPV-002	Code or Command Injection (Network API)	mitm	Open	Test not yet performed.

---

Test Case Execution

DES-02

• Verdict: Open

DES-06

• Verdict: Open

DES-07

• Verdict: Open

DES-08

The DES considered for this test are:

• mqtt.production.loqed.com:8883
• integrations.loqed.com:443
  • No HSTS header
  • Outdated nginx
• api.production.loqed.com:443
  • No HSTS header
• All of the above:
  • Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers

And the shelly cloud services:

• control.shelly.cloud:443
  • No HSTS header
  • Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
  • Potentially vuln. to CVE-2013-3587
    • Google’s/Shelly’s hosting config
• shelly-120-eu.shelly.cloud:443
  • No HSTS header
  • Exposes nginx and Ubuntu OS
• :6113
  • Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
  • Vulnerable to secure client-initiated renegotiation
• shelly-101-eu.shelly.cloud:31234
  • Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
  • No HSTS header
• shelly-infra1-eu.shelly.cloud:443
  • Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
  • No HSTS header
  • Exposes nginx and Ubuntu OS
  • No TLS 1.3
• :9443
  • Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
  • Exposes application banner x-powered-by express
  • No HSTS header
• changelog-backend.shelly.cloud:443
  • No TLS 1.3
  • Exposes nginx and Ubuntu OS
  • Potentially vuln. to CVE-2013-3587
    • Google’s/Shelly’s hosting config
• repo.shelly.cloud:443
  • Exposes nginx and Ubuntu OS
• All *.shelly.cloud use wildcard cert.

testssl -oA <output> <target>

• Results: testssl reports

• Verdict: PASS (with findings)

DES-09

Some ports have already been scanned, see initial information gathering.

nmap -p 1-65535 -T4 -A -v 10.12.2.30

Zenmap's "intense scan, all TCP ports".

The bridge is the only device with an IP network interface (the lock is BLE-only). In our network it currently has the address 10.12.2.30.

After the factory reset I had to reconfigure the bridge to determine its new IP. The procedure was captured here and re-run through the PreTester here.

• Result: nmap report

Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext). All other ports are filtered.

• Verdict: PASS

DES-10

• Verdict: Open

DES-11

• Verdict: Open

DES-12

• Verdict: Open

DES-13

• Verdict: Open