120 lines
4.4 KiB
Markdown
120 lines
4.4 KiB
Markdown
| Test-ID | ISTG Reference | Name | Tools | Status | Finding |
|
||
| ------- | -------------- | ---- | ----- | ------ | ------- |
|
||
| DES-02 | ISTG-DES-AUTHZ-001 | Unauthorized Access to Data Exchange Services | nmap, mitm, adb | Open | Test not yet performed. |
|
||
| DES-06 | ISTG-DES-INFO-001 | Disclosure of Implementation Details (DES) | nmap, jadx, smali code | Open | Test not yet performed. |
|
||
| DES-07 | ISTG-DES-INFO-003 | Disclosure of User Data | Wireshark, tcpdump, mitm | Open | Test not yet performed. |
|
||
| DES-08 | ISTG-DES-CONF-001 | Usage of Outdated Software | testssl.sh, openssl | PASS (with findings) | Device: no outdated software on the bridge's exposed interface. Ecosystem (LOQED/Shelly cloud): TLS broadly strong, but low/medium hardening issues, client-initiated renegotiation on `shelly-120:6113` (DoS), TLS 1.3 absent on 2 hosts, outdated nginx 1.21.6 on integrations, version/OS & Express banners, shared `*.shelly.cloud wildcard cert`, missing HSTS, BREACH preconditions on 2 hosts. |
|
||
| DES-09 | ISTG-DES-CONF-002 | Presence of Unnecessary Software (Network Services) | nmap | PASS | No unnecesarrily open ports on the bridge |
|
||
| DES-10 | ISTG-DES-SCRT-001 | Access to Confidential Data | adb/root, Frida, SQLCipher, sqlite3 | Open | Test not yet performed. |
|
||
| DES-11 | ISTG-DES-CRYPT-001 | Usage of Weak Cryptographic Algorithms (Transport Encryption) | testssl.sh, openssl | Open |Test not yet performed. |
|
||
| DES-12 | ISTG-DES-INPV-001 | Insufficient Input Validation (Network API) | mitm | Open | Test not yet performed. |
|
||
| DES-13 | ISTG-DES-INPV-002 | Code or Command Injection (Network API) | mitm | Open | Test not yet performed. |
|
||
|
||
---
|
||
|
||
## Test Case Execution
|
||
|
||
### DES-02
|
||
|
||
- **Verdict: Open**
|
||
|
||
### DES-06
|
||
|
||
- **Verdict: Open**
|
||
|
||
### DES-07
|
||
|
||
- **Verdict: Open**
|
||
|
||
### DES-08
|
||
|
||
The DES considered for this test are:
|
||
- `mqtt.production.loqed.com:8883`
|
||
- `integrations.loqed.com:443`
|
||
- No HSTS header
|
||
- Outdated nginx
|
||
- `api.production.loqed.com:443`
|
||
- No HSTS header
|
||
- All of the above:
|
||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||
|
||
|
||
And the shelly cloud services:
|
||
- `control.shelly.cloud:443`
|
||
- No HSTS header
|
||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||
- Potentially vuln. to CVE-2013-3587
|
||
- Google’s/Shelly’s hosting config
|
||
- `shelly-120-eu.shelly.cloud:443`
|
||
- No HSTS header
|
||
- Exposes nginx and Ubuntu OS
|
||
- `:6113`
|
||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||
- **Vulnerable to secure client-initiated renegotiation**
|
||
- `shelly-101-eu.shelly.cloud:31234`
|
||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||
- No HSTS header
|
||
- `shelly-infra1-eu.shelly.cloud:443`
|
||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||
- No HSTS header
|
||
- Exposes nginx and Ubuntu OS
|
||
- **No TLS 1.3**
|
||
- `:9443`
|
||
- Potentially vuln. to CVE-2013-0169, tied to obsoleted CBC ciphers
|
||
- Exposes application banner x-powered-by express
|
||
- No HSTS header
|
||
- `changelog-backend.shelly.cloud:443`
|
||
- **No TLS 1.3**
|
||
- Exposes nginx and Ubuntu OS
|
||
- Potentially vuln. to CVE-2013-3587
|
||
- Google’s/Shelly’s hosting config
|
||
- `repo.shelly.cloud:443`
|
||
- Exposes nginx and Ubuntu OS
|
||
- All `*.shelly.cloud` use wildcard cert.
|
||
|
||
```bash
|
||
testssl -oA <output> <target>
|
||
```
|
||
|
||
- **Results**: [testssl reports](test_case_evidence/DES/DES08/)
|
||
|
||
- **Verdict: PASS (with findings)**
|
||
|
||
### DES-09
|
||
|
||
Some ports have already been scanned, see [initial information gathering](Document0-Initial_Information_Gathering.md).
|
||
|
||
```bash
|
||
nmap -p 1-65535 -T4 -A -v 10.12.2.30
|
||
```
|
||
|
||
> Zenmap's "intense scan, all TCP ports".
|
||
|
||
The bridge is the only device with an IP network interface (the lock is BLE-only).
|
||
In our network it currently has the address `10.12.2.30`.
|
||
|
||
> After the factory reset I had to reconfigure the bridge to determine its new IP.
|
||
> The procedure was captured [here](network/captures/init_after_reset.pcapng) and re-run through the PreTester [here](network/pretester_reports/init_after_reset_report.md).
|
||
|
||
- **Result**: [nmap report](test_case_evidence/DES/DES09/des09_bridge.nmap)
|
||
|
||
Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext).
|
||
All other ports are filtered.
|
||
|
||
- **Verdict: PASS**
|
||
|
||
### DES-10
|
||
|
||
- **Verdict: Open**
|
||
|
||
### DES-11
|
||
|
||
- **Verdict: Open**
|
||
|
||
### DES-12
|
||
|
||
- **Verdict: Open**
|
||
|
||
### DES-13
|
||
|
||
- **Verdict: Open** |