Monday, April 12, 2021
  • Setup menu at Appearance » Menus and assign menu to Top Bar Navigation
Advertisement
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
No Result
View All Result
Home Internet Security

Digital sign systems allowed hacker access through default passwords

February 4, 2019
in Internet Security
Digital sign systems allowed hacker access through default passwords
586
SHARES
3.3k
VIEWS
Share on FacebookShare on Twitter

A researcher has uncovered severe vulnerabilities in digital signage software developed by Tightrope Media Systems (TRMS) thanks to the use of a default password.

The findings were made due to a recent penetration test of the Carousel system conducted by cybersecurity researcher Drew Green.

You might also like

Washington State educational organizations targeted in cryptojacking spree

Critical Zoom vulnerability triggers remote code execution without user input

Nation-state cyber attacks targeting businesses are on the rise

Green’s client was making use of the software on an appliance provided by TRMS which the researcher describes as “essentially an x86 Windows 10 PC.”

As documented in a recent blog post, the tests began in the worst way — as Green was able to walk straight in due to an unchanged default administrator password, a bug now assigned CVE-2018-18929.

After accessing the web interface without any need to guess or brute-force credentials, Green then found references online to an arbitrary file read (LFI) vulnerability present in the software’s RenderingFetch API function, CVE-2018-14573.

See also: Facebook’s worst privacy scandals and data disasters

The researcher decided to explore further. TRMS’s Carousel system allows users to upload “bulletins” which are the items displayed on digital signs.


Drew Green

The interface accepts .ZIP files for uploads, and during testing, Green was not only able to export existing, legitimate bulletins, but was also able to upload a .ZIP file containing two malicious files to Carousel.

However, the researcher came across a stumbling block when he attempted to travel to the URL of the malicious files.

“It appeared that when inserting files into this ZIP archive, the path separator for files and directories was being set to the forward-slash character (“/”) rather than the backslash character (“”),” Green said. “This caused the files I added to be discarded by the server upon upload. I was eventually able to see this clearly by opening the file in a hex editor.”

TechRepublic: Spectre and Meltdown explained: A comprehensive guide for professionals

In order to overcome this barrier, all it took was for the researcher to manually change the characters in question. Green was then able to execute commands on the system via a web shell.

With access assured, the researcher uploaded a Powershell file which connected a remote shell back to his system — granting Green the ability to upload arbitrary files and remotely execute code.

Another vulnerability, CVE-2018-18931, was uncovered which allowed the researcher to bump up privileges on a user account to a local administrator, and while exploiting the bug required a system restart — something basic accounts cannot do — he was able to send a command to force a reboot and trigger the exploit.

CNET: Samsung SmartThings still hasn’t earned my trust in the smart home

The researcher notified Tightrope Media Systems of his findings in November 2018. The company responded by saying that the vulnerabilities were fixed in the latest version of the firm’s signage software.

However, Green says that Tightrope Media Systems did not request the specifics of the bugs found.

“They have not followed-up with me to discuss with them the specifics of these vulnerabilities,” Green says. “Now that approximately 90 days have elapsed since original disclosure, this information is being made publicly available.”

ZDNet has reached out to Tightrope Media Systems and will update if we hear back.

Previous and related coverage

Credit: Source link

Previous Post

Cryptocurrency Firm Losses $145 Million After CEO Dies With Only Password

Next Post

CSS :placeholder-shown

Related Posts

Washington State educational organizations targeted in cryptojacking spree
Internet Security

Washington State educational organizations targeted in cryptojacking spree

April 10, 2021
Critical Zoom vulnerability triggers remote code execution without user input
Internet Security

Critical Zoom vulnerability triggers remote code execution without user input

April 10, 2021
Nation-state cyber attacks targeting businesses are on the rise
Internet Security

Nation-state cyber attacks targeting businesses are on the rise

April 10, 2021
These are the terrible passwords that people are still using. Here’s how to do better
Internet Security

These are the terrible passwords that people are still using. Here’s how to do better

April 9, 2021
Why do phishing attacks work? Blame the humans, not the technology
Internet Security

Why do phishing attacks work? Blame the humans, not the technology

April 9, 2021
Next Post
How to Change the WordPress Admin Login Logo

CSS :placeholder-shown

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

January 6, 2019
Microsoft, Google Use Artificial Intelligence to Fight Hackers

Microsoft, Google Use Artificial Intelligence to Fight Hackers

January 6, 2019

Categories

  • Artificial Intelligence
  • Big Data
  • Blockchain
  • Crypto News
  • Data Science
  • Digital Marketing
  • Internet Privacy
  • Internet Security
  • Learn to Code
  • Machine Learning
  • Marketing Technology
  • Neural Networks
  • Technology Companies

Don't miss it

Interpretive Analytics in One Picture
Data Science

Interpretive Analytics in One Picture

April 12, 2021
AI and Machine Learning Driven Contract Lifecycle Management for Government Contractors
Machine Learning

AI and Machine Learning Driven Contract Lifecycle Management for Government Contractors

April 12, 2021
Cambridge Quantum Computing Pioneers Quantum Machine Learning Methods for Reasoning
Machine Learning

Cambridge Quantum Computing Pioneers Quantum Machine Learning Methods for Reasoning

April 11, 2021
Why Machine Learning Over Artificial Intelligence?
Machine Learning

Why Machine Learning Over Artificial Intelligence?

April 11, 2021
27 million galaxy morphologies quantified and cataloged with the help of machine learning
Machine Learning

27 million galaxy morphologies quantified and cataloged with the help of machine learning

April 11, 2021
Machine learning and big data needed to learn the language of cancer and Alzheimer’s
Machine Learning

Machine learning and big data needed to learn the language of cancer and Alzheimer’s

April 11, 2021
NikolaNews

NikolaNews.com is an online News Portal which aims to share news about blockchain, AI, Big Data, and Data Privacy and more!

What’s New Here?

  • Interpretive Analytics in One Picture April 12, 2021
  • AI and Machine Learning Driven Contract Lifecycle Management for Government Contractors April 12, 2021
  • Cambridge Quantum Computing Pioneers Quantum Machine Learning Methods for Reasoning April 11, 2021
  • Why Machine Learning Over Artificial Intelligence? April 11, 2021

Subscribe to get more!

© 2019 NikolaNews.com - Global Tech Updates

No Result
View All Result
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News

© 2019 NikolaNews.com - Global Tech Updates