HackAllThings

Started reading it, pretty good so far!

Only thing, why did you choose to introduce block cipher modes in the stream cipher chapter? This makes little sense to me.

It’s worth pointing out that even the author admits that the newer Stingray II has 3G/4G support. I think this is probably related to known insecurities in the AKA protocol, as researchers have recently found [1]. It looks like call interception isn’t so straight forward anymore, but IMSI capture and approximate location capture are alive and well.

So unless you can verify that only Stingray I is deployed in the vicinity, I think it’s a stretch to say that the Stingray product “doesn’t care” about anything other than 2G.

[1] https://www.blackhat.com/docs/us-17/wednesday/us-17-Borgaonk...

As a pen tester, I wholeheartedly disagree. It’s probably more common to see unsafe YAML deserialization, rather than directly deserializing marshaled Ruby objects, but both are impactful and these types of vulnerabilities do exist. Just recently I assessed an application that used unsafe serialization to pass around an object encoded in the value of a cookie. It contained transient data related to the user’s session (e.g. what page they last visited). Last year I assessed an application that allowed users to upload YAML files, which would get parsed and deseralized as Ruby objects. Unfortunately I didn’t have a universal gadget chain then, so I had to note it as theoretically exploitable in my report. That’s troublesome because some clients may take it less seriously.

I’m personally very impressed with this research and I think it does a net good, demonstrating that deserialization of Ruby objects in any form is unsafe when you can’t trust the input.

That is fully captured in the notion of a universal deserialization gadget chain. However, for those not familiar with the concept of gadgets, yes, I can see how it might be a bit confusing at first.