Drivesec, a leading company in cybersecurity solutions for the automotive and IoT markets, and Auxilium Pentest Labs, CTF winner at DEF CON 33 specialized in Embedded Systems Penetration Testing, are excited to announce a new partnership. This collaboration aims to offer an integrated and continuous approach to validating the security of electronic systems across multiple […]
Author: Martin Pozdena
In our continuous effort to advance cyber security across the automotive sector, Auxilium Pentest Labs is thrilled to highlight an ongoing project with Tatra Trucks, focusing on their Tatra Force and Tatra Phoenix models. Project Scope Consultancy with R155 Compliance TARA Review ECU Testing Full Vehicle Testing Our collaboration with Tatra Trucks was driven by […]
[Stuttgart, Germany and Detroit, Michigan] – Auxilium Pentest Labs, a leader in automotive cybersecurity validation, is proud to announce a global strategic collaboration with Harman International, a pioneer in connected vehicle technologies. This collaboration aims to advance cybersecurity across Harman’s comprehensive portfolio of automotive solutions. Under this agreement, Auxilium will provide cutting-edge penetration testing and […]
Title: Improper Input Validation leads to buffer overflow in dlt-daemonDate: 12/05/2021CVE-ID: CVE-2021-29507Author: Thomas SermpinisVersions: 2.10.0 < version <= 2.18.6Package URL: https://github.com/GENIVI/dlt-daemon/Tested on: dlt-daemon 2.18.6 The dlt-daemon includes a configuration file load functionality (-c) which is vulnerable to a buffer overflow vulnerability and allows a malicious user to supply a specially crafted configuration file which results […]
Title: File Type Restriction Bypass in Socket.io-file NPM moduleDate: 31/07/2020CVE-ID: 2020-24807Advisory: https://github.com/advisories/GHSA-6495-8jvh-f28xAuthor: Thomas SermpinisVersions: <= 2.0.31Package URL: https://www.npmjs.com/package/socket.io-fileTested on: node v10.19.0, Socket.io-file v2.0.31, socket.io v2.3.0Proof of Concept: – During some of our pentests, we face applications that are well secured with not so many misconfigurations. That means that we have to dig deeper, if the […]