(In)Security of Domestic IT Asset Management Software
summary
The talk analyzes security flaws in four widely used Japanese IT asset management products (software that admins install on employee endpoints to prevent data leakage and remotely manage devices). The presenter performed vulnerability assessments and found multiple issues, including flaws allowing anyone to remotely control endpoints, exfiltrate data from admin servers, and vulnerabilities similar to ones previously used in real-world attacks; the talk explains technical details of those vulnerabilities and common attack techniques for finding them.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 5:55Why we started research
- 11:50IT asset management basics
- 17:12Communication path vulnerabilities
- 20:10Encryption flaws in management
- 27:06Remote access control issues
- 31:18SQL injection in server
- 35:13Weak component encryption
- 42:09Directory traversal flaws
- 44:25IT asset risks and fixes
- 47:21Security recommendations
related talks
38mHacking Demos, Dirty Secrets, Dangerous Lies, Asset Intelligence
58mMedical Device Security
55mBreaking and Fixing Web Application Security
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
19mThe Blind Spots of IT Experts on Security & What Companies Must Do Against It
18mIT Security – Don’t let Open Source Software become the next menace
58mAttacking through the Software Supply Chain
37mI Own Your Building (Management System)