so now I will hand you over to Ignacio
okay I think
okay
everyone can hear me oh yeah Okay cool
so here we go
uh my name is
so be patient because I have to I my
first language are Spanish and I have to
sing in Spanish and translate them
um I now I work in like a software
engineer in attack IQ
uh and there's my social media if you
have any question or something before
you talk
a little bit what will you see today uh
first of all it's like a kind of
introduction uh how I found these bugs
and issues
and then a little recently about the the
NFC box application marks and web
applications
and forever for the end of the talk I
will show you like a comparison or how
we can match this one with our top 10.
this is not a series I talk or something
like that the the title is designed for
people without yes I take knowledge or
people who is starting in this one can
you understand so
a little disclaimer some procedures and
techniques using here are not completely
legal and maybe some companies
organization can take legal action so
don't do it or if you do it take care
with that but try to don't do it
so how would you started uh when I was
hanging out with friends and we are
moving to another bar
um in the window of the car I found that
pamphlet and that says something like a
now with Mauricio parking you can park
with your phone directly
um
a night
and that was one just for car or if you
have two cars you need two or if you
charge your car you need another one
and when the application was released
now the people can do everything with
the with their phone like uh park the
car change money to the parking uh a
different car and that and they can see
the transaction history about the
parkings and that
so the now you have two options you can
use the keychain or you can use
application
and I found the problems like in March
or April of 2022
uh well there is a pamphlet and there is
the the login page of the application
and there is a little new when the
application was released
so
first of all I try to do a little
Wireless attack dictionary attack to the
login page with the knowledge with the
no dictionaries and not the people who
use
and what didn't work and also I tried to
SQL injection
but no no no not to get taxes
bless you
and then uh and then I try a directory
list
and I found some interesting urls
and one of them is this one slash
download
and there is a kind of a readme or
installation guide about the the energy
reader the NFC use in for the keychain
um I in the vote another page you have a
kind of dedication they say something
like uh here you have all the files this
is for you Lucy I don't have to release
it but thank you
um I don't love that file and I extract
them and I found some interesting stuff
uh one of them is like a log fight
and I found this
request
with the ID session and I say okay maybe
we can found some SQL in checking here
but we didn't have the the server URL or
the IEP address or something
so now we have two different sites for
continue the research
one of them is moving to the application
and website and I think it's the most
pretty I prefer it JavaScript or Java
instead of C but
we will continue with you with the
controller so what we had in all the in
all that files
uh we have the entire controller for the
for the NFC tag for the MiFi reader so
we can install them in our computer if
we have the reader
uh we can install them and we can do
whatever we want like a clone the tags
uh read the content of the cars of the
attacks
or just format them
uh and also obviously for do this one we
need a key the key used for for the
keychain but we have the guitar code in
the in the controller so
we can do whatever we want if we have
the
the properly
so
moving to the application and website
uh I download the Android application I
the compiler
and first of all I get noticed about the
all the code of the application was in
plain text so they didn't have
encryption or off location or something
so you can read all the code of the
application
and then 40 minutes
and then I found for a lot of common
strings with the IP address and the URL
server for the production for testing
and development
and all of them was common and well I
found the the URL and I try to do a kind
of SQL injector
and that will work so
now we have a one second instruction in
the code
and if we exploit them we found 92
tables all of them in plain texture and
the most interesting tables is the users
tables in the users tables we have the
users and the password but just in case
this didn't work also we have the ID
session and we can replace the cookie in
our Navigator and this will reward too
and now we have the user password and
the admin password so we can try to log
it in and we get login so
now we are the owners of the system we
can play with them or
report them
um
what we can do with the system
about the park
about the parking matters we have the IP
address so we can play directly with the
parking meter
uh we can and also we can turn around to
turn off them delete them we can do
whatever we want
uh about the we have the location for of
them
and allow the users we can create new
users delete new user or administrator
to
and also we can see all the transaction
history for the charge the money for the
devs for we can we can see everything
and moving a little bit about the users
the do we have 70k user more or less in
Rio Gordo
and we have the personal data and the
parking data about the personal data we
have the the normal stuff like a ID
number phone number the address we have
everything over there and about the
parking data we have the
okay for example we can say okay this
guy Park every day at the same time for
the same hours in the same place maybe
this guy work here or something and also
we have the home address and we can
check that is different we can be doing
that
so I think that is a risk information if
someone with bad intention get them and
I think it's like a kind of big deal
and after that I continue and research a
little bit more about it
and I found the same system was
implemented in five different cities in
Argentina like a medium or big city
so I never was good with math but I do
some calculation about it and almost the
44 about the population of Rio cuarto
used them so if we have five cities and
about the population of each one
we now don't didn't have a 70 000 users
we have a 345
000 users all of them with the data and
that
so
foreign
application security
is used for developers or security
professional for much the different
vulnerabilities
uh for example the number one the broken
Access Control where we can found that
we can found them in the in the web page
in the first one where we can form the
all this all the
all the code about the
the NFC Reader
and about the second one the
cryptographic failures we confirm them
in the application and also we can found
them in the Android
uh well in check them
we get the credentials on that and
insecure design for example we can form
them in about two
uh uh if you never hear about the hours
of your starting in this world so I
recommend to you there is a accurate
code on that and you have a six more for
for checking that
and for finish this one a little update
all of this one was was reported and the
company gave me the thanks and that
they fixed at the model of PHP so there
is no more SQL instruction
and but when I was writing this present
this slice they still have some SQL
instructions so everything is normal too
and also the password have not have no
big challenges so I try to log it in
again with the same credentials and this
work so
some good practices and that they never
was a play but well I do myself so I
report them if they didn't change the
password it's not my deal so
and I think that is everything if you
come you have time yeah yeah so if you
have any question or something or that
is it
thank you
[Applause]
so Ignacio thank you very much
um you're here the rest of the day
you hear the rest of today yeah yep so
if you do have any questions uh ladies
and gentlemen do seek out uh you can ask
your if you want any tips on how to
park your car for free