TEAM SUID (@_setuid0_) header
TEAM SUID (@_setuid0_) profile picture

TEAM SUID

@_setuid0_

Vulnerability Researchers focusing on IoT, Embedded Systems and E-Voting #Cybersecurity

suid.ch
Joined February 2019
  • Tweets52
  • Following0
  • Followers146
15Media
Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)Photo by TEAM SUID (@_setuid0_)
We're happy to present...D-LINKGATE - A Preauth RCE to Root Chain on D-Link DAP-2020 devices. Patch your devices ASAP (suid.ch/research/DAP-2020_Pr…) #CyberSecurity #VulnResearch
Image from TEAM SUID (@_setuid0_)
1
m.bazonline.ch/articles/5c9e… could we please have a list on how you got to 17'000.-? From our calculations based on onlinevote-pit.ch/stats we have counted only 2'000.- @bazonline @swisspost
1
1
3
Image from TEAM SUID (@_setuid0_)
1
There really are some creepy coincidences in this world. While discussing #EVoting over the phone these were our telegram verification icons... 😂😂
Image from TEAM SUID (@_setuid0_)
1
3
#PIT Starter Guide aka. proof on why the PIT is nothing but a pr stunt github.com/setuid0-sec/Swiss… #EVoting #Cybersecurity
1
2
3
5
We just published Release #2 featuring the officialy approved X-Forwarded-For HTTP Header Injection and a #pit starter guide for new participants. Get it on suid.ch #Evoting #Cybersecurity #Bugbounty
Image from TEAM SUID (@_setuid0_)
9
1
8
The report got resolved today. We will follow up with a public release soon.
TEAM SUID (@_setuid0_) profile pictureTEAM SUID@_setuid0_4 Mar 2019
@swisspost after waiting over 3 weeks (2W unresolved gitlab issue + 1W for poc) for an easy to reproduce code vuln, we're starting to believe that this slowdown can be of political nature. We cannot support this and it's starting to harm our cooperation. #EVoting #Cybersecurity
3
@swisspost after waiting over 3 weeks (2W unresolved gitlab issue + 1W for poc) for an easy to reproduce code vuln, we're starting to believe that this slowdown can be of political nature. We cannot support this and it's starting to harm our cooperation. #EVoting #Cybersecurity
2
5
2
9
BugBounties require both parties to take each other seriously.
2
2
You can now download our #security reports of the swiss evoting system, including a code injection #vulnerability from our website suid.ch #EVoting #Cybersecurity #BugBounty
Image from TEAM SUID (@_setuid0_)
16
3
28
These 6 reports are all for now. We are going to release pdfs in the next days for an easier read. Now we're going back to work on auditing the internet facing endpoints - and are hoping for a still good cooperation with the swiss post
1
1
5
"Don't worry, it's offline"
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
2
2
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
2
"Is there anything more to say"
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
3
1
Fyi
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
2
"Not in scope"
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
2
"Just outsource it" The problem here is that the project contains a lot of external dependencies, which essentially act as a blackbox. It will be really challenging keeping track of all of them and auditing them.
2
3
1
Image from TEAM SUID (@_setuid0_)
Image from TEAM SUID (@_setuid0_)
4
1
"If it has the term 'secure' in it's title you should be very wary' After getting a green light from the swiss post for publishing we can disclose our findings with you. In the next days we are going to share the pdf's of the issues with you for a more comfortable read.
2
1
more replies
With that threat model it's being assumed, that one can trust every employee, even though insider threats are very common today. It seems like the swiss post assumes that you can trust every employee, even though insider threats are very common today.
3
1
1
In our eyes it's still a difference if an election gets manipulated due to an attack on the operating system, which is a general infrastructure problem, or the application gets exploited due to a vulnerability in the code.
1
1
1
Load more