Publishing the tool serves the following purposes: It was developed as part of the coordinated vulnerability disclosure and is released with permission by the KNX Association. The ETS5 Password Recovery Tool is a proof of concept that demonstrates the issue by decrypting and displaying the sensitive information. User / tunneling passwords and derived keys.Device management passwords and derived keys.Device authentication codes and derived keys.The following confidential information are improperly encrypted: If the ETS5 would properly implement the encryption and a strong project password is chosen, it would provide a harder challenge for an attacker, even if they managed to get remote access to the computer.
Hence, it is likely that many users and system integrators have not taken additional steps to ensure the confidentiality of the project store. This is particularly problematic, because the ETS5 gives the users the impression that project password would be used to encrypt the project information, not just for exported projects. The information contained within allow to eaves-drop on, impersonate and reconfigure KNX devices. If an attacker is able to gain access to the files in the project store, they can decrypt them despite not knowing the project password. This can pose a threat to the security of the KNX installations. Storing cryptographic secrets in source code is ill-advised because they can be recovered by reverse engineering the software, thus offering little more protection than storing the information as cleartext. This is possible because the ETS5 has a significant design flaw, it uses a hard-coded password and salt to encrypt the project information ( CVE-2021-36799). Have you forgotten the password to one of your ETS5 projects and cannot access the configuration for the KNX installation anymore? The ETS5 Password Recovery Tool allows you to retrieve the project password and other secrets saved in the project store of the ETS5.
ETS5 Password Recovery Tool Table of Contents
0 kommentar(er)
