Skip to main content

Ethical Hacking

In this project we do ethical hacking (penetration testing / white hat hacking) of various devices and systems.

Additional information

More information about the Ethical hacking lab can be found here .

Vulnerabilities published

CVE-2021-34086  - In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver hosts APIs vulnerable to CSRF. They do not verify incoming requests. Students: Linus Backlund & Linnéa Ridderström, Supervisor: Pontus Johnson, Examiner: Anita Kullen.

CVE-2021-34087  - In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local webserver can be used for clickjacking. This includes the settings page. Students: Linus Backlund & Linnéa Ridderström, Supervisor: Pontus Johnson, Examiner: Anita Kullen.

CVE-2021-22263  - An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. A user account with 'external' status which is granted 'Maintainer' role on any project on the GitLab instance where 'project tokens' are allowed may elevate its privilege to 'Internal' and access Internal projects. Students: John Augustsson & Johan Carlsson, Supervisor: Pontus Johnson, Examiner: Mathias Ekstedt.

CVE-2021-22228  - An issue has been discovered in GitLab affecting all versions. Improper access control allows unauthorised users to access project details using Graphql. Students: John Augustsson & Johan Carlsson, Supervisor: Pontus Johnson, Examiner: Mathias Ekstedt.

CVE-2021-39866  - A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens. Students: John Augustsson & Johan Carlsson, Supervisor: Pontus Johnson, Examiner: Mathias Ekstedt.

CVE-2021-37147  - Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. LF line ending forwarded. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-37148  - Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests, "chunked" is chunked and Bad chunked body parsing. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-37149  - Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests, multiple issues. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-22959  The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-22960  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-34594  - Relative path traversal vulnerability through TwinCAT OPC UA Server, Beckoff Security Advisory , Johannes Olegård, Emre Süren, and Robert Lagerström.  

CVE-2021-41504 - An Elevated Privilege issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the devices command interface may allow further attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. Students: Hristo Georgiev & Azad Mustafa, Supervisor: Pontus Johnson, Examiner: Mathias Ekstedt.

CVE-2021-41503  - DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. Students: Hristo Georgiev & Azad Mustafa, Supervisor: Pontus Johnson, Examiner: Mathias Ekstedt.

CVE-2021-41136  - Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-38512  - An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-37555  - TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser. Student: Julia Lokrantz, Supervisor: Pontus Johnson, Examiner: Ibrahim Orhan.

CVE-2021-33197 - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-33039  - Reserved.

CVE-2021-32715  - hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-32714  - hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. Students: Asta Olofsson & Mattias Grenfeldt, Supervisor: Robert Lagerström, Examiner: Pawel Herman.

CVE-2021-32471  - Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbitrary code via crafted data. Pontus Johnson. With proof-of-concept code from Compsci boffin .

CVE-2020-28396  - a Protection Mechanism Failure was found in Siemens SICAM A8000 Remote Terminal Unit Series. Student: Sam Hamra, Supervisor: Mathias Ekstedt, Examiner: Pontus Johnson.

CVE-2020-15019  - Reserved.

CVE-2020-13119  - ismartgate PRO 1.5.9 is vulnerable to clickjacking. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12843  - ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV must be used. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12842  - ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12841  - ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12840  - ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12839  - ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12838  - ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12837  - ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must be used. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12282  - iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (This can be combined with reflected XSS.) Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12281 - iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.
CVE-2020-12280  - iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php. Student: Madeleine Berner, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2020-15781  - XSS in Siemens SICAM A8000 RTUs. Student: Emma Good, Supervisor: Pontus Johnson, Examiner: Mathias Ekstedt

CVE-2019-12941  - AutoPi Wi-Fi/NB and 4G/LTE devices allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. Students: Aldin Burdzovic and Jonathan Matsson, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2019-12944  - Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable. Student: Arvid Viderberg, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2019-12943  - Insecure permission, password reset function, in TTLock Open Platform. Student: Arvid Viderberg, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2019-12942  - Insecure permission, account revocation mechanism, in TTLock Open Platform. Student: Arvid Viderberg, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2019-12821  - Vulnerability in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. Students: Theodor Olsson and Albin Larsson Forsberg, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2019-12820  - Vulnerability in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, possible MiTM attack on http. Students: Theodor Olsson and Albin Larsson Forsberg, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2019-12797  - Vulnerability in a clone version of an ELM327 OBD2 Bluetooth device, hardcoded PIN leading to arbitrary commands to an OBD-II bus of a vehicle. Students: Ludvig Christensen and Daniel Dannberg, Supervisor: Pontus Johnson, Examiner: Robert Lagerström.

CVE-2018-3786  - A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument. Pontus Johnson

Media coverage

Techsplain  podcast on Spotify about the hacker threat, 2021-11-24.

Swedish television SVT reports on how hacked car dongles can spread computer virus , 2020-10-11.

Swedish television SVT reports on how the police hacked phones used by criminals , 2020-09-16.

Swedish television SVT reports on vulnerabilities found in a smart garage application , 2020-07-12.

Swedish magazine Energi  reports about our work on cyber security in the power domain, 2019-12-20.

Expressen reports on cyber risks in modern cars  with comments from Robert Lagerström, 2019-11-21.

Dagens Industri (web-TV) with a panel on cyber security in cars  with Robert Lagerström in the panel (in Swedish), 2019-11-21.

Svenska forskare ska hacka europeiska elbolag , NyTeknik, 2019-09-09.

Swedish Radio reports on the importance of cyber security and ethical hacking (w. MSB & KTH), Ökat behov av etisk hackning , 2019-09-06.

Därför ska KTH hacka elbolag i Bulgarien , Forskning & Framsteg, 2019-09-06.

Nu ska elbolagen hackas – KTH får 1,5 miljoner till white hats , Computer Sweden, 2019-09-04.

Svenska forskare hackar elbolag i Europa , KTH News, 2019-08-30.

Dagens Nyheter write about vulnerabilities in car dongles  found by Aldin Burdzovic and Jonathan Matsson, 2019-06-01.

Louis Cameron Booth and Matay Mayrany interviewed in SVT about hacking electric scooters , 2019-05-11.

Robert Lagerström interviewed in Metro about hacking smart homes , 2019-04-28.

Robert Lagerström in KTH news about smart city security and ethical hacking , 2019-04-24.

Theodor Olsson and Albin Larsson Forsberg interviewed in TV4 about hacking a robot vacuum cleaner , 2019-04-24.

Swedish TV interview with Pontus Johnson doing a live hacking demonstration .

Swedish TV interview with Pontus Johnson on the vulnerabilities of smart consumer products .

Swedish TV interview with Pontus Johnson on the vulnerabilities of the 5G network .

Kurser i etisk hackning ska öka it-säkerhet  (interview with Pontus Johnson, Radio P1 Ekot)

Den goda hackern  (interview with Pontus Johnson, Radio P1 Uppkopplad)

KTH utbildar i etisk hackning  (interview with Pontus Johnson, Radio P3)

KTH utbildar försvarets cybersoldater , NyTeknik, 2019-06-13.

Uppkopplingen gör bilen smartare – men hackare kan ta kontroll över ratten , Dagens Nyheter, 2019-06-01.

KTH öppnar sin utbildning i etisk hackning – företagen också välkomna  (Computer Sweden)

Ny KTH-kurs ska lära företag att tänka som hackare  (Ny Teknik)

Han utbildar företagare till hackare  (DI)

Vithattar blir svarta på KTH  (Voister)

Nu kan du plugga till hackare på KTH  (Computer Sweden)

Swedish University Offers ‘Ethical Hacking' Courses for 'Greater IT Security'  (Sputnik news)

Шведский ВУЗ будет готовить хакеров  (Kompravda)

Reports

[1]
E. Süren et al., "PatrIoT : practical and agile threat research for IoT," International Journal of Information Security, 2022.
[2]
E. Rencelj Ling et al., "Securing Communication and Identifying Threats in RTUs : A Vulnerability Analysis," in ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security, 2022.
[7]
[8]
[11]
R. Baran and C. Lindén, "Etisk hackning : Säkerheten i en nätbutik," , 2021.
[13]
A. Altin and V. Nicolaou, "Race Conditions in Web Applications," , 2021.
[14]
G. Rubbestad and W. Söderqvist, "Hacking a Wi-Fi based drone," , 2021.
[16]
R. Achkoudir and Z. Alsaadi, "Ethical Hacking of a Smart Plug," , 2021.
[19]
[20]
H. Georgiev and A. Mustafa, "Hacking commercial IP cameras : Home Surveillance," , 2021.
[23]
S. Veijalainen and T. Noreng Karlsson, "Evaluating the security of a smart door lock system," , 2021.
[29]
F. Heiding and R. Lagerström, "Ethical Principles for Designing Responsible Offensive Cyber Security Training," in Privacy and Identity 2020, 2020, pp. 21-39.
[30]
N. Kakouros, P. Johnson and R. Lagerström, "Detecting plagiarism in penetration testing education," in Nordsec 2020, The 25th Nordic Conference on Secure IT Systems, November 23-24, Online, 2020.
[31]
L.-E. Hamid and S. Möller, "How Secure is Verisure’s Alarm System?," , 2020.
[37]
T. Höglund Gran and E. Mickols, "Hacking a Commercial Drone," , 2020.
[47]
[48]
C. Torgilsman and E. Bröndum, "Ethical Hacking of a Robot Vacuum Cleaner," , 2020.
[50]
O. Andrén and A. Heurlin, "Snapchat Spectacles 2.0 : Shakey or Secure," , 2020.

J. Olegård, " Security and Forensic Analysis of an Internet of Things Smart Home Ecosystem ", Master thesis, KTH Royal Institute of Technology, Sweden, 2020.

Viktor Edström and Eldar Zeynalli, Bachelor thesis, KTH Royal Institute of Technology, Sweden, 2020.
​​​​​​​Penetration testing a civilian drone: Reverse engineering software in search for security vulnerabilities

Gustav Marstorp and Hannes Lindström, Bachelor thesis, KTH Royal Institute of Technology, Sweden, 2018. Security Testing of an OBD-II Connected IoT Device (pdf 155 kB)

Simon Carlsson and Max Näf, Bachelor thesis, KTH Royal Institute of Technology, Sweden, 2018. Internet of Things Hacking  

Page responsible:Web editors at EECS
Belongs to: Network and Systems Engineering
Last changed: May 13, 2022