Issue 150: Vulnerability in Fortress home security system, API fuzzing techniques, hardening GraphQL implementations, and central governance for APIs
Brief
This week, we have recent vulnerabilities in the Fortress home security system that allowed an attacker to remotely disable the system, a guide on API fuzzing techniques and tools, best practice for hardening GraphQL implementations, and views on central governance for APIs.
Vulnerability: Fortress home security vulnerability allows remote disarming
This week, Rapid7 disclosed two vulnerabilities in Fortress S03 WiFi home security system that their researcher Arvind Vishwakarma discovered. The vulnerabilities allowed an attacker to remotely disarm the alarm system using an unauthenticated API endpoint and elementary and easily obtainable user account information, such as an email address.
At the time of writing, Fortress had not acknowledged the issue, nor provided any indication of an intent to resolve it. It is also not known if the issue can be resolved without a hardware upgrade.