TECHBOARD #2: AnyDesk Has a Public Exploit, BitFaktura Suffers Data Breach

Real-World Hacks

Invoicing service BitFaktura has reported a breach of customer data. On September 28, the operator detected unauthorized access and copying of its database. According to the published incident notice, the exposed information included company data, hashed passwords, API tokens, integration keys, and session identifiers. Valid tokens may allow access to accounts through integrations without entering a password, meaning that changing a password alone may not be enough.

The company reports replacing customer API tokens and restricting existing keys to previously used IP addresses. It is urging customers to change their passwords, enable two-factor authentication, and update the keys used in their integrations.

Vulnerability Landscape

An AnyDesk vulnerability allows attackers to gain root privileges before a connection is approved. On October 8, researchers published the AnyPwn exploit targeting AnyDesk for Linux 8.0.2. A flaw in network message processing causes memory corruption and allows commands to be executed with root privileges, under which the service normally runs. The published exploit demonstrates an attack through a direct connection on TCP port 7070.

The researchers did not demonstrate a complete attack through relay servers. Success depends on memory layout, and an unsuccessful attempt may crash the service. A fix has been available since June in version 8.0.3. What is new in October is a working public exploit, making it more urgent to check older installations. Penetration testers should also account for the risk of service disruption.

Pwn2Own saw successful attacks against smartphones and AI software. Pwn2Own is a competition where researchers demonstrate vulnerability exploitation for cash prizes and disclose their findings to vendors for remediation. The October results from Ireland included successful remote attacks against the Google Pixel 10 and Samsung Galaxy S26. In LiteLLM, software used to work with language models, a researcher combined insufficient input validation with code injection to achieve remote command execution. These results illustrate that AI security testing must also cover the software supporting AI operations.

Tool Tips

REA connects AI agents with reverse engineering tools. The tool helps analyze binary files, JavaScript and Electron applications, and .NET assemblies. It provides findings along with supporting evidence for verification. REA helps penetration testers understand applications more quickly and identify areas requiring deeper analysis.

Sliver GUI provides a graphical overview of testing operations. The interface allows users to manage sessions, agents that regularly communicate with the server, and collected files and credentials. It does not yet support every command and capability of the original framework.

AI/LLM News

Anthropic is expanding access for penetration testers. The expanded Cyber Verification Program has three tiers: Defense Access, Red Team Access, and Specialized Access. The second tier is particularly relevant to penetration testing companies. It enables verified organizations to conduct authorized testing with fewer restrictions. Access requires approval and remains subject to limitations. Individual researchers are not yet eligible for Red Team Access. Companies must also consider data retention requirements.

In another update, Anthropic has announced countermeasures, including ending conversations, for users who treat its models in an inhumane or abusive manner. The new rules are expected to take effect on November 12. Model testing and research are exempt.

CITADELO News

A secure backend does not guarantee a secure mobile application. Across 39 mobile application testing projects, we identified 254 vulnerabilities. Common issues included credentials and API keys hardcoded into applications, as well as sensitive data stored without adequate protection. In our new article on mobile application penetration testing, we explain how these weaknesses can allow attackers to gain access to user accounts.

Are Your Systems Ready for the Latest Cyber Threats?

New vulnerabilities and publicly available exploits are shortening the time companies have to respond. Penetration testing helps identify weaknesses in applications and infrastructure before attackers can exploit them.