Toggle menu
Research 22 March 2021
Silently Unmasking Virgin Media VPN Users in Seconds (CVE-2019-16651)

Introduction Fidus’ R&D team identified a vulnerability within Virgin Media Super Hub 3 routers that permitted for exfiltration of sensitive information remotely, which, among other things, can be used to determine the actual, ISP issued IP address of VPN users. A vulnerability we were asked to hold back from releasing for a whole year. A […]

Research 20 March 2020
XSSLash – A Tale of Playing Quiplash at Work

Introduction Quiplash – a game full of wit, banter and borderline acceptable humour… and security consultants on a lunch break. To set the scene, the date was 19th February 2020 and the mood was cheerful in the Fidus office. Lunch had just been delivered and today was the day that Mario Kart was not going […]

Corporate 18 March 2020
Security and Working From Home

The many complexities around remote working have long been used as an excuse for limiting its roll-out. But with recent announcements that everyone should try to self-isolate, businesses are now being forced to change their stance. The good news is that the technical barriers to home working have been steadily lowering. In fact, most of […]

Corporate 16 March 2020
Security continuity with remote access technology

Following government guidance, more and more businesses are now investigating and suggesting the use of remote working to help protect employees from infection. In some cases this may even mean closing offices entirely. To help balance the welfare of your workers with the security demands of your network, Fidus has prepared multiple solutions. Each will […]

Corporate 29 January 2020
Fidus achieve CREST Accreditation

“Becoming CREST certified shows Fidus’ commitment to ensuring we maintain the highest standards of policies and procedures within our company.” Fidus Information Security have gained CREST accreditation for penetration testing services. We are extremely proud to announce that we are now a Council for Registered Ethical Security Testers (CREST) accredited company for penetration testing services. […]

Research 19 October 2019
ClickToPray eRosary Account Takeover

Exploiting the eRosary Application In this post we’re going to cover a trivial full account takeover vulnerability our team identified within the new eRosary application, whilst placing an order for the watch! The ClickToPray eRosary beads are advertised as ‘an interactive, smart and app-driven device that serves as a tool for learning how to pray […]

Research 10 May 2019
Exploiting 10,000+ devices used by Britain’s most vulnerable

In this post, we’re going to detail some of the issues our team identified with the an extremely common Alarm & GPS device used by vulnerable people around the world (at least 10,000+ in the UK). The device in question is manufactured in China and seems to be purchased in bulk by numerous providers who […]