Blog Posts

RSS
How to use an undocumented ILIAS security vulnerability to gain RCE

How to use an undocumented ILIAS security vulnerability to gain RCE

ILIAS is a free and open source learning platform which can be used to create and distribute web-based teaching and learning materials. It is often used by universities and companies for e-learning. …

  • Jun 9, 2020
  • 4 minute read
Testing the 'Netatmo Welcome' Smart Camera – Hardware Hacking

Testing the 'Netatmo Welcome' Smart Camera – Hardware Hacking

Netatmo Welcome is a smart camera, which is capable of recognizing faces, streaming recordings into the cloud or alerting the owner in case of a burglary. As part of ongoing research into the Internet …

  • Apr 25, 2019
  • 11 minute read
Testing the 'Netatmo Welcome' Smart Camera

Testing the 'Netatmo Welcome' Smart Camera

Netatmo Welcome is a smart camera, which is capable of recognizing faces, streaming recordings into the cloud or alerting the owner in case of a burglary. As part of ongoing research into the Internet …

  • Sep 20, 2018
  • 9 minute read
Deobfuscating VBA and PowerShell Scripts of an Emotet Trojan Downloader

Deobfuscating VBA and PowerShell Scripts of an Emotet Trojan Downloader

We analyzed a recent wave of phishing mails trying to spread the Emotet banking trojan via malicious Word documents. This post provides details of the obfuscation methods used in the VBA macro and the …

  • Sep 1, 2017
  • 10 minute read
Practical Tips for OWASP Top 10 2017 #7: Insufficient Attack Protection

Practical Tips for OWASP Top 10 2017 #7: Insufficient Attack Protection

Contents Introduction Attack Detection using Honeytraps Fake form fields Fake cookies Fake HTML comments Fake robots.txt entries Attack Response Active Response Passive Response Going Further: …

  • May 20, 2017
  • 11 minute read
How we identified a tcpdump vulnerability using cloud fuzzing

How we identified a tcpdump vulnerability using cloud fuzzing

Fuzzing is a method to identify software bugs and vulnerabilities. The current development shows a trend to move fuzzing into the cloud, as cloud fuzzing offers a fuzzing speed increase and lots of …

  • Mar 20, 2017
  • 11 minute read
Privacy Analysis of Windows 10 Enterprise at Telemetry Level 0

Privacy Analysis of Windows 10 Enterprise at Telemetry Level 0

The focus of this research is to analyze the amount of privacy provided in Windows 10 when using the most restrictive privacy settings available. Windows 10 has been observed to establish encrypted …

  • Jan 25, 2017
  • 5 minute read
Reverse Engineering the TP-Link HS110

Reverse Engineering the TP-Link HS110

The TP-Link HS110 Wi-Fi is a cloud-enabled power plug that can be turned on and off remotely via app and offers energy monitoring and scheduling capabilities. As part of ongoing research into Internet …

  • Jul 29, 2016
  • 15 minute read