This is an German blog post as it is a recap from a German conference.
Sven und ich hatten zwei unglaublich spannende und lehrreiche Tage bei der heise devSec in Marburg.
Besonders hängen geblieben ist bei uns die Keynote von Volodymyr Styran zum Thema “Predictability Is Vulnerability: What Four Years of Cyber War Teach About Software Security”. Eine Erkenntnis daraus deckt sich stark mit unseren Erfahrungen aus zahlreichen Pentests: Angriffe müssen nicht immer aus einer hochkomplexen Exploit Chain bestehen. Oft sind es nicht die Zero-Day Exploit, die zur kritischen Kompromittierung der Umgebung führen würden, sondern banale Konfigurationsprobleme, wie schwache oder geleakte Credentials. Seine Erkenntnis ist, dass durch vorhersehbare Umgebungen, stabile Konfigurationen und kompromittierte Credentials die Angreifer lange unentdeckt und persistent bleiben und sich bewegen können.
A while ago we started researching Bluetooth Auracast security and wrote about
some of our insights. Back then
we released the Auracast Hacker’s
Toolkit that
allowed scanning, listing, and dumping Auracast broadcasts. The main goal was to
be able to capture over-the-air packets in order to brute-force the Broadcast
Code. Along with this blog post we’re releasing an updated version of the
toolkit. This time we implemented proper sniffing capabilities. If you’re
interested in the details, feel free to read on. If not, grab your nRF52840 USB
dongle,
flash the firmware, start sniffing,
and load the captures in our Auracast Packet Visualizer.
This is the first post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. Over the next four posts, we’ll walk through how token-based attacks work, put important Microsoft defenses gaining relevance in this context, Continuous Access Evaluation and Token Protection, through empirical testing, and check where Entra ID still deviates from OAuth 2.0 best practices. This post sets the stage: why token theft matters, and how attackers actually get their hands on a token.
While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.
As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its defense-in-depth strategy actually hold up against this shift? We put it to the test.
In our presentation, we explored the security challenges of namespace-based multi-tenancy in Kubernetes. We demonstrated real-world attacks against Kubeflow, Istio, and Traefik that can break the intended isolation between namespaces and workloads. One of the highlights was demonstrating a privilege-escalation attack we discovered that allowed us to gain cluster-admin privileges.
As part of our Bluetooth Audio security research, we found a
security vulnerability in Apple’s Beats Studio Buds’ pairing mechanism.
The devices were found vulnerable to an insecure Bluetooth pairing
window in which an attacker could pair with the earbuds without user
interaction and establish a valid Bluetooth bonding. This would allow an
attacker to eavesdrop on the victim through the earbuds’ microphone, play
audio on the device, or track the device via Bluetooth Low Energy.
With this blog post I am pleased to announce the publication of a new ERNW White
Paper about our incident analysis and digital forensics framework. It is
available on our website.
Due to the increasing number and impact of computer security incidents, it has
become essential to develop and implement efficient measures for their
investigation. However, comprehensive forensic analyses are time-consuming, and
this time is often not available to security analysts during computer security
incidents. As a result, automated tools are increasingly being used. These
tools, however, often cover only a limited scope of the necessary analyses and
typically require deep technical expertise to be used effectively.
While working on an OT project, we looked into TIA Portal1 project files to
extract more information about changes, especially timestamps to be able to
reconstruct a timeline. The TIA Portal (Totally Integrated Automation Portal)
allows to create and upload programs for PLC (Programmable Logic Controller)
devices often used in the OT (Operational Technology) landscape. Some attacks
are able to find the workstation with the TIA Portal and manipulate the project
to reprogram the PLCs. To be able to reconstruct the timeline of these changes
we wanted to be able to read the timestamps of events from the TIA project
files.
The #TROOPERS26 ‘AD & Entra ID Security’ track delivered an incredible
experience – much like the entire conference! We were thrilled to host some of
the brightest minds in identity research alongside a highly engaged audience who
brought valuable insights to the roundtable discussions. While the presentation
slides have already been published on the TROOPERS website, several speakers
have shared complementary tools, in-depth blog posts, and active social media
threads. To make things easy, we’ve compiled a comprehensive list of all these
fantastic resources from the track below.