In our presentation, we explored the security challenges of namespace-based multi-tenancy in Kubernetes. We demonstrated real-world attacks against Kubeflow, Istio, and Traefik that can break the intended isolation between namespaces and workloads. One of the highlights was demonstrating a privilege-escalation attack we discovered that allowed us to gain cluster-admin privileges.
As part of our Bluetooth Audio security research, we found a
security vulnerability in Apple’s Beats Studio Buds’ pairing mechanism.
The devices were found vulnerable to an insecure Bluetooth pairing
window in which an attacker could pair with the earbuds without user
interaction and establish a valid Bluetooth bonding. This would allow an
attacker to eavesdrop on the victim through the earbuds’ microphone, play
audio on the device, or track the device via Bluetooth Low Energy.
With this blog post I am pleased to announce the publication of a new ERNW White
Paper about our incident analysis and digital forensics framework. It is
available on our website.
Due to the increasing number and impact of computer security incidents, it has
become essential to develop and implement efficient measures for their
investigation. However, comprehensive forensic analyses are time-consuming, and
this time is often not available to security analysts during computer security
incidents. As a result, automated tools are increasingly being used. These
tools, however, often cover only a limited scope of the necessary analyses and
typically require deep technical expertise to be used effectively.
While working on an OT project, we looked into TIA Portal1 project files to
extract more information about changes, especially timestamps to be able to
reconstruct a timeline. The TIA Portal (Totally Integrated Automation Portal)
allows to create and upload programs for PLC (Programmable Logic Controller)
devices often used in the OT (Operational Technology) landscape. Some attacks
are able to find the workstation with the TIA Portal and manipulate the project
to reprogram the PLCs. To be able to reconstruct the timeline of these changes
we wanted to be able to read the timestamps of events from the TIA project
files.
The #TROOPERS26 ‘AD & Entra ID Security’ track delivered an incredible
experience – much like the entire conference! We were thrilled to host some of
the brightest minds in identity research alongside a highly engaged audience who
brought valuable insights to the roundtable discussions. While the presentation
slides have already been published on the TROOPERS website, several speakers
have shared complementary tools, in-depth blog posts, and active social media
threads. To make things easy, we’ve compiled a comprehensive list of all these
fantastic resources from the track below.
In this post I want to talk about a very essential part of my workflow when
dealing with Bluetooth devices, particularly IoT devices with a corresponding
mobile app: Live capture of Android Bluetooth traffic with Wireshark.
Before you stop reading because you think you know how to do this already, the
method does not involve pulling bug reports off your phone, and it does not
require root. And most importantly it gives you a live packet log in
Wireshark.
Yesterday, the BSI (the German Federal Office for Information Security, or
Bundesamt für Sicherheit in der Informationstechnik in German) published the
first result document from the “Windows dissected” (ger.: “Windows seziert”)
project: our analysis of Windows Hello for Business (WHfB). If you have followed
this blog over the past year, you have seen the pieces. The full 170-page report
has now been published. And it can be downloaded from the
project page.
Last week I gave a talk at #TROOPERS26:
Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection.
I discussed the challenges of incident analysis, such as increasing storage
capacities and the lack of integration between tools. I presented a modular
framework that integrates established forensic and analysis tools using a
decision-tree-based control mechanism. A workflow was designed to control the
execution of 14 integrated analysis tools in order to reproduce the manual
analysis process usually performed by analysts. Moreover, the framework is
capable of identifying whether a system has been compromised and compiles a
analyst-oriented report. Together with the audience we took a look at the report
in a live demonstration. The evaluation results of the framework were promising
as it was able to identify all compromised systems. However, a significant
number of false positive classifications were also observed. To improve the
framework possible future extensions include functionality such as recovering
already deleted files to detect missed Indicators of Compromise. Additionally,
our team want to integrate artificial intelligence in the workflow to help in
data processing and make more decisions automatically. The slides will be
published next week on the conference website. I will add the link in this blog
post when they become available. A more detailed description of the content of
the talk can be found in the following sections. Looking forward to
#TROOPERS27!
How to strengthen Supply Chain Security: Practical Exchange and Roadmap
Join an open, practitioner-focused roundtable for direct exchange on supply
chain security. This session offers a concise overview of core concepts,
e.g. SBOM, CSAF, and VEX and digs into the processes behind them: how to obtain,
process and apply information to improve security across the supply chain.
We will examine:
How SBOM, CSAF and VEX relate and why version-level detail matters.
The practical value of an SBOM and why it’s increasingly required by law and
IT procurement.
How to create and consume SBOMs?
Methods to identify dependencies in the context of vulnerabilities.
Approaches to triage: not all vulnerabilities affect every stakeholder
equally.
Techniques to analyze vulnerabilities and identify affected products and
product families.
Sources of vulnerability information and how to map data unambiguously to
products and specific software versions.
Reporting obligations: where and how to disclose vulnerabilities.
Tools and automation that help manage information volume and complexity.
Technical, organizational and personnel challenges to achieving end-to-end
supply chain security.
The role of AI in supply chain security.
How do we protect ourselves from malicious actors / infected dependencies?
The Cyber Resilience Act (CRA): implications for companies, products and
consumers, the CRA roadmap, and concrete deadlines and actions.
We will show a live demonstration of the whole process, e.g. covering the
consumption of SBOMs, vulnerability identification and assessment, creation of
VEX documents.
This roundtable is designed for security practitioners, product owners,
compliance officers and decision-makers who want actionable guidance and peer
discussion. Expect candid conversation, real-world examples and next steps you
can take to strengthen resilience across your supply chains.
Imagine the following: You visit a webpage with a lot of text you don’t want to
read and ask your AI assistant for a summary. A few moments later, the AI
assistant has extracted one of your emails and sent it to an attacker without
you ever knowing.
In October 2025, we found exactly this vulnerability in Firefox’s AI chatbot
integration1.
Firefox offers a summarization, explaination and proofread AI feature. When a
user makes use of one of these features, Firefox pastes a prompt into the
sidebar AI chat including the page title, the selected text (or, if the whole
page is summarized, a selection is being made by Firefox) and an instruction on
how to process the provided text. The sidebar AI chat is essentially an IFrame
of a third-party chatbot (Claude, Copilot, …).