Julian Suleder on Insinuator.net - Bold Statements

Heads-up: TROOPERS Roundtable – Supply Chain Security

Mon, 22 Jun 2026 00:00:00 +0000

How to strengthen Supply Chain Security: Practical Exchange and Roadmap

Join an open, practitioner-focused roundtable for direct exchange on supply chain security. This session offers a concise overview of core concepts, e.g. SBOM, CSAF, and VEX and digs into the processes behind them: how to obtain, process and apply information to improve security across the supply chain.

We will examine:

How SBOM, CSAF and VEX relate and why version-level detail matters.
The practical value of an SBOM and why it’s increasingly required by law and IT procurement.
How to create and consume SBOMs?
Methods to identify dependencies in the context of vulnerabilities.
Approaches to triage: not all vulnerabilities affect every stakeholder equally.
Techniques to analyze vulnerabilities and identify affected products and product families.
Sources of vulnerability information and how to map data unambiguously to products and specific software versions.
Reporting obligations: where and how to disclose vulnerabilities.
Tools and automation that help manage information volume and complexity.
Technical, organizational and personnel challenges to achieving end-to-end supply chain security.
The role of AI in supply chain security.
How do we protect ourselves from malicious actors / infected dependencies?
The Cyber Resilience Act (CRA): implications for companies, products and consumers, the CRA roadmap, and concrete deadlines and actions.
We will show a live demonstration of the whole process, e.g. covering the consumption of SBOMs, vulnerability identification and assessment, creation of VEX documents.

This roundtable is designed for security practitioners, product owners, compliance officers and decision-makers who want actionable guidance and peer discussion. Expect candid conversation, real-world examples and next steps you can take to strengthen resilience across your supply chains.

One More Thing: Introducing the New macOS 26 Tahoe Hardening Guide

Wed, 11 Feb 2026 00:00:00 +0000

After seven years, we’re publishing a new macOS hardening guide. Fully updated, modernized, and now publicly available on GitHub as Markdown and on our website as PDF.

The previous guide, written for macOS Mojave (10.14), reflected a very different macOS security model. At the time, hardening often meant working around the operating system, manually enforcing controls, and compensating for missing platform guarantees. That guide served its purpose, but the platform has fundamentally changed since then.

Hack In The Box Security Conference 2023 @ Amsterdam - Summary

Thu, 04 May 2023 00:00:00 +0000

In this blog post, we are sharing summaries of talks from the Hack in the Box Conference in Amsterdam (HITBSecConf2023), the final HITB conference in Amsterdam. Before we do that, however, we would like to extend a heartfelt thank you to the organizers of the conference for putting together such an insightful and engaging event.

Dr. Bramwell Brizendine – Windows Syscalls in Shellcode: Advanced Techniques for Malicious Functionality

The talk by Bramwell Brizendine covered the topic of syscall usage in shell code. The general idea here is to hide from AV/EDR systems by not using APIs such as CreateProcessA, which may be monitored, but to directly call into the corresponding kernel functions. This can be accomplished for example with the syscall CPU instruction (see ¹, ² and ³ for more information). While this technique is not perfectly stealthy and can still be detected (e.g., with a kernel driver), it circumvents at least inline-hooks in user space. Another downside is the effort of building shell code that directly uses syscalls. Besides more overhead in preparing everything for the syscall (for example manually creating appropriate structs), the correct syscall ID must be gathered, which can change between kernel versions.

ManiMed: Ypsomed AG – mylife YpsoPump System Vulnerabilities

Thu, 29 Jul 2021 00:00:00 +0000

The Federal Office for Information Security (BSI) aims to sensitize manufacturers and the public regarding security risks of networked medical devices in Germany. In response to the often fatal security reports and press releases of networked medical devices, the BSI initiated the project Manipulation of Medical Devices (ManiMed) in 2019. In this project, a security analysis of selected products is carried out through security assessments followed by Coordinated Vulnerability Diclosure (CVD) processes. The project report was published on December 31, 2020, and can be accessed on the BSI website [1].

ManiMed: Hamilton Medical AG – HAMILTON-T1 Ventilator Vulnerabilities

Mon, 22 Feb 2021 00:00:00 +0000

ManiMed: B. Braun Melsungen AG – Space System Vulnerabilities

Mon, 15 Feb 2021 00:00:00 +0000

ManiMed: Innokas Yhtymä Oy - VC150 Patient Monitor Vulnerabilities

Mon, 01 Feb 2021 00:00:00 +0000

ManiMed: Philips Medizin Systeme Böblingen GmbH – IntelliVue System Vulnerabilities

Mon, 25 Jan 2021 00:00:00 +0000

ManiMed: Market Analysis

Mon, 18 Jan 2021 00:00:00 +0000

ERNW White Paper 70 – HL7 FHIR: Preserving Distributed Resource Integrity

Fri, 18 Dec 2020 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper about the HL7 FHIR communication standard.

Introduction

Digital networking is already widespread in many areas of life. More and more medical devices are also being networked in the healthcare industry. This growth makes the development and use of new medical communication standards necessary since existing solutions can only meet the changing requirements with great effort. The HL7 FHIR standard is an example of such a medical communication standard. FHIR is said to have increased the interoperability between different medical contexts,e.g., administration, billing, and clinical care, to enable data exchange of various systems. The FHIR standard addresses the security risks associated with strongly networked communication from a large number of systems across the trust and organizational boundaries only indirectly because FHIR does not define mandatory security controls or requirements.

Apps on Prescription?! – Perspectives on Digital Health Applications (DiGA)

Thu, 05 Nov 2020 00:00:00 +0000

Some time ago, we carried out an evaluation of the Digital Health Applications Ordinance (Digitale-Gesundheitsanwendungen-Verordnung, DiGAV) for the Federal Chamber of Psychotherapists in Germany (Bundespsychotherapeutenkammer, BPtK) focusing on the security of digital health applications, often referred to as apps on prescription.

The audit was intended to determine to which extent security guidelines, security objectives, and best practices are adhered to by the requirements formulated by the ordinance, thus enabling the foundations to securely operate digital health applications. The main subject of the examination is whether requirements, including procedural requirements defined in the ordinance are sufficient to ensure security of digital health applications. The examination has shown that the requirements can be seen as positive. However, in order to be able to make reliable statements about the IT security of digital healthcare applications, further details and mechanisms should be clarified within the ordinance, which I would like to present in the following.

ERNW White Paper 69 – Safety Impact of Vulnerabilities in Insulin Pumps

Fri, 11 Sep 2020 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper [1]. The paper is about severe vulnerabilities in an insulin pump we assessed during project ManiMed and we are proud to publish this subset of the results today.

Manipulating Medical Devices

The German Federal Office for Information Security (BSI), in its role as the Federal Cyber Security Authority in Germany, aims to sensitize manufacturers and the public regarding security risks of networked medical devices. In response to the often fatal security reports and press releases of networked medical devices, the BSI initiated the project Manipulation of Medical Devices (ManiMed) in 2019. In this project, a security analysis of selected products is carried out through security assessments. In the context of this project, severe vulnerabilities were identified during the assessment of the DANA Diabecare RS system.

Medical Device Security: HL7v2 Injections in Patient Monitors

Thu, 23 Apr 2020 00:00:00 +0000

Digital networking is already widespread in many areas of life. In the healthcare industry, a clear trend towards networked devices is noticeable, so that the number of high-tech medical devices in hospitals is steadily increasing.

In this blog post, we want to elucidate a vulnerability we identified during the security assessment of a patient monitor. The device sends HL7 v2.x messages, such as observation results to HL7 v2.x capable electronic medical record (EMR) systems. A user with malicious intent can tamper these messages. As HL7 v2.x is a common medical communication standard, we also want to present how this kind of vulnerability may be mitigated. The assessment was part of the BSI project ManiMed, which we would like to present in the following section.

DMEA 2019: A reunion with the Medical Informatics Community

Mon, 29 Apr 2019 00:00:00 +0000

Earlier this month I attended the Digital Medical Expertise & Applications (DMEA) 2019. The DMEA fair in Berlin (formerly conhIT) is the central platform for digital health care as it brings together companies of health IT, academic institutions, politics and healthcare delivery organizations in several format such as innovation hubs and talks during congress sessions as a part of the industry fair. I participated in a congress session about IT security in healthcare with a talk about medical device security and common security flaws in medical devices. Some of the aspects have also been covered in my talk at #TR19 [1].

Motivational Aspects and Privacy Concerns on Wearables in the German Running Community

Fri, 14 Dec 2018 00:00:00 +0000

Today I am proud to announce that another paper of my former colleagues from Heilbronn University and me was published in one of the journals with the highest impact factor for Medical Informatics research called JMIR mHealth and uHealth. There is a reason why we published in this journal besides its informatics focus. The journal is an open access journal. That means that readers are not charged on a pay-per-view basis or other business models to access the full text of the paper. In return, the authors need to pay publication fees. In my opinion restricting access to academic research is not a way to go. I think this isn’t a thing we see in the security community often anyway. But this is and was the standard in academia for years.

GI Sicherheit 2018 Conference

Thu, 03 May 2018 00:00:00 +0000

Last week (25^(th) – 27^(th) April), I attended the “Sicherheit 2018” in Konstanz which is the annual meeting of the security community of the Gesellschaft für Informatik e.V. (GI) in Germany. The conference is in equal proportions attended by researchers and people of the industry working in security-related disciplines which lead to lively and pleasant discussions conversations.

The topics discussed were contentual wide-reaching, so there were very technical talks like Sebastian Banescu who was the winner and one of two candidates nominated for the best PhD thesis award presenting about “Characterizing the Strength of Software Obfuscation Against Automated Attacks”, as well as conceptual presentations such as Sabrina Krausz elucidated her bachelor thesis about an integrated procedure model for planning and implementing an ISMS on the example of the pharmaceutical production.