Last week I gave a talk at #TROOPERS26: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection. I discussed the challenges of incident analysis, such as increasing storage capacities and the lack of integration between tools. I presented a modular framework that integrates established forensic and analysis tools using a decision-tree-based control mechanism. A workflow was designed to control the execution of 14 integrated analysis tools in order to reproduce the manual analysis process usually performed by analysts. Moreover, the framework is capable of identifying whether a system has been compromised and compiles a analyst-oriented report. Together with the audience we took a look at the report in a live demonstration. The evaluation results of the framework were promising as it was able to identify all compromised systems. However, a significant number of false positive classifications were also observed. To improve the framework possible future extensions include functionality such as recovering already deleted files to detect missed Indicators of Compromise. Additionally, our team want to integrate artificial intelligence in the workflow to help in data processing and make more decisions automatically. The slides will be published next week on the conference website. I will add the link in this blog post when they become available. A more detailed description of the content of the talk can be found in the following sections. Looking forward to #TROOPERS27!
Continue reading Continue readingHeads-up: TROOPERS Roundtable – Supply Chain Security
How to strengthen Supply Chain Security: Practical Exchange and Roadmap
Join an open, practitioner-focused roundtable for direct exchange on supply chain security. This session offers a concise overview of core concepts, e.g. SBOM, CSAF, and VEX and digs into the processes behind them: how to obtain, process and apply information to improve security across the supply chain.
We will examine:
- How SBOM, CSAF and VEX relate and why version-level detail matters.
- The practical value of an SBOM and why it’s increasingly required by law and IT procurement.
- How to create and consume SBOMs?
- Methods to identify dependencies in the context of vulnerabilities.
- Approaches to triage: not all vulnerabilities affect every stakeholder equally.
- Techniques to analyze vulnerabilities and identify affected products and product families.
- Sources of vulnerability information and how to map data unambiguously to products and specific software versions.
- Reporting obligations: where and how to disclose vulnerabilities.
- Tools and automation that help manage information volume and complexity.
- Technical, organizational and personnel challenges to achieving end-to-end supply chain security.
- The role of AI in supply chain security.
- How do we protect ourselves from malicious actors / infected dependencies?
- The Cyber Resilience Act (CRA): implications for companies, products and consumers, the CRA roadmap, and concrete deadlines and actions.
- We will show a live demonstration of the whole process, e.g. covering the consumption of SBOMs, vulnerability identification and assessment, creation of VEX documents.
This roundtable is designed for security practitioners, product owners, compliance officers and decision-makers who want actionable guidance and peer discussion. Expect candid conversation, real-world examples and next steps you can take to strengthen resilience across your supply chains.
Continue reading Continue readingVulnerability Disclosure: Stealing Emails via Firefox’s AI Features
Imagine the following: You visit a webpage with a lot of text you don’t want to read and ask your AI assistant for a summary. A few moments later, the AI assistant has extracted one of your emails and sent it to an attacker without you ever knowing.
In October 2025, we found exactly this vulnerability in Firefox’s AI chatbot integration1.
Firefox offers a summarization, explaination and proofread AI feature. When a user makes use of one of these features, Firefox pastes a prompt into the sidebar AI chat including the page title, the selected text (or, if the whole page is summarized, a selection is being made by Firefox) and an instruction on how to process the provided text. The sidebar AI chat is essentially an IFrame of a third-party chatbot (Claude, Copilot, …).
Continue reading Continue readingInsights into Entra ID’s (Un)Conditional Access
When looking at security measures in Microsoft Entra ID environments, a common recommendation is to implement Conditional Access policies.
Whether Conditional Access is implemented can be quickly checked, and you can put a check mark next to it in your best-practice compliance form. However, simply implementing conditional access will not provide much security. A phishing attack that we recently analyzed highlights this very well.
Continue reading Continue readingCVE-2026-47237 – Overly Permissive Istio Permissions Allow Kubeflow Authorization Token Stealing
Kubeflow is vulnerable to the theft of authorization tokens by any user of the
Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With
this token, the attacker can take over the user’s account and the data that is
processed by that user. The attacker needs a valid user with the kubeflow-edit
or Contributor role in a random Kubeflow namespace to perform this attack. This
is given if Automatic Profile Creation is enabled. A setup based on the
official manifests prior to version 1.10, and on most other packaged Kubeflow
distributions, is vulnerable.
The Istio edit permissions were removed by Kubeflow in a timely manner. Affected users should update to the latest version to mitigate this issue.
Continue reading Continue readingERNW White Paper 77: Unified Security Hardening with Cross-Platform Native Binaries
When configuring a new device, achieving an acceptable Lynis hardening score is a challenge most practitioners are familiar with.
Continue reading Continue readingERNW Whitepaper 76: Linux Client Hardening Guide
Hardening a Linux client system to an acceptable degree is a time-consuming process, one that demands familiarity with a broad set of configuration parameters, framework recommendations, and the reasoning behind each control.
This post introduces our new Linux client hardening guide (MD, PDF), a comprehensive, publicly available hardening reference for Linux systems.
Motivation and Scope
The guide covers the full breadth of controls needed to significantly raise the security posture of a modern Linux installation while preserving operational usability (this will be very subjective, the guide reflects my opinion of “usable”). It has been developed and validated against Ubuntu 24.04 LTS as the primary reference platform, and cross-tested on Fedora, Debian 12, and Arch Linux as well as on traditionally server-oriented distributions like openSUSE Leap 15.6, Debian 12, Rocky Linux 9, and Red Hat Enterprise Linux 9 while not focussing on those as the guide is created for Linux clients.
Continue reading Continue readingWhen paradigms are shifting: InfoSec in the age of AI
Over the last few weeks, I have had a very productive exchange with Christoph Klaassen on the impact of AI on security governance and compliance. In this post, we summarize our thoughts.
Continue reading Continue readingDisclosure: Command Injection in Geutebrück Cameras
During a penetration test for a customer, we identified a command injection
vulnerability in Geutebrück security cameras that allows authenticated attackers
to execute arbitrary commands as root through the web interface. The root cause
is unsanitized user input being passed into a sed script (and at least 12
other CGI endpoints). In addition to the injection, we identified an XSS
vulnerability, an exposed system menu leaking configuration and log data, and an
insecure GET-parameter-to-environment-variable mapping that enables abuse of
variables like LD_PRELOAD and LD_DEBUG. We reported the findings to
Geutebrück and a patched firmware was provided. This post walks through how we
got from a sed error message to a root shell.
Windows Early Boot Configuration: The CmControlVector and PspSystemMitigationOptions
While investigating how process mitigation settings are initialized, I
encountered the global variable PspSystemMitigationOptions. Tracing how this
value is populated led me to the CmControlVector. In this blog post, we take a
look at the Windows kernel land configuration manager, especially its global
CmControlVector variable. Quick note: the kernel’s configuration manager is
not related to Microsoft Intune’s
Configuration Manager.
In short, the configuration manager is responsible for managing and implementing
the registry. However, it is also responsible for setting up parts of the system
during early boot.