When conducting pentests of Bluetooth devices or whilst working on Bluetooth
related research, we often use Bumble. In
this Blogpost I will present a solution to capture a live stream of Bumble
Bluetooth traffic in Wireshark.
Bumble is a fully featured Bluetooth stack, written entirely in Python. What
makes it extremely powerful for security assessments and research is the level
of control it provides. It can simulate certain conditions, including errors,
with a level of precision that most Bluetooth stacks don’t offer. However,
sometimes you not only need control, you also need visibility.
We are regularly offering a
GCP Incident Response and Analysis
training. In this training, we analyze resources in GCP cloud together with our
trainees that were successfully compromised by attackers, e.g., GCE instances
and Cloud Build projects. Therefore, we need tooling that quickly detects
misconfiguration of resources that helped the attacker during the compromise.
During the analysis of different tools and different kinds of misconfiguration
we realized that GCE instance access scopes are a blind spot of many (in fact
all that we tested) security audit tools. In this blog post, we want to
elaborate on the problems that arise from this behavior.
About six months ago we released a
security advisory
on this blog about vulnerabilities in Airoha-based Bluetooth headphones and
earbuds. Back then, we didn’t release all technical details to give vendors more
time to release updates and users time to patch their devices. Around the time
of the initial partial disclosure in the beginning of June, Airoha put out an
SDK release for their customers that mitigates the vulnerabilities. Now, half a
year later, we finally want to publish the technical details and release a tool
for researchers and users to continue researching and check whether their
devices are vulnerable.
Three weeks ago, I attended MCTTP 2025 in Munich,
organized by Vogel IT and curated by the fine folks Florian Hansemann, Dr. Marc
Maisch, and Florian Oelmaier. Awesome event with some very cool talks, and great
conversations over dinner and most notably at the Oktoberfest on Saturday
(thanks again for that special trip, Flo!). I had the pleasure and honor to give
the keynote on the 2nd day. The goal was to make it a bit entertaining and
enlightening for the international audience, so I covered some German
literature, too ;-). The slides can be found
here, and the transcript
here. Looking forward
to meeting some folks again next year, maybe even at
TROOPERS26 😉
Today we are releasing a new white paper that delivers a technical analysis of
security weaknesses discovered in WinpMem, an open-source Windows memory
acquisition driver widely used in digital forensics.
After a concise primer on relevant Windows internals (virtual vs. physical
memory, page tables and PTEs, CR3 context switching, and kernel and user memory
separation), the report examines how both the fundamental design of WinpMem and
specific implementation choices create severe risk.
The VERTIV Avocent AutoView switches are analog keyboard, video, and mouse (KVM)
switches used in data center servers. They also expose a web server in the
network, which allows for some configuration.
During a penetration test for a customer, a device of this type was identified
in the infrastructure and analyzed, revealing an authentication bypass in the
web application.
The application is written in PHP. To gain access to the PHP scripts, the
firmware update was downloaded from the vendor’s download page. From the update,
the PHP files can easily be extracted and analyzed.
With the rise of AI assistance features in an increasing number of products, we
have begun to focus some of our research efforts on refining our internal
detection and testing guidelines for LLMs by taking a brief look at the new AI
integrations we discover.
Alongside the rise of applications with LLM integrations, an increasing number
of customers come to ERNW to specifically assess AI applications. Our colleagues
Florian Grunow and
Hannes Mohr analyzed the novel attack
vectors that emerged and presented the results at
TROOPERS24 already.
First, a few words regarding my experience at Black Hat: for me, it was the
first time attending the conference and then directly as a speaker. I thoroughly
enjoyed Black Hat. It took a while to get used to the size of the conference and
the vibe of Las Vegas. What was especially interesting for me was connecting
with other researchers. One thing that stood out was meeting with the team from
MSRC and putting faces to the team itself. It feels way more personal to know
who you’re talking to when you know the people handling your cases. During
TROOPERS I typically have the chance to connect with many researchers, mainly
from Europe. At Black Hat US, on the other hand, it is possible to connect more
with the US scene and meet people you haven’t seen in a long time! Seeing
familiar faces again is always nice, as opposed to putting them into your
biometric template database. One nice detail was that some international
researchers are aware of the research BSI (German: “Bundesamt für Sicherheit in
der Informationstechnik” – “German federal office for IT security”) is
facilitating. The results of our presentation stem from the “Windows Dissected”
project we are performing on behalf of the BSI.
The #TROOPERS25 ‘AD & Entra ID Security’ track was a blast – as was the whole
conference 😉 – bringing together some of the smartest researchers in the field
and a great audience of practitioners willing to share their experiences during
the roundtable. The slides of the talks have
been released in the interim on the TROOPERS website, but
since many speakers published additional blogposts or released tools, we provide
a compilation of resources from the track in the following.
The purpose of this blog post is to explain how Secure Boot works. In
particular, we will explain where current implementations of Secure Boot by
Linux distributors fall short compared to Microsoft Windows and Apple macOS.
Major distributors like Canonical, Debian, openSUSE, and Red Hat place a high
priority on making their operating systems work out of the box. Given the
current Linux landscape with out-of-tree drivers and incompatible licenses,
providing the end user with all the drivers possibly needed to boot the system
can be challenging.