ERNW White Paper on Insinuator.net - Bold Statements

ERNW White Paper 79: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection

Wed, 12 Aug 2026 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper about our incident analysis and digital forensics framework. It is available on our website.

Due to the increasing number and impact of computer security incidents, it has become essential to develop and implement efficient measures for their investigation. However, comprehensive forensic analyses are time-consuming, and this time is often not available to security analysts during computer security incidents. As a result, automated tools are increasingly being used. These tools, however, often cover only a limited scope of the necessary analyses and typically require deep technical expertise to be used effectively.

ERNW White Paper 77: Unified Security Hardening with Cross-Platform Native Binaries

Wed, 20 May 2026 00:00:00 +0000

When configuring a new device, achieving an acceptable Lynis hardening score is a challenge most practitioners are familiar with.

ERNW Whitepaper 76: Linux Client Hardening Guide

Tue, 19 May 2026 00:00:00 +0000

Hardening a Linux client system to an acceptable degree is a time-consuming process, one that demands familiarity with a broad set of configuration parameters, framework recommendations, and the reasoning behind each control.

This post introduces our new Linux client hardening guide (MD, PDF), a comprehensive, publicly available hardening reference for Linux systems.

Motivation and Scope

The guide covers the full breadth of controls needed to significantly raise the security posture of a modern Linux installation while preserving operational usability (this will be very subjective, the guide reflects my opinion of “usable”). It has been developed and validated against Ubuntu 24.04 LTS as the primary reference platform, and cross-tested on Fedora, Debian 12, and Arch Linux as well as on traditionally server-oriented distributions like openSUSE Leap 15.6, Debian 12, Rocky Linux 9, and Red Hat Enterprise Linux 9 while not focussing on those as the guide is created for Linux clients.

One More Thing: Introducing the New macOS 26 Tahoe Hardening Guide

Wed, 11 Feb 2026 00:00:00 +0000

After seven years, we’re publishing a new macOS hardening guide. Fully updated, modernized, and now publicly available on GitHub as Markdown and on our website as PDF.

The previous guide, written for macOS Mojave (10.14), reflected a very different macOS security model. At the time, hardening often meant working around the operating system, manually enforcing controls, and compensating for missing platform guarantees. That guide served its purpose, but the platform has fundamentally changed since then.

Release of ERNW White Paper 73: Analyzing WinpMem Driver Vulnerabilities

Thu, 02 Oct 2025 00:00:00 +0000

Today we are releasing a new white paper that delivers a technical analysis of security weaknesses discovered in WinpMem, an open-source Windows memory acquisition driver widely used in digital forensics.

After a concise primer on relevant Windows internals (virtual vs. physical memory, page tables and PTEs, CR3 context switching, and kernel and user memory separation), the report examines how both the fundamental design of WinpMem and specific implementation choices create severe risk.

ERNW Whitepaper 71: Analysis of Anti-Virus Software Quarantine Files

Wed, 27 Jan 2021 00:00:00 +0000

I am glad to announce the release of the ERNW whitepaper 71 containing information about quarantine file formats of different AV software vendors. It is available here.

Anti-Virus Software

I took quarantine files from real-life incidents and created some in a lab environment. Afterwards I tried to identify metadata, like timestamps, path names, malware names, and the actual malicious file in the quarantine files. One goal was to use this information to support our incident analyses: Using the results, we can now easily create timelines showing information about quarantined files, extract the detected malware, and sometimes even find information about processes that created the malicious files.

ERNW White Paper 70 – HL7 FHIR: Preserving Distributed Resource Integrity

Fri, 18 Dec 2020 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper about the HL7 FHIR communication standard.

Introduction

Digital networking is already widespread in many areas of life. More and more medical devices are also being networked in the healthcare industry. This growth makes the development and use of new medical communication standards necessary since existing solutions can only meet the changing requirements with great effort. The HL7 FHIR standard is an example of such a medical communication standard. FHIR is said to have increased the interoperability between different medical contexts,e.g., administration, billing, and clinical care, to enable data exchange of various systems. The FHIR standard addresses the security risks associated with strongly networked communication from a large number of systems across the trust and organizational boundaries only indirectly because FHIR does not define mandatory security controls or requirements.

ERNW White Paper 69 – Safety Impact of Vulnerabilities in Insulin Pumps

Fri, 11 Sep 2020 00:00:00 +0000

With this blog post I am pleased to announce the publication of a new ERNW White Paper [1]. The paper is about severe vulnerabilities in an insulin pump we assessed during project ManiMed and we are proud to publish this subset of the results today.

Manipulating Medical Devices

The German Federal Office for Information Security (BSI), in its role as the Federal Cyber Security Authority in Germany, aims to sensitize manufacturers and the public regarding security risks of networked medical devices. In response to the often fatal security reports and press releases of networked medical devices, the BSI initiated the project Manipulation of Medical Devices (ManiMed) in 2019. In this project, a security analysis of selected products is carried out through security assessments. In the context of this project, severe vulnerabilities were identified during the assessment of the DANA Diabecare RS system.

ERNW Whitepaper 67: Active Directory Trust Considerations

Tue, 11 Dec 2018 00:00:00 +0000

Last week Will “harmj0y” Schroeder published an excellent technical article titled “Not A Security Boundary: Breaking Forest Trusts” in which he lays out how a highly critical security compromise can be achieved across a forest boundary, resulting from a combination of default AD (security) settings and a novel attack method. His post is a follow-up to the DerbyCon talk “The Unintended Risks of Trusting Active Directory” which he had given together with Lee Christensen and Matt Nelson at DerbyCon (video here). They will also discuss this at the upcoming Troopers Active Directory Security Track (details on some more talks, including Sean Metcalf’s one, can be found in this post or this one).

White Paper on Incident Analysis and Forensics in Docker Environments

Wed, 14 Feb 2018 00:00:00 +0000

In this article, we describe the impact of the increased use of Docker in corporate environments on forensic investigations and incident analysis. Even though Docker is being used more and more (Portworx, Inc., 2017), the implications of the changed runtime environment for forensic processes and tools have barely been considered. We describe the technological basics of Docker and, based on them, outline the differences that occur with respect to digital evidence and previously used methods for evidence acquisition. Specifically, we look at digital evidence within a Docker container which are lost or need to be acquired in different ways compared to a classical virtual machine, and what new traces and opportunities arise from Docker itself.

White Paper on Multi-Factor Authentication in Microsoft Windows Environments

Mon, 29 Jan 2018 00:00:00 +0000

A new ERNW whitepaper was just published. I wrote this whitepaper in the course of my bachelor thesis and it examines multi-factor authentication in Microsoft Windows environments:

Credential theft and the subsequent reuse of stolen credentials are a significant problem in today’s information security. To counter the associated risks, a planned approach is required as part of a comprehensive security architecture program. This includes the implementation of multi-factor authentication as an important building block. This whitepaper covers the relevant steps of implementing a multi-factor authentication system in an enterprise environment and closes with a security evaluation.

White Paper on Incident Handling First Steps, Preparation Plans, and Process Models

Wed, 01 Feb 2017 00:00:00 +0000

We just published my Whitepaper about First Steps, Preparation Plans, and Process Models for Incident Handling, that I wrote to pass the time between Christmas and New Year. The whitepaper sums up information that I consider to be useful to prepare for IT security incidents as a conclusion from the incidents in which we supported over the past year.

Have you for example thought about classes of incidents that are most likely to affect you and formulated Incident Handling Preparation Plans for those incidents?

An MLD Testing Methodology

Fri, 06 Mar 2015 00:00:00 +0000

Based on recent research in the ERNW IPv6 lab and with our MLD talk looming we’ve put together a (as we think) comprehensive document discussing how to thoroughly test MLD implementations in various components (network devices or servers/clients). We hope it can contribute to a better understanding of the protocol and that it can serve as either a checklist for your own environment or as a source of inspiration for researchers looking at MLD themselves.

Evaluation of IPv6 Capabilities of Commercial IPAM Solutions

Wed, 28 Jan 2015 00:00:00 +0000

Originating from a customer IPv6 deployment project, in early 2014 we defined a number of requirements as for the IPv6 capabilities of IPAM solutions, with a certain focus on security-related requirements (due to the specific environment of the project). We subsequently performed a practical evaluation of several commercial solutions, based on documentation, lab implementation and vendor communication.

We just released a newsletter describing the requirements and the results of the evaluation.
It should be noted that in the interim newer versions of the evaluated products might be available which might have enhanced features. Hence, from our perspective, understanding the requirements of an individual environment might even be more important than the actual results described in that document (as those only reflect a certain point of time). We hope to contribute here to a well-informed requirements definition and decision taking process on your side.
Feel free to get back to us on any of the points laid out or, even better, join us at the Troopers IPv6 Security Summit in Heidelberg on Mar 16th/17th in order to discuss any related points.

Dynamics of IPv6 Prefixes within the LIR Scope in the RIPE NCC Region

Thu, 06 Nov 2014 00:00:00 +0000

To contribute to the current debate on IPv6 route deaggregation & “strict-filtering” performed by certain ISPs we just released a white paper on “Dynamics of IPv6 Prefixes within the LIR Scope in the RIPE NCC Region“. I will give a talk on the overall topic later today at the Routing Working Group. We sincerely hope that the IPv6 community becomes aware of the inherent issues, and that practical solutions can be found which consider & meet the needs of the different parties involved.

ERNW Newsletter 42: Dangers of Disabled Pre-Boot Authentication in Corporate Environments

Mon, 16 Dec 2013 00:00:00 +0000

It’s been a long time… we just published an ERNW Newsletter. Here’s the abstract:

In order to protect sensitive data on corporate laptops, most companies are using full disk encryption solutions. While native encryption products like Microsoft Bitlocker, Apple FileVault and open source solutions like TrueCrypt were already heavily scrutinized by security researchers, many popular commercial third party products are to some point still black boxes.

In this paper, we discuss Check Point Full Disk Encryption (FDE) with active “Windows Integrated Logon”. Checkpoint FDE is a software package that is part of Check Point Endpoint Security and offers full disk encryption on Microsoft Windows and Mac OS X systems. The “Windows Integrated Logon” feature reduces total cost of ownership by disabling pre-boot authentication. Check Point themselves warn about security risk associated with using this feature.

VMDK Has Left the Building — Newsletter

Sat, 23 Feb 2013 00:00:00 +0000

We are pleased to announce that we summarized the results from our VMDK research in our latest newsletter.

We hope you enjoy the reading and will get some “food for thought”!

The newsletter can be found at:
ERNW_Newsletter_41_ExploitingVirtualFileFormats.pd

A digitally signed version can be found at:
ERNW_Newsletter_41_ExploitingVirtualFileFormats_signed.pdf

Enjoy your weekend,
Matthias

Windows Server 2008 R2 BSI-compliance

Thu, 26 Jul 2012 00:00:00 +0000

Recommendations by the German Federal Office for Information Security (BSI – Bundesamt für Sicherheit in der Informationstechnik) are obligatory for German government agencies, civil services and authorities (like recommendations of the NIST are relevant to American government agencies and authorities). They are often used as references and security best practices in other countries as well. Hence it is hard to understand why the recommendations on how to harden Windows Server 2008 based systems were published only some weeks ago and only on a preliminary draft basis (which is, obviously, better than nothing ;-)).

Sell Your Own Device – A Field Study on Decommissioning of Mobile Devices

Tue, 28 Feb 2012 00:00:00 +0000

On Friday we released our latest technical newsletter with the fancy title “Sell Your Own Device – A Field Study on Decommissioning of Mobile Devices”. It is the result of a field study on decommissioned mobile business devices bought on eBay and about how stored data may be extracted in different ways.

As always we love to share plenty of practical advise: At the end of the newsletter you will find the mitigating controls to securely handle mobile devices at the end of their life cycle process.

A Wrap-up on MFD Security

Wed, 16 Nov 2011 00:00:00 +0000

On last year’s TROOPERS11, Matthias (mluft) and I gave a talk on Multifunction Devices. Hardly surprising: It was related to the state of secure operation of MFDs. It was heavily motivated by experiences we collected out in the wild. We faced a frightening low level of awareness concerning the role of MFDs for the overall security picture – in particular regarding the processing of sensitive data…

However, instead of only showing and proving well-known weaknesses and vulnerabilities, we decided to adapt ERNW’s *Seven Sisters *model in order to match the needs of secure MFD operation and to develop some kind of guideline. As Matthias already lost some words on this, I’m not gonna waste your valuable time by repeating, what has already been said. However I described our approach and our thoughts on that topic in a recently published ERNW Newsletter. If for what ever reason you didn’t see our talk or even didn’t attend TROOPERS11 at all, have a look on Newsletter 37 and give us feedback on what you think about the whole topic…

Certificate Based Device Authentication with iOS Devices

Wed, 05 Oct 2011 00:00:00 +0000

We recently performed a Proof-of-Concept (PoC) implementation of certificate based auth with iPads in some large environment. So far the focus has been mainly on WLAN access; VPN and EAS authentication are going to follow in the next step.

As we figure that the topic might be of interest for some of you, we’ve extracted a certain, not-too-customer-specific part of the deliverable and converted it into an ERNW newsletter. Special thanks go to Rene Graf for leading the project! 😉

Research on “Application Virtualization” – Results online now

Mon, 16 Aug 2010 00:00:00 +0000

Just wanted to let you know that we sent out ERNW Newsletter 32 end of last week. As we promised it includes the results of research regarding the question “Is browser virtualization a valid security control in order to mitigate browser based security risks?”.

Simon did a great job with writing the latest newsletter. It’s a 30-page document which should help you to have a basis for well-informed decisions when it comes to the deployment of an application virtualization technology.