EFAIL – are encrypted e-mails insecure now?
As the chairmen of a German human rights association I‘m familiar with how NGOs handle e-mail encryption and how important it is. Of course the research behind EFAIL points out valid vulnerabilities, …
Breaking IoT devices - a pentesting checklist
When I was preparing my talk for TROOPERS I noticed that there aren't a lot of ressources on penetration testing for IoT devices that's why I wrote this short todo list in the speaker’s lounge. Use it…
Are you sure - you are alone?
Everything began in the summer of 2017...a lonely IoT camera was getting dusty on my table, I remember I bought it back in 2016 to check what's going on at home when I'm on vacation but I guess that w…
Why you shouldn't use enableRemoteAdmin and lock down your Axis server
On a recent pentest I discovered a Apache Axis instance exposed on port 80, I never saw something like this before so I started to play with it and discovered some interesting things. But first of all…