Security-Bits.de

As probably so many of you, I’m currently in various discussions on the dawn of vulnerabilities discovered by AI.

AI is moving forward quickly, making life easier for the one and harder for the others.

A while back I registered privlab.xyz for of my projects.

The Cyber Resilience Act contains various chapters referring to products and when they were placed on the market.

Working in Security, one of my core tasks is defending threats and attack vectors.

IDs no matter if government or company issued, for fun or a club, have both crucial but also symbolic roles.

Currently needing some deeper insights into LLMs, what they do and especially how they do it, I decided to write down a few lines, which I hope might be helpful.

Just having lost about a week debugging a potentially major issue, I’ve decided to share a few insights, to potentially save others the time I, we, just wasted: FortiVPN Auth with SSO shows a strange email address and redirects to login.live.com.

One of the most fun things of doing OT Security is being able to share strange things, just like todays Atlas Copco IPM IAM Process Control.

Currently giving Binarly a spin, I got to run analysis on a bunch of firmware, I’ve been wanting to have a look at for a long time, with one special trait, it’s automated.

(Sorry, all German!)

Sometimes, one wants to see whats going on on an embedded device, or maybe, what might have been going on in the past.

So I recently had to read through a few ten-thousand lines of Fortigate configs.

So, somehow, I feel like often causing irritation by turning around, looking for an Ikea Samla Box, of which I now have just under 200, and quickly do a PoC, prove a point or find a reference.

A few years back, mainly out of frustration, I developed something that started as a poor man’s asset management system for a company’s perimeter, which turned into a poor man’s perimeter Security tool.

For some Remote Wipe is the ultimate solution for Mobile Security.

After a long while, I’ve finally managed to write a few lines on my telescope.

I’m often told my home network is typical me and far to complex.

The German elektronische PatientenAkte or electronic patient file is a central approach, storing notes from all doctors on all generally insured patients in a central, more or less, secure place.

As already mentioned on various channels, I brought a fun little card printer with me to this year’s H2HC in Sao Paulo.

Back in 2019 I gave a presentation at hardwear.io titled “Day One with a TTIG-868” .

Most things that can easily kill you and others, require certification to ensure that applicable measures to reduce risks have been applied and that they’re functional.

Back when COVID had started and the first vaccinations had been applied, there was the fun challenge of proving one’s vaccination status.

A while back I started looking for a solution with which I could prove to be able to work safely from home while breaking devices.

Possibly highly intuitive to others, but a real b**** when not being fit.

In Germany petrol stations have to regularly share the price of their products with a government agency.

A while back Germany decided it would be a good idea to regulate the IT infrastructure in doctor’s practices.

type: ‘post’ title: ‘USB Malware’ date: ‘2024-06-22 01:00:01 +0000’ tags: [] author: ‘brian’ A short while ago I needed some real life malware samples to do a PoC related to the infection mass storage devices like memory cards and USB drives.

I recently received a nanoBTS 165G, which strangely enough made a rattling sound.

One of my big Todo List projects is temperature monitoring for the house.

A lot of time is invested into defining and describing OT Security or Operational Technology Security, especially in contrast to IT Security.

A while back Germany decided it would be a good idea to regulate the IT infrastructure in doctor’s practices.

Working on trainings to teach basics can be very frustrating due to the word basic.

Yet another PoC from my to do list: Which data passes through the SIM card on a data modem?

After a long time discussing the concept of USB sticks with internal AV engines, I’ve decided to create a quick and dirty PoC.

type: ‘post’ title: ‘Why and how Flipper Zero, not What’ date: ‘2023-12-13 10:00:01 +0000’ tags: [] author: ‘brian’ I always enjoy talking to people with various practical experience in the Security field and how questions and discussions slightly shift.

I recently got to make a new, fun badge for H2HC , which turned out to be a custom GameBoy game.

Working with risks is a task various departments and roles have to perform throughout a large company or cooperations.

Sorry, only in German this time.

CyberChef is a quick and easy tool for playing with encodings, data and information.

I recently ran a hardware based CTF at H2HC in Brazil.

Running some Ubiquiti UniFi equipment, I’ve also got a USW-Flex-Mini 5 port switch in my setup.

I recently wanted to understand why a product, which was certified following multiple different standards was so easy to pwn.

Needing a victim for an OT related talk, I decided to hit eBay and quickly found a cheap offer for a few Hirschmann industrial router/firewall/VPN node “EAGLE One” .

So I recently got a Hantek 2D72 handheld scope, signal generator and multimeter.

Since our first Packetwars at H2HC in 2015, it has somehow become a fun tradition.

A few months ago a friend asked me whether I’d be prepared to assist the Hacker Jeopardy staff to create a fun little prize for the 25th jubilee edition.

It seems that Hackers have a significant interest in Adrenaline and Epi-Pens: How they work, what they look like and how to use them.

I’m just on my way home from visiting Blue Frost Security ’s second edition of OffensiveCon .

type: ‘post’ title: ‘#UnlockedLaptop’ date: ‘2019-02-05 00:00:01 +0000’ tags: [] author: ‘brian’ Still traveling quite a bit, I’m always fascinated to see people in various places “just quickly getting up” and leaving their laptop unlocked.