RESEARCH BLOG

We are security experts and strive to be at the cutting edge

This blog features insights from our technical research, where we look at critical systems and highlight key security issues.

FEATURED

Heading

Blockchain security – Best practices for your next review

Over the past years and in over a dozen audits we gained extensive experience in auditing Substrate-based Blockchain technologies. In this blog post we share our methodology that helped to identify many critical vulnerabilities.

NEW

Balancing long-term technology evolution with short-term side-effects - Vulnerability disclosure best practices

Responsible disclosure is the best practice to handle and fix unknown vulnerabilities. This blog includes real-world experience and advice from over a decade of SRLabs disclosing vulnerabilities responsibly.

NEW

Honeypot research shows variety of DDoS amplification methods

UDP protocol design makes it easy to hide the real origin of requests, making it the perfect candidate for DDoS amplification and leaving prevention as the only protection against these threats

NEW

Achieving Telerik Remote Code Execution 100 Times Faster

A cryptographic vulnerability in the development software Telerik UI from 2017 turned out to be impractical to exploit until now. This blogpost details the optimization techniques deployed, which can be applied to similar issues in other software.

Incorrectly patched ZyXEL vulnerability becomes zero-day again

We dug deeper into the vulnerability and patch for CVE-2020-9054, a pre-auth command injection in ZyXEL NAS devices. We found that the patched vulnerability was still exploit-able due to incomplete patching.

A decade of hacking – meet the people behind SRLabs

It almost seems like eons ago when we were just some geeks having fun solving tech puzzles. We were discovering flaws in systems that we used every day. From this research, we soon realized it would be a bigger benefit for everybody ...

The Android patch ecosystem – Still fragmented, but improving

Since 2018, SRLabs has refined Android patch analysis through the app SnoopSnitch [1]. Recent SnoopSnitch data paints an improved picture of the Android ecosystem over what we saw in 2018 [2].