RESEARCH BLOG

We are security experts and strive to be at the cutting edge

This blog features insights from our technical research, where we look at critical systems and highlight key security issues.

FEATURED

Heading

Extended Android security check: SnoopSnitch tests for Java vulnerabilities

SRLabs research found a significant patch gap in the Android patch ecosystem, which has since been shrunk. In our hunt for more missing patches, our SnoopSnitch app now detects significantly more potential vulnerabilities by analyzing Java bytecode.

NEW

Your Blockchain is only as secure as the application on top of it

Applications interacting with blockchain networks can be an attack surface to malicious actors and therefore need to be reviewed thoroughly.

NEW

When your phone gets sick: FluBot abuses Accessibility features to steal data

By abusing Accessibility features the FluBot malware circumvents Android's permission system to steal banking credentials. We explain how FluBot does this and what app developers can do to protect their users.

NEW

Chaining Three Zero-Day Exploits in ITSM Software ServiceTonic for Remote Code Execution

This blog post covers how three zero-days in one software product were chained together to access a company network through an Internet-accessible web application and then fully compromise it.

Blockchain security – Six common mistakes found in Substrate chains

There is relatively little guidance on security mistakes to expect when working on blockchain projects. This post lists six mistakes we regularly find when auditing Substrate-based chains along with hands-on advice on how to mitigate the issues.

Blockchain security – Best practices for your next review

Over the past years and in over a dozen audits we gained extensive experience in auditing Substrate-based Blockchain technologies. In this blog post we share our methodology that helped to identify many critical vulnerabilities.

Balancing long-term technology evolution with short-term side-effects - Vulnerability disclosure best practices

Responsible disclosure is the best practice to handle and fix unknown vulnerabilities. This blog includes real-world experience and advice from over a decade of SRLabs disclosing vulnerabilities responsibly.