RESEARCH BLOG

We are security experts and strive to be at the cutting edge

This blog features insights from our technical research, where we look at critical systems and highlight key security issues.

FEATURED

Heading

Blue Merle: Reducing your cellular footprint

Mobile network operator tracking methods present privacy risks for users of 4G LTE routers, even those designed for user anonymization. Our open-source blue merle project mitigates those affecting the GL.iNet Mudi (GL-E750) router.

NEW

EDRs decrease your enterprise security, unless properly hardened

Through default credentials we gained full access to the popular Cynet 360 EDR system, its privileges, and functions. Additionally, we discovered three high-severity vulnerabilities in the EDR, arising from weak access control on API endpoints.

NEW

Smarter is not always wiser: How we hacked a smart payment terminal

Smart payment terminals can be vulnerable due to their expanded capabilities and the use of end-of-life OS, which result in a large attack surface. This post shares our experience hacking a popular smart point of sale device during an SRLabs retreat.

NEW

Hacking mobile networks has gotten a lot more interesting with 5G and Open RAN

Cloud security is often the weakest link in modern 5G networks according to our red team hacking assessments. Telcos have an opportunity now to embrace cloud security best practices and make 5G networks much more hacking resilient.

Chaining Three Zero-Day Exploits in ITSM Software ServiceTonic for Remote Code Execution

This blog post covers how three zero-days in one software product were chained together to access a company network through an Internet-accessible web application and then fully compromise it.

Blockchain security – Six common mistakes found in Substrate chains

There is relatively little guidance on security mistakes to expect when working on blockchain projects. This post lists six mistakes we regularly find when auditing Substrate-based chains along with hands-on advice on how to mitigate the issues.

Blockchain security – Best practices for your next review

Over the past years and in over a dozen audits we gained extensive experience in auditing Substrate-based Blockchain technologies. In this blog post we share our methodology that helped to identify many critical vulnerabilities.