Hacking Connected Home Alarm Systems – The Expensive [part 2]

TL;DR: We were wondering whether price affects the security of IoT appliances. So we verified the security of two differently priced connected home alarm systems. Both IoT alarms are marketed as an easy solution to protect your home. Unfortunately we find this not to be the case as we identified multiple critical vulnerabilities in both systems.  … Continue reading Hacking Connected Home Alarm Systems – The Expensive [part 2]

Helping children to get creative with code – NVISO @ WeGoSTEM

WeGoSTEM is an initiative that gives pupils of the 5th and 6th grade the chance to discover their talent for science and technology in a creative way. Each year WeGoSTEM wants to reach thousands of children and make them enthusiastic about STEM (Science, Technology, Engineering, Mathematics). Just like last year NVISO employees volunteered and  spent … Continue reading Helping children to get creative with code – NVISO @ WeGoSTEM

Hacking Connected Home Alarm Systems – The Cheap [Part 1]

TL;DR: We were wondering whether price affects the security of IoT appliances. So we verified the security of two differently priced connected home alarm systems. Both IoT alarms are marketed as an easy solution to protect your home. Unfortunately we find this not to be the case as we identified multiple critical vulnerabilities in both systems. … Continue reading Hacking Connected Home Alarm Systems – The Cheap [Part 1]

The Rise of Adversary Emulation

In this blog post, we will discuss a fairly new concept that has been gaining a lot of traction recently: Adversary Emulation. Adversary emulation aims to test a network’s resilience against advanced attackers or advanced persistent threats (APTs). To do so, the adversary’s tactics, techniques, and procedures (TTPs) are emulated along the cyber kill chain, … Continue reading The Rise of Adversary Emulation

OpenSSH User Enumeration Vulnerability: a Close Look

Intro An OpenSSH user enumeration vulnerability (CVE-2018-15473) became public via a GitHub commit. This vulnerability does not produce a list of valid usernames, but it does allow guessing of usernames. In this blog post, we take a closer look at this vulnerability and propose mitigation and monitoring actions. Technical details This vulnerability manifests itself in … Continue reading OpenSSH User Enumeration Vulnerability: a Close Look