Vulnerability in Cordaware bestinformed
CVE CVE-2021-3168 Vulnerable software Cordaware bestinformed <= version 5.1.0.3 Vulnerability An Unquoted service path in Cordaware bestinformed software allows a local attacker to potentially escalate privileges to system level. Timeline 15.12.2020 Vendor informed via email 17.12.2020 Sending additional information to Vendor 12/18/2020 Calling Vendor 11.01.2021 Still no reply 14.01.2021 Disclosure because of exceeding the 30-day […]
Certifications Q4 2020
I try to attend technical trainings regularly to get new input for my work. Therefore, in the past few months, I have completed additional trainings and acquired certifications accordingly: I try to write a review for every training, but I don’t know when yet 😉
Lecture at Trust in Tech Cologne
I was allowed to give a talk at Trust in Tech Cologne on 21.09.2020. I enjoyed the event extremely much and it was a super open round, thank you very much for that! Click here for the slides on the topic“The last one closes the door – Unlocked offices as an invitation for hackers“.
Podcast at Tech Data
I had a lot of fun with an anniversary edition of the podcast “Ones & Zeros, IT Simply Explained” at Tech Data. We talked about different technical testing options for the level of security in companies. Who likes can listen in 😉
Vulnerability in monitoring software
CVE CVE-2020-13912 Vulnerable software SolarWinds “Advanced Monitoring Agent” before 10.8.9 Vulnerability Insufficient authorization/ rights extension Timeline Description The Advanced Monitoring Agent software up to version 10.8.9 was executed when each user (remote or local) logged in. The corresponding file can be modified by all users on the system. A malicious user could exchange the file […]
3x More security in the HomeOffice
In the past few weeks, I have created a number of webinars and documents that can help companies and possibly also one or two private individuals to protect themselves in the home office. Depending on how much time you can/want to spend for this, you just have to choose the right paragraph 😉 For those […]
Too much cyber, too little security!
The number of cyberattacks, the damage they cause, and the professionalism of the perpetrators continues to grow. Therefore, the security market is currently growing faster than any other. Nevertheless, or precisely because of this, many providers appear on the market who have no business in security. How do you recognize a good security service provider? […]
From AWAE to OSWE: The Preperation Guide
As promised on Twitter this post will document my steps through the OSWE exam preperation. Searching for available study material After some google action i found some useful stuff Step 1: The Plan I decided to follow the training order mentioned in AWAE-PREP because it seemed logical considering the AWAE course material. Step 2: Start […]
Best Practice: Intel Unquoted Service Path
Affected Software Intel Management Interface <= 1815.12.0.2021 Issue In my last assessment I discovered an unquoted service path in the Intel Management Engine Interface. In general this could lead to privilege escalation on a system, if the service is running with higher privileges and we (unprivileged user) got writing permissions along the installation path of […]
HanseSecure as one of the top 21 – twice
It’s funny that two independent companies name the “21” cybersecurity and redteaming resources in the world. But I appreciate being named in both lists. One is an American tech blog called Techbeacon and the other is the American endpointprotectoin company SentinelOne. 2018 – Techbeacon: Modern Red Teaming: 21 resources for your security team. https://techbeacon.com/security/modern-red-teaming-21-resources-your-security-team 2019 […]
