diamond_full diamond diamond_half diamond_euro search-icon menu chat-icon close-icon envelope-icon smartphone-call-icon



preview-image for Logo

Attacking a random number generator

October 12, 2020 #cryptography #attacks

In software dealing with security, randomness is often necessary to generate keys or tokens for resetting passwords or identifying sessions. There, randomness is required to be unpredictable for an attacker. However, sometimes developers do not use cryptographically secure pseudo random number generators (CSPRNG) in this scenario. Instead they utilize faster pseudorandom number generators (PRNG). Consequently, the question arises how hard it is to attack a common (not cryptographically secure) random number generator.

preview-image for Logo

Power analysis based software reverse engineering assisted by fuzzing II

September 3, 2020 #embedded security #secforcars #power analysis #reverse engineering #fuzzing #attacks

In the previous post a setup and a technique to extract a representative section of a powertrace of a specific instruction of a STM32F3 processor were described. This section is called a “template”. These templates should later be used to identify instructions via a power sidechannel and reconstruct the flow of an unknown program on a controller that can not be dumped via JTAG. In this part of our poweranalysis series the extracted templates from the previous post will be analyzed to determine whether they are representative enough to reverse engineer entire programs from a powertrace.

preview-image for title

Uncovering a Malware Campaign Targeting the Logistics Industry

April 2, 2020 #phishing #attacks

Recent malware campaigns targeting private individuals and organizations quickly adapted to new spreading methods: Content related to COVID-19 is currently one of the main ways to distribute spam emails and malicious software [1]. This post outlines how opening a malicious Word document enables an attacker to conduct industrial espionage. This specific malware was likely sent to a selected list of potential victims, embedded in a document that was attached to a COVID-19-related phishing email.


Power analysis based software reverse engineering assisted by fuzzing I

August 26, 2019 #embedded security #secforcars #power analysis #reverse engineering #fuzzing #attacks

This is the first part of a three part series about power analysis based software reverse engineering. It is part of our work in the SecForCARs project and the bachelor thesis ‘Poweranalyse basiertes Software Reverse Engineering mit Hilfe von Fuzzing’. The results will be summarized in this blogpost series. In this first part the goals of the research and the power analysis template extraction process are presented.

preview-image for it-grc-cwolfert-schutzwerk.png

Presentation about "targeted attacks on IT networks"

October 5, 2016 #news #talk #event #attacks

SCHUTZWERK at the first IT-GRC Congress in Berlin. On the 15th and 16th June 2016 the first IT-GRC Congress took place in Berlin. The organizers "ISACA Germany Chapter e.V." and “Quadriga Hochschule Berlin” focus the event on “Cyber Security & Digital Transformation”. But the topics went beyond Governance, Revision and Compliance and covered also the current threat landscape in information technology. At the event Christoph Wolfert, Senior Security Consultant at SCHUTZWERK GmbH, spoke about targeted attacks.