Michael Kirchner

Finding security vulnerabilities in TLS-Libraries automatically using TLS-Anvil. Check out our new german article in the "IT-SICHERHEIT magazine" or on our cybersecurity blog.  🌐 Hackmanit Blog https://lnkd.in/eYW-VN4E ✅ German magazine article by IT-SICHERHEIT https://lnkd.in/ea-yU_eE 🛠️ TLS-Anvil https://tls-anvil.com/ 🔑 KoTeBi https://www.kotebi.de/en/ #TLS #itsecurity #itsicherheit #cybersicherheit #cybersecurity

4

Anatomy Lesson from the Perspective of a Pentester - Guest Lecture at Johannes Gutenberg University Mainz 🎓 Our colleague Matthias Göhring was once again invited to give a guest lecture at Johannes Gutenberg-Universität Mainz. This time, the topic was “Professional Penetration Testing”. The question arose: What characterizes a good #PenetrationTest and how should it be structured? The lecture also covered topics such as the different types of technical security analyses and the management of #vulnerabilities. Thank you very much for the great event. We look forward to the next one! 📰👉 https://lnkd.in/eTbXTyRi #Pentesting #CyberSecurity #JGUMainz #moresecurity

2

🚨 #Cybersecurity Alert: The German Federal Office for Information Security (BSI) has uncovered serious vulnerabilities in the social media app Mastodon and minor ones in the messenger service Matrix. 🛡️ Mastodon's version 4.1.6 was found to have two high-risk vulnerabilities, CVE-2023-46950 and CVE-2023-46951, which could allow attackers to compromise user data. Additionally, Mastodon has 22 dependencies on open-source code with critical or high security vulnerabilities. Matrix, on the other hand, had several low-risk issues, including unprotected uploaded files and a vulnerability that allows session terminations by privileged users. Both platforms lack a structured approach to identifying and correcting vulnerabilities, with code duplication suggesting untidy growth. The BSI recommends refactoring for better vulnerability management and future extensibility. This analysis is part of an ongoing project to enhance the security of open-source software used by public authorities and private users. Stay vigilant and ensure your software is up-to-date! 💻 #InfoSec #OpenSource #Mastodon #Matrix #VulnerabilityManagement #TechNews [Original source in the comments 👇]

🛡️ The best defense (for devs) is a strong offense (mindset)! 🛡️ Want to code more secure apps? Think like a hacker. Find out how to better anticipate, prevent, and mitigate potential security threats at #codetalks24 with Matthias Held, #CISO at Bugscrowd. Whether you’re a developer, tech lead, or security specialist, learn how to view your app through the eyes of an attacker—and protect it in the process. 🔓 Join Matthias to: 🚨 Simulate real-world attacks on your systems and applications 🕵️‍♀️ Explore case studies on common security pitfalls and successful hacks 🧩 Discover frameworks for threat modeling ✍️ Get practical tips for integrating security into your code review process 👥 Build a culture of security awareness within your development team This talk will transform how you think about coding and security, making secure coding practices a natural part of your development process. Join us at #codetalks24 (19-20 September)

26

🚨 #Cybersecurity Alert: The German Federal Office for Information Security (BSI) has uncovered serious vulnerabilities in the social media platform Mastodon and some minor ones in the messenger service Matrix. 🛡️ Key findings: - Mastodon v4.1.6 had two high-risk vulnerabilities, CVE-2023-46950 & CVE-2023-46951, allowing potential compromise of user data. - Matrix's issues were less severe but included unprotected uploaded files and session management concerns. The BSI's proactive approach to identifying and informing developers of these issues underscores the importance of regular code audits and vulnerability management. As we rely more on open-source software, such initiatives are crucial for maintaining trust and security in digital communication tools. Are you keeping your platforms secure? Share your best practices for software security below! 🔐 #InfoSec #OpenSource #DigitalSecurity #Mastodon #Matrix #VulnerabilityManagement [Original source in the comments 👇]

Are you new to cybersecurity? Ever heard of penetration tests? Our colleague Jonas will share some valuable insights on October 10th! In cooperation with our friends at DInO | Digital Innovation Ostbayern, Jonas will introduce you into the realms of cybersecurity. Learn about penetration tests and how they will help making your products safer! Best part about it? It's totally free to join! So what are you waiting for?

6

🚀 DevSecCon Germany Sebastian Roth and Ardit Beu present “Using Threat Modeling to Create a DevSecOps Plan” with Mohamed AboElKheir! 🚀 Join us to learn practical approaches and best practices for embedding robust security measures into your workflow from the outset. 🗓 Event Details: • Date: 30th July • Time: 12pm CEST • Location: Virtual (Join from anywhere!) In this session, we will illustrate the importance of initiating the security planning process with a comprehensive threat model. This foundational step is essential for devising a strategic plan to select, implement, and configure the most suitable security tools. By proactively identifying potential threats and vulnerabilities, we can ensure that these tools effectively mitigate identified risks. Furthermore, we will discuss the integration of these tools into various stages of the development pipeline, thereby enhancing the overall security and resilience of your systems. Key Takeaways: • Foundational Importance of Threat Modeling: Understand why starting with a thorough threat model is critical for strategic security planning. • Early Identification of Threats and Vulnerabilities: Learn how early detection ensures that security tools are effectively aligned with identified risks. • Strategic Selection and Implementation of Security Tools: Gain insights into selecting, implementing, and configuring the most appropriate security tools based on the threat model. • Seamless Integration into Development Pipeline: Discover best practices for integrating security tools into different stages of the development pipeline. • Enhancing Security and Resilience: Explore methods to bolster the overall security and resilience of your systems through strategic planning and tool integration. Don’t miss this opportunity to learn from an expert in the field and network with fellow professionals! 🔗 Register now to secure your spot and be part of this insightful event. We look forward to seeing you there!

37

3 Kommentare

#AI is the double-edged sword in #cybersecurity ⚔️ What happens when this innovation becomes a vulnerability? Jasmin Landry, Security Researcher and HackerOne Pentester put it together quite nicely (check out the quote in the post ⬇️) Two key fronts to consider here: 1️⃣ Security for AI: managing the risks that come with AI deployments. 2️⃣ AI for Security: leveraging AI to detect and manage vulnerabilities faster than ever before. But here’s the kicker: even with cutting-edge AI tools, human expertise is still critical to ensuring trustworthy, secure innovation. In our recent deep dive into AI and vulnerability management, we highlight how security teams are adapting to stay ahead of threats—and what it means for the future. 💬 What’s your take?

8

‘Serious hacker attack’ forces Frankfurt university to shut down IT systems. Why it matters: 1. The recent cyber attack on the Frankfurt University of Applied Sciences affirms Germany's universities, particularly those offering courses in applied sciences, as targets for hacking attempts - potentially disrupting education and research. 2. The attack reveals cybercriminals' growing capability to infiltrate even well-protected systems; the university's inability to estimate its extent suggests hackers may have accessed critical parts of its infrastructure, impacting services and communication. 3. Ongoing attacks against universities not only threaten institutional operations but also disrupt students' lives, emphasizing the need for increased cybersecurity measures. Recent incidents show hackers' potential to affect a broad range of services, from enrollment to building access, underscoring the urgent need for comprehensive and robust cyber defenses. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/eMvwyPvV

6

"𝗧𝗵𝗲 𝗰𝘆𝗯𝗲𝗿 𝘁𝗵𝗿𝗲𝗮𝘁 𝗶𝘀 𝗵𝗶𝗴𝗵𝗲𝗿 𝘁𝗵𝗮𝗻 𝗲𝘃𝗲𝗿 𝗯𝗲𝗳𝗼𝗿𝗲.“ ☠️💻️ 💡 According to the German Bundesamt für Sicherheit in der Informationstechnik (BSI) the cyber threat level in 2023 was higher than ever before. Cyber attacks do not only affect large companies - small and medium-sized organizations are also increasingly affected, as attacks are often widespread. Ransomware in particular can compromise critical business data and cause costly business interruptions. ✅ For this reason, 𝗕𝗦𝗜 has developed the "𝗖𝘆𝗯𝗲𝗿𝗥𝗶𝘀𝗶𝗸𝗼𝗖𝗵𝗲𝗰𝗸", tailor-made for SMEs. After a short interview with the key contacts, the result of the check is a standardized report that provides a quick overview of the status of information security in your company. 👉️ https://lnkd.in/dXR7PDHq 🏅 𝗔𝘀 𝗮 𝗾𝘂𝗮𝗹𝗶𝗳𝗶𝗲𝗱 𝘀𝗲𝗿𝘃𝗶𝗰𝗲 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿, ITK Engineering𝗼𝗳𝗳𝗲𝗿𝘀 𝘁𝗵𝗲 𝗕𝗦𝗜 𝗖𝘆𝗯𝗲𝗿𝗥𝗶𝘀𝗸𝗖𝗵𝗲𝗰𝗸 - 𝗰𝗼𝗻𝘁𝗮𝗰𝘁 𝘂𝘀 𝗻𝗼𝘄 𝗳𝗼𝗿 𝗺𝗼𝗿𝗲 𝗶𝗻𝗳𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻 𝗮𝘁 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆@𝗶𝘁𝗸-𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴.𝗱𝗲 💬 Learn here more about our comprehensive #cybersecurity portfolio: https://lnkd.in/dn9ZJxC4 #ITKEngineering #ITKtech #cybersecurity #cyberrisikocheck #certified

29

1 Kommentar

#BlueDucky is still a relevant tool to scan and identify vulnerable #Bluetooth devices to 0-click attack (CVE-2023-45866). Don't postpone updates of your smart gadgets in 2025 Post Credit: Lukas Stefanko #infosec #hacking #hacker #cyberseurity #bugbounty #bugbountytips

4

We are happy to work together with AI innovators to implement best practices in cybersecurity. Graphworks.ai is at the forefront of AI technology, providing AI-powered insights into supply chain intelligence in real-time. This capability empowers organizations to quickly adapt to shifting market conditions and customer demands. Innovation and security hand-in-hand!👏

2

🚨 "SnailLoad," a newly discovered security flaw, exploits internet speed fluctuations to track users' online activities covertly. Unlike traditional attacks, it operates without malicious code, evading firewalls and VPNs. Researchers at TU Graz discovered this method, where attackers initiate contact by tricking users into downloading slow files, like from websites or ads, to monitor latency variations. By analyzing these patterns, attackers can accurately reconstruct users' online actions, such as watching specific YouTube videos, with up to 98% success. Mitigating this threat poses challenges, as potential fixes, like artificially slowing internet speeds, would disrupt essential applications such as video conferencing and gaming. For more insights 👉 https://buff.ly/3xor2Lo #SnailLoad #firewalls #VPN #privacythreat #internetsecurity #cybersecurity #vulnerability #onlineprivacy

5