Research
Write-ups going back to 2010. Findings, and the tools that produced them.
- Fuzzing Made Easy #5: How to decide what to fuzz in a complex target On a complex target the hardest fuzzing question comes before the first harness: what is actually worth fuzzing? We threat-model the attack surface, follow untrusted data to where it gets dangerous, and turn that into a ranked, shaped set of harnesses, worked end-to-end on Mbed TLS.
- Fuzzing Made Easy #8: How to perform coverage analysis Coverage analysis is an essential step for a successful fuzzing campaign, to identify uncovered code regions and change the campaign to reach them.
- Incident Response: Erpressungswelle auf Frauenhäuser Incident response help for social institutions.
- Beyond Fable: Can a Local LLM Replace Cloud AI for Security Code Reviews A comparative study of Claude Fable 5, Claude Opus 4.6/4.8, GLM-5, Gemma4-26b, and Qwen3.6-35B-A3B on two production codebases.
- Kids360: Getting adopted globally Exploiting a parental control app leads to surveilling families around the globe.
- OpenVPN 2.7 security audit: 18 findings, one critical bug, and what made the difference We report results from a 16-week security audit of the OpenVPN 2.7 release canidate, sponsored by the Sovereign Tech Agency in cooperation with the Open Technology Fund. We found 18 issues, including one critical logic bug in a replay check, and we describe the methodology and audit infrastructure we left behind. OpenVPN 2.7 was released with all important fixes included.
- Fuzzing CosmWasm Smart Contracts We introduce CosmFuzz, a coverage-guided fuzzer for CosmWasm smart contracts, and show how invariant-based testing quickly exposes a real token-accounting bug in cw20-base.
- We don't need to hack your AI Agent to hack your AI Agent We strolled through an enterprise AI assistant's backend, helped ourselves to full application takeover and access to every chat log, and had a Microsoft Entra ID dump for dessert — no prompt injection, no model tricks, no AI expertise required.
- AI-generated code, AI-generated findings, and the verification bottleneck We analyze how LLM-assisted coding and LLM-generated vulnerability reports shift the bottleneck from discovery to verification, and why security outcomes depend on reachability, context, and impact rather than vulnerability counts.
- Breaking ILIAS #2: Three to RCE We describe three previously unknown vulnerabilities enabling remote code execution (RCE) in versions 8, 9, and 10 of the widely used learning management system ILIAS.
- Competing at the DEF CON CTF Finals 2025 Nils competed in the DEF CON 33 CTF finals, placing 8th while running attack-defense operations, participating in the LiveCTF, and publishing a write-up on exploiting a Jukebooox bug leading to a glibc leak and ROP chain.
- Breaking ILIAS #1: From Open Redirect to Admin We describe two vulnerabilities in the learning management platform ILIAS that we found as part of a recent client engagement. Exploiting a stored XSS we achieve command execution as root.
- Fuzzing Made Easy #2: Unlocking the Secrets of Effective Fuzzing Harnesses Fuzzing is an effective technique for finding bugs, but it’s only as effective as your fuzzing harness. We explore the secrets of good harnessing for fuzzing, from common mistakes to best practices.
- Hexagon-Fuzz: Full-system emulated fuzzing of Qualcomm basebands We developed the first open-source toolchain for full-system emulated fuzzing of any Hexagon firmware, addressing a critical gap in baseband security research.
- Ethical hackers can help reduce SS7 abuse Ethical hackers help reduce SS7 abuse by finding security problems to protect phone users, and clear rules are needed to ensure only trusted testers have SS7 access.
- Enhancing our Code Audits with AI We combine human expertise with AI as a co-pilot to enhance code audits, carefully protecting client confidentiality by analyzing closed-source code in-house, and continuously improving our models through benchmarking and fine-tuning without replacing expert human review.
- Xiaohongshu: Little Red Book reads you Xiaohongshu exposes users to network-level attacks through partially unencrypted traffic, collects more device data than disclosed, and actively obstructs app analysis efforts.
- Fuzzing Made Easy Part #3: GoLibAFL — Fuzzing Go binaries using LibAFL We developed GoLibAFL, a new fuzzer for Go code built on top of LibAFL.
- Fuzzing Made Easy Outline In this article series, we share all we know about effective fuzz testing.
- Fuzzing Made Easy #1: A beginner’s guide to writing a fuzzing harness In this article, we focus on customizing a fuzzing harness, the key to effective fuzz testing.
- BogusBazaar: A criminal network of webshop fraudsters A large criminal network operates tens of thousands of fake webshops that have processed over a million orders totaling USD 50 million, stealing credit card details from more than 850,000 victims mainly in Western Europe and the USA.
- Black Basta Buster: Decrypting files without paying the ransom We created a decryptor for files encrypted with the Black Basta ransomware between November 2022 and December 2023.
- Certiception: The ADCS honeypot we always wanted We release Certiception, our Active Directory Certificate Services (ADCS) honeypot tool.
- Mobile anonymity software package “blue-merle” gets a 2.0 release We released a new version of our mobile anonymity software package blue-merle. This software package for the GL.iNet Mudi 4G LTE router adds additional privacy protections to mitigate some deanonymization risks exhibited by the original product.
- Advanced fuzzing unmasks elusive vulnerabilities The question the fuzzing community and we were asking – is it possible to find this specific vulnerability with fuzzing? And if so, why was it not found in Google‘s OSS-Fuzz initiative? This article attempts to answer these questions and also tries to give guidance to better fuzzing campaigns.
- Telco security retreat 2023 In October 2023, the SRLabs Infrared Team embarked on an immersive retreat in the vibrant city of Valencia.
- EDRs decrease your enterprise security, unless properly hardened We found default creds and three critical API flaws in Cynet 360 EDR. Learn how attackers could hijack defenses—and what fixes keep systems safe.
- Smarter is not always wiser: How we hacked a smart payment terminal We hacked a smart POS device running Android 7. Weak boot security and unpatched exploits enabled root access and payment data theft.
- Hacking mobile networks has gotten a lot more interesting with 5G and Open RAN 5G shifts security risks to the cloud. Learn how Docker misconfigurations expose telco networks and how red teaming helps keep 5G hacking resilient.
- Extended Android security check: SnoopSnitch tests for Java vulnerabilities SnoopSnitch now detects missing Android Java patches. SRLabs explains how bytecode signatures double patch coverage and help close the Android patch gap.
- Your Blockchain is only as secure as the application on top of it SRLabs found a flaw in SocialKYC that allowed fake Twitter verifications. A three-line fix shows why blockchain apps must be reviewed as thoroughly as chains.
- When your phone gets sick: FluBot abuses Accessibility features to steal data FluBot malware exploits Android Accessibility to steal banking credentials, spread via SMS, and block removal—making it today’s top mobile threat.
- Chaining Three Zero-Day Exploits in ITSM Software ServiceTonic for Remote Code Execution SRLabs chained three zero-days in ServiceTonic ITSM—HQL injection, SSO flaw, and path traversal—to gain full remote code execution.
- Blockchain security – Six common mistakes found in Substrate chains SRLabs outlines six common bug classes in Substrate-based blockchains, from logic flaws to unsafe arithmetic, and how to mitigate them.
- Blockchain security – Best practices for your next review SRLabs shares a four-step methodology for auditing Substrate-based blockchains, combining threat modeling, design review, fuzzing, and code audits.
- Balancing long-term technology evolution with short-term side-effects - Vulnerability disclosure best practices SRLabs shares best practices for responsible vulnerability disclosure (CVD), guiding researchers and vendors toward secure, collaborative outcomes.
- Honeypot research shows variety of DDoS amplification methods Hackers exploit UDP services like Chargen, SSDP, and STUN for DDoS amplification. Misconfigured devices fuel massive attacks—better defenses are vital.
- Achieving Telerik Remote Code Execution 100 Times Faster Optimized exploitation of Telerik UI CVE-2017-9248 turns an “impractical” flaw into remote code execution risk for enterprises.
- Incorrectly patched ZyXEL vulnerability becomes zero-day again Incomplete patches leave systems exposed. SRLabs found ZyXEL’s CVE-2020-9054 fix bypassable via FTP, showing how attackers reuse flaws with slight tweaks.
- A decade of hacking SRLabs celebrates 10 years of hacking: from Berlin roots to a global team securing networks, payments, and infrastructure — while growing a culture of curiosity.
- The Android patch ecosystem – Still fragmented, but improving Android patching improved in 2019: vendors applied fixes faster and missed fewer. Fragmentation remains the biggest challenge to closing the patch gap.
- New RCS technology exposes most mobile users to hacking SRLabs found critical flaws in RCS, Google’s SMS successor. Weak provisioning, DNS spoofing, and caller ID abuse expose Android users to hacking.
- Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping Malicious Alexa and Google Home apps can phish passwords and eavesdrop. SRLabs’ Smart Spies research exposes critical smart speaker privacy flaws.
- New SIM attacks de-mystified, protection tools now available Around 9% of SIM cards are vulnerable to Simjacker-style attacks. Tools like SIMtester and SnoopSnitch help users detect risks and binary SMS exploits.
- The blockchain ecosystem has a patch problem SRLabs found many Ethereum nodes remain unpatched for months, exposing the blockchain to crashes and lowering defenses against 51% attacks.
- Simple fuzzing goes a long way, even for critical blockchain software A flaw in Parity Ethereum let attackers crash nodes via malicious blocks. The DoS bug shows why fuzz-testing is vital for blockchain software security.
- Banking regulation has an effect on Hackability Banks are harder to hack than other industries, but the advantage is uneven across the Hackability sub-scores. That skew points to regulatory compliance rather than security evolution as the driver.
- The Hackability of organizations can be measured and compared SRLabs’ Hackability Score measures how vulnerable organizations are compared to peers, revealing industry security gaps and best practices.
- The Android ecosystem contains a hidden patch gap Many Android phones miss critical patches despite monthly updates. The hidden patch gap leaves devices exposed. Tools like SnoopSnitch help verify.
- The Cloud exposes your private IP cameras Millions of cloud-connected cameras are exposed by weak IDs and default passwords, putting privacy at risk and fueling the next wave of IoT botnets.
- Legacy booking systems disclose travelers’ private information Global booking systems like Amadeus, Sabre & Travelport lack proper authentication, exposing traveler data and flights to easy hacking and fraud.
- Outdated payment protocols expose customers and merchants Outdated payment protocols like ZVT and Poseidon expose card data, PINs, and merchant accounts to fraud. Unique terminal keys are urgently needed.
- USB peripherals can turn against their users BadUSB reprograms USB devices into stealthy attack tools. Infected peripherals can survive OS reinstalls, leaving computers permanently compromised.
- Fingerprints are not fit for secure device unlocking Fingerprint sensors like Apple’s Touch ID are vulnerable to spoofing. Biometric flaws make them weak for device security but useful as remote 2FA.
- SIM cards are prone to remote hacking Outdated SIM cards using weak DES keys risk remote hacking, malware installs, and SIM cloning. Stronger cryptography and SMS filtering are needed.
- Mobile networks differ widely in security, none protect well in all dimensions GSM protection measures that have existed for years reach few networks. Of 107 mapped on gsmmap.org by May 2012, five used A5/3 encryption, eight strict authentication and twelve home routing.
- Payment terminals allow for remote PIN capture and card cloning POS payment terminals have critical flaws enabling card cloning, transaction fraud, and spoofing. Hardware issues leave cashless payments at risk.
- Cryptographic problems are reduced to their true hardness by SAT solvers Weak ciphers in access control and NFC can be cracked in seconds with SAT solvers. Modern cryptography like AES and ECC is essential for security.
- The physical access control market is ripe for an upgrade to modern technology Most access control systems lack strong security. This study defines best practices using open standards for safer, modern building protection.
- Decrypting GSM phone calls GSM calls remain vulnerable to recording and cracking with tools like Airprobe and Kraken. Stronger 3G/4G security is urgently needed.
- Legic Prime RFID cards rely on obscurity and consequently did not withstand scrutiny Legic Prime RFID has critical flaws allowing card cloning and spoofing. Strong encryption and secure keys are needed for safe access control.