Dr. Marina Krotofil

🔍 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗙𝗼𝗿𝗲𝗻𝘀𝗶𝗰𝘀 𝗧𝗶𝗽: 𝗨𝗻𝗺𝗮𝘀𝗸𝗶𝗻𝗴 𝗨𝘀𝗲𝗿 𝗔𝗰𝘁𝗶𝘃𝗶𝘁𝘆 𝘄𝗶𝘁𝗵 𝗥𝘂𝗻𝗠𝗥𝗨! 🕵️‍♂️ Did you know that Windows keeps a detailed log of commands and programs executed via the "𝗥𝘂𝗻 𝗱𝗶𝗮𝗹𝗼𝗴 𝗯𝗼𝘅" (𝙒𝙞𝙣𝙙𝙤𝙬𝙨 + 𝙍)?  This often-overlooked Registry key, known as 𝗥𝘂𝗻𝗠𝗥𝗨, is a goldmine for forensic investigators! 🚀 Found at  𝙃𝙆𝙀𝙔_𝘾𝙐𝙍𝙍𝙀𝙉𝙏_𝙐𝙎𝙀𝙍\𝙎𝙤𝙛𝙩𝙬𝙖𝙧𝙚\𝙈𝙞𝙘𝙧𝙤𝙨𝙤𝙛𝙩\𝙒𝙞𝙣𝙙𝙤𝙬𝙨\𝘾𝙪𝙧𝙧𝙚𝙣𝙩𝙑𝙚𝙧𝙨𝙞𝙤𝙣\𝙀𝙭𝙥𝙡𝙤𝙧𝙚𝙧\𝙍𝙪𝙣𝙈𝙍𝙐 This simple yet powerful key can reveal critical insights into user behavior, including:  1.   𝗖𝗼𝗺𝗺𝗮𝗻𝗱-𝗹𝗶𝗻𝗲 𝘁𝗼𝗼𝗹𝘀 𝘂𝘀𝗲𝗱: Did a user execute any suspicious scripts?  2.   𝗣𝗼𝗿𝘁𝗮𝗯𝗹𝗲 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀 𝗹𝗮𝘂𝗻𝗰𝗵𝗲𝗱: Were unauthorized programs run without installation?  3.   𝗢𝗿𝗱𝗲𝗿 𝗼𝗳 𝗲𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻: The 𝗠𝗥𝗨𝗟𝗶𝘀𝘁 value precisely tracks the sequence of commands. As seen in the example, if 𝗠𝗥𝗨𝗟𝗶𝘀𝘁 shows "𝗰𝗯𝗮", it means "c" (𝗰𝗺𝗱) was the most recent command, followed by "b" (𝗰𝗮𝗹𝗰), and "a" (𝗿𝗲𝗴𝗲𝗱𝗶𝘁) was the oldest. This chronological order is invaluable for reconstructing events! ⏳ Understanding the 𝗥𝘂𝗻𝗠𝗥𝗨 key is crucial for incident response and digital investigations. It helps paint a clearer picture of what a user was doing on a system. #DigitalForensics #Cybersecurity #WindowsRegistry #IncidentResponse #DFIR #RunMRU #CyberInvestigation #DF

221

15 Kommentare

Critical chain of vulnerabilities in the Bluetooth stack enables 1-click RCE (remote code execution) on German cars. 🚘 🔵🦷💥 Security researcher Mikhail Evdokimov shared a new attack on OpenSynergy BlueSDK that consists of four separate vulnerabilities and leads to a one-click RCE (Remote Code Execution). The attack was named "PerfektBlue." The use of the German word "perfekt," which means "perfect," is a deliberate play on words - not a typo. This is a clear reference to German car manufacturers on which the author tested his kill chain: Mercedes-Benz, Škoda, and Volkswagen. A very impressive piece of work with quite serious results. I'm waiting for a presentation, technical paper, or at least some PoC code to test. Fingers crossed. In the meantime, all the details we have are below. More details: PerfektBlue [Blog]: https://lnkd.in/dskee4JY PerfektBlue - critical vulnerabilities in OpenSynergy Blue SDK [Advisory]: https://lnkd.in/diR2V4vY #automotive #hacking #vulnerability #technology #bluetooth #Volkswagen #skoda #Mercedes #data #infosec #embedded

364

2 Kommentare

Quantum Computers Capable of Breaking Cryptography in 10 years? The Federal Office for Information Security (BSI) in Germany has released an updated study on the development of quantum computing technologies and their impact on cybersecurity. 💡 Key takeaways: 🔑 A cryptographically relevant quantum computer could become a reality within 16 years - 4 years earlier than previously estimated. Advanced developments in error correction and hardware even suggest this timeline might shrink to as little as 10 years, though further verification is needed. Quantum computers hold immense potential as a key technology of the future. However, they also pose a significant threat to cybersecurity. Here's why: Our current digital infrastructure relies heavily on public-key cryptography, which, for now, is secure with classical hardware. But once universal quantum computers with sufficient capabilities emerge, this security paradigm shifts. Data encrypted today but not "quantum-safe" can be intercepted now and decrypted later when such quantum systems are available - what we call "store now, decrypt later." This not only compromises confidentiality but also endangers other critical objectives like authenticity. 🔒 The BSI urges organizations to start transitioning to quantum-safe cryptography now to mitigate these risks and safeguard our future digital infrastructure.

67

📡 𝗨𝗸𝗿𝗮𝗶𝗻𝗲’𝘀 𝗖𝘆𝗯𝗲𝗿 𝗪𝗮𝗿: 𝟯 𝗬𝗲𝗮𝗿𝘀 𝗼𝗳 𝗖𝗼𝗻𝗳𝗹𝗶𝗰𝘁, 𝟯 𝗟𝗲𝘀𝘀𝗼𝗻𝘀 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗪𝗼𝗿𝗹𝗱 Since 2022, Ukraine has defended not just its territory—but its networks. Over 12,000 cyber incidents have hit critical infrastructure, from energy and telecom to government registries. These attacks weren’t isolated—they were synchronized with missile strikes and deepfake propaganda, aiming to destabilize, spy, and undermine public trust. 🔍 What makes this war different? Hybrid warfare is real – Cyber operations actively support kinetic attacks. People are the primary targets – Deepfakes, fake news, and phishing drive cognitive warfare. Resilience was built under fire – Ukraine migrated critical systems to the cloud, rebuilt fast, and fostered deep cooperation across government, industry, and civil society. 🇺🇦 Ukraine has become a living laboratory for cyber warfare, offering real-time insights to NATO and EU allies. Their experience shows: - Threat sharing is essential. - Supply chain compromise and persistent access are the new normal. - Digital readiness is now part of national defense. #cyberwarfare #ukraine #digitalsecurity #hybridconflict #cyberresilience #nato #cyberstrategy #infowar #criticalinfrastructure #deepfakes #misinformation #supplychainsecurity #nationalsecurity

55

4 Kommentare

The screenshot below is from a recent Incident Response case, investigated by my colleague Florian Scheiber. The user "printer" suddenly sprang to life because an attacker brute-forced the VPN login (without Multi-Factor Authentication). This was not the first time a "printer" account was breached in our investigations. This might indicate that companies are setting up regular accounts for service tasks, like printing (??), and equipping the account with a weak password and no MFA. Of course, such a "service account" should never be allowed to log into the network over VPN in the first place. However, this is an interesting example of "User behavior analytics", as this account was never seen logging in over VPN, nor generating such a usage pattern. An anomaly that could stand out in monitoring.

122

6 Kommentare

Since passports and IDs are typically valid for at least 5 years, planning for PQC is vital. Look out for an increasing number of projects to specify usage of PQC. The European Commission has signposted quantum-resistant cryptography (PQC) as the future for electronic machine-readable travel documents (eMRTDs). This forward-thinking stance underscores the critical need for the European Union to adapt to emerging quantum threats and ensure the safety of its digital infrastructures. The transition to PQC is not just about keeping up with technological changes, but about proactively securing the future of EU’s digital systems. We must collaborate across sectors to ensure we’re prepared for the challenges ahead. 🌍 Let’s start the conversation today – the sooner we begin these transitions, the safer and more resilient our digital infrastructure will be tomorrow. Check out Keyfactor's all-in-one resource hub for the post-quantum era: https://okt.to/bO9gih #QuantumComputing #PQC #eMRTD #Cybersecurity #PQCReadiness

48

3 Kommentare

In an unsettling development in the ongoing cyber conflict linked to the Russia-Ukraine war, Ukrainian-aligned hacking groups have claimed responsibility for a large-scale cyberattack targeting a major Russian drone manufacturing company. The targeted firm, identified as Gaskar Group, is believed to play a key role in supplying unmanned aerial vehicles (UAVs) to Russian forces. Two pro-Ukrainian hacker collectives, the BO Team and the Ukrainian Cyber Alliance, reportedly carried out the operation in collaboration with Ukraine’s military intelligence service. The BO Team, a group known for supporting Ukraine through cyber operations, shared news of the breach on a Telegram channel on July 14. According to their statement, the team successfully gained full access to the internal network, servers, and data systems of the drone company. This breach reportedly allowed them to obtain sensitive technical details about existing and upcoming UAV models. https://lnkd.in/eERusQCQ

25

3 Kommentare

This paper by Cas Cremers, Niklas Medinger and Aurora Naska, "Impossibility Results for Post-Compromise Security in Real-World Communication Systems", tackles one of the most uncomfortable truths in applied cryptography: that the post-compromise security guarantees that we celebrate in academic papers often don't survive contact with real-world deployment constraints. The authors formally prove that messengers like Signal, WhatsApp, and iMessage cannot achieve full conversation-level PCS while remaining resilient to the everyday failures users actually experience: backup restores, memory glitches, lost devices, and hardware hiccups. What sets this research apart is its intellectual honesty and constructive approach. Rather than simply identifying problems, the authors systematically explore the design space using formal verification with the Tamarin prover, building incremental models that reveal exactly where and why security guarantees break down. Their analysis of session management policies is particularly elegant: they explain why Signal stores exactly 40 sessions and demonstrate the fundamental trade-offs between security and usability that every messenger must navigate. Their core insight: you cannot simultaneously guarantee bulletproof post-compromise security and maintain a communication system that works reliably in the messy real world. This is the kind of work that should be winning awards. It combines deep theoretical rigor with practical impact, challenges sacred-cow assumptions the entire secure messaging industry has been making, and provides concrete recommendations for improvement. The gap between security theory and deployable practice is one of the most important problems in our field, and papers like this one that confront these tensions head-on rather than papering over them represent the kind of intellectual honesty that's needed in the field. https://lnkd.in/eZgsbz3V

165

3 Kommentare

Are We Overdoing Cybersecurity? Let’s be honest, for some organizations, we have noticed cybersecurity feels more like a hassle than a help. Not every company is a bank, a military site, or a nuclear plant. Yet some still pour money into layers of security tools and controls for systems that if hacked, wouldn’t even cause major damage. Do we really need military-grade protection for a public website or a shared folder of non-sensitive data? Probably not. Spending too much on tools for low-risk assets can create stress, slow things down, and shift focus away from what actually matters. Security should match the value of what you’re protecting, not just follow trends or tick boxes. Sometimes, less but smarter is what truly enables the business and saves costs along the way.

51

18 Kommentare