The Curious Engineer

All blogs / Security

SEC Consult

sec-consult.com

SEC Consult is one of the leading consultancies in the field of cyber and application security. The company specializes in information security management, security audits, penetration testing, ISO 27001 certification support, cyber defense and secure software certification.

Security

’15’16’17’18’19’20’21’22’23’24’25’26
Posts
178 from 19 May 2015 to 23 Oct 2026
Posting
monthly (6 in the last year)
Kind
company blog
Also at
https://sec-consult.com/blog

2026 6

  1. Multiple Cross-Site Scripting Vulnerabilities in VertiGIS WebOrderSystem (KundenManager, AuftragsManager)
  2. Multiple critical vulnerabilities in multiple TP-Link device series
  3. From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
  4. Multiple Vulnerabilities in Paessler PRTG Network Monitor
  5. Navigating the ethical boundaries of independent security research: A comprehensive analysis of the consumer pet tracking ecosystem
  6. Hands-Free Lockpicking: Critical Vulnerabilities in dormakaba’s Physical Access Control System

2025 11

  1. Forensics gone wrong? Unpredicted behaviour of writeblockers
  2. Visit SEC Consult at it-sa 2025
  3. C2 powered by dinosaurs
  4. Pentesting in a World without Servers
  5. SEC Consult at the ICT Security Conference 2025
  6. Sleeping Beauty: Taming CrowdStrike Falcon With One Simple Trick
  7. How Beyond Gravity, a leading Swiss aerospace company, is fortifying cybersecurity: a real-life success story
  8. Ransomhub Ransomware: Double-Extortion Attack and How to Defend
  9. Join us at the Swiss Cyber Security Days!
  10. A Missed Opportunity: Addressing Weak Password Hashing in VxWorks
  11. Cyber Threats to EV Charging Infrastructure: Risks and Protection through Penetration Testing

2024 18

  1. TLPT in the Financial Sector Under DORA: Assessing the Current Status of TIBER
  2. Inside an Active Intrusion: Exclusive Interview with the Incident Manager
  3. Debunking Cloud Security Myths: Clearing Misconceptions That Risk Your Business
  4. Ransomgroup Helldown: Attacks on Zyxel Devices
  5. Enhancing Network Security: Monitoring Client Communication with Velociraptor
  6. SEC Consult at the ICT Security Conference 2024
  7. Unlocking Cloud Security: Insights from the DORA Framework
  8. Unveiling Qilin/Agenda Ransomware - A Deep Dive into Modern Cyber Threats
  9. Securing the Digital Frontier: Navigating Software Supply Chain Risks with the EU's Cyber Resilience Act
  10. Qualified Body (QuaSte) for Verification of Compliance with the NIS Act
  11. About smugglers, bumblebees and dinosaurs - and how to take over the world
  12. SEC Consult Germany Secures Top Ranking Once More in Great Place To Work® Awards 2024
  13. Cyber resilience: Internet-based vehicle registration (i-Kfz) demands higher security standards from registration authorities
  14. Data Security in Data Protection
  15. Digital operational resilience testing program according to DORA
  16. We are "Best Employer" in Germany and Austria in 2024! SEC Consult once again certified as a "Great Place to Work"®
  17. DORA: One year to go until full compliance with the new regulatory framework
  18. SECGlitcher (Part 1) - Reproducible Voltage Glitching on STM32 Microcontrollers

2023 25

  1. SMTP Smuggling - Spoofing E-Mails Worldwide
  2. TRAP; RESET; POISON; - Taking over a country Kaminsky style
  3. Guardians of the Digital Realm: Celebrating 400 Advisories and Responsible Disclosure
  4. Modern Phone Scammers: Stealing Money with a Phone Call
  5. Android Mobile Root Detection – Snake Oil or Silver Bullet?
  6. Human factor: an underestimated issue in cybersecurity
  7. Thomas Houiellebecq is the new Head of Cyber Security Consulting of SEC Consult (Switzerland) Ltd.
  8. Ransomware: A Growing Digital Threat and How to Defend Against It
  9. Swiss Cyber Storm 2023 – The Human Factor
  10. Escaping Phishermen Nets: Cryptographic Methods Unveiled in the Fight Against Reverse Proxy Attacks
  11. SEC Consult Austria: Amir Salkic is new Head of CyberSecurity Consulting
  12. Nimpostor: Bringing the nim language to Mythic C2
  13. Responsible Disclosure of an Exploit Chain Targeting the RFC Interface Implementation in SAP® Application Server for ABAP
  14. DNS Analyzer - Finding DNS vulnerabilities with Burp Suite
  15. Bypassing Android Biometric Authentication
  16. Alternative Mobile Messengers From An OWASP Point Of View
  17. Securing Databricks cluster init scripts
  18. BumbleBee hunting with a Velociraptor
  19. "Great Place To Work" awards Germany's Best Employers 2023: SEC Consult Germany top-ranked again
  20. Visual Signature Spoofing in PDFs
  21. Blackmail Roulette: The Risks of Electronic Shelf Labels for Retail and Critical Infrastructure
  22. Better don't be too QUIC(K)
  23. SEC Consult is once again one of the top employers in the cybersecurity industry in 2023
  24. Log Management & Digital Forensics in Data Protection
  25. Operational Technology Security (OT) meets Ransomware: An underestimated security risk

2022 13

  1. The hidden costs of parental control apps
  2. The enemy from within: Unauthenticated Buffer Overflows in Zyxel routers still haunting users
  3. The eufyCam Long-Term Observation
  4. Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style
  5. Phishing is booming! Security checklist for the 6 most widespread methods.
  6. Microsoft Exchange Server Zero-Day Exploit
  7. SEC Consult Austria is also one of the best addresses for cybersecurity experts in 2022!
  8. 360 degree cyber security - planned & implemented by the number 1!
  9. Someone call the patch manager
  10. A Primer on Cold Boot Attacks Against Embedded Systems
  11. SEC Consult Germany is also a "Great Place To Work" in 2022 with a top ranking in the ITK category!
  12. The role of top leadership in IT security: RUAG International Success Story
  13. 5GCroCo H2020 EU - Project: Seamless Connected and Automated Mobility in Europe

2021 20

  1. New Services by SEC Defence
  2. Zyxel Communications and SEC Consult reach next-level of cybersecurity
  3. HiKam - "Hi - I'm (not) your Kam"
  4. Forgot password? Taking over user accounts Kaminsky style
  5. Trust is good, certificates are better!
  6. Atos Switzerland completes local acquisition of cybersecurity specialist SEC Consult
  7. Authentication Bypass Vulnerability Affecting All SAP Kernel (ABAP) Releases in Maintenance
  8. SEC Consult Germany awarded as Best Employer in the ITK category
  9. Challenges for SAP® Security and how to approach them
  10. Aggrokatz: pypykatz meets Cobalt Strike
  11. Career Advice for Cybersecurity Newcomers
  12. Who saves the world? Girls!
  13. ISO 27001: What documentation is required for certification?
  14. SAP® Privilege Escalation through ABAP Code Injection in SAP® Business Warehouse
  15. Happy Pi-Day! We got a challenge for you!
  16. Great Place to Work: We are certified!
  17. Top 5 Of The Simplest And Most Effective Measures To Prevent Hacker Attacks
  18. IT Security In The Home Office – What Should Be Considered?
  19. Remotely Exploitable Flaws in SAP® Business Warehouse and SAP® BW/4HANA
  20. From Hackable Garage Doors To Insecure Security Products

2020 25

  1. Atos completes the acquisition of leading Cybersecurity consulting company SEC Consult
  2. Bug Or Feature: Privilege Escalation In Windows Autopilot
  3. Data Breach In The Home Office – And Now?
  4. TIBER-DE: Identify Vulnerabilities In The Cyber Defense Strategy With The Red Teaming Test
  5. Data Security And Compliance In The Home-Office
  6. Hörmann: Opening Doors for everyone...
  7. SEC Consult to join forces with Atos
  8. TIBER-DE: Attack Simulations To Ensure Greater Resilience Against Cyber-Attacks In The Financial Sector
  9. Deanonymization Of Lithuanian E-Signature Users
  10. FIDO2 for Microsoft Online Accounts / Azure AD
  11. Code Injection in SAP Application Server ABAP - Solution Tools Plugin ST-PI
  12. Ad-Hoc Log Management in case of Emergency (SEC Defence)
  13. Security Requirements Engineering - Reaching Mastery
  14. Creating Active Directory Labs for Blue and Red Teams
  15. Security Requirements Engineering – The Backbone Of Your SSDLC
  16. A Deep Dive Into Secure Software Development Based On OWASP SAMM
  17. Patch Immediately: Critical Vulnerability In SAP® ABAP Systems (CVE-2020-6262)
  18. First Virtual OWASP Vienna Chapter Meeting: Secure Software Development With OWASP SAMM
  19. TIBER-DE: SEC Consult Helps The Financial Sector To Strengthen Its Cyber-resilience
  20. Corona Crisis: SEC Consult Is Still There For All Customers
  21. IT Security In Times Of The Coronavirus Is Both Different And Diverse
  22. Corona Virus And Unintentional Cyber Consequences
  23. SEC Consult Goes Bochum: Security Specialist Opens New Office In German “Capital Of IT Security"
  24. The Impact On Security Testing For Devops-driven Applications
  25. How To Use Blockchain Technology To Secure Forensic Evidence

2019 17

  1. Critical Success Factors For Your ISO/IEC 27001 Certification Audit
  2. Winning The Interface War: Extracting Information From Electronic Devices With The SEC Xtractor
  3. The Brand New ÖNORM A 7700 Is Live
  4. Impressions From The NASA Space Apps Challenge Vilnius
  5. Vulnerability In EU Cross-Border Authentication Software (eIDAS Node)
  6. Ready For The NISG & NISV? – Official Requirements For Dealing With Security Incidents
  7. Global Cyberlympics 2019 – SEC Consult Team “no Signal” Is Top 2 Of Asia
  8. Mailvelope: BSI Improves Email Security
  9. SEC Consult Supports Global Standardization And Certification Initiatives
  10. Behind The Scenes: Baltic Cyber Security Forum 2019
  11. Devdays 2019: How To Bypass Web Application Firewalls
  12. Unsung Heroes: What It Really Means To Be Successful In IT Security
  13. Windows Privilege Escalation – An Approach For Penetration Testers
  14. Pentesting: Benefits, Legal Compliance And Costs
  15. Reverse Engineering Architecture And Pinout of Custom Asics
  16. One Hack Of A Valentine: When Iot Gets Under Your Skin
  17. Cryptographic Vulnerabilities In German E-government Library

2018 15

  1. My Name Is Johann Wolfgang Von Goethe – I Can Prove It
  2. Kitten Of Doom – Why You Should Patch Skype For Business Immediately
  3. Millions Of Xiongmai Video Surveillance Devices Can Be Hacked Via Cloud Feature (Xmeye P2p Cloud)
  4. Solution For The Google CTF 2018 Hacking Contest
  5. Application Security Monitoring: The One Thing Companies Claim Not To Have A Budget For
  6. True Story: The Case Of A Hacked Baby Monitor (Gwelltimes P2P Cloud)
  7. Pentester’S Windows NTFS Tricks Collection
  8. TR-069: IoT Before It Was Cool!
  9. Small Business Owners: When Cybercrime Threatens Your Existence
  10. Oracle Access Manager’S Identity Crisis
  11. The Meltdown Exploit Explained (Part 1): The Basics
  12. Busting The Bad – When Criminals Scam The Wrong Company
  13. How To Successfully Fight Cybercrime On An International Scale
  14. Internet Of Babies - When Baby Monitors Fail To Be Smart
  15. Internet Of Dildos: A Long Way To A Vibrant Future – From IoT To IoD

2017 11

  1. The Art Of Fuzzing – Slides And Demos
  2. Fake Crypto: Microsoft Outlook S/MIME Cleartext Disclosure (CVE-2017-11776)
  3. Hack The Hacker – Fuzzing Mimikatz On Windows With WinAFL & Heatmaps (0day)
  4. Reverse Engineering Hardware Of Embedded Devices: From China To The World
  5. German E-Government: Details About Critical Vulnerabilities In Core Communication Library
  6. Ghosts From The Past: Authentication Bypass And OEM Backdoors In WiMAX Routers
  7. Tracking The Culprit: SEC Technologies And Fraunhofer IPK Deliver Technology To Identify Criminal Activities In Enterprise Networks
  8. Chainsaw Of Custody: Manipulating Forensic Evidence The Easy Way
  9. What Unites HP, Philips And Fujitsu? One Service And Millions Of Vulnerable Devices.
  10. Abusing NVIDIA’s Node.js To Bypass Application Whitelisting
  11. Last Call To Replace SHA-1 Certificates

2016 7

  1. Backdoor In Sony IPELA Engine IP Cameras
  2. Controlling Kerio Control – When Your Firewall Turns Against You
  3. House Of Keys: 9 Months Later… 40% Worse
  4. EU General Data Protection Regulation Comes Into Force On May 24, 2016
  5. SEC Consult Study On Smart Home Security In Germany – A First Silver Lining On The Horizon Of IoT?
  6. Deliberately Hidden Backdoor Account In Several AMX (Harman Professional) Devices
  7. McAfee Application Control – The Dinosaurs Want Their Vuln Back

2015 3

  1. House Of Keys: Industry-wide Https Certificate And SSH Key Reuse Endangers Millions Of Devices Worldwide
  2. The Omnipresence Of Ubiquiti Networks Devices On The Public Web
  3. KCODES NETUSB: HOW A SMALL TAIWANESE SOFTWARE COMPANY CAN IMPACT THE SECURITY OF MILLIONS OF DEVICES WORLDWIDE

Undated 7

  1. Msi installer repair to system a detailed journey
  2. Assumed breach internal threats in the cloud
  3. Investigating solaris sunos persistence using system processes
  4. Understanding dora core concepts spotlight on critical or important functions
  5. Sec consult at it sa expo 2024 a resounding success in it security
  6. Mastering dora core topics a deep dive into incident management
  7. Inside the threat a behind the scenes look at stopping an active intrusion