Posts
SySS Tech Blog
Cancel

Introducing AzurEnum

As time goes on, organizations keep moving more and more IT assets into the cloud. More importantly, the Azure cloud plays a paramount role in the IT structure of most companies due to its merging ...

Zero Touch Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk Phones

In this blog post, we describe several vulnerabilities that were discovered during a security analysis of AudioCodes desk phones and Zoom’s Zero Touch Provisioning. We also discuss and demonstrate...

NetSupport RAT distributed via fake invoices

NetSupport Manager is a legitimate remote control software that is developed by a UK-based company. However, as uncovered in this analysis, the software is used in a currently active phishing campa...

The Blind Spots of BloodHound

Let’s get one thing straight: This article is not at all a dig on BloodHound.

Abusing Microsoft Teams Direct Routing

In this blog post, a practical problem and security issue when it comes to phone integration with Microsoft Teams Direct Routing is described.

Tampering with Thunderbird attachments under Windows

In this blog post a few techniques for tampering with Thunderbird attachments, which simplify social engineering (SE) attacks from an attacker perspective, are shown. Introduction Thunderbird unde...

Hacking Some More Secure USB Flash Drives (Part II)

In the second article of this series, SySS IT security expert Matthias Deeg presents security vulnerabilities found in another crypto USB flash drive with AES hardware encryption.

Rooting Mitel Desk Phones Through the Backdoor (CVE-2022-29854, CVE-2022-29855)

Abstract During a security analysis of an enterprise communication infrastructure, IT security expert Moritz Abrell identified an “undocumented functionality” (backdoor) in the firmware of Mitel 6...

Hacking Some More Secure USB Flash Drives (Part I)

During a research project in the beginning of 2022, SySS IT security expert Matthias Deeg found several security vulnerabilities in different tested USB flash drives with AES hardware encryption.

Yet Another Local Privilege Escalation Attack via Razer Synapse Installer (CVE-2021-44226)

During a research project in fall 2021, SySS IT security expert Dr. Oliver Schwarz found a security vulnerability in the Razer Synapse installer for Windows which can be exploited in a local privil...