What We Do

Fill 4

The focus of ERNW Research is performing Research projects in all areas of IT security - publicly funded projects in cooperation with universities, customer projects, as well as internal research projects.

Our goal is to perform cutting edge research to preserve excellence, and apply our knowledge and research results in highly technical projects for our customers.

Particular fields of attention are the areas of Incident Response, Forensic Computing, Malware Analysis, and Medical Device Security, as well as advanced security assessments.


ERNW Universe

ERNW Insinuator

Our company blog is the main source for research and insights created at ERNW, reflections on the information security world, and practical security advice resulting from assessment and consulting projects.

ERNW Research

Our first spin-off focuses on research work of all kinds, which can comprise publicly funded projects, cooperation with universities or fellow researchers, and the supervision and support of ERNW-internal research or methodology-focused projects.

ERNW Insight

Following our belief that knowledge must be shared, ERNW Insight focuses on finding and developing the best ways to make ERNW knowledge accessible to all (e.g. by hosting ERNW’s TROOPERS conference).

ERNW SecTools

The youngest member of the ERNW family broadens the ERNW portfolio by developing IT security related software as measured by our own high standards.


Services

  • Publicly Funded Research Projects

    Following our knowledge-driven company culture, we offer research services to work on both scientific and pragmatic problems in the IT security space. Past funded research activities focused on Security Awareness, Digital Forensics, Reverse Engineering & Vulnerability Analysis, and telecommunications security. Future activities are coordinated by ERNW Research.

  • Incident Response & Forensic Reports

    We support our customers in implementing incident response processes/preparation as well as in analyzing occurred or suspected incidents. Following common incident response process models, we offer the development of incident preparation plans, immediate and on-site incident response and malware analysis, as well as the compilation of technical forensic reports.

    • Incident Response

      We support our customers implementing incident response processes to be prepared and able to handle incidents as they occur. ERNW delivers services in every step of those models to ensure a fast recovery from the incident. With the help of the so-called common model we focus on the management of incidents and the integration of the incident handling with the processes of an organization. Exact proceeding in evidence collection and incident analysis is another important part of the process. (The incident response process is structured into several phases, which cover a wide range of services. They include the definition of an incident policy, the implementation of pro-active measures, the detection of incidents, the formulation of a response strategy, the report and documentation of an incident and implementing controls to prevent other incidents.)

    • Digital Forensics

      To collect evidence in a forensically sound manner to be usable in legal proceedings, we document each performed step in detail – especially how evidence has been acquired and preserved. For this we prepare a detailed, comprehensive and credible report. It includes a multi-staged description with on the one hand high-level summaries for legal staff, as well as in-depth technical documentation that allows other experts to monitor every step and to repeat all analysis to reproduce and prove our results independently.

    • Malware Analysis

      If in the analysis phase of an incident some executable file has been identified, whose functionality is unclear, this might for example be a piece of malware or some custom program implemented by a suspect. IP Addresses or passwords are examples for information that might be of interest. To figure out the functionality of the file, we apply multiple analysis steps and techniques, such as Static Analysis, Automated and Manual Dynamic Analysis and Reverse Engineering.

  • Medical Device Security

    The environment of a healthcare provider is highly specialized. Various audiences with individual backgrounds, expectations and needs use and rely on a variety of medical devices. A defective or manipulated medical device may be massive threat to a patient’s life and may lead to serious harm. This is why ERNW offers medical device security. We customize methodologies to cover more medicine-exclusive topics such as the interoperability of the devices concerning medical communication standards such as HL7.

  • Security Assessment Services

    We provide assessment services such as penetration testing, audits, red teaming, and (closed-source) product evaluations. While we have developed many defined testing methodologies for different technologies, we mainly focus on highly technical and individual assessments. Examples for specialized assessment expertise comprise IoT/embedded/industrial/medical devices, cloud/virtualization/hosting platforms, Microsoft & Active Directory environments, or network/security appliances.

    • Penetration Tests

      Penetration tests is an important tool to simulate a targeted attack scenario to evaluate the effectiveness of already implemented security measures and procedures and to demonstrate the potential of such attacks.

    • Redteaming

      Redteaming is an important tool to simulate a targeted attack and APT scenario to evaluate the effectiveness of already implemented security measures and procedures, as well as monitoring and incident detection capabilities and to demonstrate the potential of targeted attacks and to raise awareness for remaining risks. Redteaming starts with the threat modelling phase, where different attack strategies are prepared and evaluated in the context of the customer. Following the actual Redteaming will be performed after a model, that reflects how real-world targeted attacks are conducted. In the end we provide a comprehensive written report including a detailed management summary, and verbal debriefing with the customer. In addition, we offer optional follow-up modules like the creation of a personalized social engineering policy and security awareness training.


Newsletter sign up

Get the latest Informations about technical topics & Trainings within the IT-Security Community and a lot of special insights. Sign up now for our Newsletter:

Latest Insinuator blog posts

March 26, 2020

Dog Whisperer Update

With the current situation, it’s not easy to find the right angle to start this blog post, so I won’t even try… but with Troopers cancelled, my Bloodhound workshop went down the drain, and I didn’t get a chance to meet or catch up with all of you and share my latest BloodHound adventures. So […]

March 23, 2020

VMware NSX-T Distributed Firewall can be bypassed by default

We recently came across an issue when playing around with VMware NSX-T which not anyone might be aware of when getting started with it. Because many of our customers start with transitioning to NSX-T, we want to share this with you. In short, the Distributed Firewall (DFW) of NSX-T can be easily bypassed in the […]

March 04, 2020

DNS exfiltration case study

Lately, we came across a remote code execution in a Tomcat web service by utilizing Expression Language. The vulnerable POST body field expected a number. When sending ${1+2} instead, the web site included a Java error message about a failed conversion to java.lang.Long from java.lang.String with value “3”. From that error message we learned a […]

February 27, 2020

TROOPERS20 Training Teaser: Attack And Defence In AWS: Chaining Vulnerabilities To Go Beyond The OWASP Top 10

Attackers are everywhere. They are now on the cloud too! Attacking the most popular cloud provider – AWS, requires the knowledge of how different services are setup, what defences do we need to bypass, what service attributes can be abused, where can information be leaked, how do I escalate privileges, what about monitoring solutions that […]

February 06, 2020

Critical Bluetooth Vulnerability in Android (CVE-2020-0022) – BlueFrag

On November 3rd, 2019, we have reported a critical vulnerability affecting the Android Bluetooth subsystem. This vulnerability has been assigned CVE-2020-0022 and was now patched in the latest security patch from February 2020.

More on More articles on our company blog