Full-disk encryption is one of the most basic measures for the physical security of end-user devices. If you follow IT security news even a little, though, it feels like a new BitLocker vulnerability gets published every few months. In this post I explain in detail how BitLocker works, which attacks exist, and how you can protect yourself against them.
“What does a pentest cost?” is the question I get asked the most, and the honest answer is always “it depends.” That’s not a dodge. A pentest is billed by effort, not sold as a fixed product, so the real question underneath it is what decides how much effort a given project actually needs. This post explains exactly that.
During an internal infrastructure penetration test or a web application penetration test, I regularly need to send clients things they really don’t want lying around in an inbox: the final report, extracted credentials, a dump used as proof for a finding. Email and generic file sharing tools are a bad fit for that. So I built VidraCrypt (opens in a new tab), a small open-source tool that decrypts files entirely in the browser, with the server never seeing the passphrase or the plaintext.
Choosing a penetration testing provider is hard when you are not a security specialist yourself, which is the situation most SMBs are in. The market is full of confident sales pitches, and the difference between a genuinely useful test and an expensive compliance checkbox is not obvious from a brochure. This checklist gives you the specific questions to ask and what good answers sound like.
NIS2 has pulled thousands of mid-sized companies into a compliance regime they never had to think about before. If you run IT at a 50 to 500 person company in the DACH region, you have probably been told you need to “do something about NIS2,” and that a penetration test is part of it. This article explains, plainly, what a NIS2-ready pentest actually looks like and what auditors expect to see.
You need a penetration test, and the market offers three very different shapes of provider: the boutique single operator, the large security firm, and the PTaaS platform. They are priced differently, they deliver differently, and they are not interchangeable. This guide compares them on the factors that actually change the outcome.
Security awareness training is valuable. Recognizing suspicious emails, questioning unexpected login requests, and knowing what phishing looks like: all of that makes attacks harder.
But here’s the honest truth: with enough effort, anyone can be phished. I run simulated phishing campaigns for clients regularly as part of Cyber Attack Simulation engagements, and I have never failed to catch at least a few users, no matter how good their training is.
You’ve decided you need a penetration test. Good call. But before you sign a proposal, there’s a lot that can go wrong: wrong scope, wrong methodology, wrong expectations. The result is a report that collects dust and a budget that got wasted.
This guide is written for the people buying pentests, not the people running them. It covers what a pentest actually is, when to do one, what to expect, and how to avoid the most common and expensive mistakes.
BitLocker is always a topic in Windows client pentests. For full-disk encryption not to be easily bypassed, BitLocker must be configured securely.
There is in fact a vulnerability that can be used to bypass BitLocker without special hardware, and in principle anyone can exploit it. This post covers the bitpixie attack, why BitLocker’s default mode is vulnerable, and what you can do about it.
In this blog post, I describe how I managed to read password hashes from the lsass.exe process memory in Windows 11 24H2. Since this version was still very new at the time of writing this post, some of the issues are due to a lack of tool support and should be resolved in the future. However, this post may also help in adapting the tools for later Windows versions.
Kerberos works similarly to a passport: A passport authority issues the passport after the person has identified themselves. With this passport, they can then go to the border and prove their identity.
In this blog post, I will briefly address two often overlooked vulnerabilities and misconfigurations in the Active Directory Tiering model. Specifically, I will focus on the mishandling of terminal servers and the helpdesk user group.
What do we see in the photo? The settings for User Account Control (UAC). But what exactly is that and how can it be bypassed?
BloodHound is a tool developed by penetration testers and red teamers to better identify and visualize attack paths in Active Directory. However, that doesn’t mean it can’t also be used effectively by admins or the blue team.
This week, a vulnerability in the CheckPoint VPN Gateway (CVE-2024-24919) was disclosed. Unfortunately, CheckPoint has provided us with very little information about the impact of this vulnerability. I want to change that! I will show how the vulnerability can be exploited and what information an attacker can extract.
Unfortunately, setting a good password policy for Active Directory is difficult. This is also because there are several best practices that sometimes contradict each other. In this post, I will try to address the various best practices and give my own recommendation.
This is the first part of a series in which we look into default insecure configurations in Active Directory. This part covers the Pre-Windows 2000 Compatible Access group. What is it? What are the risks? And what can we do about it?
Despite Hyper-V’s impressive performance, its GUI can feel sluggish compared to direct interaction on your host. Finding a solution to this was challenging, as resources were scarce. This post outlines how to configure Hyper-V and Linux virtual machines for a more responsive UI, achieving a performance level comparable to VMware Workstation.
Firstly, what exactly is BitLocker? BitLocker is Microsoft’s full disk encryption solution. While there are alternative solutions from other companies, my experience shows that BitLocker is the preferred choice for most organizations today. The reasons are straightforward: it’s included at no additional cost and integrates seamlessly with Active Directory and EntraID.
This article will guide you through setting up BitLocker and also go into some of the potential attacks against BitLocker, offering insights into its security features.