Pentest Library

White Paper

You want to know more about our services and our approach in detail? In our white paper, you will find an in depth description of how we will perform a test in your company, which tools we are going to use, and which circumstance are necessary in order to realize an efficient and successful security assessment. If you like to receive our white paper in print, do not hesitate to send en email to info@syss.de including your name and postal address.

SySS Responsible Disclosure Policy: Research and Responsibility

SySS GmbH deals with security issues in a responsible way. In the form of a security advisory we report security vulnerabilities which are not in products of our customers and which are not excluded from public disclosure due to contractual agreements with vendors.

The security advisory contains detailed information about the found vulnerability that allows the vendor to reproduce and further investigate the reported security issue. Vulnerabilities will be disclosed to the public if a solution was published by the vendor or 45 days after the initial report by the SySS GmbH, regardless of the vulnerability status, for example if there is a patch or workaround from the affected vendor. In well-founded exceptional cases, this standard procedure may not be followed and an alternative, adjusted publication schedule will be negotiated with the vendor. 

The goal of our Responsible Disclosure Policy is, to weigh up the need of the public to know of security vulnerabilities against the vendor’s time to remedy all security issues effectively. The final publication schedule will be based on the best interests of the community overall, considering both positions. Before the responsible disclosure of a security vulnerability, the SySS GmbH allows vendors the opportunity to analyze reported security issues, to develop effective countermeasures, and to test them thoroughly.

October 2018 | Biometricks: Bypassing an Enterprise-Grade Biometric Face Authentication System

A presentation by Matthias Deeg, #Hacktivity2018, Budapest, October 13, 2018

(copy 1)

Juli 2018 | Rikki Don't Lose that Bluetooth Device

An article by Matthias Deeg and Gerhard Klostermeier about "Bluetooth Trust Relationships"

July 2018 | Antivirus Evasion with Metasploit's Web Delivery

Leveraging PowerShell to Execute Arbitrary Shellcode. An article by Dr. Adrian Vollmer

June 2018 | Case Study: Security of Modern Bluetooth Keyboards

An article by Matthias Deeg and Gerhard Klostermeier

Juni 2017

November 2017 | IoT Penetration Test

An article by IT Security Consultant Alexander Straßheim and SySS Managing Director Sebastian Schreiber.

Juni 2017 (Kopie 1)

June 2017 | Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets

An article by IT Security Consultants Matthias Deeg und Gerhard Klostermeier

May 2017

May 2017 | DNS Backchannel. Using the Domain Name System to Communicate with Hosts in Separated Networks

An article by Senior IT Security Consultant Finn Steglich

März 2017

March 2017 | Attacking RDP: How to eavesdrop on poorly secured RDP connections

An article by IT Security Consultant Dr. Adrian Vollmer

Oktober 2016

October 2016 | Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets

A presentation by Matthias Deeg und Gerhard Klostermeier, Ruxcon 2016, Melbourne, October 23, 2016

September 2016

September 2016 | Deactivating Endpoint Protection Software in an Unauthorized Manner (Revisited)

How to Bypass the Password-Based Authentication for Unloading Kaspersky Endpoint Security 10 for Windows and other Endpoint Protection Software Products as a Limited User, an article by Matthias Deeg and Sven Freund

November 2015

November 2015 | Privilege Escalation via Client Management Software

A presentation by Matthias Deeg

BSidesVienna 0x7DF, Wien, November 21, 2015

November 2015

November 2015 | Deactivating Endpoint Protection Software in an Unauthorized Manner

A presentation by Matthias Deeg, DeepSec, Wien, November 19, 2015

October 2015

October 2015 | Attacking all your IPv4 devices at home from the Internet via Dual-Stack Lite

A presentation by Micha Borrmann, Hacktivity, Budapest, October 10, 2015

November 2014

November 2014 | Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software

A presentation by Matthias Deeg, BSidesVienna 0x7DE, Wien, November 22, 2014

October 2014

October 2014 | CVSS Is a Big Botch

Presentation by IT-Security Consultant Micha Borrmann, Hacktivity, Budapest, October 10, 2014

August 2014

August 2014 | Outsmarted – Why Malware Works in Face of Antivirus Software

An article by Matthias Deeg, Sebastian Nerz and Daniel Sauder

June 2012

June 2012 | Case Study: Deactivating Endpoint Protection Software in an Unauthorized Manner

An article by Matthias Deeg and Sebastian Schreiber

May 2012

May 2012 | Credit Cards: Guessing CVV, Spoofing Payment and Experiences with Fraud Detection Systems

A presentation by Micha Borrmann, Positive Hackdays (PHDays), Moskau, May 30/31, 2012

January 2011

January 2011 | Privilege Escalation via Antivirus Software

A security vulnerability in the software component McAfee Security Agent, which is part of the antivirus software McAfee VirusScan Enterprise, can be leveraged in attacks against corporate networks. An article by Matthias Deeg and Sebastian Schreiber

February 2010

February 2010 | Mobile Security - Data Security on the iPhone

An article by Christian Eichelmann and Sebastian Schreiber (available in English and German)

December 2009

December 2009 | Cryptographically Secure? SySS Cracks a USB Flash Drive

The SySS GmbH cracked a hardware-encrypted FIPS 140-2 certified USB flash drive from SanDisk. An article by Matthias Deeg and Sebastian Schreiber (available in English and German)

February 2000

February 2000 | Compressed TCP/IP-Sessions using SSH-like tools

An article by Sebastian Schreiber