modzero

modzero.comIn-depth IT Security

21 Nov 2024

Hello Bluesky 👋 We are an IT security company. Our team consists of like-minded hackers located in Germany and Switzerland. Our core areas of expertise are comprehensive technical security analyses, penetration tests and red teaming services. Want to learn more about us? Check: modzero.com/en/

modzero.comPlease Do Not Hack Me - The Tale of a TeamSpeak Use-After-Free

3 June

And here is the detailed report on our PSA from last week: "Please Do Not Hack Me - The Tale of a TeamSpeak Use-After-Free" modzero.com/en/blog/plea...

modzero.com[MZ-26-01] TeamSpeak

28 May

🎶 PSA: Multiple Denial of Service vulnerabilities in TeamSpeak. Find our colleague Michael Imfelds advisory here modzero.com/en/advisorie...

netzpolitik.orgHacken & Kunst: „Kunst allein reicht nicht aus“Helena Nikonole hat Kameras in Russland gehackt und Anti-Kriegsbotschaften verbreitet. Nun entwickelt die Künstlerin ein winziges Gerät, um ohne Internet Nachrichten zu verschicken. Mit kreativen und ...

12 Mar

We're Hiring! We are currently looking for a Penetration Tester and a Senior Red Teamer. Check out our open positions and reach out if you think you’d be a great fit. Here: modzero.com/en/jobs/

modzero reposted

Helena Nikonole hat Kameras in Russland gehackt und Anti-Kriegsbotschaften verbreitet. Nun entwickelt die Künstlerin ein winziges Gerät, um ohne Internet Nachrichten zu verschicken. Mit kreativen und praktischen Lösungen will sich Nikonole einer zusammenbrechenden Welt entgegenstellen.

modzero reposted

Drew Harwell

@drewharwell.com

7 Jan

X basically industrialized the creation of fake porn of women who don't consent. Others did it first, but Grok made it normalized and centralized: publicly visible, instantly creatable by anyone, regardless of who's being targeted and dehumanized. Only question now is will X suffer any consequences

modzero reposted

Stadt Wien-Büchereien

@buechereienwien.bsky.social

7 Jan

Sollen wir Büchertische zum Thema Fitness und Fasten machen oder gleich die Oster-Backbücher rausstellen?

modzero.comNo Leak, No Problem - Bypassing ASLR with a ROP Chain to Gain RCE

10 Nov 2025

No Leak, No Problem - Remember our PSA about updating your INSTAR cameras? Here’s the reason in detail, worked out and noted by our teammate Michael Imfeld: modzero.com/en/blog/no-l...

6 Nov 2025

Does anyone here have a working way to contact archive.org? It's about a security issue...

28 Sept 2025

catch a glimpse of us holding our annual “state of the zero” meetup - to wrap our heads around all of IT and us. we also took a boat trip, ate too many sweets, touched some grass, saved the world, had a barbecue and a drink or two…💓 #modzero #infosec #itsecurity #captainitswednesday

modzero.com[MZ-25-03] INSTAR 2K+ and 4K Series

14 Aug 2025

PSA update your INSTAR cameras. Our teammate Michael Imfeld identified a critical RCE (CVE-2025-8760) on 2k+ and 4K devices. Find the advisory here: modzero.com/en/advisorie...

modzero.comWhen Backups Open Backdoors: Accessing Sensitive Cloud Data via

29 June 2025

Teammate Leonid discovered a leaked credential that allowed anyone unauthorized access to all Microsoft tenants of orgs that use Synology's "Active Backup for Microsoft 365" (ABM), including sensitive data like Teams channel messages. 🤓 #synology #disclosure #modzero modzero.com/en/blog/when...

29 June 2025

This blog post contains the full technical walk-through and discovery of the vulnerability, its impact, and our experience during the responsible disclosure process with Synology.

25 June 2025

nooooooooooo... 💔

ToonHive@toonhive.bsky.social

Tiny Chef announces his show has been cancelled at Nickelodeon after 2 seasons and 41 episodes.

thetinychefshow.comSUPPORT CHEF — The Tiny Chef Show

25 June 2025

donate! www.thetinychefshow.com/fan-club-log...

modzero.comROPing our way to RCE

7 Feb 2025

ROPing our way to “Yay, RCE” - and a lesson in the importance of a good nights sleep! Follow our Colleague Michaels journey of developing an ARM ROP chain to exploit a buffer overflow in uc-http modzero.com/en/blog/ropi...

7 Feb 2025

Via Return-Oriented Programming chain small code snippets, or gadgets, already present in a program’s memory can be leveraged By chaining these gadgets together, they can execute arbitrary code without injecting anything new

kandidierendencheck.dekandidierendencheck Bundestagswahl 2025 | Wahlhilfe für deine ErststimmeVergleichen Sie Ihre Meinung mit der Ihrer Kandidierenden über 18 Themen zur Wahl! Jetzt mitmachen!

7 Feb 2025

Dive into the process of reverse engineering, gadget hunting, and crafting a working exploit.

modzero reposted

abgeordnetenwatch

@abgeordnetenwatch.de

3 Feb 2025

🔔 Unser #kandidierendencheck ist online: 18 Thesen beantworten - und ihr erfahrt, welche Kandidierenden in eurem Wahlkreis so denken wie ihr. 👇 www.kandidierendencheck.de/bundestag

modzero reposted

netzpolitik.org

@netzpolitik.org

29 Jan 2025

Seit heute ist der Real-O-Mat online. Das Tool vergleicht die eigene Position bei relevanten Fragen mit denen der Fraktionen im Bundestag. Grundlage dafür sind keine Wahlkampfversprechen, sondern das Abstimmungsverhalten. netzpolitik.org/2025/real-o-...

netzpolitik.orgReal-O-Mat: Taten zählen mehr als WorteSeit heute ist der Real-O-Mat online. Das Tool vergleicht die eigene Position bei relevanten Fragen mit denen der Fraktionen im Bundestag. Grundlage dafür sind keine Wahlkampfversprechen, sondern das ...

youtube.com37C3 - Finding Vulnerabilities in Internet-Connected DevicesYouTube video by media.ccc.de

was just listening to #DeLaSoul's classic #RingRingRing on the radio and thought about the time we broke a phone. or: how some coupled minor pinches can become a proper headache colleagues @yonk42.bsky.social and @parzel.bsky.social talked about it at #37c3 www.youtube.com/watch?v=K9mm...

attackers could then listen in on conversations using the built-in microphones or could reroute incoming and outgoing calls ... and so on

modzero.comMultiple Vulnerabilities in Poly VoIP Products

learn all about it from our colleagues Pascal and Christoph at their 37c3 talk or from our published disclosure report: modzero.com/en/blog/mult...

youtube.com37C3 - Finding Vulnerabilities in Internet-Connected DevicesYouTube video by media.ccc.de

we found several vulnerabilities in commonly used desk phones and smart conference speakers. combined, the issues can be used to take over a device through the local network or with physical access

modzero reposted

dunja hayali

@dunjahayali.de

13 Jan 2025

Wenn Sie sich die Unwörter der letzten 11 Jahre anschauen, was fällt Ihnen auf? • 2024 Biodeutsch • 2023 Remigration

modzero.comExploiting SSTI in a Modern Spring Boot Application (3.3.4)

10 Jan 2025

We broke something: in a recent pentest on a hardened target, we were able to achieve unauthenticated Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in a Spring Boot application We wrote it down for you to try at home: modzero.com/en/blog/spri...

10 Jan 2025

The post outlines the current state of SSTI on Spring Boot, explains where we got stuck with existing payloads and how to find your own exploitable libraries to bypass defenses.

media.ccc.deDer Thüring-Test für WahlsoftwareWähle Dein Risiko! Vor der Bundestagswahl 2017 veröffentlichten wir unsere Analyse über haarsträubende Sicherheitslücken in einer weit v...

10 Jan 2025

We were quite happy - at least for a minute - for there are probably easier ways to achieve the final result. So let us know if you have a better approach :) contact via link!

modzero reposted

linuzifer

@linuzifer.bsky.social

29 Dec 2024

Der @ths.ch und ich haben uns beim #38C3 mal wieder mit Wahlsoftware beschäftigt. media.ccc.de/v/38c3-der-t...

29 Dec 2024

it wasn't me. 🫶 #38c3