Data Analysis of the RHYSIDA Hack at the Berlin Senate Departments

1.4 million files, one leak, many open questions: The analysis of the RHYSIDA attack on Berlin

Key: [OBSERVED] evidenced and sourced | [ASSESSED] expert assessment | [SCENARIO] possible scenario, not evidenced as having occurred.

Title image – RHYSIDA leak site. Authentic screenshot excerpts of the “Berlin, Germany” entry (Tor network): window header, capacity figure (5.79 TB, as stated by the attackers) and data catalog line (5.26 TB / 1,439,893 files). The entry was published by the group itself; the file list and sensitive details are redacted. Retrieved as part of the analysis, as of 12 October 2026.

TL;DR

[OBSERVED] In 2026, the ransomware group […]

By NSIDE|2026-10-13T18:22:54+02:0013. October 2026|

33 Seconds — That’s How Long It Takes Before a New Web Server Comes Under Attack

Imagine opening a new shop — and before the sign above the door has even been hung straight, the first burglars are already at the entrance, checking whether the lock holds.

Anyone who has ever administered a web server is familiar with this phenomenon: such servers are constantly exposed to requests from automated crawlers and bots — often within just seconds of being brought online for the first time.

In this blog post, we want to look into where these bots come from and what they are searching for. We will also show some of the ways bots discover new web services in the first place, and how you can most effectively protect your web server against automated attacks.

[…]

By Jonas Lieb|2026-05-21T10:01:09+02:006. May 2026|

LFI in Cloud-Managed Kubernetes: How Insecure Default Settings Enable Cluster Compromise

Kubernetes has become an essential component of modern web applications. Its adoption has grown rapidly in recent years, and as penetration testers and red teamers we increasingly encounter infrastructures running on Kubernetes.

However, managing a Kubernetes cluster yourself is a significant undertaking, which is why many organizations rely on managed solutions from Azure, AWS, or GCP. This blog focuses specifically on insecure default configurations in Azure Kubernetes Service (AKS) and how attackers can exploit simple vulnerabilities to potentially compromise an entire cluster.

[…]

By Tobias Wicke|2026-03-13T15:18:55+01:0013. March 2026|

Kernel Access Please – BYOVD and Vulnerable Drivers

Introduction

BYOVD attacks (Bring Your Own Vulnerable Driver) have evolved into a serious threat in recent years. Attackers exploit legitimate but vulnerable kernel drivers to execute privileged operations on target systems. What matters here is not which drivers are regularly used on the system, but rather which drivers are supported—in other words, which drivers attackers can subsequently install. A recent blog article by Check Point Research shows that various versions of the Truesight driver are actively being used in the wild for such attacks.

This article explores the technical background of BYOVD attacks: why legacy drivers represent a structural security problem, how Microsoft’s protective measures can be circumvented, and how simple the practical exploitation of the Truesight driver actually is.

Why Old Drivers Are So […]

By Marius Schwarz|2026-02-02T15:38:54+01:002. February 2026|

Exploitation of a Vanilla Buffer Overflow in the o2 HomeBox 6441 Router (unauthenticated) – A Step by Step Abuse Guide

Introduction

We regularly investigate the security of Customer Premises Equipment (CPEs), also known as SOHO routers. One important aspect of these investigations is to check for memory corruption vulnerabilities like buffer overflows. While these types of bugs were discovered in 1996[1] and secure coding practices as well as exploitation mitigation techniques should render these issues to a vanishing phenomenon, we still encounter them on today’s devices.
In August 2018, NSIDE investigated the O2 HomeBox 6441 in terms of memory corruption vulnerabilities and discovered a buffer overflow in the embedded webserver. Most of the time NSIDE doesn’t publish such findings, because we are bound by NDAs

The Vulnerability

Usually all parameters that are accepted by the webserver get sanitized and their length is checked or ceiled against/to an upper bound. […]

By Martin Steil|2021-03-16T14:28:20+01:0011. March 2019|

Dumping SPI Flash Memory of Embedded Devices

Introduction

While auditing the security of embedded devices we often face situations where the firmware of the system under test is either not publicly available or the vendor can’t provide it due to legal issues. Accessing the firmware gives a lot of insight on how the device actually works. Even in assessments, where scope is limited to Web Application Testing only, helpful information can be gathered by having access to the firmware.

This blog post depicts the general approach for retrieving the firmware from such devices by accessing the flash memory chip directly. Please note the provided information in this example is limited to the flash memory chip only, as the tested system cannot be disclosed due to legal constraints.

Accessing the hardware

After opening the housing […]

By Sebastian Trahm|2026-01-12T11:56:22+01:0011. June 2018|

Android Apps: From Simple Vulnerabilities to Permanent Malware Infection

Introduction

Many people underestimate the possibilities a remote attacker has who managed to exploit a remote code execution vulnerability on Android devices.

On Windows systems, it is widely accepted that a vulnerability in one software can lead to the compromise of other software and, ultimately, to the infection of the whole system. The same is, in fact, also possible for Android, even though many people believe the attacker would be confined to the vulnerable app’s context (in the Android file system and UID/GID sandboxing sense).

In this blog post we will show how a vulnerability in one single app can lead to the permanent (and virtually irreversible) infection of an Android device with malware. To this end we will walk the reader through the single steps that lead […]

By Rafael Fedler|2021-03-16T14:28:54+01:0031. March 2016|

Burp and TCP Connection Reuse / TCP Streaming

Recently we were working on an engagement to test a fat client using a web service and ran into a problem with Burp. Surprisingly enough, there was not a single resource on the Internet to help us out. Hoping that others dealing with the same issue won’t lose their sanity like we almost did, I am writing this blog post now ;)

We were trying to test a web application, or rather a client application (a binary!) communicating with a web service built on top of an HTTP REST API, with Burp as a transparent/invisible proxy in between. For some completely unknown reason, when Burp was between the client software and the server, the client application just refused to log in.

A comparison of HTTP requests and […]

By Rafael Fedler|2021-03-16T14:28:47+01:0019. June 2015|

[CVE-2014-5335] CSRF in Innovaphone PBX

Innovaphone PBX Admin-GUI CSRF

Impact: High
CVSS2 Score: 7.8 (AV:N/AC:M/Au:S/C:P/I:C/A:C/E:F/RL:U/RC:C)
Announced: August 21, 2014
Reporter: Rainer Giedat (NSIDE ATTACK LOGIC GmbH, https://www.nsideattacklogic.de/)
Products: Innovaphone PBX Administration GUI
Affected Versions: all known versions (tested 10.00 sr11)
CVE-id: CVE-2014-5335

Summary

The innovaphone PBX is a powerful and sophisticated VoIP telephone system for use in professional business environments. In addition to a wide range of IP telephony functionalities, the innovaphone PBX is also equipped with a perfectly integrated Unified Communications solution that can be enabled as needed at any time and at any workspace.

The innovaphone PBX uses a web-based user interface. This UI is vulnerable to cross-site request forgery attacks (CSRF).

Description

The UI does not check if a request was sent originating from a page it delivered before or from an untrusted and potentially malicious source. With a […]

By NSIDE|2022-05-19T17:10:09+02:0021. August 2014|

NSIDE Tech Blog

STAY UP TO DATE