New post: Security Advisory: Airoha-based Bluetooth Headphones and Earbuds https://insinuator.net/2025/06/airoha-bluetooth-security-vulnerabilities/
Remote
Insinuator
@Insinuator@infosec.exchange
mastodon 4.8.0-alpha.3+glitchBold Statements.
IT-Security Blog feed run by @ERNW@infosec.exchange.
45 Followers
0 Following
6 Posts
Joined November 09, 2022
Blog:
Imprint:
Run by:
Conference:
Twitter:
New post: Vulnerability Disclosure: Command Injection in Kemp LoadMaster Load Balancer (CVE-2024-7591) https://insinuator.net/2024/11/vulnerability-disclosure-command-injection-in-kemp-loadmaster-load-balancer-cve-2024-7591/
New post: Windows Hello for Business – Full Report Has Been Released https://insinuator.net/2026/07/windows-hello-for-business-full-report-has-been-released/
New post: Your Android Bluetooth Traffic Captures Should Be Live https://insinuator.net/2026/07/your-android-bluetooth-traffic-captures-should-be-live/
Part 2 of our series on token theft in Microsoft Entra ID is live, accompanying ERNW White Paper 80.
This one puts Continuous Access Evaluation to the test empirically.
Of 740 first-party resources we checked for the CAE claim, 33 carried it.
Revocation timing ranged from 0 seconds for network-based policies to around 5 minutes at Exchange Online. In exchange for that, CAE tokens may live up to 28 hours rather than the usual 90 minutes.
https://insinuator.net/2026/09/token-theft-in-microsoft-entra-id-part-2-of-4-continuous-access-evaluation/ by Niklas Kerner
#EntraID #CAE #ZeroTrust #InfoSec
Part II of our Bluetooth Auracast research is live, along with an updated Auracast Hacker's Toolkit that now does proper sniffing.
Over-the-air BIS PDUs never reach the Bluetooth host. Pre-transmissions, retransmissions and controller-only fields stay in the controller, so we patched Zephyr's BLE controller to forward every Link Layer PDU. Captures parse in Wireshark.
Plus the new Auracast Packet Visualizer.
By Dennis Heinze.
https://insinuator.net/2026/09/auracast-part2/
#Bluetooth #Auracast