@moritz_abrell

IT Security Enthusiast; Penetration Tester; Security Researcher

Joined February 2022
  • Tweets65
  • Following274
  • Followers379
7Media
Finally published the blog post about abusing @Zoom for remote attacks on endponits: blog.syss.com/posts/zero-tou… It was fun to present this at @BlackHatEvents

Zero Touch Pwn: Abusing Zoom’s Zero Touch Provisioning for Remote Attacks on Desk Phones

In this blog post, we describe several vulnerabilities that were discovered during a security analysis of AudioCodes desk phones and Zoom’s Zero Touch Provisioning. We also discuss and demonstrate...

blog.syss.com
1
29
2
50
7,300
Tired of all the fancy AI stuff? Come see TURNado at Black Hat Arsenal in London and learn how to test and abuse TURN servers. Who knows, TURN tunneling might just be the next technique your AI agent uses to escape its network sandbox 😉 blackhat.com/europe/arsenal/… #BlackHat #BHEU
2
1
2
312
Check out our new blog post and PoC video demonstrating how a QNAP NAS can be compromised via non-control-data exploitation. #CVE #Vulnerability #Exploit #QNAP #CyberSecurity youtube.com/watch?v=_6Pwdss-…

Against All Odds: Exploiting a QNAP NAS

In this proof-of-concept video, SySS IT security expert Moritz Abre...

youtube.com
1
3
1
8
1,697
blog.syss.com/posts/qnap/

Against All Odds: Exploiting a QNAP NAS

In this blog post, we take a look at a strcpy()-based overflow and non-control-data exploitation in a QNAP NAS. TL;DR We found stack-based buffer overflows in the upload handlers of the QNAP file...

blog.syss.com
1
4
14
1,200
We identified multiple vulnerabilities in @AudioCodes OVOC that can be chained to achieve, root RCE. Read the details here: syss.de/pentest-blog/kritisc… #CyberSecurity #InfoSec #Vulnerability #CVE

Kritische Schwachstellen in AudioCodes OVOC

Die Verwaltungs- und Monitoring-Lösung One Voice Operations Center (OVOC) des Herstellers AudioCodes beinhaltet mehrere kritische Schwachstellen.

syss.de
6
11
1,980
Recent reports mention APTs abusing Microsoft TURN servers for C2 communication. In our new blog post, we break down what’s actually going on, share practical guidance on how to assess TURN servers, and release a tool to perform such tests yourself: blog.syss.com/posts/turnado/

TURN! - What could possibly go wrong?

In this blog post, we describe common pitfalls and attack vectors in TURN services. For practical testing and exploitation, we also introduce a new easy-to-use open-source tool called TURNado....

blog.syss.com
10
22
1,591
Moritz Abrell retweeted
Ray Maker@dcrainmakerblogMar 3
An interesting wrap-up presentation from the security researcher who found the COROS watch security vulnerabilities last year. Worth a watch if you're into geekery: youtube.com/watch?v=WmY9XBJE…
4
23
5,220
Great work and write-up!
Matthias Deeg@matthiasdeegFeb 12
Today, a tech blog article by my colleague Christian Zäske titled "MeshHacks: Exploiting Linksys Intelligent Mesh from the Internet" concerning six security vulnerabilities in different Linksys routers was published. blog.syss.com/posts/meshhack…

MeshHacks: Exploiting Linksys Intelligent Mesh from the Internet

In this blog post, we describe multiple vulnerabilities we found in Linksys Wi-Fi routers, especially exploiting the “Intelligent Mesh™” functionality, which can be used to wirelessly link routers to...

blog.syss.com
145
Had a great time at @hardwear_io 2025. Awesome conference! youtu.be/WmY9XBJEq2A?si=q7b4…
5
182
Moritz Abrell retweeted
Matthias Deeg@matthiasdeegJan 28
Today, I have published a new YouTube video about browser swapping attacks, demonstrating and explaining a security issue in OAuth 2.0 that my colleague Jonas Primbs found. youtube.com/watch?v=hDrfwKSU…
1
1
4
229
Moritz Abrell retweeted
hardwear.io@hardwear_io20 Nov 2025
⌚ A sports watch you trust on every run…or do you? At #hw_ioNL2025 Moritz Abrell takes us behind the scenes of the #COROSPACE3, where a routine BLE assessment spiralled into discovering hidden vulnerabilities & a public wake-up call for the vendor. 👉hardwear.io/netherlands-2025…
3
4
573
I'm back home from the beautiful city of Bergamo and the awesome @nohatcon. Today, we have published the security advisories concerning the Verbatim security update I was talking about on Saturday in my presentation "Your Security Update is Not Secure Enough".
1
1
1
5
339
The talk recording can now be found on YouTube youtube.com/watch?v=tmIoT2Lt…

BalCCon2k25 - IKARUS - Prison Break - Kiosk Mode Environments

BalCCon2k25 - Against the Current - IKARUS - Prison Break - Kiosk ...

youtube.com
Gerhard Klostermeier@iiiikarus27 Sep 2025
I was giving a talk at @BalCC0n about breaking out of kiosk mode environments. The conference was an fantastic experience! You can find the full write-up with tips & tricks, slides, etc. here: github.com/ikarus23/kiosk-mo…

GitHub - ikarus23/kiosk-mode-breakout: A collection of tips & tricks on how to escape a kiosk mode...

A collection of tips & tricks on how to escape a kiosk mode environment - ikarus23/kiosk-mode-breakout

github.com
8
15
3,016
Excited to contribute to the content of this year‘s @hardwear_io . Looking forward to Amsterdam! hardwear.io/netherlands-2025…
1
3
185
Today, my colleague @moritz_abrell published a new tech blog article titled "Automated Patch Diff Analysis using LLMs", and it's about what its title suggests. 😄 If you're interested in LLM-based workflows and IT security, you should read it here: blog.syss.com/posts/automate…

Automated Patch Diff Analysis using LLMs

Large Language Models (LLMs) are increasingly integrated into AI workflows and agents to streamline a wide range of tasks. In this blog post, we introduce an approach for using LLMs for automated...

blog.syss.com
1
1
4
227
Moritz Abrell retweeted
Memfault
@Memfault8 Aug 2025
Our favorite articles & learnings from July by @moritz_abrell, @azonenberg, @iarsystems, @koehlma, @linuxfoundation, @cratesiostatus, @Raspberry_Pi, @EbenUpton, @qtproject, @JLCPCB, @ZephyrIoT, and more! Read our latest monthly roundup on Interrupt, Memfault's developer blog & community: interrupt.memfault.com/blog/… #embedded #embeddedsystems #firmware #hardware #iot

What we’ve been reading in July (2025)

Here are the articles, videos, and tools we’ve been excited about in July 2025.

interrupt.memfault.com
1
1
851
Moritz Abrell retweeted
0xor0ne
@0xor0ne5 Jul 2025
Introduction to Voltage Glitching (STM32L051 microcontroller) blog.syss.com/posts/voltage-… Credits @BartimaeusvUruk #hardware #infosec
2
32
140
10,377
Today we published the blog post about the BLE analysis of a COROS PACE3 sports watch: blog.syss.com/posts/bluetoot… #CVE #Vulnerability #BLE #COROS

Watch Out! Bluetooth Analysis of the COROS PACE 3

In this blog post, we describe the Bluetooth analysis of the COROS PACE 3 sports watch and the security vulnerabilities we found during this research.

blog.syss.com
4
6
1
16
3,100
Check out the discovery and analysis of CVE-2025-33073 by my colleagues. A vulnerability with real-world impact. blog.syss.com/posts/kerberos…

Authentication coercion of machine accounts and Kerberos relaying/reflection over SMB

In this blog article, further technical details concerning the Microsoft Windows SMB security vulnerability CVE-2025-33073 are presented.

blog.syss.com
2
5
539
Today, my new blog article titled "Voltage Glitching with the Pico Glitcher and Findus" was published. You can find it on the SySS Tech Blog: blog.syss.com/posts/voltage-…

Voltage Glitching with the Pico Glitcher and Findus

Fault injection attacks against microcontrollers can be very rewarding for attackers, if they are successful. In this article, a new hardware device for performing voltage glitching attacks, the Pico...

blog.syss.com
3
7
671
Check out our today published CVEs on @AudioCodes Session Border Controller and One Voice Operation Center. Unauthenticated path traversal, hard-coded keys and unauthenticated persistent XSS. syss.de/pentest-blog/mehrere… CVE-2024-52883 CVE-2024-52882 CVE-2024-52884 CVE-2024-52881
1
4
348
Load more