SRLabs
srlabs.de · Company blog · on HN since 2011
Berlin security research firm Security Research Labs, publishing work on BadUSB, SIM cards, GSM, mobile networks, and payment protocols.
What HN saysHN links it for telecom and hardware security research. Commenters point to Karsten Nohl's work on telco weaknesses, and the firm posts job and research-month ads.
44HN people shared it
22linked it in comments
35stories submitted
692story points
4 months agolast shared
2011people per year2026
Most-shared posts
- 1Turning USB peripherals into BadUSB5 people · 8 points · first shared 2014 · 3 comments on HN
- 2Rooting SIM cards4 people · 64 points · first shared 2013 · 14 comments on HN
- 3Security Research Labs4 people · 1 points · first shared 2018 · discussion on HN
- 4Outdated payment protocols expose customers and merchants3 people · 37 points · first shared 2015 · 8 comments on HN
- 5Bogusbazaar: A Criminal Network of Webshop Fraudsters3 people · 7 points · first shared 2024 · discussion on HN
- 6RCS technology exposes most mobile users to hacking (2019)3 people · 2 points · first shared 2019 · discussion on HN
- 7BadUSB – On accessories that turn evil [pdf]2 people · 84 points · first shared 2014 · 24 comments on HN
- 8Decrypting GSM phone calls2 people · 6 points · first shared 2013 · discussion on HN
- 9EDRs decrease your enterprise security, unless properly hardened2 people · 3 points · first shared 2022 · discussion on HN
- 10Cryptographic problems are reduced to their true hardness by SAT solver2 people · 2 points · first shared 2015 · discussion on HN
- 11New SIM attacks de-mystified, protection tools now available1 people · 190 points · first shared 2019 · 33 comments on HN
- 12Alexa and Google Home expose users to vishing and eavesdropping1 people · 178 points · first shared 2019 · 62 comments on HN
- 13Hexagon fuzz: Full-system emulated fuzzing of Qualcomm basebands1 people · 81 points · first shared 2025 · 22 comments on HN
- 14Incorrectly patched ZyXEL vulnerability becomes zero-day again1 people · 4 points · first shared 2021 · discussion on HN
- 15AI-generated code, AI-generated findings, and the verification bottleneck1 people · 3 points · first shared 2026 · discussion on HN
What HN people wrote when they linked it
FreshFries · 2020-12-03
Interested in the topic?
Search for Karsten Nohl. That man is a 'one man army' exposing weaknesses in telcos and their protocols and has been for years. So long that many of these "S7 (as called in Europe) or SS7 (USA) tricks" are not even abusable in many networks since he helped them mitigate the issues.
https://en.wikipedia.org/wiki/Karsten_Nohl
https://srlabs.de
They guy's one of my all time heroes.
borumpilot · 2019-10-01
It is dated, just not on the page itself:
https://srlabs.de/#bites "27.09.2019"
kerm1t · 2018-11-01
SRLabs | Security Research Month | Malaysia and Indonesia | February 10th - March 9th 2019 | On-site
Join us for one month of hacking research in Malaysia and Indonesia!
Every year, we (https://srlabs.de) escape the cold Berlin winter for a "Hackerurlaub" (hacker vacation). For the third year already now, we are inviting fellow hackers to join us. Flights, villa, fun and mentorship are all included.
During the month there you will work on your own project, supported by us, the SRLabs team. We are a Berlin-based hacking research collective and consulting think tank and focus on everyday technology that expose many people to risk. You may know us from our work like BadUSB [1] or SS7 Hacking [2].
How to apply?
All you need to do in preparation is to come up with a hacking target and send your application to beach[at]srlabs.de. For details, please visit https://hack-the-beach.com
[1] https://www.wired.com/2014/07/usb-security/
[2] https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-…
louismerlin · 2024-10-02
SRLabs | Security Engineer | Berlin, DE | Full Time
Our security team is growing across offices, and we are looking for Security Engineers that are knowledgeable in blockchain security, application security, and vulnerabilities.
Here are a few things that you will be doing:
- Review systems to secure digital assets (e.g. cryptocurrency) from attackers
- Analyze and present results to team member and clients
- Work closely with security engineers and development teams in IT security projects
- Participate in hacking exercises, and conduct developer trainings
- Code review of blockchain implementations
Take a look at the job description: https://srlabs.breezy.hr/p/f569b4d83eb601-security-engineer-blockchain…
Take a look at our research blog: https://www.srlabs.de/blog
lxgr · 2021-11-07
Not really updated, but new applications can be remotely installed and then interact with the baseband and (to a limited extent) the smartphone OS.
It‘s not "any entity", though – the provider’s keys are needed to do this, and they can already do much of that tracking using other, network-side means.
If the signing keys are compromised, though, bad things can happen: https://www.srlabs.de/bites/rooting-sim-cards
mschuster91 · 2020-08-26
Yep, named that way after the city their discoverers are based at. https://srlabs.de/bites/decrypting-gsm/
faitswulff · 2019-11-30
From the SR Labs post on the topic:
> In the second half of 2019, Google and a group of mobile operators started implementing a new communication technology, Rich Communication Services...In June 2019, Google officially announced their plans to push RCS on all Android phones starting with trials being run in UK and France. Fast-forward to November 2019, RCS is being rolled out to all Android users in the US, and operators in other countries are running trials.
https://srlabs.de/bites/rcs-hacking/
est31 · 2019-01-02
You might be able to use it to prevent BadUSB like attacks. Something looks like an USB stick with data on it, you plug it in. The device tells the computer that it's a keyboard and sends keypresses to install some virus or something. [1]
I don't know about the particulars of this standard though, maybe it's just some DRM thing and soon you'll have to buy expensive dell mice for dell laptops or something like it's already the case with gamepads and consoles.
[1]: https://srlabs.de/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackHat-v1…
theptip · 2016-04-27
See the recent BadUSB attack [1][2] for how this sort of attack can work; the firmware of the USB microcontroller itself can be infected.
[1] https://srlabs.de/badusb/
[2] http://www.wired.com/2014/07/usb-security/
orless · 2015-12-28
These are slides from this talk:
https://srlabs.de/pos-vulns/
https://events.ccc.de/congress/2015/Fahrplan/events/7368.html
Video:
https://media.ccc.de/v/32c3-7368-shopshifting#video
kalleboo · 2015-12-28
Well that article was completely devoid of information.
Here's the post by the researchers themselves: https://srlabs.de/pos-vulns/
tldr: POS card readers have poor security - their HSMs leak their keys, and many of them don't have unique keys so you can impersonate them
brudgers · 2015-12-12
Slide Deck: https://srlabs.de/blog/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackH…
and it's discussion: https://news.ycombinator.com/item?id=8164766
adrianN · 2015-09-11
Plugging things in your USB port has been known as a dangerous activity for quite some time.[1,2] It's surprising that someone at Elsevier thought it would be a good idea to use these techniques though.
[1] https://srlabs.de/badusb
[2] https://media.blackhat.com/bh-dc-11/Larimer/BlackHat_DC_2011_Larimer_V…
sirsar · 2015-01-02
Yep, see the BadUSB proof-of-concept: https://srlabs.de/badusb/
ersii · 2013-11-13
I would also suggest watching Karsten Nohl/SRLabs security research into JavaCard and the "state of the SIM" from the Observe Make Hack 2013 camping conference, which is available at: https://archive.org/details/D4T204201301031400SimCardExploitationKarst… and his article at https://srlabs.de/rooting-sim-cards/
e3pi · 2013-07-22
We've read here recently, re: Snowden in Hong Kong, (rooted?) phones and ($5?) SIMs are inexpensive and popular in HK. Are there varieties of --I don't know, what-- `rooted(?)', `unformatted(?)' SIMs that become desirable to a knowledgeable hacker community, beyond what consumers get with their service?
edit: I just now found on HN front page:
https://srlabs.de/rooting-sim-cards/
caf · 2013-07-22
This appears to be confirmed - from https://srlabs.de/rooting-sim-cards/ :
A rainbow table resolves this plaintext-signature tuple to
a 56-bit DES key within two minutes on a standard computer.
The cracked DES key enables an attacker to send properly
signed binary SMS, which download Java applets onto the SIM.
It's particularly sad that the same key is used for the MAC in both directions (network-to-SIM and SIM-to-network).
js4all · 2011-01-05
Wow, this is a serious hack. Everyone can now sniff and decrypt GSM calls with some cheep old phones. The tools and the new faster rainbow tables discussed can be found here: http://srlabs.de/research/decrypting_gsm/
peterwwillis · 2014-12-19
Really, none of this is surprising or new. If you're bored/curious, here's some fun reading on exploring/exploiting telecom networks. Spoiler alert: it's really easy and it has been forever. Big ups to Philippe Langlois for all his great research over the years.
Interview: Telecom Security Expert Philippe Langlois on GCHQ Spying (http://www.spiegel.de/international/europe/interview-telecom-security-…
Vulnerabilities and Possible Attacks
against the GPRS Backbone Network (http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Possible%20At…
Getting in the SS7 kingdom: hard
technology and disturbingly easy hacks
to get entry points in the walled garden (http://www.hackitoergosum.org/2010/HES2010-planglois-Attacking-SS7.pdf…
Telecom Signaling Attacks on 3G and LTE networks (http://www.slideshare.net/p1sec/telecom-security-from-ss7-to-all-ip-al…
GSM and 3G Security (https://webcache.googleusercontent.com/search?q=cache:WlEd4HCpl48J:www…
Locating Mobile Phones
using Signalling System #7 (http://events.ccc.de/congress/2008/Fahrplan/attachments/1262_25c3-loca…
SCTPscan - Finding entry points to SS7 Networks & Telecommunication Backbones…
rurban · 2016-04-24
cbmc: http://www.cprover.org/cbmc/applications.shtml
cmbc is easiest to install, they even have binaries.
easy samples also in the manual:
http://www.cprover.org/cprover-manual/modeling-assertions.shtml
klee: https://klee.github.io/tutorials/
pretty hard to install
coq: https://coq.inria.fr/a-short-introduction-to-coq
the real beast out there. easy to install. but hardly usable for normal hackers, because of their mathematical notation.
but it's using plain c, and you can verify c with various solvers.
z3: http://rise4fun.com/z3/tutorial
the most popular, but only python or SMT-LIB 2.0 (lisp).
for crypto https://srlabs.de/minisat-intro/ has some explanation how to break weak ciphers or hashes, knowing the weakness beforehand. but the various hackers posting on their blogs usually have better practical explanations.
ysnp · 2025-10-12
All mobile computing and connectivity hardware is unverifiable in reality and by design. It's not some property exclusive to Google Pixels.
Their business model also does not involve selling data afaik, it's selling access to their adspaces [1] all over the internet including the ability to target people (based on information Google jealously hoard). They stand to lose just as much as most other OEMs if they did suspicious things in hardware just like Apple, Samsung etc.
If you're serious about security you will avoid using OEMs that have unfortunate patch gaps which leave device owners at the mercy to *known vulnerabilities* [1][2][3][4] as well as unknown threats which is fortunately one of GrapheneOS's many reasonable device support requirements.
[1] https://blog.google/products/ads-commerce/more-effective-media-buying-…
[2] https://srlabs.de/blog/android-patch-gap
[3] https://srlabs.de/blog/android-patch-gap-2020
[4] https://www.android-device-security.org/talks/
[5] https://techcommunity.microsoft.com/blog/vulnerability-management/rese…
mshook · 2017-11-08
Fingerprinting has been done: https://cise.ufl.edu/~butler/pubs/sadfe11.pdf
And given you can easily reprogram thumb drives and such, it's easy to do evil stuff with them. You can plug a thumb drive with a reprogrammed firmware which will detect the OS based on IO patterns and then it can tell the OS it's also a keyboard and runs command for you.
https://srlabs.de/bites/usb-peripherals-turn/
https://srlabs.de/wp-content/uploads/2014/11/SRLabs-BadUSB-Pacsec-v2.p…
https://github.com/brandonlw/Psychson
https://www.computerworld.com/article/2690790/tools-for-creating-malic…
From the article: "During their Derbycon demonstration, which is available on YouTube, the two researchers replicated the emulated keyboard attack, but also showed how to create a hidden partition on thumb drives to defeat forensic tools and how to bypass the password for protected partitions on some USB drives that provide such a feature."