The Absurdity of “Cybersecurity Evaluations”

The communication from the leading AI labs, Anthropic and OpenAI, follows a disturbing pattern. Both frame these incidents as necessary “Cybersecurity Evaluations,” essentially as controlled experiments to measure model capabilities.

In Anthropic’s case, it was not a technical breakout from a sandbox via a software vulnerability, but a simple yet serious infrastructure misconfiguration: a misunderstanding with a test partner led to the test environment simply being connected to the public internet. This negligence allowed the Claude models to reach the internet and hack three different organizations. In one of these cases , the AI even attempted to upload a package to the public Python Package Index (PyPI), which was however prevented by PyPI’s automatic protection systems.

The fact that high-potency AI models can act unrestricted on the internet and compromise uninvolved companies cannot be understood as scientific progress, but rather as a failure of security architecture. For the affected companies, the origin of the attack is irrelevant; the fact that AI agents can now autonomously define targets and independently execute complex attack chains over several days is a new, existential threat level.

Machine vs. Human: The New Dynamics of Lateral Movement

A crucial point is the way these agents operate. While a human attacker often follows certain patterns and shows a noticeable time delay during lateral movement in the network, the AI operates at “machine speed.”

An AI agent analyzes vulnerabilities, tries exploits, and moves through the network with a speed and logic that often overwhelms traditional monitoring systems designed for human response times. This absence of human patterns makes detection significantly more difficult.

Regulatory Focus: Technical Errors Become Legal Risks

The incidents are now putting AI labs heavily in the focus of regulatory authorities, especially the AI Safety Institutes . With the entry into force of the EU AI Act, technical “breakouts” are turning into systemic legal risks. A model’s ability to autonomously overcome security barriers could in the future no longer be viewed as an experiment, but as gross negligence, leading to billion-dollar fines (up to 7% of global turnover) and extensive claims for damages.

Three Levers for an Agent-Resilient Infrastructure

Traditional perimeter thinking has long been obsolete. Anyone who believes that a firewall or a sandbox is sufficient is ignoring at least the lessons of the last few weeks. What is required is an architecture based not on isolation, but on continuous verification.

Zero Trust and Radical Micro-segmentation

The assumption that a once-authenticated process is trustworthy must be abandoned. Every request within the network is validated. For SMEs, this specifically means dividing the network into VLANs to prevent the unhindered lateral movement of an AI agent.

Deception Technology: Systematic Deception

AI agents act extremely logically and systematically. This characteristic can be used against them. The placement of honeytokens serves as a highly effective early warning system. Access to these tokens is a clear indicator of compromise long before conventional alarms go off.

AI-powered Detection and Managed Response

A human cannot react in real-time to the speed of an autonomous agent. The transition to AI-powered EDR and XDR systems is inevitable. SMEs can close this gap through Managed Detection and Response (MDR) services, where external experts monitor anomalies in real-time.

Strategic Resilience: Defense in Depth and Assume Breach

The incidents at OpenAI and Anthropic mark a turning point. In a world where AI models autonomously penetrate productive systems, it is no longer enough to just “close the door.” We therefore consistently pursue two strategic approaches:

• Assume Breach: We assume that the perimeter has already been breached. The goal is no longer just to prevent the break-in, but to detect the attacker as quickly as possible and maximally restrict their freedom of movement in the network.
• Defense in Depth: Security is understood as a multi-layered system. If one layer fails, other independent security mechanisms immediately take over to limit the damage.

In this context, the professional penetration test remains an indispensable instrument. It is the necessary foundation for making vulnerabilities visible in the first place and testing the effectiveness of security chains. But only the combination of regular penetration tests and an agent-resilient architecture creates true resilience.

Just a week ago, the autonomous breakout of an OpenAI model from its test environment seemed like an isolated, albeit alarming, warning signal. However, current reports from Anthropic have painted a far more worrying picture: we are not talking about an isolated incident, but a structural problem of today's AI architecture. What recently seemed like a laboratory experiment has long since become a reality in our networked infrastructures.

From Advisor to Actor

The decisive difference from previous attacks lies in the agentic capability of AI models. While AI previously primarily functioned as an intelligent advisor, AI agents can now act independently: they autonomously define goals, select tools, and independently execute complex attack chains over several days. The risk has thus shifted from mere manipulation of a response to the abusive exploitation of agency. An AI agent with access to APIs or databases no longer acts as an advisor, but as an actor. When this actor departs from their original objective or is manipulated by external impulses, attack vectors are created that simply bypass traditional security concepts.

A Paradigm Shift: From Zero Trust to Agentic AI Security

Zero Trust is the standard in IT security, but this approach reaches its limits with autonomous agents possessing legitimate identities. Instead of only verifying access, the intention must be validated and the AI's causal chain monitored in the future. Agentic AI Security starts precisely here and ensures that autonomous agents are not only authorized, but that their actions remain transparent, verified, and verifiable.

An Industry Solution Approach

To meet the dynamic threat landscape, leading technology companies have launched the Open Secure AI Alliance (OSAI). Their goal is to improve the security of AI systems through the use of open technologies. Since proprietary, closed security systems often cannot keep up with the speed of autonomous attacks, the alliance relies on the development and exchange of open tools and techniques. This is intended to ensure the necessary transparency as well as high adaptability and sovereign control.

The New Reality of Defense

The autonomy of AI agents requires a security model with concrete strategies for safeguarding. At the center are precise authorization concepts, Human-in-the-Loop procedures, and carefully designed test environments . Open-source tools can be used to implement these strategies, for example by validating the inputs and outputs of agents in real-time, detecting anomalies, or making the AI's so-called chains of thought transparent and traceable.

Only if we combine limited agency with human oversight and an open defense strategy can we utilize the productivity of AI without sacrificing sovereignty over our systems.

What Happened?

On July 16, 2026, Hugging Face released information regarding a security incident on parts of its production infrastructure, describing the uniqueness of the event:

This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own.

A few days later, OpenAI explained on its website that the cyberattack on Hugging Face was triggered by a test they conducted: the autonomously attacking AI consisted of two OpenAI models that were able to break out of the test environment during an evaluation and hack the production infrastructure of Hugging Face.

To quantitatively capture the capabilities of GPT-5.6 Sol and another, as yet unpublished model, both systems were tested as part of an internal evaluation on their ability to design complex attack paths for advanced exploits. According to OpenAI, these benchmarks normally run in highly isolated environments where network access is restricted to the installation of packages via internally hosted third-party software. However, to test the maximum capability of the models, important security mechanisms were deactivated.

Within the sandbox environment, the models consumed significant computational effort to find open internet access. In doing so, they identified and exploited a zero-day vulnerability in a software proxy. Consequently, the models executed attacks such as privilege escalation and lateral movement until they finally reached a gateway with internet access. With this access, the models attempted to retrieve test solutions for ExploitGym directly from Hugging Face's production database.

Hugging Face locates the entry point of the attack in a data processing pipeline. A malicious query, specifically prepared for this pipeline, was able to execute code on one of the servers. One of the models also combined several attack vectors, including stolen credentials and zero-day vulnerabilities, to find a path for remote code execution (RCE) on Hugging Face's servers.

Incident Response: Anomaly Detection and Forensic Analysis

The attack on Hugging Face was itself identified via AI-powered anomaly detection. A SIEM system, which detects suspicious patterns in telemetry data, evaluated around 17,000 suspicious events and was able to identify the actual attack through the analysis. Hugging Face was able to stop access to the infrastructure and lock out the attacker.

During the forensic investigations, an interesting irony emerged: Hugging Face could not use models from OpenAI or Anthropic for the analysis, as their integrated security policies blocked the evaluation of the attack data. Instead, they worked with GLM 5.2, a Chinese open-weight model.

A New Era of the Cyber Threat Landscape

The use of AI accelerates both the discovery and exploitation of vulnerabilities. The incident shows that powerful AI models can discover and exploit new and complex attack vectors in real systems. The further development of AI models must therefore be mandatory accompanied by improved protective measures.

What does this mean in practice?

As a foundation, infrastructures must be consistently set up according to principles such as Secure-by-Design and Zero Trust. The assumption that a sandbox environment is apparently secure enough has proven to be a dangerous misconception. Strict segmentation and minimal privileges are the most effective protective measures against adaptive and autonomous agents.

Furthermore, we are experiencing a renaissance of penetration testing . It is more important than ever to systematically check one's own systems for vulnerabilities. State-of-the-art penetration tests today combine experience and the latest technologies:

• AI-powered pentests use tools to test systems with the same speed and logic with which an AI would attack.
• Manual pentesting shows why human intuition is indispensable. Experienced security experts can question complex systems and find creative attack paths that an AI (still) misses.

The attack by OpenAI on Hugging Face shows how the boundaries between offensive and defensive AI use are blurring. Those who do not adapt their security strategy to the speed of generative AI leave the door wide open for autonomous attackers.

With the emergence of the first structures and security communities in the nineties, public platforms for discussing information security were created for the first time. Security researchers who had found a vulnerability reported it there to find recognition in the community. In the best case, the affected parties, whether manufacturers or organizations, were also present in these communities and thus had the opportunity to fix them.

By the beginning of the 2010s, information about vulnerabilities increasingly became a sought-after asset, not only for those affected but also for criminals, so-called threat actors. These exploited vulnerabilities to attack the affected parties, their customers, or both. This culminated in the emergence of ransomware : the victims' data is encrypted to then extort the key for a ransom.

All the more important is that security researchers who have discovered a vulnerability and want to report it receive information on how to reach the affected parties. It should be mentioned at this point that the vulnerability is already present at the time of discovery. The security researcher was only the (hopefully) first person to discover it.

Challenges when reporting a vulnerability

If someone has found a vulnerability in open-source software (Free and Open Source Software (FOSS)), reporting is usually easier. A large part of open-source software is hosted on public platforms such as GitHub and has documented communication channels such as mailing lists, forums or chat platforms. A vulnerability can be reported through this route, mostly even confidentially, and thus the remediation process can be initiated.

With proprietary and commercial software, the reporting path is not always so easy to find. While the giants of the industry such as Microsoft, Google and co. have well-documented reporting paths, the situation is different for smaller manufacturers. The challenge is even greater if it is not a classic piece of software, but a gap in a platform or an infrastructure system.

Consequences of a missing reporting path

If a security researcher cannot find a reporting path and gives up their effort, the actual problem persists and the information remains hidden. In the best case, no one else finds the vulnerability. In the worst case, someone with criminal energy exploits it – today even controlled by artificial intelligence (AI) – and extorts the affected parties or steals their data.

Alternatively, the security researcher can choose the path of full disclosure and publish all information about the vulnerability and possibly its exploitation directly on the internet or on social media. This puts the affected parties under pressure to fix the gap as quickly as possible to prevent it from being exploited by them or their customers. Further information on the different reporting paths and how aramido itself handles found vulnerabilities is described in our blog .

security.txt as a lifesaver

To simply counter the described consequences, a so-called security.txt can be stored. This is a small but effective method to give security researchers the crucial hint on reporting paths. As the name suggests, this is actually a simple text file. This is stored in a standardized path on the own website in the subdirectory /.well-known/, so finally under /.well-known/security.txt. aramido's security.txt is located here, for example: /.well-known/security.txt.

Example of a security.txt file

# If you would like to report a security issue
# you may report it to us via PGP or S/MIME
# encrypted mail or via our contact form
Contact: mailto:security@aramido.de
Contact: /en/kontakt
Contact: tel:+497214519910
Encryption: /pgp/aramido.security.asc
Encryption: openpgp4fpr:960EC6FEAAD4858CF54C5E942A492C40E17B729F
Encryption: /cert/aramido.security.pem
Preferred-Languages: de, en
Hiring: /en/jobs
Canonical: /.well-known/security.txt
Expires: 2027-03-25T00:00:00z

The most important element of the file is the specification of the contact options that a security researcher can use to report a vulnerability. In the simplest case, this can be an email address, but a web form or a telephone number are also possible. To ensure that the contact information is up to date, a validity date is given, usually one year after creation. In this interval, the file is checked and the date is set into the future again.

Formally, the security.txt is standardized by the RFC 9116 of the Internet Engineering Task Force. The information mentioned in the last section is mandatory; the following information can be added optionally:

• Information on how reports can be submitted encrypted
• Preferred language of the report
• Further links to guidelines for security reports, job portals and public acknowledgments

Should a security.txt always be published?

Yes. As soon as a domain is in use, i.e., the associated services are used – whether it is a website, email or something else – from an expert's point of view, we advise creating and publishing a security.txt. If no one reports anything, all the better. The opposite case is much worse for the reasons described above.

Program Overview

The diverse program combines exciting presentations and live hacks with a Capture the Flag competition as well as interactive stations that invite you to participate and tinker together.

This year's focus is on digital sovereignty. Since digital independence is a core value of aramido, we want to convey to all visitors what digital sovereignty means in practice and how easy the path to your own independence can be. A special focus is on artificial intelligence: we illustrate the associated dangers but also show how AI systems can be operated sovereignly.

A special highlight this year is the new Deepfake station. At this station, not only can you clone your own voice , but you can also create your own deepfake video – all within a few minutes. Additionally, interested visitors can manipulate AI systems to reveal secret information, even without extensive hacking experience.

In good weather, our roof terrace once again invites you to let the eventful day wind down above the rooftops of Karlsruhe.

Presentations

Those who want to protect effectively must know the attack techniques. In the presentations, the aramido team demonstrates with several live hacks that hacking is also part of the task field of an information security consultancy.

Activity Stations

Besides the presentations, various stations invite you to get informed and participate:

• Capture the Flag competition (CTF)
• Deepfake – Create your own deepfake video
• USB Condom soldering station
• Hacking gadget exhibition
• Next-Level Game (Hacking Challenge)
• AI Prompt Injection (Hacking Challenge)
• Fooling fingerprint sensors
• Crypto Box
• Tschunk Bar

Subject to change.

Presentation Details

Smartphone Hacking – From Manipulations by Attackers to Protective Measures

The history of smartphones is short. In 2007, Apple introduced the first iPhone with its own operating system iOS, and a year later, Android, today's dominant smartphone operating system, entered the market. And the history of the first smartphone hacks is just as old: from the first jailbreaks to celebrity nudes and commercially and state-sponsored spyware.

Using attack trees and live hacking demonstrations, the speakers show how smartphones are attacked. Understanding this is the basis for effective protective measures.

On this basis, a comparison from a data protection perspective of iOS and Android is made. Additionally, a possible alternative to these two operating systems is briefly presented.

» Back to program overview

Sovereign Handling of Vulnerability Reports – Or: Don't Ignore the Messenger

A security researcher reports a vulnerability to a provider.

Expectation: The person receives praise and recognition.

Reality: The person can be sued.

In 2025, over 45,000 vulnerabilities were discovered. A large part of them by independent security researchers. Therefore, it is all the more important that these people dare to report the vulnerabilities, as there are many pitfalls, especially legal ones.

In the presentation, the speakers present the hurdles of vulnerability reports and the processes of a secure handling of them. Various possibilities for securing security researchers and companies are shown.

» Back to program overview

Hacking on Ice – When you should better turn off your PC (Live Hack)

To protect data from unauthorized access, it is encrypted with tools such as Microsoft's BitLocker and Apple's FileVault encryption. For mobile devices in a business environment, this is often a compliance requirement. Only those who know the password can access the data. That this is a misconception, security researchers showed as early as 2008: if they had physical access to a computer that was switched on or "sleeping" (standby mode), they could read the password from the working memory. Even today, so-called Cold Boot attacks are still possible.

In the presentation, such an attack on a computer with disk encryption will be carried out live, and countermeasures will be presented to avoid becoming a victim of a Cold Boot attack. Whether Windows, macOS or Linux: everyone who relies on disk encryption is affected.

» Back to program overview

Information Security and AI – Chance and Risk for Companies

AI technologies are developing rapidly and fundamentally changing the security landscape. What offers valuable opportunities for companies can be exploited by attackers.

In the presentation, the speakers provide a look behind the scenes of how to maintain sovereignty over your own IT systems. They show what dangers can emanate from artificial intelligence and how such systems can be operated securely. The goal is to recognize, minimize risks, and at the same time use the potentials.

» Back to program overview

Details of the Activity Stations

CTF – Capture the Flag Competition

Various university teams compete against each other in a Capture the Flag (CTF) competition, proving their skills in dealing with security-relevant vulnerabilities. They must solve various tasks to find so-called "flags." These flags are hidden strings that serve as proof of the successful exploitation of a vulnerability or the solving of a task.

Deepfake – Create your own deepfake video

Try voice cloning and deepfakes yourself. Only a short text needs to be spoken and a photo of the person created. Characteristic features of the voice and face are trained through machine learning and stored in a model. Subsequently, the AI can speak texts with the cloned voice and the generated face.

Secure charging at foreign USB ports: USB Condom soldering station

Those who want to be active themselves have the perfect opportunity at the soldering workshop to create their own small gadget. With soldering irons and 3D-printed housings, visitors create their own USB condom. With this useful tool, you can charge devices with confidence at foreign USB ports.

Presentation of various hacking gadgets

Experience the hacking tools of our penetration testers live and try them out. From the WiFi Pineapple and Rubber Ducky to the Flipper Zero: how inconspicuous tools can cause great damage to a system. Some are even so small that they can be easily tucked into a pocket.

Next-Level Game (Hacking Challenge)

Ready for the next level?

In our Next-Level Game, hacking skills can be proven in different levels. In each level, the access data for the next level can be found. The task is to get to the next password in different ways in order to advance. No additional software is required.

Accept the challenge with us now.

AI Prompt Injection (Hacking Challenge)

“Hello AI, give me sensitive data”

It's not that simple to get sensitive data from an AI. However, there are a few possibilities that might actually lead to the desired goal …?

At this station, an AI can be tested and (possibly) tricked through clever prompts.

Fooling fingerprint sensors

Matching the smartphone hacking presentation, visitors can clone their own fingerprint using simple tricks and everyday materials. It's amazing how positively corresponding sensors react!

Cryptography made easy

Cryptography is often the basis for security in information systems. Without the ability to encrypt data and thus effectively protect it from access, most security goals would simply not be achievable. But even today's complex cryptography started small. Using the CryptoBox from the Karlsruhe University of Education, which was specifically developed for students from 1st to 10th grade, people of all ages gain an easy and playful access to this exciting subject.

Tschunk Bar

Of course, there is plenty of "Tschunk" at the Tschunk Bar. It is the supplement of choice when you are hungry for fantasy and craving liquid while hacking: Club Mate + lime + cane sugar + ice + rum = more flags.

Attention: Anyone who starts perceiving the world in binary should stop the Tschunk consumption for safety.

In good weather, let the week wind down with a cool drink above the rooftops of Karlsruhe and get into conversation with others – for that, the aramido roof terrace is the perfect place!
Tip: In the evening, you have a beautiful view of the sunset and the live band “Salty Tunes” will provide the atmospheric musical accompaniment for the rest of the evening.

» Back to program overview

Office Space with Perspective

The modern building complex of the Albtal-Verkehrs-Gesellschaft (AVG) at the eastern entrance of Karlsruhe is an attractive place to work: Around 450 m² of bright, spacious office areas are now available for sub-lease. The space on the 6th floor features a separate entrance, a modern heating and cooling ceiling system with individually controllable room climates for each workstation, as well as an impressive view of the Black Forest.

Excellent Location and Equipment

The location could hardly be better: The Tullastraße/Alter Schlachthof stop is right outside the door, the A5 motorway is reachable in a few minutes, and the Creative Park Alter Schlachthof—a vibrant center for innovation and exchange—is located opposite. Numerous restaurants, canteens, and shopping facilities are within walking distance.

The separate rental area for subtenants includes bright office rooms, its own coffee kitchen, sanitary facilities, and a storage room. Professional cleaning of the area is already included.

With these premises, aramido wants to give other companies the chance to grow in a modern environment.

Overview

• Address: Durlacher Allee 73, 76131 Karlsruhe
• Space: approx. 450 m² bright, spacious office rooms
• Climate control: modern heating and cooling ceiling system, individually adjustable room climate per workstation
• View: 6th floor, panoramic view of Karlsruhe and the Black Forest
• Transport links: very good public transport connections (Tullastraße/Alter Schlachthof stop right outside the door), A5 motorway reachable in a few minutes, parking spaces and charging station
• Surroundings: numerous restaurants, cafes, canteens, shopping facilities, and "Alter Schlachthof" Creative Park within walking distance
• Service: professional office cleaning included
• Availability: immediately

Social Engineering is at least as old as the fairy tales of the Brothers Grimm. In the story "The Wolf and the Seven Young Goats", the wolf uses various tricks to pose as the goats' mother. In the end, he manages to outsmart the goats, and they open the door for him, which has devastating consequences. This fairy tale teaches that one should not trust seemingly familiar characteristics such as appearance and voice unconditionally.

AI: The Wolf in Sheep's Clothing

AI can make work easier in many areas, but it also carries risks: on the one hand, one should never trust an AI unconditionally, as it is trained on large amounts of data from a wide variety of sources to recognize patterns and make decisions. If these data are incomplete, biased, inaccurate or faulty, the AI can draw wrong conclusions. One then receives inaccurate or incorrect answers that may sound plausible. On the other hand, new technologies enable more sophisticated attacks. Especially in the area of social engineering, attackers can now proceed more easily, faster and more specifically to deceive us, just like the Big Bad Wolf in the fairy tale. In the future, it will be more difficult to recognize phishing attacks. In the aforementioned fairy tale, the wolf pretends to be a known figure with clever tricks to win the trust of his victims. Today we speak of "Deepfakes" such as voice cloning as well as image and video manipulation. Just like the goats in the fairy tale, we should be careful about whom we trust and to whom we open the door!

We gave a presentation on this topic at the Night of Digitalization . Below you will find the video of the presentation as a shortened version.

How Artificial Intelligence Works

Put simply, an AI is based on statistical methods, probabilities and pattern recognition. Through training with large amounts of data, it learns which patterns occur in the data and how language is used. An AI language model is trained with extensive text data that encompasses a large part of documented human knowledge. This allows it to make predictions about which words are meaningful in a particular context. The difference between a chicken and a cow is recognized by the AI because it has processed numerous descriptions of both animals in the training data.

The text generated by an AI is new every time and can vary. The results are not deterministic, which means that an AI can give different answers to the same question – in contrast to a classic computer program that works with fixed instructions such as "if", "then" and "else".

New Attack Methods in Phishing and Vishing

Phishing is a popular social engineering method and can take place over various channels such as SMS, email and various messengers. With special AIs, personalized phishing attacks can be carried out automatically. These AIs, for example, scan the websites of the companies to be attacked and automatically create phishing messages using the collected information and send them to selected recipients.

In addition to written phishing attacks, there are also attacks by telephone, so-called vishing. Attackers, for example, pose as employees of a large software company in order to obtain sensitive information from their victims. Traditionally, this method required high personnel costs with a call center character. By combining text-generative and text-to-speech AI, many victims can be reached simultaneously with minimal effort.
Through adapted voice cloning and targeted vishing, methods such as the well-known "grandchild trick" become even more dangerous. The nature of the attacks is not new. However, they become much more successful through the use of voice cloning.

AI Technology for Voice Cloning

In connection with voice cloning, a speech AI model can be trained to mimic the voice of a specific person by using voice samples and learning how they speak. There are already open-source AIs with user-friendly interfaces that can be used by many people without extensive prior knowledge. Thus, attacks in this area can increase.

There are two main types of AI for voice cloning:

• Text-to-Speech (TTS)
  In this method, the text that the cloned voice should read is specified. TTS technology simply reads a certain text aloud and thus generates an artificial speech output.
• Inference
  In this method, the trained model does not read a text file, but manipulates the voice characteristics in an existing audio recording. With real-time models, texts can be output directly while speaking with the cloned voice.

How Attackers Get Voice Samples

There are various ways in which attackers can obtain voice samples. The two most likely scenarios are social engineering and publicly available voice recordings:

• Social Engineering
  Attackers can engage their target person in a conversation and record them secretly. In this way, they obtain voice samples that they can later use for cloning the voice.
• Publicly Available Voice Recordings
  Public recordings of speeches or social media profiles with video content on the internet can serve as a source for voice samples. This can be particularly risky for people who are in the public eye or are active on social media.

Legitimate Use Cases for Voice Cloning

In addition to the misuse of voice cloning for criminal purposes, there are also some areas in which it can be used sensibly and legally. For example here:

• Education and Learning
  Through the cloning of speech, multilingual training materials can be created more easily. This could enable the availability of teaching materials in different languages and better prepare students with different backgrounds for learning.
• Accessibility
  Voice cloning can help people who are no longer able to use their voice due to physical impairments or accidents. With the help of a trained text-to-speech model, they can continue to communicate and speak with their own voice.
• Entertainment
  Voice cloning can be used to recreate the speaking roles of actors in films or video games.
• Historical Presentation
  Voice cloning can bring historical figures and events to life. By cloning known voices, people could better understand these figures and their life stories, as the presentation appears more authentic.

Social Engineering – Motives and Techniques

Attackers specifically exploit the psychological weaknesses of people and use various methods to achieve their goals. Their motives include financial enrichment through extortion or fraud, political and social manipulation to generate unrest in the population, identity or data theft, damage to reputation or disinformation.

Through cleverly devised tricks, attackers use one or more tactics. These are often based on the principles of persuasion psychology, as described by the well-known US psychologist Robert B. Cialdini in his book "Influence: The Psychology of Persuasion" (1984):

• Time Pressure
  
• Authority
  
• Reciprocity
  
• Social Proof
  
• Commitment and Consistency
  
• Liking
  

In 2016, Cialdini added another technique to the six: The principle of unity and shared identities.

Fraud has always worked by exploiting the human psyche. Over the years, however, the requirements have changed. Attackers constantly adapt their methods to be as successful as possible. With AIs, they have received a practical toolbox that makes it even easier for them to carry out attacks.

Detecting Fraud and Protecting Yourself

To protect yourself from fraud attempts, it is important to be vigilant and skeptical of unusual incidents. We have listed some strategies here on how you can protect yourself from social engineering:

• Ensuring Identity
  • Be skeptical if unusual communication channels were chosen.
  • Critically question unusual requests, even if they come from supposedly known persons.
  • In case of doubt, choose a known and secure communication channel for query or verification.
• Only disclose the most necessary personal information on the internet.
  • If possible, ensure that your voice is not freely available on the internet.
  • Avoid passing on confidential information via insecure channels.
  • Define and use secure communication channels, for example for banking transactions or other sensitive matters.
• Critical Consideration of Media Content
  • Do not blindly trust images, videos and audio recordings from unverified sources. Content in social media in particular can be manipulated or faked.
  • Check the source and look for further confirmations if something seems suspicious.
• Regularly inform yourself about new fraud tricks and techniques.
  • Stay vigilant and look for signs of phishing, vishing or social engineering attacks.

The number of cyberattacks has continued to rise in recent years, driven in no small part by the ever-growing dependence on digital systems and global tensions.

The EU has responded to this threat landscape with a new Cybersecurity Strategy: in addition to strengthening European cooperation and promoting skilled professionals, joint cyber defense facilities are to be established. The strategy's goals are also to be achieved through a series of new EU directives and regulations, including the NIS 2 Directive.

As early as 2016, the EU adopted an initial directive on the security of network and information systems (NIS). In Germany, this is limited to approximately 2,000 companies from specifically defined sectors. However, attacks are now causing significant economic damage in other sectors as well. Therefore, the EU has significantly expanded the circle of affected companies for the second NIS directive. Estimates suggest that in Germany alone, up to 30,000 companies will be affected by NIS 2.

How is NIS 2 being implemented in Germany?

Unlike, for example, the GDPR, NIS 2 is an EU directive and is not directly binding. Therefore, individual EU member states must enact national laws to implement the directive.

In Germany, there is a draft of the NIS 2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG). The draft has been approved by the cabinet but still needs to be passed by the Bundestag. However, no major changes are expected.

Additionally, the EU has reserved the option to issue implementing regulations. A draft for an initial regulation is currently under consultation. This provides specifications for the assessment of security incidents and the implementation of measures for companies that provide certain IT services, such as social network providers or managed service providers.

According to the current status, both documents are to be fully adopted by October 17, 2024.

Who is affected by NIS 2?

Whether a company is affected depends on a number of criteria. These include, among others, the industry, the size and location of the company, and whether business is conducted within the EU. More detailed information on who is affected by NIS 2 can be found in the second part of our article series .

What can affected entities expect?

The EU is also relying on technology neutrality with NIS 2. The directive specifies what must be implemented but has few requirements on how this should be done. You can find out which specific measures are required in the third part of our article series .

When must affected entities take action?

Immediately upon the expected entry into force of the NIS 2 Directive on October 17, 2024, entities must meet the requirements for risk management measures and reporting obligations. To initiate the necessary measures in a timely manner, it is recommended to take action now.

All companies affected at the time of entry into force must register with the BSI by January 17, 2025, at the latest. For companies that become affected later, for example because the number of employees was only then exceeded, a deadline of three months applies.

What happens next?

To achieve the goal of significantly increasing the level of information security in companies across the EU, the EU relies on the cooperation of these companies. To reach these objectives, NIS 2 provides for a number of obligations, the non-compliance with which can be severely penalized.

Information to determine whether a company is affected and which measures must be taken can be found in the following blog posts. The aramido consultants are also available to answer any questions.

The number of affected companies is increasing significantly with NIS 2. Estimates for Germany suggest 30,000 affected companies (for comparison: the first NIS Directive affected approximately 2,000 companies).

There is no official notification as to whether a specific company is affected. Therefore, it is up to the companies themselves to determine their status. A number of criteria are relevant for this.

What does affected status depend on?

First, there are two thresholds:

• Small or micro-enterprises are only affected in exceptional cases.
• Small or micro-enterprises have fewer than 50 employees and an annual turnover or annual balance sheet total of less than 10 million euros.
• For medium-sized enterprises, the requirements are generally less stringent than for those exceeding these values.
• Medium-sized enterprises have fewer than 250 employees.
• The profit is less than 50 million euros or the balance sheet total is smaller than 43 million euros.

Especially important entities

The EU regulation speaks of essential entities, while the German implementation refers to especially important entities – both mean the same thing.

Entities that exceed the thresholds for medium-sized enterprises and belong to an entity type listed in Annex 1 of the NIS2UmsuCG are considered especially important. This includes entity types from the following sectors:

• Energy
• Transport and Traffic
• Finance
• Health
• Water
• Digital Infrastructure
• Space

Not all companies operating in one of these sectors are affected; it depends on the precise definition of the entity type.

Especially important are also operators of critical infrastructures (KRITIS), qualified trust service providers, top-level domain name registries or DNS service providers, as well as medium-sized telecommunications providers.

Important entities

Important entities are medium or large companies that fall under one of the entity types in Annex I or II of the NIS2UmsuCG. This adds the following sectors to those mentioned above:

• Waste Management
• Food and Chemical Industries
• Manufacturers of Medical Devices or certain Electrical Equipment
• Mechanical Engineers and Vehicle Manufacturers
• Digital Service Providers
• Research Institutions

As with especially important entities, the precise definition of the entity types is decisive here as well.

Additionally, trust service providers and all telecommunications providers that are not especially important are considered important.

Those affected by the implementing regulation

With the first implementing regulation, the EU aims for the direct regulation of companies that offer inherently cross-border services. Currently, this includes providers of the following services:

• DNS service providers and TLD name registries
• Cloud Computing, Data Centers, and Content Delivery Networks
• Managed (Security) Services
• Online Marketplaces, Online Search Engines, and Social Networks

How do I find out if my company is affected?

An initial indication can be found, for example, in the NIS 2 impact assessment of the BSI. For a more detailed examination, the consultants at aramido GmbH are at your disposal. A final legal review can also be helpful.

More on the topic of NIS 2

What is NIS 2?

To advance information security in entities, the EU sets a whole range of requirements with the NIS 2 Directive. As a first step, responsibilities within the company should be established. NIS 2 makes it clear that information security is a matter for executive management and defines explicit requirements for the management of affected entities.

Obligations of Executive Management

Executive management must implement and monitor certain risk measures . Consequently, executive management must be trained in handling information security risks at least every three years. The training must provide the ability to identify and assess risks and their impact and to take appropriate measures.

If they culpably breach their duties, executive management can now even be held personally liable for damages incurred.

Some implementation duties can be delegated. However, the duty to monitor and the training required to monitor effectively always remain with the executive management.

Reporting Obligation

When significant security incidents occur, companies must make a series of reports to the BSI. In certain cases, the BSI may also order that customers or the public be informed about the incidents.

The BSI will further define exactly how a report must be carried out. However, a design similar to the existing reporting obligation for operators of critical infrastructure is likely.

A security incident is considered significant if it leads to, or could lead to, severe operational disruptions, financial losses, or significant damage to third parties. Most entities must define for themselves how this assessment is carried out in detail.

For all entities falling under the first implementing regulation, there are concrete specifications on how significant security incidents must be assessed.

Registration with the BSI

Affected entities are obliged to register with the BSI. In addition to general company and contact data, information on the industry and the EU countries in which the company operates must be submitted. Changes to this information must be reported to the BSI within two weeks.

Implementing Risk Management Measures

A central part of the NIS 2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) is the obligation to implement risk management measures:

"[...] Entities are obliged to take appropriate, proportionate, and effective technical and organizational measures to avoid disruptions in availability, integrity, authenticity, and confidentiality [...] and to keep the impact of security incidents as low as possible."

NIS 2 then describes a series of concrete measures:

• Fundamental risk and information security concepts
• Handling of security incidents
• Business Continuity Management (BCM)
• Supply chain security and system development
• Security awareness training
• Cryptography concepts
• Personnel security and physical security
• Assessment of the effectiveness of risk management

However, these are merely minimum requirements – depending on the company's risk situation, further measures may be necessary to fulfill the requirement.

When must affected entities take action?

Immediately upon the expected entry into force of the NIS 2 Directive on October 17, 2024, entities must meet the requirements for risk management measures and reporting obligations. To initiate necessary measures in a timely manner, it is therefore essential to take action now.

For all those affected at the time of entry into force, the registration of the organization with the BSI must have been completed by January 17, 2025, at the latest. For entities that become affected later, for example because the number of employees was only then exceeded, a deadline of three months applies.

What should affected entities do now?

Given the little time remaining before measures must be implemented, affected parties should act swiftly.

1. Determine affected status

Read about how affected status can be determined in the second part of the NIS 2 article series .

2. Gap Analysis

It must be determined in which areas gaps exist in fulfilling the NIS 2 requirements.

3. Define Measures

Appropriate measures must be defined for all gaps.

4. Implement Measures

Registration must be prepared, a reporting process set up, and risk management established.

The aramido consultants can support you in all these steps.

To protect the company sustainably in the face of a constantly changing threat landscape, information security must be understood as a process. New risks must be identified and addressed repeatedly – not only to fulfill legal requirements, but above all, to protect the company from significant damage.

More on the topic of NIS 2

What is NIS 2?

There are many different types of steganography:

• Double bottoms in packages or envelopes were used as secret hiding places.
• Messages were written with lemon juice as secret ink.
• Information was transformed into ciphertext through ciphers.
• Hidden messages in texts and images were sent as semagrams.

The only limit to steganography is creativity in transmitting information as securely as possible. Depending on the purpose, effort, and security level, different methods can be used and even combined.

Semagram and Coding

A well-known example of a semagram is the image of the San Antonio River from the book The Codebreakers – The Story of Secret Writing by David Kahn. In this case, secret messages were hidden in the image. The inconspicuous blades of grass on the bank are Morse code. A short and a long blade of grass in a tuft represent an "A" in this case. In this way, entire maps and other tactical information could be transmitted in the past.

The Morse Alphabet

Camouflage and Encryption Today

The need for secure data transmission has always existed – whether to communicate tactical decisions or agree on secret meeting points. Steganography is still used today, for example by criminals who hide malware in images.

However, those who wish to transmit confidential information are better off relying on recognized, secure methods today . Depending on the use case, symmetric or asymmetric encryption methods are used, for example AES, RSA or ECC. These methods secure internet communication, encrypted email traffic and also SIP telephone connections.

Program Overview

A colorful program is offered: from exciting live hacking presentations and a Capture the Flag competition to an exhibition of hacking tools, the aramido team showcases a wide range of valuable content.

Various interactive stations invite you to participate and tinker together. For the first time, it will be possible to clone your own voice at the Voice Cloning station.

In good weather, our roof terrace once again offers the opportunity to let the eventful day wind down – with a cool drink in hand and a view of the sunset over the rooftops of Karlsruhe.

Presentations

Those who want to protect effectively must know how attacks are carried out. In the presentations, the aramido team uses several live hacks to show that hacking is also part of the duties of an information security consultant.

Activity Stations

Besides the presentations, various stations invite you to get informed and participate:

• Capture the Flag competition (CTF)
• Voice Cloning – Clone your own voice
• USB Condom soldering station
• Hacking gadget exhibition
• Fingerprint dummy
• Crypto Box
• Tschunk Bar

Subject to change.

Presentation Details

Smartphone Hacking – A brief history of vulnerable cyborgs

The history of smartphones is short. In 2007, Apple introduced the first iPhone with its own iOS operating system, and a year later, Android, today's dominant smartphone operating system, entered the market. And the history of the first smartphone hacks is just as old: from the first jailbreaks to celebrity nudes and commercially and state-sponsored spyware.

Using attack trees and live hacking demonstrations, the speakers show how smartphones are attacked. Understanding this is the basis for effective protective measures.

» Back to program overview

Capture the Flag (CTF) – What the CTF competition is all about

Capture the Flag (CTF) is a popular competition in the field of IT security, where participants prove their skills in dealing with vulnerabilities and other puzzles. These competitions are a kind of game in which teams or individuals must solve various security tasks to find so-called flags.

In the presentation, the speakers explain what a CTF is, what types of tasks exist, how to start with CTF games, and what skills and knowledge are required.

» Back to program overview

Voice Cloning – The art of digital voice replication

Voice Cloning is a fascinating technology that makes it possible to clone human voices using artificial intelligence (AI). Characteristic features of a voice, such as tone, pauses, and accents, are trained through machine learning and stored in a model. Subsequently, the AI can read texts or change spoken recordings with the cloned voice.

In the presentation, the speakers show live how easily and quickly a voice can be cloned, where the current limits are, and how to best protect yourself from the dangers of "deep fakes."

» Back to program overview

Hacking on Ice – When you should better turn off your PC (Live Hack)

To protect data from unauthorized access, it is encrypted with tools such as Microsoft's BitLocker and Apple's FileVault. For mobile devices in a business environment, this is often a compliance requirement. Only those who know the password can access the data. That this is a misconception, security researchers showed as early as 2008: if they had physical access to a computer that was switched on or "sleeping" (standby mode), they could read the password from the working memory. Even today, so-called Cold Boot attacks are still possible.

In the presentation, such an attack on a computer with disk encryption will be carried out live, and countermeasures will be presented to avoid becoming a victim of a Cold Boot attack. Whether Windows, macOS, or Linux: everyone who relies on disk encryption is affected.

» Back to program overview

Details of the Activity Stations

CTF – Capture the Flag Competition

Various university teams compete against each other in a Capture the Flag (CTF) competition, proving their skills in dealing with security-relevant vulnerabilities. They must solve various tasks to find so-called "flags." These flags are hidden strings that serve as proof of the successful exploitation of a vulnerability or the solving of a task.
The award ceremony takes place during the CTF presentation (5:15 PM – 5:45 PM).

Voice Cloning – Clone your own voice

Try voice cloning yourself! Only a short text needs to be spoken. Characteristic features of the voice are trained through machine learning and stored in a model. Subsequently, the AI can read texts with the cloned voice.

USB Condom soldering station

Those who want to be active themselves have the perfect opportunity at the soldering workshop to create their own small gadget. Using soldering irons and 3D-printed housings, visitors create their own USB condom. With this useful tool, you can charge devices with confidence at foreign USB ports.

Presentation of Hacking Gadgets

Get an overview of the tools used by penetration testers at aramido's hacking tool exhibition. From the WiFi Pineapple and Rubber Ducky to the Flipper Zero, you can learn how seemingly inconspicuous tools can cause significant damage.

Fingerprint Dummy

Matching the smartphone hacking presentation, visitors can clone their own fingerprint using simple tricks and everyday materials. It's amazing how positively corresponding sensors react!

Cryptography made easy

Cryptography is often the basis for security in information systems. Without the ability to encrypt data and thus effectively protect it from access, most security goals would simply be unattainable. But even today's complex cryptography started small. Using the CryptoBox from the Karlsruhe University of Education, specifically developed for students from 1st to 10th grade, people of all ages can gain easy and playful access to this fascinating subject.

Tschunk Bar

Of course, there is plenty of "Tschunk" at the Tschunk Bar. It is the supplement of choice when you are hungry for fantasy and craving liquid while hacking: Club Mate + lime + cane sugar + ice + rum = more flags.

Attention: Anyone who starts perceiving the world in binary should stop the Tschunk consumption for safety.

In good weather, let the week wind down with a cool drink above the rooftops of Karlsruhe and get into conversation with others – the aramido roof terrace is the perfect place for that!
Tip: In the evening, you have a beautiful view of the sunset.

» Back to program overview

Hackathon at aramido: StudentHACK2024

aramido has been dealing with such questions about AI for some time. That is why this topic is also the reason for StudentHACK 2024 with studentec e.V., a university group of the Karlsruhe Institute of Technology (KIT). Together, a two-day interdisciplinary hackathon was organized, bringing students together to develop innovative solutions for complex problems.

The Impact of AI on Social Engineering

The success of social engineering ultimately depends on the ability to convince people. Many tactics help increase the chances of tricking people, such as creating urgency or exploiting cognitive biases. One of the most effective methods of persuasion, for example, is to adopt the tone and conversation style that the recipient is accustomed to from the sender.

Thanks to impressive progress in natural language processing, AI systems can now analyze very large amounts of data to understand personal preferences, behavioral patterns, tone, colloquialisms, and demographic data. With the help of AI, attackers can draft personalized and extremely convincing messages, which can increase the success rates of social engineering attacks. The further development of AI technologies means that they are also becoming better at creating content that can bypass defense measures such as spam filters. The most striking improvement in AI recently has been generative algorithms. These algorithms are capable of producing human-like texts that are often barely distinguishable from real human texts. By imitating human writing patterns, AI can create messages that are more likely to reach the intended recipient and be classified as non-suspicious.

The Challenge for Defense

Fortunately, there is also a flip side: the same developments in AI can also improve the ability to detect social engineering. Machine learning algorithms can extract features typical of a social engineering attack by analyzing large amounts of text. Companies and organizations are therefore investing in AI-powered solutions that can both detect attacks and take preventive measures.

In the future, aramido will continue to deal with this dangerous alliance of AI and social engineering and incorporate the innovative ideas and results of the hackathon. Raising awareness of the risks and investing in advanced technologies are crucial for ensuring digital security.

All students can expect intense collaboration in teams to develop groundbreaking solutions, and the opportunity for networking with talented students and industry experts. Excellent catering with Mate, snacks, and full meals, in true aramido style, will be provided.

Looking Over the Shoulders of Hackers

Hackers often target the Microsoft AD. To attack an Active Directory, several weaknesses in the IT infrastructure are exploited. aramido shows what such an attack looks like in a special broadcast on hacker attacks . Watch hackers over their shoulders as they take full control of a Windows domain.

In the special broadcast on hacker attacks, it is shown how an employee of a company is phished. Hackers succeed in gaining access to the corporate network, where they can take over a server through a dictionary attack. They listen in on the network and can take over the account of a local administrator through LLMNR poisoning. Through the incorrect use of a domain administrator user, their password can be intercepted. Insufficient network segmentation can no longer prevent the complete takeover of the Active Directory. It turns out that the special broadcast on hacker attacks is a demonstration of a Red Teaming Assessment that was carried out by aramido as a security audit on behalf of a company.

10-Point Plan for Securing Windows Domains

To keep important systems of an IT infrastructure safe from hackers, a good security concept , capable security experts and regular security audits are needed. In addition to individual measures that meet the requirements of a company, we recommend the following 10-point plan for securing an Active Directory (AD):

1. Implement strong authentication
   • Use multi-factor authentication (MFA) at least for all domain users and administrators.
   • Use smartcards, hardware tokens or biometric authentication methods.
2. Harden security settings
   • Configure Group Policy Objects (GPOs) to enforce security policies.
   • Enable selective authentication for specific users and groups.
   • Implement Network Access Control (NAC) solutions to control device access.
3. Protect passwords
   • Use a password manager to create and store complex passwords.
   • Implement password policies that prescribe a minimum length, uniqueness, and high complexity.
4. Control user access
   • Implement role-based access control (RBAC) to restrict user permissions based on their roles.
   • Use group policies to control user permissions and access rights.
5. Monitor network traffic
   • Use Network Security Monitoring (NSM) tools to detect suspicious activities.
   • Monitor for unauthorized access, data breaches, and malicious software.
6. Audit events
   • Enable monitoring of important events such as login attempts, changes to user accounts, and security policy violations.
   • Regularly review audit logs to identify suspicious activities.
7. Apply updates
   • Keep operating systems, applications, and drivers up to date with security patches.
   • Implement a patch management process to ensure timely installation.
8. Deploy anti-malware programs
   • Install and maintain antivirus and anti-malware software on all devices connected to the domain.
   • Regularly scan for malware and viruses.
9. Train users
   • Inform users about security risks and best practices, such as the use of secure passwords and the avoidance of phishing scams .
   • Conduct regular security awareness training.
10. Perform security audits
    • Conduct regular security audits, for example through Red Teaming Assessments or penetration tests , to identify vulnerabilities and weak points.
    • Implement plans for remediating security issues so that they are eliminated as quickly as possible.

What information can an attacker collect about your company through Open Source Intelligence (OSINT) and use for an attack? Are your employees sufficiently trained to recognize a well-crafted phishing email as malicious? How can a dictionary be used for a hacker attack? During the presentation, we won’t shy away from using “Bloodhounds” and “poisoning network traffic.”

Experience firsthand how important, for example, the correct configuration of servers, the use of secure passwords, or the principle of least privilege is. In some cases, even multi-factor authentication cannot protect against a hostile takeover!

The demonstration ends with the success of the hackers, who are able to take over the infrastructure completely. While real attackers would proceed, for example, by encrypting systems to then demand a ransom, the presenting hackers will be available for questions and discussion after their work is done.

The evening will conclude with snacks and drinks.