| Homepage | https://www.x41-dsec.de |
| Github | https://github.com/x41sec |
| https://de.linkedin.com/company/x41 |
After auditing the @mullvadnet client applications in 2024, we have recently audited Mullvad VPN's API.
The API is used by clients, partners, and internal services to manage user accounts and parts of the VPN infrastructure.
Five issues were identified, of which only one had a very limited impact on users of the service.
The technical details may be found in our report. https://www.x41-dsec.de/security/research/news/2026/01/20/mullvad/
https://x41-dsec.de/security/training/tableopt/exercise/2025/03/12/tabletop-exercises/
What are Tabletop Exercises (TTX) and why they matter to companies.
X41 performed an audit of Hickory DNS which is an open source Rust based DNS client, server, and resolver. We were sponsored by the great folks at @ostifofficial and supported by @ProssimoISRG
Our full report can be downloaded here: https://x41-dsec.de/security/research/job/news/2025/03/10/hickory-review-2025/
X41 Reviewed Mullvad VPN
https://x41-dsec.de/news/2024/12/11/mullvad/
Many thanks to the @mullvadnet team for the professional and good interaction during this audit!
Advisory X41-2024-001: Weak Chilkat PRNG
https://x41-dsec.de/lab/advisories/x41-2024-001-chilkat-prng/
The Chilkat library generated secret key material using a pseudorandom number generator not designed for cryptographic purposes. Attackers observing a sufficient number of outputs can recover past and future outputs of it. This includes, for example, key material generated with it, allowing attackers to decrypt or alter data protected by the key material.
