Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.deCure53 Security Assessment of the NEW WORK SEIdenteco Integration, Management Summary 12.2022
Cure53, Dr.-Ing. M. Heiderich, Dr. A. Pirker, MSc. H. Moesl, P. Einkemmer

Cure53, which is a Berlin-based IT security consultancy, completed a security assessment ofthe NEW WORK SE Identeco Integration, with a specific focus on how it is implemented within
the broader NEW WORK SE infrastructure. The core aim of this July 2022 project was tothoroughly examine the security condition of the Identeco API services regarding theirimplementations, source code, cryptography and broader cryptographic design.
To be able to issue a reliable verdict about the components in scope, the Cure53 team carriedout a a penetration test, code audit and security examination. In addition, in the final phase of
the project, the testing team verified fixes that the Identeco team crafted in response to the few
identified shortcomings and resulting recommendations proposed by Cure53.
As for the precise timeline and specific resources, Cure53 completed the examination in lateJune and early July of 2022, namely in CWs 26 and 27. A total of twelve days were invested toreach the coverage expected for this assignment, whereas a team of four senior testers has
been composed and tasked with this project’s preparation, execution and finalization.
For optimal structuring and tracking of tasks, the work was split into three separate work
packages (WPs):•••

WP1: Implementation of the Identeco software within the NEW WORK SE infra (Elixir)
WP2: Implementation and source code of the Identeco API service (Rust)
WP3: Review and audit of the utilized cryptography and cryptographic designs

Following the established best practices of the Cure53 - NEW WORK SE cooperation, thisproject has benefited from a white-box methodological approach. Cure53 was provided withURLs, sources, documentation, VPN access, as well as all other means of access andinformation required to complete the tests.
The project progressed effectively on the whole. All preparations were done in June 2022
(CW25) to foster a smooth transition into the testing phase. Over the course of the engagement,
the communications were done using a private, dedicated and shared Slack channel, as it isagain the standard procedure in tests conducted by Cure53 for the NEW WORK SE entities.
The channel could be joined and used by all personnel involved in NW-23.

Cure53, Berlin · 06/22/23

1/3

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de

The discussions throughout the test were very good and productive and not many questions
had to be asked. Ongoing interactions positively contributed to the overall outcomes of thisproject. Ultimately, the scope was well-prepared and clear as usual, greatly contributing to thefact that no noteworthy roadblocks were encountered during the test.
Cure53 offered frequent status updates about the test and the emerging findings. Live-reportingwas neither requested by NEW WORK SE, nor seen as necessary in light of the mostly
manageable severities ascribed to the spotted findings.
As for the findings, the Cure53 team managed to get very good coverage over the WP1-WP3
scope items. Among eight security-relevant discoveries, one was classified to be security
vulnerabilities and the remaining seven should be viewed as general weaknesses with lowerexploitation potential. Thus, it can be argued that this breakdown of issues suggests a positive
outcome of the assessment.

Finding ID

Work Package

StatusComment

NW-23-001

WP3 (Crypto)

Fixed

The fix was verified by Cure53

NW-23-002

WP3 (Crypto)

False Alert

NW-23-003

WP3 (Crypto)

False Alert

NW-23-004

WP2 (Identeco API)

Fixed

NW-23-005

WP1 (NEW WORK SE Infra) N/A

NW-23-006

WP1 (NEW WORK SE Infra) N/A

NW-23-007

WP1 (NEW WORK SE Infra) N/A

NW-23-008

WP2 (Identeco API)

The fix was verified by Cure53

Addressed The solution was verified by Cure53

Table.: Fix status as of December 2022
As noted, most of the relevant findings have now been tackled by Identeco and were verified as
fixed by Cure53 in the weeks following the project.

Cure53, Berlin · 06/22/23

2/3

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de

In conclusion, drawing on the evidence gathered during testing and subsequent fix verification,
one can clearly argue that the outcomes highlight the Identeco development team’s commitmentto maintaining security features with due diligence and adherence to best practices.
This Cure53 project shows that the overall security strength that the NEW WORK SE Identeco
Integration delivers, after fix verification having concluded, good impressions, particularly withregard to its cryptographic design, possible information leaks and injection attacks, malicious
users and external data access from sources outside of the organization as no relevant security
issues were left unfixed.
The NEW WORK SE Identeco Integration is, in Cure53’s opinion, currently well-protectedagainst a broad number of attack vectors, as corroborated by the number and quality of thesubmitted fixes and the subsequent successful fix verification.

Cure53, Berlin · 06/22/23

3/3