Datenschutz-Plaudereien · Martin Steiger & Andreas Von Gunten, Datenschutzpartner

DAT387 Nationales Testinstitut für Cybersicherheit (Tobias Castagna)

·25 min·2 clips

A Bluetooth headset left on a desk can be secretly paired by a passerby in seconds — and then used to eavesdrop on every call from anywhere in Bluetooth range, with no LED blinking to warn the owner.

1. Datenschutz-Plaudereien host Martin Steiger interviews Tobias Castagna from NTC (National Test Institute for Cybersecurity) about the organization's current security research. 2. Tobias Castagna leads the test experts team at NTC (ntc.swiss), a Swiss non-profit founded in 2020 and substantially funded starting in 2022 through Canton Zug, which has since diversified to foundation donors and commission income. 3. The episode frames cybersecurity testing as a public-interest activity: NTC only works for businesses, critical infrastructure, and authorities — never for the manufacturers or vendors being tested. 4. Castagna explains NTC's three-tier project model: commissioned projects (clients pay), initiative projects (NTC pays), and collaborative projects (costs shared with affected parties like hospitals). 5. The hospital clinical information system (KIS) research — published early 2025 — involved testing three major Swiss hospital systems: KISIM, InEKiS, and EPIC, with NTC gaining internal network access at real hospitals. 6. Castagna says serious security vulnerabilities were found, some since fixed and others structural, but characterizes the risk as lower than headlines suggest because attackers would first need to breach the hospital network perimeter. 7. He distinguishes between the individual installation risk (e.g., a household Temu app) and the systemic risk (e.g., coordinated attacks on grid infrastructure), noting NTC's self-funded tests focus on scenarios where no paying customer exists. 8. The TikTok and Temu app analyses are cited as examples of NTC self-funding tests because the affected users — private individuals — would not pay for security audits. 9. On photovoltaic infrastructure, Castagna reveals NTC is investigating cybersecurity risks of internet-connected solar inverters, which at peak hours supply more than 50% of Switzerland's electricity and are controllable from manufacturer clouds. 10. He describes the systemic risk: a coordinated attack driving down solar installations simultaneously at noon could destabilize the national electricity grid — a risk individual households have little incentive to address. 11. Castagna mentions 'supply chain attacks' and 'vibe coding' (embedding dynamic code from third-party internet sources) as growing systemic concerns where end users have no practical ability to verify safety. 12. He describes NTC's 2025 peripheral device security research — published in the NZZ under the headline 'Hackers could use keyboards and headsets to spy on companies' — covering keyboards, headsets, and conference room equipment. 13. A key finding: Bluetooth headsets designed for multi-device pairing can be covertly paired by an attacker with seconds of physical access, enabling permanent eavesdropping with no LED warning — even while the device is charging. 14. Castagna is cautious about product-specific recommendations, explaining that security assessments go stale quickly and NTC avoids 'test winner' style rankings in favor of identifying overarching risk categories. 15. He discusses the ETH Zurich password manager research as a parallel: studies that find specific flaws leave users uncertain what to do, and NTC tries to give actionable guidance rather than just surfacing problems. 16. The challenge of media communication is discussed: NTC has received feedback that their hospital KIS disclosures were too alarming, causing some people to think hospitals were completely unsafe. 17. On NTC's funding, Castagna confirms the organization is pursuing long-term stability through a combination of political initiatives, foundation donors, and commissioned projects — viewing each commission as cross-subsidizing public-interest work. 18. The format is a one-on-one interview in conversational German (translated by transcription service), with Martin Steiger asking practical user-oriented questions and Castagna providing technical but accessible answers. 19. IT security professionals, hospital administrators, and anyone responsible for critical infrastructure in Switzerland will find the most actionable insights here. 20. General listeners who want high-level cybersecurity awareness but find Swiss-specific regulatory and funding context less relevant may prefer broader international security podcasts.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Datenschutz-Plaudereien