P256 - Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit
Auflistung P256 - Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit nach Titel
1 - 10 von 27
Treffer pro Seite
Sortieroptionen
- KonferenzbeitragAttacks on fitness trackers revisited: a case-study of unfit firmware security(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Rieck, JakobFitness trackers - wearables that continuously record a wearer's step count and related activity data - are quickly gaining in popularity. Apart from being useful for individuals seeking a more healthy lifestyle, their data is also being used in court and by insurance companies to adjust premiums. For these use cases, it is essential to ensure authenticity and integrity of data. Here we demonstrate a flaw in the way firmware for Withings' Activité is verified, allowing an adversary to compromise the tracker itself. This type of attack has so far not been applied to fitness trackers. Vendors have started mitigating previous attacks, which manipulated data by interfering with wireless channels, or by physically moving the tracker to fool sensors. Hardware similarities amongst different trackers suggest findings can be transferred to other tracker as well.
- KonferenzbeitragAuf dem Weg verTAN:Über die Sicherheit App-basierter TAN-Verfahren(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Haupert, Vincent; Müller, TiloDie deutschen Banken wenden sich zunehmend von den alten TAN-Verfahren ab. Als Motiv zur Erschließung neuer Techniken abseits der indizierten TAN-Liste, mTAN und chipTAN wird neben der Sicherheit auch der fehlende Komfort durch die Notwendigkeit dedizierter Hardware angeführt. Neue App-basierte TAN-Verfahren erlauben es dem Nutzer, eine Transaktion mit seinem mobilen Endgerät (Android oder iOS) auszulösen und auf dem selben Gerät zu bestätigen - und das bei vermeintlich höherer Sicherheit als bei den etablierten Verfahren. Wir haben die Sicherheit solcher App-basierten TAN-Verfahren am Beispiel des pushTAN-Verfahrens der Sparkassen ausgewertet und attestieren dem Verfahren gravierende konzeptionelle Schwächen. Der bewusste Verzicht auf eigenständige Hardware zur Transaktionsauslösung und -bestätigung macht das Verfahren für Schadsoftware zu einer leichten Beute. Zur Demonstration dieser Schwächen haben wir einen An- griff entwickelt, der vom Nutzer Transaktionen abfängt und vor ihrer Bestätigung nach Belieben manipulieren kann.
- KonferenzbeitragAutomotive Ethernet: security opportunity or challenge?(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Corbett, Christopher; Schoch, Elmar; Kargl, Frank; Preussner, FelixThe automotive industry's future trends, such as automated driving or advanced driver assistance, require large bandwidths to handle massive data streams and strongly depend on well timed communication. The Ethernet technology is seen as a suitable candidate to cover those needs for vehicle-internal networks; however, Ethernet involves security issues. Thus, by discussing automotive Ethernet attributes with regard to the adaption of existing security mechanisms in contrast to the potential of creating new ones, several challenges and opportunities emerge in consideration of comparatively fewer available resources and the integration into a vehicle environment. Based on these results we derive and propose ideas for manipulation and misuse detection mechanisms.
- KonferenzbeitragDie Bordkarte als Authentifikationsmittel bei Flugreisen(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Astrakhantceva, Mariia; Karjoth, Günter; Hübscher, BettinaMobile Technologien und das Web sind omnipräsent. Auch die Flugfahrtbranche setzt auf die Buchung über das Internet. Diese Angebote erhöhen nicht nur die Benutzerfreundlichkeit, optimieren den Abflugprozess und ersparen Millionen Euro an Kosten, sondern enthalten auch Gefahren - für Passagiere wie Fluglinien. Veröffentlicht jemand das Foto einer Bordkarte auf dem Internet, kann die darauf abgedruckte Information verwendet werden, um beispielsweise den Rückflug zu annulieren. Diese Gefahr ist vielen Passagieren nicht bewußt. Die Möglichkeit dieses Angriffs besteht nicht nur durch das Wissen über die Information auf der Bordkarte, sondern auch durch eine schwache Authentifizierung auf Seite der Fluglinie. Dieser Artikel beschreibt die technischen Grundlagen, diskutiert die rechtlichen Aspekte und erörtert mögliche Gegenmaßnahmen.
- KonferenzbeitragComparative evaluation of machine learning-based malware detection on android.(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Hahn, Sebastian; Protsenko, Mykola; Müller, TiloThe Android platform is known as the market leader for mobile devices, but it also has gained much attention among malware authors in recent years. The widespread of malware, a consequence of its popularity and the design features of the Android ecosystem, constitutes a major security threat currently targeted by the research community. Among all counter methods proposed in previous publications, many rely on machine learning algorithms based on statically extracted attributes from an app. Machine learning, which is also inspired by the developed field of desktop malware detection, has proven to be a promising approach for fighting Android malware. Many publications, however, rely on different data sets for different application attributes, rendering the comparison of them difficult. Furthermore, there exist attribute sets known from the desktop world which have not been ported to Android yet. In this paper, we aim to step towards filling this gap by assessing the effectiveness of the total number of 11 attribute sets, including those never evaluated on Android before, using a consistent data set of 10,000 apps. Our comparative evaluation provides a ranking for the single attribute sets according the detection performance they can reach, and suggests the most effective combination of all attributes.
- KonferenzbeitragCorrelation-resistant fuzzy vault for fingerprints(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Butt, Moazzam; Merkle, Johannes; Korte, Ulrike; Busch, ChristophThe fuzzy vault is one of the most popular biometric encryption schemes for protecting fingerprint data. However, its implementation faces two challenges: First, the fingerprints need to be aligned. Some publications have proposed the storage of auxiliary data to assist alignment, but these data may leak information about the biometric features. Secondly, the fuzzy vault is susceptible to attacks that correlate the data from two protected templates, which does not only violate the requirement of unlinkability but also allows the recovery of the biometric data. In this work, we present a fuzzy vault construction for fingerprint data (minutiae) that addresses both issues. We do so by applying an absolute alignment method to the fingerprints, performing a quantization of the minutiae positions to a grid, and using all grid points unoccupied by minutiae as chaff. This approach results in all vaults containing the same set of points. In order to improve recognition performance, we also use the minutiae's angles and types. We present experimental evaluations and compare the results with the existing works on fuzzy fingerprint vault.
- KonferenzbeitragDesigning resilient and secure smart micro grids(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Valipour, SiavashThe research presented in this extended abstract paper depicts a smart grid management framework which enables a decentralized and autonomous organization of the energy participants within these grids. Based on basic requirements for operating such systems, challenges and tasks are being discussed here as a basis for future research. The discussion encompasses both fields of electrical engineering and computer science. The presented grid coordination and energy transfer schemes are briefly regarded and openly discussed.
- KonferenzbeitragDetecting anomalies in BACnet network data(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Tonejc, Jernej; Kaur, Jaspreet; Kobekova, AlexandraOver the last few years, the volume of data in the Building Automation System (BAS) networks has increased exponentially. Nowadays, it is possible to obtain several kinds of data from building networks such as data based on individual service type, specific building location and even specific time of the day. As a consequence, large volumes of data with more variables have to be considered when performing the data analysis. This means that there is a need to identify the most important variables for analysis. In this paper, we introduce a framework which allows the characterization of BACnet network traffic data by means of machine learning techniques. This framework is based on unsupervised machine learning methods, specifically, Principal Components Analysis and Clustering. Such methods are used because of the large volume of data that needs to be taken into consideration, preventing the manual labeling of the data which is required for supervised learning methods. We show the efficiency and effectiveness of the framework in detecting anomalies by performing experiments on different BACnet network traffic data, captured by Wireshark, together with synthetically generated data.
- KonferenzbeitragDistributed evolutionary fuzzing with evofuzz(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Beterke, FabianThis paper describes the design of a tool (called Evofuzz) that implements the technique of evolutionary (or coverage-guided) fuzzing in a scalable, distributed manner. The architecture, design-choices and implementation specifics of this tool are examined, explained and criticized. After outlining possible improvements and future work that is not yet completed, the paper finishes by presenting the results from fuzzing real-world programs and explains how to recreate them using the provided tool.
- KonferenzbeitragA framework for encrypted computation on shared data(Sicherheit 2016 - Sicherheit, Schutz und Zuverlässigkeit, 2016) Kasem-Madani, SaffijaIn times of surveillance and data retention, sharing information often comes together with privacy concerns. However, information sharing has benefits, e.g. sharing log files for including the knowledge gained from a broader view for security analysis, or sharing healthcare data for the use in studies for improving medical treatments. We present an information sharing framework design that meets both privacy and utility requirements of the information sharing parties. We utilize homomorphic encryption and show how it can be used for offline data analysis.
- «
- 1 (current)
- 2
- 3
- »