@misc{HillerAmannHohlfeld, author = {Hiller, Jens and Amann, Johanna and Hohlfeld, Oliver}, title = {The Boon and Bane of Cross-Signing: Shedding Light on a Common Practice in Public Key Infrastructures}, series = {CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, October 2020}, journal = {CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, October 2020}, doi = {10.1145/3372297.3423345}, pages = {1289 -- 1306}, abstract = {Public Key Infrastructures (PKIs) with their trusted Certificate Authorities (CAs) provide the trust backbone for the Internet: CAs sign certificates which prove the identity of servers, applications, or users. To be trusted by operating systems and browsers, a CA has to undergo lengthy and costly validation processes. Alternatively, trusted CAs can cross-sign other CAs to extend their trust to them. In this paper, we systematically analyze the present and past state of cross-signing in the Web PKI. Our dataset (derived from passive TLS monitors and public CT logs) encompasses more than 7 years and 225 million certificates with 9.3 billion trust paths. We show benefits and risks of cross-signing. We discuss the difficulty of revoking trusted CA certificates where, worrisome, cross-signing can result in valid trust paths to remain after revocation; a problem for non-browser software that often blindly trusts all CA certificates and ignores revocations. However, cross-signing also enables fast bootstrapping of new CAs, e.g., Let's Encrypt, and achieves a non-disruptive user experience by providing backward compatibility. In this paper, we propose new rules and guidance for cross-signing to preserve its positive potential while mitigating its risks.}, language = {en} } @misc{HillerHenzeZimmermannetal., author = {Hiller, Jens and Henze, Martin and Zimmermann, Torsten and Hohlfeld, Oliver and Wehrle, Klaus}, title = {The Case for Session Sharing: Relieving Clients from TLS Handshake Overheads}, series = {2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 14-17 Oct. 2019, Osnabr{\"u}ck, Germany}, journal = {2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 14-17 Oct. 2019, Osnabr{\"u}ck, Germany}, publisher = {IEEE}, isbn = {978-1-7281-2561-9}, doi = {10.1109/LCNSymposium47956.2019.9000667}, pages = {9}, abstract = {In recent years, the amount of traffic protected with Transport Layer Security (TLS) has significantly increased and new protocols such as HTTP/2 and QUIC further foster this emerging trend. However, protecting traffic with TLS has significant impacts on network entities. While the restrictions for middleboxes have been extensively studied, addressing the impact of TLS on clients and servers has been mostly neglected so far. Especially mobile clients in emerging 5G and IoT deployments suffer from significantly increased latency, traffic, and energy overheads when protecting traffic with TLS. In this paper, we address this emerging topic by thoroughly analyzing the impact of TLS on clients and servers and derive opportunities for significantly decreasing latency of TLS communication and downsizing TLS management traffic, thereby also reducing TLSinduced server load. We propose a protocol compatible redesign of TLS session management to use these opportunities and showcase their potential based on mobile device traffic and mobile web-browsing traces. These show promising potentials for latency improvements by up to 25.8\% and energy savings of up to 26.3\%.}, language = {en} } @misc{HasslingerNtougiasHasslingeretal., author = {Hasslinger, Gerhard and Ntougias, Konstantinos and Hasslinger, Frank and Hohlfeld, Oliver}, title = {Fast and Efficient Web Caching Methods Regarding the Size and Performance Measures per Data Object}, series = {2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 11-13 Sept. 2019, Limassol, Cyprus}, journal = {2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 11-13 Sept. 2019, Limassol, Cyprus}, publisher = {IEEE}, isbn = {978-1-7281-1016-5}, issn = {2378-4873}, doi = {10.1109/CAMAD.2019.8858459}, pages = {7}, abstract = {Caching methods are developed since 50 years for paging in CPU and database systems, and since 25 years for web caching as main application areas among others. Pages of unique size are usual in CPU caches, whereas web caches are storing data chunks of different size in a widely varying range. We study the impact of different object sizes on the performance and the overhead of web caching. This entails different caching goals, starting from the byte and object hit ratio to a generalized value hit ratio for optimized costs and benefits of caching regarding traffic engineering (TE), reduced delays and other QoS measures. The selection of the cache contents turns out to be crucial for the web cache efficiency with awareness of the size and other properties in a score for each object. We introduce a new class of rank exchange caching methods and show how their performance compares to other strategies with extensions needed to include the size and scores for QoS and TE caching goals. Finally, we derive bounds on the object, byte and value hit ratio for the independent request model (IRM) based on optimum knapsack solutions of the cache content.}, language = {en} } @misc{ReelfsBergmannHohlfeldetal., author = {Reelfs, Jens Helge and Bergmann, Max and Hohlfeld, Oliver and Henckell, Niklas}, title = {Understanding \& Predicting User Lifetime with Machine Learning in an Anonymous Location-Based Social Network}, series = {Companion Proceedings of the Web Conference 2021}, volume = {2021}, journal = {Companion Proceedings of the Web Conference 2021}, publisher = {ACM}, address = {Ljubljana, Slovenia}, isbn = {978-1-4503-8313-4}, doi = {10.1145/3442442.3451887}, pages = {8}, abstract = {In this work, we predict the user lifetime within the anonymous and location-based social network Jodel in the Kingdom of Saudi Arabia. Jodel's location-based nature yields to the establishment of disjoint communities country-wide and enables for the first time the study of user lifetime in the case of a large set of disjoint communities. A user's lifetime is an important measurement for evaluating and steering customer bases as it can be leveraged to predict churn and possibly apply suitable methods to circumvent potential user losses. We train and test off the shelf machine learning techniques with 5-fold crossvalidation to predict user lifetime as a regression and classification problem; identifying the Random Forest to provide very strong results. Discussing model complexity and quality trade-offs, we also dive deep into a time-dependent feature subset analysis, which does not work very well; Easing up the classification problem into a binary decision (lifetime longer than timespan ) enables a practical lifetime predictor with very good performance. We identify implicit similarities across community models according to strong correlations in feature importance. A single countrywide model generalizes the problem and works equally well for any tested community; the overall model internally works similar to others also indicated by its feature importances.}, language = {en} } @misc{KoppDietzelHohlfeld, author = {Kopp, Daniel and Dietzel, Christoph and Hohlfeld, Oliver}, title = {DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks}, series = {Proceedings of the Passive and Active Measurement (PAM) conference 2021}, journal = {Proceedings of the Passive and Active Measurement (PAM) conference 2021}, pages = {17}, abstract = {DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97\% of the attack traffic.}, language = {en} } @misc{FealVallinaGambaetal., author = {Feal, {\´A}lvaro and Vallina, Pelayo and Gamba, Julien and Pastrana, Sergio and Nappa, Antonio and Hohlfeld, Oliver and Vallina-Rodriguez, Narseo and Tapiador, Juan}, title = {Blocklist Babel: On the Transparency and Dynamics of Open Source Blocklisting}, series = {IEEE Transactions on Network and Service Management}, journal = {IEEE Transactions on Network and Service Management}, publisher = {IEEE}, issn = {1932-4537}, doi = {10.1109/TNSM.2021.3075552}, pages = {16}, abstract = {Blocklists constitute a widely-used Internet security mechanism to filter undesired network traffic based on IP/domain reputation and behavior. Many blocklists are distributed in open source form by threat intelligence providers who aggregate and process input from their own sensors, but also from thirdparty feeds or providers. Despite their wide adoption, many open-source blocklist providers lack clear documentation about their structure, curation process, contents, dynamics, and interrelationships with other providers. In this paper, we perform a transparency and content analysis of 2,093 free and open source blocklists with the aim of exploring those questions. To that end, we perform a longitudinal 6-month crawling campaign yielding more than 13.5M unique records. This allows us to shed light on their nature, dynamics, inter-provider relationships, and transparency. Specifically, we discuss how the lack of consensus on distribution formats, blocklist labeling taxonomy, content focus, and temporal dynamics creates a complex ecosystem that complicates their combined crawling, aggregation and use. We also provide observations regarding their generally low overlap as well as acute differences in terms of liveness (i.e., how frequently records get indexed and removed from the list) and the lack of documentation about their data collection processes, nature and intended purpose. We conclude the paper with recommendations in terms of transparency, accountability, and standardization.}, language = {en} } @misc{HohlfeldGuseDeMoor, author = {Hohlfeld, Oliver and Guse, Dennis and De Moor, Katrien}, title = {A Questionnaire to Assess Virtual Conference Participation Experience}, series = {2021 Thirteenth International Conference on Quality of Multimedia Experience (QoMEX)}, journal = {2021 Thirteenth International Conference on Quality of Multimedia Experience (QoMEX)}, publisher = {IEEE}, isbn = {978-1-6654-3589-5}, issn = {2472-7814}, doi = {10.1109/QoMEX51781.2021.9465406}, pages = {4}, abstract = {This tools track paper presents the design of a questionnaire methodology to assess the participants experience of virtual conferences. This survey approach consists of a preconference questionnaire assessing participation goals and expectations and a post-conference questionnaire assessing the actual participation and related experiences. It enables a data-driven investigation of participants' expectations, goals, attitudes, actual experiences, and general feedback about virtual conferences. As such, it can help to better understand how virtual conference experiences can be improved in the future and how the virtual format can become a more attractive alternative, also in non-pandemic times. The questionnaire was used at three conferences and two workshops. Despite a missing validation, we released it early to foster research on virtual conferences.}, language = {en} } @misc{KoppStrehleHohlfeld, author = {Kopp, Daniel and Strehle, Eric and Hohlfeld, Oliver}, title = {CyberBunker 2.0 - A Domain and Traffic Perspective on a Bullet Proof Hoster}, series = {CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021}, journal = {CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021}, doi = {10.1145/3460120.3485352}, pages = {3}, language = {en} } @misc{WagnerKoppWichtlhuberetal., author = {Wagner, Daniel and Kopp, Daniel and Wichtlhuber, Matthias and Dietzel, Christoph and Hohlfeld, Oliver and Smaragdakis, Georgios and Feldmann, Anja}, title = {United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale}, series = {ACM CCS 2021 - November 15-19, Virtual Conference}, journal = {ACM CCS 2021 - November 15-19, Virtual Conference}, doi = {10.1145/3460120.3485385}, language = {en} } @misc{DoanvanRijswijkDeijHohlfeldetal., author = {Doan, Trinh Viet and van Rijswijk-Deij, Roland and Hohlfeld, Oliver and Bajpai, Vaibhav}, title = {An Empirical View on Consolidation of the Web}, series = {ACM Transactions on Internet Technology (TOIT)}, volume = {22}, journal = {ACM Transactions on Internet Technology (TOIT)}, number = {3}, issn = {1557-6051}, doi = {10.1145/3503158}, pages = {1 -- 30}, abstract = {The majority of Web content is delivered by only a few companies that provide Content Delivery Infrastructuress (CDIss) such as Content Delivery Networkss (CDNss) and cloud hosts. Due to increasing concerns about trends of centralization, empirical studies on the extent and implications of resulting Internet consolidation are necessary. Thus, we present an empirical view on consolidation of the Web by leveraging datasets from two different measurement platforms. We first analyze Web consolidation around CDIs at the level of landing webpages, before narrowing down the analysis to a level of embedded page resources. The datasets cover 1(a) longitudinal measurements of DNS records for 166.5 M Web domains over five years, 1(b) measurements of DNS records for Alexa Top 1 M over a month and (2) measurements of page loads and renders for 4.3 M webpages, which include data on 392.3 M requested resources. We then define CDIs penetration as the ratio of CDI-hosted objects to all measured objects, which we use to quantify consolidation around CDIs. We observe that CDI penetration has close to doubled since 2015, reaching a lower bound of 15\% for all .com, .net, and .org Web domains as of January 2020. Overall, we find a set of six CDIss to deliver the majority of content across all datasets, with these six CDIss being responsible for more than 80\% of all 221.9 M CDI-delivered resources (56.6\% of all resources in total). We find high dependencies of Web content on a small group of CDIss, in particular, for fonts, ads, and trackers, as well as JavaScript resources such as jQuery. We further observe CDIss to play important roles in rolling out IPv6 and TLS 1.3 support. Overall, these observations indicate a potential oligopoly, which brings both benefits but also risks to the future of the Web.}, language = {en} }