@inproceedings{UrbanLehnigerHeyneetal., author = {Urban, Roberto and Lehniger, Kai and Heyne, Maximilian and Sch{\"o}lzel, Mario and Vierhaus, Heinrich Theodor}, title = {Vergleich der Beschreibung und Simulation einer Befehlssatzarchitektur in LISA und CoMet}, series = {MBMV 2014, B{\"o}blingen, Methoden und Beschreibungssprachen zur Modellierung und Verifikation von Schaltungen und Systemen}, booktitle = {MBMV 2014, B{\"o}blingen, Methoden und Beschreibungssprachen zur Modellierung und Verifikation von Schaltungen und Systemen}, publisher = {Cuvillier Verlag}, address = {G{\"o}ttingen}, isbn = {978-3-95404-637-9}, pages = {101 -- 112}, language = {de} } @misc{LehnigerAftowiczSchoelzeletal., author = {Lehniger, Kai and Aftowicz, Marcin and Sch{\"o}lzel, Mario and Langend{\"o}rfer, Peter}, title = {Coarse-Grained Control Flow Integrity Check for Processors with Sliding Register Windows}, series = {12th Mediterranean Conference on Embedded Computing (MECO)}, journal = {12th Mediterranean Conference on Embedded Computing (MECO)}, isbn = {979-8-3503-2291-0}, issn = {2637-9511}, doi = {10.1109/MECO58584.2023.10154928}, pages = {7}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Window Canaries: Re-Thinking Stack Canaries for Architectures With Register Windows}, series = {IEEE Transactions on Dependable and Secure Computing}, volume = {20}, journal = {IEEE Transactions on Dependable and Secure Computing}, number = {6}, issn = {1941-0018}, doi = {10.1109/TDSC.2022.3230748}, pages = {4637 -- 4647}, abstract = {his paper presents Window Canaries, a novel approach to Stack Canaries for architectures with a register window that protects return addresses and stack pointers without the need of adding additional instruction to each potentially vulnerable function. Instead, placement and check of the canary word is moved to window exception handlers that are responsible to handle register window overflows and underflows. The approach offers low performance overhead while guaranteeing that return addresses are protected by stack buffer overflows without relying on a heuristic that decides which functions to instrument. The contributions of this paper are a complete implementation of the approach for the Xtensa LX architecture with register window option as well as a performance evaluation and discussion of advantages and drawbacks.}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Through the Window: Exploitation and Countermeasures of the ESP32 Register Window Overflow}, series = {Future Internet}, volume = {15}, journal = {Future Internet}, number = {6}, issn = {1999-5903}, doi = {10.3390/fi15060217}, abstract = {With the increasing popularity of IoT (Internet-of-Things) devices, their security becomes an increasingly important issue. Buffer overflow vulnerabilities have been known for decades, but are still relevant, especially for embedded devices where certain security measures cannot be implemented due to hardware restrictions or simply due to their impact on performance. Therefore, many buffer overflow detection mechanisms check for overflows only before critical data are used. All data that an attacker could use for his own purposes can be considered critical. It is, therefore, essential that all critical data are checked between writing a buffer and its usage. This paper presents a vulnerability of the ESP32 microcontroller, used in millions of IoT devices, that is based on a pointer that is not protected by classic buffer overflow detection mechanisms such as Stack Canaries or Shadow Stacks. This paper discusses the implications of vulnerability and presents mitigation techniques, including a patch, that fixes the vulnerability. The overhead of the patch is evaluated using simulation as well as an ESP32-WROVER-E development board. We showed that, in the simulation with 32 general-purpose registers, the overhead for the CoreMark benchmark ranges between 0.1\% and 0.4\%. On the ESP32, which uses an Xtensa LX6 core with 64 general-purpose registers, the overhead went down to below 0.01\%. A worst-case scenario, modeled by a synthetic benchmark, showed overheads up to 9.68\%.}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {StackSpecter: detecting stack buffer overflows for the Xtensa architecture}, series = {2024 34th International Telecommunication Networks and Applications Conference (ITNAC)}, journal = {2024 34th International Telecommunication Networks and Applications Conference (ITNAC)}, publisher = {IEEE}, doi = {10.1109/ITNAC62915.2024.10815333}, pages = {1 -- 7}, language = {en} } @misc{LehnigerRaghunathanLangendoerfer, author = {Lehniger, Kai and Raghunathan, Shuba Pradha and Langend{\"o}rfer, Peter}, title = {WindowGuardian: return address integrity for ESP32 microcontrollers with Xtensa Processors using AES and register Windows}, series = {2024 13th Mediterranean Conference on Embedded Computing (MECO)}, journal = {2024 13th Mediterranean Conference on Embedded Computing (MECO)}, publisher = {IEEE}, doi = {10.1109/MECO62516.2024.10577840}, pages = {1 -- 8}, language = {en} } @misc{LehnigerSchoelzelTabattetal., author = {Lehniger, Kai and Sch{\"o}lzel, Mario and Tabatt, Peter and Aftowicz, Marcin and Langend{\"o}rfer, Peter}, title = {Simplified Control Flow Integrity Method for Permutated Programs}, series = {Proc. 32. Crypto-Day Matters 2021, (2021)}, journal = {Proc. 32. Crypto-Day Matters 2021, (2021)}, doi = {10.18420/cdm-2021-32-21}, pages = {2}, language = {en} } @misc{SaadLehnigerLangendoerfer, author = {Saad, AbdElaziz AbdElaal and Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Incremental Code Updates Exploitation as a Basis for Return Oriented Programming Attacks on Resource-Constrained Devices}, series = {5th Cyber Security in Networking Conference (CSNet 2021), (2021)}, journal = {5th Cyber Security in Networking Conference (CSNet 2021), (2021)}, isbn = {978-1-6654-0723-6}, issn = {2768-0029}, doi = {10.1109/CSNet52717.2021.9614275}, pages = {8}, language = {en} } @misc{LehnigerSaadLangendoerfer, author = {Lehniger, Kai and Saad, Abdelaziz and Langend{\"o}rfer, Peter}, title = {Finding Gadgets in Incremental Code Updates for Return-Oriented Programming Attacks on Resource-Constrained Devices}, series = {Annals of Telecommunications}, volume = {78}, journal = {Annals of Telecommunications}, issn = {0003-4347}, doi = {10.1007/s12243-022-00917-8}, pages = {209 -- 229}, language = {en} } @misc{AmatovLehnigerLangendoerfer, author = {Amatov, Batyi and Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Return-Oriented Programming Gadget Catalog for the Xtensa Architecture}, series = {6th International Workshop on Security, Privacy and Trust in the Internet of Things (SPT-IoT 2022)}, journal = {6th International Workshop on Security, Privacy and Trust in the Internet of Things (SPT-IoT 2022)}, isbn = {978-1-6654-1647-4}, doi = {10.1109/PerComWorkshops53856.2022.9767489}, pages = {6}, language = {en} } @misc{LehnigerSchoelzelJeloneketal., author = {Lehniger, Kai and Sch{\"o}lzel, Mario and Jelonek, Jonas and Tabatt, Peter and Aftowicz, Marcin and Langend{\"o}rfer, Peter}, title = {Combination of ROP Defense Mechanisms for Better Safety and Security in Embedded Systems}, series = {25th Euromicro Conference on Digital Systems Design (DSD 2022), Maspalomas, Spain, 31 August 2022 - 02 September 2022}, journal = {25th Euromicro Conference on Digital Systems Design (DSD 2022), Maspalomas, Spain, 31 August 2022 - 02 September 2022}, isbn = {978-1-6654-7404-7}, issn = {2771-2508}, doi = {10.1109/DSD57027.2022.00070}, pages = {8}, language = {en} } @misc{TabattJelonekSchoelzeletal., author = {Tabatt, Peter and Jelonek, Jonas and Sch{\"o}lzel, Mario and Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Code Mutation as a Mean Against ROP Attacks for Embedded Systems}, series = {11th Mediterranean Conference on Embedded Computing (MECO 2022), Budva, Montenegro, 07-10 June 2022}, journal = {11th Mediterranean Conference on Embedded Computing (MECO 2022), Budva, Montenegro, 07-10 June 2022}, isbn = {978-1-6654-6828-2}, issn = {2637-9511}, doi = {10.1109/MECO55406.2022.9797185}, pages = {4}, language = {en} } @misc{AftowiczLehnigerLangendoerfer, author = {Aftowicz, Marcin and Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Scalable FPGA Hardware Accelerator for SVM Inference}, series = {Proc. 10th International Conference on Cyber-Physical Systems and Internet-of-Things (CPS\&IoT 2022)}, journal = {Proc. 10th International Conference on Cyber-Physical Systems and Internet-of-Things (CPS\&IoT 2022)}, isbn = {978-1-6654-6828-2}, issn = {2637-9511}, doi = {10.1109/MECO55406.2022.9797110}, pages = {4}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Through the Window: On the Exploitability of Xtensa's Register Window Overflow}, series = {32nd International Telecommunication Networks and Applications Conference (ITNAC 2022), Wellington, New Zealand, 30 November 2022 - 02 December 2022}, journal = {32nd International Telecommunication Networks and Applications Conference (ITNAC 2022), Wellington, New Zealand, 30 November 2022 - 02 December 2022}, isbn = {978-1-6654-7103-9}, issn = {2474-154X}, doi = {10.1109/ITNAC55475.2022.9998407}, pages = {353 -- 358}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Comment on ''RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices''}, series = {IEEE Access}, volume = {13}, journal = {IEEE Access}, publisher = {IEEE}, address = {Piscataway, NJ}, issn = {2169-3536}, doi = {10.1109/ACCESS.2025.3568598}, pages = {90358 -- 90361}, abstract = {This is a comment on "RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices." RIO prevents finding gadgets for return-oriented programming attacks by encrypting return instructions. This paper shows flaws in the design of RIO that allow for the easy retrieval of the plaintext return instructions without decrypting them. Additionally, changes are proposed to improve upon the original idea.}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Investigating compact shadow stacks for the Xtensa LX architecture}, series = {2025 14th Mediterranean Conference on Embedded Computing (MECO)}, journal = {2025 14th Mediterranean Conference on Embedded Computing (MECO)}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {979-8-3315-1341-2}, doi = {10.1109/MECO66322.2025.11049161}, pages = {1 -- 6}, abstract = {This paper presents a compact shadow stack implementation for the Xtensa LX architecture, implemented for an ESP32 microcontroller. The implementation is done by changing the register window exception handlers in the FreeRTOS operating system. In a second implementation the shadow stack was extended to all register values, not just return addresses. This not only increases security but also performance, reducing the overhead from 17.220\% to 13.529\%, in the worst-case-scenario. The paper also suggests future improvements that could decrease the overhead even further.}, language = {en} } @misc{AftowiczFritscherLehnigeretal., author = {Aftowicz, Marcin and Fritscher, Markus and Lehniger, Kai and Wenger, Christian and Langend{\"o}rfer, Peter and Brzozowski, Marcin}, title = {Hardware-friendly Nystr{\"o}m approximation for water treatment anomaly detection}, series = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, journal = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, address = {Piscataway, NJ}, isbn = {978-1-6654-6454-3}, doi = {10.1109/IECON55916.2024.10905880}, pages = {1 -- 7}, abstract = {This paper presents an approach to accelerate One-Class Support Vector Machines (SVM) using a hardware-friendly kernel that doesn't rely on multiplication operations, thus adaptable to hardware platforms. Leveraging Nystr{\"o}m approximation, we implemented a pipeline and compared its performance against a software implementation using libsvm. Furthermore, we evaluated the efficiency of our approach by deploying it on an FPGA. Our experiments, conducted on the SWaT dataset, demonstrate a 50x speedup using the FPGA implementation, achieving a classification time of 21 microseconds per instance. Importantly, we find no degradation in performance, as measured by the f-score of the attack class in the test set. This study explores the potential of hardware acceleration in optimizing anomaly detection systems for real-time applications.}, language = {en} } @misc{LehnigerLangendorfer, author = {Lehniger, Kai and Langendorfer, Peter}, title = {Elevating parallel shadow stack concepts for architectures with register windows}, series = {IEEE transactions on dependable and secure computing}, journal = {IEEE transactions on dependable and secure computing}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, address = {Piscataway, NJ}, issn = {1545-5971}, doi = {10.1109/TDSC.2025.3604556}, pages = {1 -- 18}, abstract = {Register windows are a processor feature that was originally developed to reduce the frequency for register spilling. This paper investigates how this mechanism can be used to implement a parallel shadow stack to protect return addresses from being corrupted. Furthermore, multiple improvements based on properties directly following the usage of register windows are proposed. Different configurations of parallel shadow stacks are evaluated based on prototype implementations on an ESP32 microcontroller and tested with different benchmarks. Performance overheads below 0.01\% for CoreMark, below 3\% for the worst case in MbedsTLS, and a worst case scenario of 22.153\% for a recursive function show that our concepts are able to be efficiently developed even for embedded devices like the ESP32.}, language = {en} }