@misc{KabinLangendoerferDyka, author = {Kabin, Ievgen and Langend{\"o}rfer, Peter and Dyka, Zoya}, title = {Vulnerability of Atomic Patterns to Simple SCA}, series = {19th IEEE East-West Design \& Test Symposium (EWDTS 2023), (2023)}, journal = {19th IEEE East-West Design \& Test Symposium (EWDTS 2023), (2023)}, isbn = {979-8-3503-1484-7}, issn = {2472-761X}, doi = {10.1109/EWDTS59469.2023.10297074}, pages = {4}, abstract = {In this work we discuss the vulnerability of atomic pattern algorithms for elliptic curve point multiplication against simple side-channel analysis attacks using our own implementation as an example. One of the assumptions, on which the atomicity principle is based, is the indistinguishability of operations with different registers, i.e. storing of the data into two different registers cannot be distinguished if their old and new data values are the same. But before the data can be stored in a register/block, this register/block has to be addressed for storing the data. Different registers/blocks have different addresses. The key-dependent addressing of registers/blocks is an inherent feature of the binary kP algorithms and allows to reveal the key k. In our work we demonstrated it. This means that the main assumption, that addressing of different registers/blocks is an indistinguishable operation, may no longer be applied when realizing kP implementations, at least not for hardware implementations.}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {Security of Programmable Logic Controllers and Related Systems: Today and Tomorrow}, series = {IEEE Open Journal of the Industrial Electronics Society}, journal = {IEEE Open Journal of the Industrial Electronics Society}, number = {4}, issn = {2644-1284}, doi = {10.1109/OJIES.2023.3335976}, pages = {659 -- 693}, abstract = {Programmable logic controllers (PLCs) are indispensable in critical infrastructures and industrial control systems. The increasing demand for enhanced cost-effectiveness and production efficiency has driven automation manufacturers to integrate PLC-based applications and systems with external networks, such as Internet. Unfortunately, this connectivity has exposed systems to potential malicious attacks from motivated adversaries. Addressing this pressing issue necessitates a comprehensive summary of ongoing research related to PLCs and their related systems. This summary should classify these systems based on disclosed vulnerabilities, potential threats, and proposed security solutions, catering to both scientists and industrial engineers. While several recent surveys have reviewed and discussed PLC security and related topics, they often fell short of covering all essential aspects comprehensively. Furthermore, prior surveys tended to focus on analyzing vulnerabilities at the system level, overlooking the vulnerabilities specific to PLCs themselves. Consequently, their findings failed to effectively secure current operational systems or propose improved solutions for future PLC designs. In this article, we bridge this research gap by providing a detailed review of all aspects concerning the security of PLCs and related systems. This includes vulnerabilities, potential attacks, and security solutions including digital forensics. We aim to offer a precise analysis, addressing the shortcomings of previous studies. Finally, we conclude this article by presenting our recommendations tailored for PLC manufacturers, researchers, and engineers. We hope that these recommendations will contribute to the development of more secure PLCs in the future.}, language = {en} } @misc{HaddadiEsfahaniMayeFrohbergetal., author = {Haddadi Esfahani, Ali and Maye, Oliver and Frohberg, Max and Speh, Maria and J{\"o}bges, Michael and Langend{\"o}rfer, Peter}, title = {Machine Learning based Real Time Detection of Freezing of Gait of Parkinson Patients Running on a Body Worn Device}, series = {IEEE/ACM international conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE 2023), 181 (2023)}, journal = {IEEE/ACM international conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE 2023), 181 (2023)}, isbn = {979-8-4007-0102-3}, issn = {2832-2975}, doi = {10.1145/3580252.3589423}, pages = {181 -- 182}, abstract = {For those who have Parkinson's disease, one of the most incapacitating symptoms is Freezing of Gait (FOG). Gait impairment and disruptions limit everyday activities and reduce quality of daily life along with the increase in the risk of falling [1]. Thanks to recent advancement in embedded electronics and sensors as well as their adaptation in the wearable device market, low power devices are becoming more and more capable running neural networks. This enables researchers to implement complex models on wearable devices that capture and analyze sensor data to detect FOGin real-time.}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {No Attacks Are Available: Securing the OpenPLC and Related Systems}, series = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, journal = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, doi = {10.13140/RG.2.2.24570.47043}, pages = {12}, abstract = {The use of Programmable Logic Controllers (PLCs) expands in industrial domains, which makes ensuring the security of Industrial Control Systems (ICSs) become paramount. The OpenPLC project, the first open-source initiative, provides flexible and cost-effective PLC solutions to build up affordable test-beds, as well as conduct experiments and academic researches. This project has wildly grown in the last few years, thus it is essential to address the most emerging security challenges it encounters. This paper introduces a new OpenPLC architecture, called OpenPLC Aqua, provided with a set of security solutions designed specifically to overcome the vulnerabilities that the current OpenPLC versions are prone to. The new OpenPLC architecture includes four security features: 1) user credentials encryption, securing the Webserver, Whitelisting and secure SSL/TLS communication channel. The OpenPLC Aqua software was tested against several attack scenarios, that were feasible against the old OpenPLC versions. Our experimental results showed our enhanced OpenPLC software is secure and resistant against several attack scenarios e.g., authentication, injection, Man-in-the-Middle and replay attacks. The OpenPLC Aqua is publicly available and a proof of concept demo is also published with this paper.}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Window Canaries: Re-Thinking Stack Canaries for Architectures With Register Windows}, series = {IEEE Transactions on Dependable and Secure Computing}, volume = {20}, journal = {IEEE Transactions on Dependable and Secure Computing}, number = {6}, issn = {1941-0018}, doi = {10.1109/TDSC.2022.3230748}, pages = {4637 -- 4647}, abstract = {his paper presents Window Canaries, a novel approach to Stack Canaries for architectures with a register window that protects return addresses and stack pointers without the need of adding additional instruction to each potentially vulnerable function. Instead, placement and check of the canary word is moved to window exception handlers that are responsible to handle register window overflows and underflows. The approach offers low performance overhead while guaranteeing that return addresses are protected by stack buffer overflows without relying on a heuristic that decides which functions to instrument. The contributions of this paper are a complete implementation of the approach for the Xtensa LX architecture with register window option as well as a performance evaluation and discussion of advantages and drawbacks.}, language = {en} } @incollection{LangendoerferKornemannAlsabbaghetal., author = {Langend{\"o}rfer, Peter and Kornemann, Stephan and Alsabbagh, Wael and Hermann, Erik}, title = {Information Security: The Cornerstone for Surviving the Digital Wild}, series = {The Future of Smart Production for SMEs: A Methodological and Practical Approach Towards Digitalization in SMEs}, booktitle = {The Future of Smart Production for SMEs: A Methodological and Practical Approach Towards Digitalization in SMEs}, publisher = {Springer International Publishing}, address = {Cham}, isbn = {978-3-031-15428-7}, doi = {10.1007/978-3-031-15428-7_29}, pages = {335 -- 341}, abstract = {In this chapter we are discussing the very basics in the sense of how to prepare your company with respect to security. The essential issues are a proper information security governance framework that takes into account the managerial and organizational issues as well as proper technical means. For the latter we introduce network separation as this is one of the prime means to protect your production network from network based attacks.}, language = {en} } @misc{AssafoLautschSuawaetal., author = {Assafo, Maryam and Lautsch, Martin and Suawa, Priscile Fogou and Jongmanns, Marcel and H{\"u}bner, Michael and Reichenbach, Marc and Brockmann, Carsten and Reinhardt, Denis and Langend{\"o}rfer, Peter}, title = {The ForTune Toolbox: Building Solutions for Condition-Based and Predictive Maintenance Focusing on Retrofitting}, publisher = {VDE Verlag}, address = {Berlin}, isbn = {978-3-8007-6204-0}, pages = {S. 541}, language = {en} } @misc{SigourouKabinLangendoerferetal., author = {Sigourou, Alkistis and Kabin, Ievgen and Langend{\"o}rfer, Peter and Sklavos, Nicolas and Dyka, Zoya}, title = {Successful Simple Side Channel Analysis: Vulnerability of an Atomic Pattern kP Algorithm Implemented with a Constant Time Crypto Library to Simple Electromagnetic Analysis Attacks}, series = {12th Mediterranean Conference on Embedded Computing (MECO 2023), 167 (2023)}, journal = {12th Mediterranean Conference on Embedded Computing (MECO 2023), 167 (2023)}, isbn = {979-8-3503-2291-0}, issn = {2637-9511}, doi = {10.1109/MECO58584.2023.10154940}, pages = {6}, language = {en} } @misc{KabinDykaLangendoerfer, author = {Kabin, Ievgen and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Randomized Addressing Countermeasures are Inefficient against Address-Bit SCA}, series = {IEEE International Conference on Cyber Security and Resilience (CSR 2023), 580 (2023)}, journal = {IEEE International Conference on Cyber Security and Resilience (CSR 2023), 580 (2023)}, isbn = {979-8-3503-1170-9}, doi = {10.1109/CSR57506.2023.10224968}, pages = {6}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Good Night, and Good Luck: A Control Logic Injection Attack on OpenPLC}, series = {Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023)}, journal = {Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023)}, doi = {10.13140/RG.2.2.32913.20321}, pages = {8}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Through the Window: Exploitation and Countermeasures of the ESP32 Register Window Overflow}, series = {Future Internet}, volume = {15}, journal = {Future Internet}, number = {6}, issn = {1999-5903}, doi = {10.3390/fi15060217}, abstract = {With the increasing popularity of IoT (Internet-of-Things) devices, their security becomes an increasingly important issue. Buffer overflow vulnerabilities have been known for decades, but are still relevant, especially for embedded devices where certain security measures cannot be implemented due to hardware restrictions or simply due to their impact on performance. Therefore, many buffer overflow detection mechanisms check for overflows only before critical data are used. All data that an attacker could use for his own purposes can be considered critical. It is, therefore, essential that all critical data are checked between writing a buffer and its usage. This paper presents a vulnerability of the ESP32 microcontroller, used in millions of IoT devices, that is based on a pointer that is not protected by classic buffer overflow detection mechanisms such as Stack Canaries or Shadow Stacks. This paper discusses the implications of vulnerability and presents mitigation techniques, including a patch, that fixes the vulnerability. The overhead of the patch is evaluated using simulation as well as an ESP32-WROVER-E development board. We showed that, in the simulation with 32 general-purpose registers, the overhead for the CoreMark benchmark ranges between 0.1\% and 0.4\%. On the ESP32, which uses an Xtensa LX6 core with 64 general-purpose registers, the overhead went down to below 0.01\%. A worst-case scenario, modeled by a synthetic benchmark, showed overheads up to 9.68\%.}, language = {en} } @misc{AftowiczKabinDykaetal., author = {Aftowicz, Marcin and Kabin, Ievgen and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Non-Profiled Unsupervised Horizontal Iterative Attack against Hardware Elliptic Curve Scalar Multiplication Using Machine Learning}, series = {Future Internet}, volume = {16}, journal = {Future Internet}, number = {2}, issn = {1999-5903}, doi = {10.3390/fi16020045}, abstract = {While IoT technology makes industries, cities, and homes smarter, it also opens the door to security risks. With the right equipment and physical access to the devices, the attacker can leverage side-channel information, like timing, power consumption, or electromagnetic emanation, to compromise cryptographic operations and extract the secret key. This work presents a side channel analysis of a cryptographic hardware accelerator for the Elliptic Curve Scalar Multiplication operation, implemented in a Field-Programmable Gate Array and as an Application-Specific Integrated Circuit. The presented framework consists of initial key extraction using a state-of-the-art statistical horizontal attack and is followed by regularized Artificial Neural Networks, which take, as input, the partially incorrect key guesses from the horizontal attack and correct them iteratively. The initial correctness of the horizontal attack, measured as the fraction of correctly extracted bits of the secret key, was improved from 75\% to 98\% by applying the iterative learning.}, language = {en} } @misc{FoersterLangendoerferHinze, author = {F{\"o}rster, Benjamin and Langend{\"o}rfer, Peter and Hinze, Thomas}, title = {Determining Distributions of Security Means for WSNs Based on the Model of a Neighborhood Watch}, series = {IEEE Access}, volume = {12}, journal = {IEEE Access}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, issn = {2169-3536}, doi = {10.1109/ACCESS.2024.3404816}, pages = {74343 -- 74366}, language = {en} } @misc{AftowiczKabinDykaetal., author = {Aftowicz, Marcin and Kabin, Ievgen and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Advantages of unsupervised learning analysis methods in single-trace SCA attacks}, series = {Microprocessors and Microsystems}, volume = {105}, journal = {Microprocessors and Microsystems}, publisher = {Elsevier BV}, issn = {0141-9331}, doi = {10.1016/j.micpro.2023.104994}, pages = {10}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {StackSpecter: detecting stack buffer overflows for the Xtensa architecture}, series = {2024 34th International Telecommunication Networks and Applications Conference (ITNAC)}, journal = {2024 34th International Telecommunication Networks and Applications Conference (ITNAC)}, publisher = {IEEE}, doi = {10.1109/ITNAC62915.2024.10815333}, pages = {1 -- 7}, language = {en} } @misc{ChitauroBrzozowskiYeneretal., author = {Chitauro, Ronald and Brzozowski, Marcin and Yener, Onur and Langend{\"o}rfer, Peter}, title = {Out of distribution generalization: KPI vs spectrogram based jamming classification in 5G}, series = {2024 International Conference on Software, Telecommunications and Computer Networks (SoftCOM)}, journal = {2024 International Conference on Software, Telecommunications and Computer Networks (SoftCOM)}, publisher = {IEEE}, doi = {10.23919/SoftCOM62040.2024.10721712}, pages = {1 -- 6}, language = {en} } @misc{AlsabbaghKimPatiletal., author = {Alsabbagh, Wael and Kim, Chaerin and Patil, Nitin Sanjay and Langend{\"o}rfer, Peter}, title = {Beyond the lens: false data injection attacks on IIoT-cameras through MQTT manipulation}, series = {2024 7th Conference on Cloud and Internet of Things (CIoT)}, journal = {2024 7th Conference on Cloud and Internet of Things (CIoT)}, publisher = {IEEE}, doi = {10.1109/CIoT63799.2024.10757025}, pages = {1 -- 7}, language = {en} } @misc{KabinSchaeffnerSigourouetal., author = {Kabin, Ievgen and Schaeffner, Jan and Sigourou, Alkistis and Petryk, Dmytro and Dyka, Zoya and Klein, Dominik and Freud, Sven and Langend{\"o}rfer, Peter}, title = {Stealth attacks on PCBs: an experimental plausibility analysis}, series = {2024 IEEE International Conference on Cyber Security and Resilience (CSR)}, journal = {2024 IEEE International Conference on Cyber Security and Resilience (CSR)}, publisher = {IEEE}, doi = {10.1109/CSR61664.2024.10679465}, pages = {905 -- 912}, language = {en} } @misc{AlsabbaghKimPatiletal., author = {Alsabbagh, Wael and Kim, Chaerin and Patil, Nitin Sanjay and Langend{\"o}rfer, Peter}, title = {Hacking the backbone : shell reverse attacks on IIoT systems}, series = {21st International Conference on Embedded Wireless Systems and Networks (EWSN)}, journal = {21st International Conference on Embedded Wireless Systems and Networks (EWSN)}, doi = {10.13140/RG.2.2.23097.79207}, pages = {1 -- 7}, abstract = {As Industrial Internet of Things (IIoT) systems expand , they face growing risks from complex cyber threats, including reverse shell attacks. These attacks exploit IIoT vulnerabilities, allowing unauthorized remote access and endangering industrial operations. This paper explores reverse shell attacks, where adversaries trick operators into unwittingly installing malware on IIoT devices. This malware then establishes hidden connections to the attacker's server, bypassing traditional firewalls. Exploiting command injection vulnerabilities on IIoT servers facilitates the deployment of reverse shell scripts, granting attackers persistent and covert system access. Our research focuses on IIoT device authentication, identifying weak credentials and using brute force attacks for initial access. We also demonstrate deploying Python-based reverse shell payloads via the SFTP protocol, creating lasting connections to the attacker's server. Through experiments with the Fischertechnik Learning Factory 4.0, we show how reverse shell payloads disrupt operations, enabling unauthorized commands and data theft. To counter these threats, we advocate for robust security measures like network segmentation, rigorous patch management, and advanced intrusion detection systems. All our attack codes and a proof-of-concept are publicly accessible.}, language = {de} } @misc{ChitauroBrzozowskiYeneretal., author = {Chitauro, Ronald and Brzozowski, Marcin and Yener, Onur and Langend{\"o}rfer, Peter}, title = {Real-time jamming detection, classification and logging using computer vision in 5G private networks}, series = {2024 19th International Symposium on Wireless Communication Systems (ISWCS)}, journal = {2024 19th International Symposium on Wireless Communication Systems (ISWCS)}, publisher = {IEEE}, doi = {10.1109/ISWCS61526.2024.10639080}, pages = {1 -- 6}, language = {en} } @misc{KabinDykaSigourouetal., author = {Kabin, Ievgen and Dyka, Zoya and Sigourou, Alkistis-Aikaterini and Langend{\"o}rfer, Peter}, title = {Static power consumption as a new side-channel analysis threat to elliptic curve cryptography implementations}, series = {2024 IEEE International Conference on Cyber Security and Resilience (CSR)}, journal = {2024 IEEE International Conference on Cyber Security and Resilience (CSR)}, publisher = {IEEE}, doi = {10.1109/CSR61664.2024.10679507}, pages = {884 -- 889}, language = {en} } @misc{AssafoLangendoerfer, author = {Assafo, Maryam and Langend{\"o}rfer, Peter}, title = {Unsupervised and semisupervised machine learning frameworks for multiclass tool wear recognition}, series = {IEEE Open Journal of the Industrial Electronics Society}, volume = {5 (2024)}, journal = {IEEE Open Journal of the Industrial Electronics Society}, publisher = {Institute of Electrical and Electronics Engineers (IEEE)}, issn = {2644-1284}, doi = {10.1109/OJIES.2024.3455264}, pages = {993 -- 1010}, language = {en} } @misc{VogelLangendoerfer, author = {Vogel, Elisabeth and Langend{\"o}rfer, Peter}, title = {Enhancing Cyber-Resilience in Cyber-Physical Systems of Systems: A Methodical Approach}, series = {Posters : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus}, journal = {Posters : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus}, publisher = {AMA Service GmbH}, address = {Von-M{\"u}nchhausen-Str. 49, 31515 Wunstorf, Germany}, doi = {10.5162/iCCC2024/P10}, pages = {146 -- 149}, language = {en} } @misc{LehnigerRaghunathanLangendoerfer, author = {Lehniger, Kai and Raghunathan, Shuba Pradha and Langend{\"o}rfer, Peter}, title = {WindowGuardian: return address integrity for ESP32 microcontrollers with Xtensa Processors using AES and register Windows}, series = {2024 13th Mediterranean Conference on Embedded Computing (MECO)}, journal = {2024 13th Mediterranean Conference on Embedded Computing (MECO)}, publisher = {IEEE}, doi = {10.1109/MECO62516.2024.10577840}, pages = {1 -- 8}, language = {en} } @misc{MykytynBrzozowskiDykaetal., author = {Mykytyn, Pavlo and Brzozowski, Marcin and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Towards secure and reliable heterogeneous real-time telemetry communication in autonomous UAV swarms}, series = {Poster : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus}, journal = {Poster : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus}, publisher = {AMA Service GmbH}, address = {Von-M{\"u}nchhausen-Str. 49, 31515 Wunstorf, Germany}, doi = {10.5162/iCCC2024/P15}, pages = {222 -- 225}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Silent sabotage : a stealthy control logic injection in IIoT systems}, series = {5th Silicon Valley Cybersecurity Conference (SVCC 2024)}, journal = {5th Silicon Valley Cybersecurity Conference (SVCC 2024)}, publisher = {IEEE}, address = {New York}, doi = {10.1109/SVCC61185.2024.10637363}, pages = {1 -- 8}, language = {de} } @misc{HaddadiEsfahaniMayeFrohbergetal., author = {Haddadi Esfahani, Ali and Maye, Oliver and Frohberg, Max and Langend{\"o}rfer, Peter}, title = {Minimizing the latency of freezing of gait detection on wearable devices}, series = {Vortr{\"a}ge : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus}, journal = {Vortr{\"a}ge : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus}, publisher = {AMA Service GmbH}, address = {Von-M{\"u}nchhausen-Str. 49, 31515 Wunstorf, Germany}, doi = {10.5162/iCCC2024/2.2}, pages = {49 -- 52}, language = {en} }