@misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {No Need to be Online to Attack - Exploiting S7-1500 PLCs by Time-Of-Day Block}, series = {Proc. 28th International Conference on Information, Communication and Automation Technologies (ICAT 2022), arajevo, Bosnia and Herzegovina, 16-18 June 2022}, journal = {Proc. 28th International Conference on Information, Communication and Automation Technologies (ICAT 2022), arajevo, Bosnia and Herzegovina, 16-18 June 2022}, isbn = {978-1-6654-6692-9}, issn = {2643-1858}, doi = {10.1109/ICAT54566.2022.9811147}, pages = {8}, language = {en} } @misc{DykaKabinBrzozowskietal., author = {Dyka, Zoya and Kabin, Ievgen and Brzozowski, Marcin and Panic, Goran and Calligaro, Cristiano and Krstic, Milos and Langend{\"o}rfer, Peter}, title = {On the SCA Resistance of Crypto IP Cores}, series = {23rd IEEE Latin-American Test Symposium (LATS 2022), Montevideo, Uruguay, 05-08 September 2022}, journal = {23rd IEEE Latin-American Test Symposium (LATS 2022), Montevideo, Uruguay, 05-08 September 2022}, isbn = {978-1-6654-5707-1}, issn = {2373-0862}, doi = {10.1109/LATS57337.2022.9937007}, pages = {2}, language = {en} } @misc{ShamilyanKabinDykaetal., author = {Shamilyan, Oxana and Kabin, Ievgen and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Distributed Artificial Intelligence as a Means to Achieve Self-X-Functions for Increasing Resilience: the First Steps}, series = {11th Mediterranean Conference on Embedded Computing (MECO), Budva, Montenegro, 07-10 June 2022}, journal = {11th Mediterranean Conference on Embedded Computing (MECO), Budva, Montenegro, 07-10 June 2022}, isbn = {978-1-6654-6828-2}, issn = {2637-9511}, doi = {10.1109/MECO55406.2022.9797193}, pages = {6}, language = {en} } @misc{AftowiczLehnigerLangendoerfer, author = {Aftowicz, Marcin and Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Scalable FPGA Hardware Accelerator for SVM Inference}, series = {Proc. 10th International Conference on Cyber-Physical Systems and Internet-of-Things (CPS\&IoT 2022)}, journal = {Proc. 10th International Conference on Cyber-Physical Systems and Internet-of-Things (CPS\&IoT 2022)}, isbn = {978-1-6654-6828-2}, issn = {2637-9511}, doi = {10.1109/MECO55406.2022.9797110}, pages = {4}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {A Remote Attack Tool on Siemens S7-300 Controllers: Practical Report}, series = {Kommunikation und Bildverarbeitung in der Automation : Ausgew{\"a}hlte Beitr{\"a}ge der Jahreskolloquien KommA und BVAu 2020}, journal = {Kommunikation und Bildverarbeitung in der Automation : Ausgew{\"a}hlte Beitr{\"a}ge der Jahreskolloquien KommA und BVAu 2020}, editor = {Jasperneite, J{\"u}rgen and Lohweg, Volker}, publisher = {Springer Vieweg}, address = {Heidelberg}, isbn = {978-3-662-64282-5}, issn = {2522-8579}, doi = {10.1007/978-3-662-64283-2_1}, pages = {3 -- 21}, language = {en} } @misc{LehnigerLangendoerfer, author = {Lehniger, Kai and Langend{\"o}rfer, Peter}, title = {Through the Window: On the Exploitability of Xtensa's Register Window Overflow}, series = {32nd International Telecommunication Networks and Applications Conference (ITNAC 2022), Wellington, New Zealand, 30 November 2022 - 02 December 2022}, journal = {32nd International Telecommunication Networks and Applications Conference (ITNAC 2022), Wellington, New Zealand, 30 November 2022 - 02 December 2022}, isbn = {978-1-6654-7103-9}, issn = {2474-154X}, doi = {10.1109/ITNAC55475.2022.9998407}, pages = {353 -- 358}, language = {en} } @misc{BrzozowskiLangendoerferCasacaetal., author = {Brzozowski, Marcin and Langend{\"o}rfer, Peter and Casaca, Augusto and Grilo, Antonio and Diaz, Manuel and Mart{\´i}n, Cristian and Camacho, Jose and Landi, Giada}, title = {UNITE: Integrated IoT-Edge-Cloud Continuum}, series = {2022 IEEE 8th World Forum on Internet of Things (WF-IoT), Yokohama, 26 October 2022 - 11 November 2022 Japan}, journal = {2022 IEEE 8th World Forum on Internet of Things (WF-IoT), Yokohama, 26 October 2022 - 11 November 2022 Japan}, isbn = {978-1-6654-9153-2}, doi = {10.1109/WF-IoT54382.2022.10152292}, pages = {6}, language = {en} } @misc{FoersterHinzeLangendorfer, author = {F{\"o}rster, Benjamin and Hinze, Thomas and Langendorfer, Peter}, title = {Topology- and Resource-Based Distribution Scheme for Collaborative Security-Focused Design Space Exploration in Large-Scale Static WSNs}, series = {2024 34th International Telecommunication Networks and Applications Conference (ITNAC)}, journal = {2024 34th International Telecommunication Networks and Applications Conference (ITNAC)}, publisher = {IEEE}, doi = {10.1109/ITNAC62915.2024.10815368}, pages = {1 -- 6}, language = {en} } @misc{AlsabbaghAmogbonjayeKimetal., author = {Alsabbagh, Wael and Amogbonjaye, Samuel and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Pirates of the MQTT : raiding IIoT systems with a rogue client}, series = {2024 8th Cyber Security in Networking Conference (CSNet)}, journal = {2024 8th Cyber Security in Networking Conference (CSNet)}, publisher = {IEEE}, address = {Piscataway, NJ}, doi = {10.1109/CSNet64211.2024.10851733}, pages = {248 -- 253}, abstract = {The integration of MQTT (Message Queuing Telemetry Transport) in Industrial Internet of Things (IIoT) systems enhances operational efficiency but introduces significant security vulnerabilities, particularly through rogue MQTT clients. These clients exploit MQTT weaknesses to disrupt industrial processes and compromise data integrity. This paper examines the impact of rogue MQTT client attacks, demonstrated through a detailed case study using the Fischertechnik Lernfabrik 4.0. We highlight how attackers can exploit MQTT's inherent vulnerabilities, including anonymous connections and message retention, to inject false data and interfere with operations. To address these risks, we propose several mitigation strategies: implementing fine-grained authorization for topic access control, enhancing replay attack protection with Message Authentication Code (MAC), employing mutual TLS (mTLS) for secure client authentication, and incorporating real-time client activity monitoring and anomaly detection. These measures aim to bolster IIoT system security, mitigate potential disruptions, and maintain operational integrity. Our findings and recommendations contribute to advancing security practices in MQTT-based IIoT environments. All attack codes and a proof-of-concept are ublicly available.}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {A payload of lies : false data injection attacks on MQTT-based IIoT systems}, series = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, journal = {IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-6654-6454-3}, doi = {10.1109/IECON55916.2024.10905487}, pages = {1 -- 8}, abstract = {In the ever-evolving landscape of Industrial Internet of Things (IIoT), security emerges as a critical concern. This paper delves into the realm of False Data Injection Attacks (FDIAs) within MQTT-based IIoT systems, specifically targeting the publisher-subscriber model. Our exploration unveils two distinct attack scenarios that exploit the vulnerabilities inherent in the communication fabric. In the first scenario, we demonstrate the potential chaos wrought by sending false data to subscribers, manipulating their perception and inducing actions that align with the attacker's whims. The second scenario ventures into the heart of the publisher, where the attacker injects false data - deceptive status updates from other publishers e.g., Programmable Logic Controllers (PLCs). The repercussions ripple through the entire industrial process, impacting operations based on fraudulent information. This showcases the cascading effects of FDIAs, illustrating the profound threat they pose to the reliability and integrity of IIoT systems. For real-world attack scenarios, Our attacks were conducted on a small MQTT-based IIoT system, using the Fischertechnik Lernfabrik 4.0 9V factory. Finally, we proposes mitigation solutions to safeguard IIoT systems from the far-reaching consequences of false data manipulation. Our attack codes as well as a proof-of-concept are publicly available for further research.}, language = {en} }