@techreport{LangendoerferHiebelMaaseretal., author = {Langend{\"o}rfer, Peter and Hiebel, St. and Maaser, Michael and Nowak, St.}, title = {Djamal-Eddine Meddour: OMEGA common semantic, Deliverable 5.1, 2008}, language = {en} } @misc{LangendoerferMaaser, author = {Langend{\"o}rfer, Peter and Maaser, Michael}, title = {Gesch{\"u}tztes Ausf{\"u}hren einer Datenverarbeitungsanwendung eines Diensteanbieters f{\"u}r einen Nutzer durch eine vertrauensw{\"u}rdige Ausf{\"u}hrungsumgebung}, language = {en} } @techreport{LangendoerferMaaser, author = {Langend{\"o}rfer, Peter and Maaser, Michael}, title = {White Paper WG5 Services and Applications: Middleware Platforms for Heterogeneous Distributed Systems}, language = {en} } @techreport{WesthoffLangendoerferPiotrowskietal., author = {Westhoff, D. and Langend{\"o}rfer, Peter and Piotrowski, Krzysztof and Poschmann, A.}, title = {Specification, Implementation and Simulation of Secure Distributed Data Storage}, language = {en} } @misc{LangendoerferDyka, author = {Langend{\"o}rfer, Peter and Dyka, Zoya}, title = {Area Efficient Hardware Implementation of Elliptic Curve Cryptography by Iteratively Applying Karatsuba's Method}, language = {en} } @misc{FalckMaassWeidenhauptetal., author = {Falck, T. and Maass, H. and Weidenhaupt, K. and Langend{\"o}rfer, Peter}, title = {Verfahren zum schrittweisen Austausch pers{\"o}nlicher Informationen in non-trusted Peer-to-Peer Umgebungen}, language = {en} } @techreport{DykaVaterMayeetal., author = {Dyka, Zoya and Vater, Frank and Maye, Oliver and Langend{\"o}rfer, Peter and Kraemer, Rolf}, title = {Efficient Implementations of Cryptographic Routines - A Review and Performance Analysis of Various Approaches}, language = {en} } @misc{AlsabbaghAmogbonjayeUrregoetal., author = {Alsabbagh, Wael and Amogbonjaye, Samuel and Urrego, Diego and Langend{\"o}rfer, Peter}, title = {A Stealthy False Command Injection Attack on Modbus based SCADA Systems}, series = {20th Consumer Communications \& Networking Conference (CCNC), (2023)}, journal = {20th Consumer Communications \& Networking Conference (CCNC), (2023)}, isbn = {978-1-6654-9734-3}, issn = {2331-9860}, doi = {10.1109/CCNC51644.2023.10059804}, pages = {9}, abstract = {Modbus is a widely-used industrial protocol in Supervisory Control and Data Acquisition (SCADA) systems for different purposes such as controlling remote devices, monitoring physical processes, data acquisition, etc. Unfortunately, such a protocol lacks security means i.e., authentication, integrity, and confidentiality. This has exposed industrial plants using the Modbus protocol and made them attractive to malicious adversaries who could perform various kinds of cyber-attacks causing significant consequences as Stuxnet showed. In this paper, we exploit the insecurity of the Modbus protocol and perform a stealthy false command injection scenario concealing our injection from the SCADA operator. Our attack approach is comprised of two main phases: 1) Pre-attack phase (offline) where an attacker sniffs, collects and stores sufficient valid request-response pairs in a database, 2) Attack phase (online) where the attacker performs false command injection and conceals his injection by replaying a valid response from his database upon each request sent from the HMI user. Such a scenario is quite severe and might cause disastrous damages in SCADA systems and critical infrastructures if it is successfully implemented by malicious adversaries. Finally, we suggest some appropriate mitigation solutions to prevent such a serious threat.}, language = {en} } @misc{FoersterLangendoerferHinze, author = {F{\"o}rster, Benjamin and Langend{\"o}rfer, Peter and Hinze, Thomas}, title = {Determining Distributions of Security Means for Wireless Sensor Networks based on the Model of a Neighbourhood Watch}, series = {arXiv}, journal = {arXiv}, doi = {10.48550/arXiv.2212.09050}, pages = {24}, abstract = {Neighbourhood watch is a concept that allows a community to distribute a complex security task in between all members. Members of the community carry out individual security tasks to contribute to the overall security of it. It reduces the workload of a particular individual while securing all members and allowing them to carry out a multitude of security tasks. Wireless sensor networks (WSNs) are composed of resource-constraint independent battery driven computers as nodes communicating wirelessly. Security in WSNs is essential. Without sufficient security, an attacker is able to eavesdrop the communication, tamper monitoring results or deny critical nodes providing their service in a way to cut off larger network parts. The resource-constraint nature of sensor nodes prevents them from running full-fledged security protocols. Instead, it is necessary to assess the most significant security threats and implement specialised protocols. A neighbourhood-watch inspired distributed security scheme for WSNs has been introduced by Langend\"orfer. Its goal is to increase the variety of attacks a WSN can fend off. A framework of such complexity has to be designed in multiple steps. Here, we introduce an approach to determine distributions of security means on large-scale static homogeneous WSNs. Therefore, we model WSNs as undirected graphs in which two nodes connected iff they are in transmission range. The framework aims to partition the graph into \$n\$ distinct security means resulting in the targeted distribution. The underlying problems turn out to be NP hard and we attempt to solve them using linear programs (LPs). To evaluate the computability of the LPs, we generate large numbers of random {\lambda}-precision unit disk graphs (UDGs) as representation of WSNs. For this purpose, we introduce a novel {\lambda}-precision UDG generator to model WSNs with a minimal distance in between nodes.}, language = {en} } @misc{FoersterLangendoerferHinze, author = {F{\"o}rster, Benjamin and Langend{\"o}rfer, Peter and Hinze, Thomas}, title = {Novel Approach to a Plant Inspired Distributed Security Scheme for Wireless Sensor Networks}, series = {12th Mediterranean Conference on Embedded Computing (MECO), Budva, Montenegro, 2023}, journal = {12th Mediterranean Conference on Embedded Computing (MECO), Budva, Montenegro, 2023}, isbn = {979-8-3503-2291-0}, issn = {2637-9511}, doi = {10.1109/MECO58584.2023.10154949}, pages = {6}, abstract = {Energy efficiency is a key factor for the longevity of wireless sensor networks (WSNs). Most representatives of the plants have evolved to be highly energy-efficient in their survival strategies, despite their limited resources. Plants have to deal with a variety of threats originating from different herbivores and microbial pathogens while handling a number of abiotic stress factors. For plants and WSNs, different defence mechanisms impose different fitness costs and therefore the costs and benefits have to be well-balanced. This way, plants are able to not only conquer a large variety of different attacks but also handle several different simultaneous attacks adequately. To react early and adapt to upcoming threats, plants within a network are capable of signalling each other within a certain distance about ongoing attacks. The biological strategies of plants in terms of signalling and defence, as well as their energy and resource limitations, share significant similarities with WSNs. This study aims to explore these similarities and demonstrates the correspondence between the biological concepts and WSNs. Additionally, we present a novel approach to enhancing security in WSNs through a cooperative distributed security scheme inspired by key factors of plant defence mechanisms, with the goal of reducing the energy constraints and maximising the longevity of the network.}, language = {en} } @misc{AlsabbaghLangendoerfer, author = {Alsabbagh, Wael and Langend{\"o}rfer, Peter}, title = {You Are What You Attack: Breaking the Cryptographically-Protected S7 Protocol}, series = {19th International Conference on Factory Communication Systems (WFCS), (2023)}, journal = {19th International Conference on Factory Communication Systems (WFCS), (2023)}, publisher = {IEEE}, isbn = {978-1-6654-6432-1}, issn = {2835-8414}, doi = {10.1109/WFCS57264.2023.10144251}, pages = {8}, abstract = {S7 protocol defines an appropriate format for exchanging messages between SIMATIC S7 PLCs and their corresponding engineering software i.e., TIA Portal. Recently, Siemens has provided its newer PLC models and their proprietary S7 protocols with a very developed and sophisticated integrity check mechanism to protect them from various exploits e.g., replay attacks. This paper addresses exactly this point, and investigates the security of the most developed integrity check mechanism that the newest S7CommPlus protocol version implements. Our results showed that the latest S7 PLC models as well as their related protocols are still vulnerable. We found that adversaries can manipulate two hashes that play a significant role in generating keys and bytes for the encryption processes implemented in the S7CommPlus protocol. This allows to reproduce S7 packets and conduct several attacks that eventually impact the operation of the target PLC and the entire physical process it controls. To validate our findings, we test all the attack scenarios presented in this work on a cryptographically protected S7 PLC from the 1500 family which uses the S7CommPlusV3 protocol.}, language = {en} } @incollection{LangendoerferKornemannAlsabbaghetal., author = {Langend{\"o}rfer, Peter and Kornemann, Stephan and Alsabbagh, Wael and Hermann, Erik}, title = {Information Security: The Cornerstone for Surviving the Digital Wild}, series = {The Future of Smart Production for SMEs: A Methodological and Practical Approach Towards Digitalization in SMEs}, booktitle = {The Future of Smart Production for SMEs: A Methodological and Practical Approach Towards Digitalization in SMEs}, publisher = {Springer International Publishing}, address = {Cham}, isbn = {978-3-031-15428-7}, doi = {10.1007/978-3-031-15428-7_29}, pages = {335 -- 341}, abstract = {In this chapter we are discussing the very basics in the sense of how to prepare your company with respect to security. The essential issues are a proper information security governance framework that takes into account the managerial and organizational issues as well as proper technical means. For the latter we introduce network separation as this is one of the prime means to protect your production network from network based attacks.}, language = {en} } @misc{SigourouKabinLangendoerferetal., author = {Sigourou, Alkistis and Kabin, Ievgen and Langend{\"o}rfer, Peter and Sklavos, Nicolas and Dyka, Zoya}, title = {Successful Simple Side Channel Analysis: Vulnerability of an Atomic Pattern kP Algorithm Implemented with a Constant Time Crypto Library to Simple Electromagnetic Analysis Attacks}, series = {12th Mediterranean Conference on Embedded Computing (MECO 2023), 167 (2023)}, journal = {12th Mediterranean Conference on Embedded Computing (MECO 2023), 167 (2023)}, isbn = {979-8-3503-2291-0}, issn = {2637-9511}, doi = {10.1109/MECO58584.2023.10154940}, pages = {6}, language = {en} } @misc{KabinDykaLangendoerfer, author = {Kabin, Ievgen and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Randomized Addressing Countermeasures are Inefficient against Address-Bit SCA}, series = {IEEE International Conference on Cyber Security and Resilience (CSR 2023), 580 (2023)}, journal = {IEEE International Conference on Cyber Security and Resilience (CSR 2023), 580 (2023)}, isbn = {979-8-3503-1170-9}, doi = {10.1109/CSR57506.2023.10224968}, pages = {6}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {Good Night, and Good Luck: A Control Logic Injection Attack on OpenPLC}, series = {Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023)}, journal = {Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023)}, doi = {10.13140/RG.2.2.32913.20321}, pages = {8}, language = {en} } @misc{AlsabbaghKimLangendoerfer, author = {Alsabbagh, Wael and Kim, Chaerin and Langend{\"o}rfer, Peter}, title = {No Attacks Are Available: Securing the OpenPLC and Related Systems}, series = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, journal = {8th GI/ACM Workshop on Industrial Automation and Control Systems (IACS WS 2023), 2085 (2023)}, doi = {10.13140/RG.2.2.24570.47043}, pages = {12}, abstract = {The use of Programmable Logic Controllers (PLCs) expands in industrial domains, which makes ensuring the security of Industrial Control Systems (ICSs) become paramount. The OpenPLC project, the first open-source initiative, provides flexible and cost-effective PLC solutions to build up affordable test-beds, as well as conduct experiments and academic researches. This project has wildly grown in the last few years, thus it is essential to address the most emerging security challenges it encounters. This paper introduces a new OpenPLC architecture, called OpenPLC Aqua, provided with a set of security solutions designed specifically to overcome the vulnerabilities that the current OpenPLC versions are prone to. The new OpenPLC architecture includes four security features: 1) user credentials encryption, securing the Webserver, Whitelisting and secure SSL/TLS communication channel. The OpenPLC Aqua software was tested against several attack scenarios, that were feasible against the old OpenPLC versions. Our experimental results showed our enhanced OpenPLC software is secure and resistant against several attack scenarios e.g., authentication, injection, Man-in-the-Middle and replay attacks. The OpenPLC Aqua is publicly available and a proof of concept demo is also published with this paper.}, language = {en} } @misc{KabinLangendoerferDyka, author = {Kabin, Ievgen and Langend{\"o}rfer, Peter and Dyka, Zoya}, title = {Vulnerability of Atomic Patterns to Simple SCA}, series = {19th IEEE East-West Design \& Test Symposium (EWDTS 2023), (2023)}, journal = {19th IEEE East-West Design \& Test Symposium (EWDTS 2023), (2023)}, isbn = {979-8-3503-1484-7}, issn = {2472-761X}, doi = {10.1109/EWDTS59469.2023.10297074}, pages = {4}, abstract = {In this work we discuss the vulnerability of atomic pattern algorithms for elliptic curve point multiplication against simple side-channel analysis attacks using our own implementation as an example. One of the assumptions, on which the atomicity principle is based, is the indistinguishability of operations with different registers, i.e. storing of the data into two different registers cannot be distinguished if their old and new data values are the same. But before the data can be stored in a register/block, this register/block has to be addressed for storing the data. Different registers/blocks have different addresses. The key-dependent addressing of registers/blocks is an inherent feature of the binary kP algorithms and allows to reveal the key k. In our work we demonstrated it. This means that the main assumption, that addressing of different registers/blocks is an indistinguishable operation, may no longer be applied when realizing kP implementations, at least not for hardware implementations.}, language = {en} } @misc{HaddadiEsfahaniMayeFrohbergetal., author = {Haddadi Esfahani, Ali and Maye, Oliver and Frohberg, Max and Speh, Maria and J{\"o}bges, Michael and Langend{\"o}rfer, Peter}, title = {Machine Learning based Real Time Detection of Freezing of Gait of Parkinson Patients Running on a Body Worn Device}, series = {IEEE/ACM international conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE 2023), 181 (2023)}, journal = {IEEE/ACM international conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE 2023), 181 (2023)}, isbn = {979-8-4007-0102-3}, issn = {2832-2975}, doi = {10.1145/3580252.3589423}, pages = {181 -- 182}, abstract = {For those who have Parkinson's disease, one of the most incapacitating symptoms is Freezing of Gait (FOG). Gait impairment and disruptions limit everyday activities and reduce quality of daily life along with the increase in the risk of falling [1]. Thanks to recent advancement in embedded electronics and sensors as well as their adaptation in the wearable device market, low power devices are becoming more and more capable running neural networks. This enables researchers to implement complex models on wearable devices that capture and analyze sensor data to detect FOGin real-time.}, language = {en} } @misc{AftowiczKabinDykaetal., author = {Aftowicz, Marcin and Kabin, Ievgen and Dyka, Zoya and Langend{\"o}rfer, Peter}, title = {Non-Profiled Unsupervised Horizontal Iterative Attack against Hardware Elliptic Curve Scalar Multiplication Using Machine Learning}, series = {Future Internet}, volume = {16}, journal = {Future Internet}, number = {2}, issn = {1999-5903}, doi = {10.3390/fi16020045}, abstract = {While IoT technology makes industries, cities, and homes smarter, it also opens the door to security risks. With the right equipment and physical access to the devices, the attacker can leverage side-channel information, like timing, power consumption, or electromagnetic emanation, to compromise cryptographic operations and extract the secret key. This work presents a side channel analysis of a cryptographic hardware accelerator for the Elliptic Curve Scalar Multiplication operation, implemented in a Field-Programmable Gate Array and as an Application-Specific Integrated Circuit. The presented framework consists of initial key extraction using a state-of-the-art statistical horizontal attack and is followed by regularized Artificial Neural Networks, which take, as input, the partially incorrect key guesses from the horizontal attack and correct them iteratively. The initial correctness of the horizontal attack, measured as the fraction of correctly extracted bits of the secret key, was improved from 75\% to 98\% by applying the iterative learning.}, language = {en} } @misc{NatarovSudakovDykaetal., author = {Natarov, Roman and Sudakov, Oleksandr and Dyka, Zoya and Kabin, Ievgen and Maksymyuk, O. and Iegorova, O. and Krishtal, Oleg A. and Langend{\"o}rfer, Peter}, title = {Resilience Aspects in Distributed Wireless Electroencephalographic Sampling}, series = {2020 9th Mediterranean Conference on Embedded Computing (MECO)}, journal = {2020 9th Mediterranean Conference on Embedded Computing (MECO)}, isbn = {978-1-7281-6949-1}, doi = {10.1109/MECO49872.2020.9134157}, pages = {7}, language = {en} }