TY - GEN A1 - Sigourou, Alkistis A1 - Kabin, Ievgen A1 - Langendörfer, Peter A1 - Sklavos, Nicolas A1 - Dyka, Zoya T1 - Successful Simple Side Channel Analysis: Vulnerability of an Atomic Pattern kP Algorithm Implemented with a Constant Time Crypto Library to Simple Electromagnetic Analysis Attacks T2 - 12th Mediterranean Conference on Embedded Computing (MECO 2023), 167 (2023) Y1 - 2023 SN - 979-8-3503-2291-0 SN - 979-8-3503-2290-3 U6 - https://doi.org/10.1109/MECO58584.2023.10154940 SN - 2637-9511 ER - TY - GEN A1 - Kabin, Ievgen A1 - Dyka, Zoya A1 - Langendörfer, Peter T1 - Randomized Addressing Countermeasures are Inefficient against Address-Bit SCA T2 - IEEE International Conference on Cyber Security and Resilience (CSR 2023), 580 (2023) Y1 - 2023 SN - 979-8-3503-1170-9 SN - 979-8-3503-1171-6 U6 - https://doi.org/10.1109/CSR57506.2023.10224968 ER - TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Langendörfer, Peter T1 - Good Night, and Good Luck: A Control Logic Injection Attack on OpenPLC T2 - Proc. 49th Annual Conference of the IEEE Industrial Electronics Society (IECON 2023), (2023) Y1 - 2023 U6 - https://doi.org/10.13140/RG.2.2.32913.20321 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Through the Window: Exploitation and Countermeasures of the ESP32 Register Window Overflow T2 - Future Internet N2 - With the increasing popularity of IoT (Internet-of-Things) devices, their security becomes an increasingly important issue. Buffer overflow vulnerabilities have been known for decades, but are still relevant, especially for embedded devices where certain security measures cannot be implemented due to hardware restrictions or simply due to their impact on performance. Therefore, many buffer overflow detection mechanisms check for overflows only before critical data are used. All data that an attacker could use for his own purposes can be considered critical. It is, therefore, essential that all critical data are checked between writing a buffer and its usage. This paper presents a vulnerability of the ESP32 microcontroller, used in millions of IoT devices, that is based on a pointer that is not protected by classic buffer overflow detection mechanisms such as Stack Canaries or Shadow Stacks. This paper discusses the implications of vulnerability and presents mitigation techniques, including a patch, that fixes the vulnerability. The overhead of the patch is evaluated using simulation as well as an ESP32-WROVER-E development board. We showed that, in the simulation with 32 general-purpose registers, the overhead for the CoreMark benchmark ranges between 0.1% and 0.4%. On the ESP32, which uses an Xtensa LX6 core with 64 general-purpose registers, the overhead went down to below 0.01%. A worst-case scenario, modeled by a synthetic benchmark, showed overheads up to 9.68%. KW - Xtensa KW - Buffer overflow KW - return-oriented prgramming Y1 - 2023 U6 - https://doi.org/10.3390/fi15060217 SN - 1999-5903 VL - 15 IS - 6 ER - TY - GEN A1 - Aftowicz, Marcin A1 - Kabin, Ievgen A1 - Dyka, Zoya A1 - Langendörfer, Peter T1 - Non-Profiled Unsupervised Horizontal Iterative Attack against Hardware Elliptic Curve Scalar Multiplication Using Machine Learning T2 - Future Internet N2 - While IoT technology makes industries, cities, and homes smarter, it also opens the door to security risks. With the right equipment and physical access to the devices, the attacker can leverage side-channel information, like timing, power consumption, or electromagnetic emanation, to compromise cryptographic operations and extract the secret key. This work presents a side channel analysis of a cryptographic hardware accelerator for the Elliptic Curve Scalar Multiplication operation, implemented in a Field-Programmable Gate Array and as an Application-Specific Integrated Circuit. The presented framework consists of initial key extraction using a state-of-the-art statistical horizontal attack and is followed by regularized Artificial Neural Networks, which take, as input, the partially incorrect key guesses from the horizontal attack and correct them iteratively. The initial correctness of the horizontal attack, measured as the fraction of correctly extracted bits of the secret key, was improved from 75% to 98% by applying the iterative learning. KW - side channel analysis KW - machine learning KW - horizontal attack KW - non-profiled attack KW - FPGA KW - ASIC Y1 - 2024 U6 - https://doi.org/10.3390/fi16020045 SN - 1999-5903 VL - 16 IS - 2 ER - TY - GEN A1 - Förster, Benjamin A1 - Langendörfer, Peter A1 - Hinze, Thomas T1 - Determining Distributions of Security Means for WSNs Based on the Model of a Neighborhood Watch T2 - IEEE Access Y1 - 2024 U6 - https://doi.org/10.1109/ACCESS.2024.3404816 SN - 2169-3536 VL - 12 SP - 74343 EP - 74366 PB - Institute of Electrical and Electronics Engineers (IEEE) ER - TY - GEN A1 - Aftowicz, Marcin A1 - Kabin, Ievgen A1 - Dyka, Zoya A1 - Langendörfer, Peter T1 - Advantages of unsupervised learning analysis methods in single-trace SCA attacks T2 - Microprocessors and Microsystems Y1 - 2024 U6 - https://doi.org/10.1016/j.micpro.2023.104994 SN - 0141-9331 VL - 105 PB - Elsevier BV ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - StackSpecter: detecting stack buffer overflows for the Xtensa architecture T2 - 2024 34th International Telecommunication Networks and Applications Conference (ITNAC) Y1 - 2024 U6 - https://doi.org/10.1109/ITNAC62915.2024.10815333 SP - 1 EP - 7 PB - IEEE ER - TY - GEN A1 - Chitauro, Ronald A1 - Brzozowski, Marcin A1 - Yener, Onur A1 - Langendörfer, Peter T1 - Out of distribution generalization: KPI vs spectrogram based jamming classification in 5G T2 - 2024 International Conference on Software, Telecommunications and Computer Networks (SoftCOM) Y1 - 2024 U6 - https://doi.org/10.23919/SoftCOM62040.2024.10721712 SP - 1 EP - 6 PB - IEEE ER - TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Patil, Nitin Sanjay A1 - Langendörfer, Peter T1 - Beyond the lens: false data injection attacks on IIoT-cameras through MQTT manipulation T2 - 2024 7th Conference on Cloud and Internet of Things (CIoT) Y1 - 2024 U6 - https://doi.org/10.1109/CIoT63799.2024.10757025 SP - 1 EP - 7 PB - IEEE ER - TY - GEN A1 - Kabin, Ievgen A1 - Schaeffner, Jan A1 - Sigourou, Alkistis A1 - Petryk, Dmytro A1 - Dyka, Zoya A1 - Klein, Dominik A1 - Freud, Sven A1 - Langendörfer, Peter T1 - Stealth attacks on PCBs: an experimental plausibility analysis T2 - 2024 IEEE International Conference on Cyber Security and Resilience (CSR) Y1 - 2024 U6 - https://doi.org/10.1109/CSR61664.2024.10679465 SP - 905 EP - 912 PB - IEEE ER - TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Patil, Nitin Sanjay A1 - Langendörfer, Peter T1 - Hacking the backbone : shell reverse attacks on IIoT systems T2 - 21st International Conference on Embedded Wireless Systems and Networks (EWSN) N2 - As Industrial Internet of Things (IIoT) systems expand , they face growing risks from complex cyber threats, including reverse shell attacks. These attacks exploit IIoT vulnerabilities, allowing unauthorized remote access and endangering industrial operations. This paper explores reverse shell attacks, where adversaries trick operators into unwittingly installing malware on IIoT devices. This malware then establishes hidden connections to the attacker's server, bypassing traditional firewalls. Exploiting command injection vulnerabilities on IIoT servers facilitates the deployment of reverse shell scripts, granting attackers persistent and covert system access. Our research focuses on IIoT device authentication, identifying weak credentials and using brute force attacks for initial access. We also demonstrate deploying Python-based reverse shell payloads via the SFTP protocol, creating lasting connections to the attacker's server. Through experiments with the Fischertechnik Learning Factory 4.0, we show how reverse shell payloads disrupt operations, enabling unauthorized commands and data theft. To counter these threats, we advocate for robust security measures like network segmentation, rigorous patch management, and advanced intrusion detection systems. All our attack codes and a proof-of-concept are publicly accessible. Y1 - 2024 U6 - https://doi.org/10.13140/RG.2.2.23097.79207 SP - 1 EP - 7 ER - TY - GEN A1 - Chitauro, Ronald A1 - Brzozowski, Marcin A1 - Yener, Onur A1 - Langendörfer, Peter T1 - Real-time jamming detection, classification and logging using computer vision in 5G private networks T2 - 2024 19th International Symposium on Wireless Communication Systems (ISWCS) Y1 - 2024 U6 - https://doi.org/10.1109/ISWCS61526.2024.10639080 SP - 1 EP - 6 PB - IEEE ER - TY - GEN A1 - Kabin, Ievgen A1 - Dyka, Zoya A1 - Sigourou, Alkistis-Aikaterini A1 - Langendörfer, Peter T1 - Static power consumption as a new side-channel analysis threat to elliptic curve cryptography implementations T2 - 2024 IEEE International Conference on Cyber Security and Resilience (CSR) Y1 - 2024 U6 - https://doi.org/10.1109/CSR61664.2024.10679507 SP - 884 EP - 889 PB - IEEE ER - TY - GEN A1 - Assafo, Maryam A1 - Langendörfer, Peter T1 - Unsupervised and semisupervised machine learning frameworks for multiclass tool wear recognition T2 - IEEE Open Journal of the Industrial Electronics Society Y1 - 2024 U6 - https://doi.org/10.1109/OJIES.2024.3455264 SN - 2644-1284 VL - 5 (2024) SP - 993 EP - 1010 PB - Institute of Electrical and Electronics Engineers (IEEE) ER - TY - GEN A1 - Vogel, Elisabeth A1 - Langendörfer, Peter T1 - Enhancing Cyber-Resilience in Cyber-Physical Systems of Systems: A Methodical Approach T2 - Posters : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus Y1 - 2024 U6 - https://doi.org/10.5162/iCCC2024/P10 SP - 146 EP - 149 PB - AMA Service GmbH CY - Von-Münchhausen-Str. 49, 31515 Wunstorf, Germany ER - TY - GEN A1 - Lehniger, Kai A1 - Raghunathan, Shuba Pradha A1 - Langendörfer, Peter T1 - WindowGuardian: return address integrity for ESP32 microcontrollers with Xtensa Processors using AES and register Windows T2 - 2024 13th Mediterranean Conference on Embedded Computing (MECO) Y1 - 2024 U6 - https://doi.org/10.1109/MECO62516.2024.10577840 SP - 1 EP - 8 PB - IEEE ER - TY - GEN A1 - Mykytyn, Pavlo A1 - Brzozowski, Marcin A1 - Dyka, Zoya A1 - Langendörfer, Peter T1 - Towards secure and reliable heterogeneous real-time telemetry communication in autonomous UAV swarms T2 - Poster : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus Y1 - 2024 U6 - https://doi.org/10.5162/iCCC2024/P15 SP - 222 EP - 225 PB - AMA Service GmbH CY - Von-Münchhausen-Str. 49, 31515 Wunstorf, Germany ER - TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Langendörfer, Peter T1 - Silent sabotage : a stealthy control logic injection in IIoT systems T2 - 5th Silicon Valley Cybersecurity Conference (SVCC 2024) Y1 - 2024 U6 - https://doi.org/10.1109/SVCC61185.2024.10637363 SP - 1 EP - 8 PB - IEEE CY - New York ER - TY - GEN A1 - Haddadi Esfahani, Ali A1 - Maye, Oliver A1 - Frohberg, Max A1 - Langendörfer, Peter T1 - Minimizing the latency of freezing of gait detection on wearable devices T2 - Vorträge : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus Y1 - 2024 U6 - https://doi.org/10.5162/iCCC2024/2.2 SP - 49 EP - 52 PB - AMA Service GmbH CY - Von-Münchhausen-Str. 49, 31515 Wunstorf, Germany ER - TY - GEN A1 - Förster, Benjamin A1 - Langendörfer, Peter A1 - Hinze, Thomas T1 - Security mean distribution in WSNs for cooperative schemes T2 - Vorträge : iCCC2024 - iCampµs Cottbus Conference 2024-05-14 - 2024-05-16 Cottbus Y1 - 2024 U6 - https://doi.org/10.5162/iCCC2024/1.2 SP - 38 EP - 41 PB - AMA Service GmbH CY - Von-Münchhausen-Str. 49, 31515 Wunstorf, Germany ER - TY - GEN A1 - Alsabbagh, Wael A1 - Kim, Chaerin A1 - Langendörfer, Peter T1 - Investigating the security of OpenPLC : vulnerabilities, attacks, and mitigation solutions T2 - IEEE Access Y1 - 2024 U6 - https://doi.org/10.1109/ACCESS.2024.3356051 SN - 2169-3536 VL - 12 SP - 11561 EP - 11583 PB - Institute of Electrical and Electronics Engineers (IEEE) ER - TY - GEN A1 - Kabin, Ievgen A1 - Dyka, Zoya A1 - Klann, Dan A1 - Langendörfer, Peter T1 - EC P-256: Successful Simple Power Analysis T2 - arXiv Y1 - 2021 U6 - https://doi.org/10.48550/arXiv.2106.12321 SP - 1 EP - 5 ER - TY - GEN A1 - Kabin, Ievgen A1 - Dyka, Zoya A1 - Klann, Dan A1 - Langendörfer, Peter T1 - EC Scalar Multiplication: Successful Simple Address-Bit SCA Attack against Atomic Patterns T2 - IEEE 22nd Latin American Test Symposium (LATS) Y1 - 2021 SN - 978-1-6654-2058-7 U6 - https://doi.org/10.1109/LATS53581.2021.9651877 SN - 2373-0862 ER - TY - GEN A1 - Sosa, Omar Alejandro A1 - Dyka, Zoya A1 - Kabin, Ievgen A1 - Langendörfer, Peter T1 - Simulation of Electromagnetic Emanation of Cryptographic ICs: Tools, Methods, Problems T2 - 19th IEEE East-West Design & Test Symposium (EWDTS 2021), 12 (2021) Y1 - 2021 SN - 978-1-6654-4504-7 U6 - https://doi.org/10.1109/EWDTS52692.2021.9581013 SN - 2472-761X ER -