TY - CHAP A1 - Urban, Roberto A1 - Lehniger, Kai A1 - Heyne, Maximilian A1 - Schölzel, Mario A1 - Vierhaus, Heinrich Theodor T1 - Vergleich der Beschreibung und Simulation einer Befehlssatzarchitektur in LISA und CoMet T2 - MBMV 2014, Böblingen, Methoden und Beschreibungssprachen zur Modellierung und Verifikation von Schaltungen und Systemen Y1 - 2014 SN - 978-3-95404-637-9 SP - 101 EP - 112 PB - Cuvillier Verlag CY - Göttingen ER - TY - GEN A1 - Lehniger, Kai A1 - Aftowicz, Marcin A1 - Schölzel, Mario A1 - Langendörfer, Peter T1 - Coarse-Grained Control Flow Integrity Check for Processors with Sliding Register Windows T2 - 12th Mediterranean Conference on Embedded Computing (MECO) Y1 - 2023 SN - 979-8-3503-2291-0 SN - 979-8-3503-2290-3 U6 - https://doi.org/10.1109/MECO58584.2023.10154928 SN - 2637-9511 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Window Canaries: Re-Thinking Stack Canaries for Architectures With Register Windows T2 - IEEE Transactions on Dependable and Secure Computing N2 - his paper presents Window Canaries, a novel approach to Stack Canaries for architectures with a register window that protects return addresses and stack pointers without the need of adding additional instruction to each potentially vulnerable function. Instead, placement and check of the canary word is moved to window exception handlers that are responsible to handle register window overflows and underflows. The approach offers low performance overhead while guaranteeing that return addresses are protected by stack buffer overflows without relying on a heuristic that decides which functions to instrument. The contributions of this paper are a complete implementation of the approach for the Xtensa LX architecture with register window option as well as a performance evaluation and discussion of advantages and drawbacks. KW - Buffer overflows KW - Computer architecture KW - stack canaries KW - Xtensa architecture Y1 - 2023 U6 - https://doi.org/10.1109/TDSC.2022.3230748 SN - 1941-0018 SN - 1545-5971 VL - 20 IS - 6 SP - 4637 EP - 4647 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Through the Window: Exploitation and Countermeasures of the ESP32 Register Window Overflow T2 - Future Internet N2 - With the increasing popularity of IoT (Internet-of-Things) devices, their security becomes an increasingly important issue. Buffer overflow vulnerabilities have been known for decades, but are still relevant, especially for embedded devices where certain security measures cannot be implemented due to hardware restrictions or simply due to their impact on performance. Therefore, many buffer overflow detection mechanisms check for overflows only before critical data are used. All data that an attacker could use for his own purposes can be considered critical. It is, therefore, essential that all critical data are checked between writing a buffer and its usage. This paper presents a vulnerability of the ESP32 microcontroller, used in millions of IoT devices, that is based on a pointer that is not protected by classic buffer overflow detection mechanisms such as Stack Canaries or Shadow Stacks. This paper discusses the implications of vulnerability and presents mitigation techniques, including a patch, that fixes the vulnerability. The overhead of the patch is evaluated using simulation as well as an ESP32-WROVER-E development board. We showed that, in the simulation with 32 general-purpose registers, the overhead for the CoreMark benchmark ranges between 0.1% and 0.4%. On the ESP32, which uses an Xtensa LX6 core with 64 general-purpose registers, the overhead went down to below 0.01%. A worst-case scenario, modeled by a synthetic benchmark, showed overheads up to 9.68%. KW - Xtensa KW - Buffer overflow KW - return-oriented prgramming Y1 - 2023 U6 - https://doi.org/10.3390/fi15060217 SN - 1999-5903 VL - 15 IS - 6 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - StackSpecter: detecting stack buffer overflows for the Xtensa architecture T2 - 2024 34th International Telecommunication Networks and Applications Conference (ITNAC) Y1 - 2024 U6 - https://doi.org/10.1109/ITNAC62915.2024.10815333 SP - 1 EP - 7 PB - IEEE ER - TY - GEN A1 - Lehniger, Kai A1 - Raghunathan, Shuba Pradha A1 - Langendörfer, Peter T1 - WindowGuardian: return address integrity for ESP32 microcontrollers with Xtensa Processors using AES and register Windows T2 - 2024 13th Mediterranean Conference on Embedded Computing (MECO) Y1 - 2024 U6 - https://doi.org/10.1109/MECO62516.2024.10577840 SP - 1 EP - 8 PB - IEEE ER - TY - GEN A1 - Lehniger, Kai A1 - Schölzel, Mario A1 - Tabatt, Peter A1 - Aftowicz, Marcin A1 - Langendörfer, Peter T1 - Simplified Control Flow Integrity Method for Permutated Programs T2 - Proc. 32. Crypto-Day Matters 2021, (2021) Y1 - 2021 U6 - https://doi.org/10.18420/cdm-2021-32-21 ER - TY - GEN A1 - Saad, AbdElaziz AbdElaal A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Incremental Code Updates Exploitation as a Basis for Return Oriented Programming Attacks on Resource-Constrained Devices T2 - 5th Cyber Security in Networking Conference (CSNet 2021), (2021) Y1 - 2021 SN - 978-1-6654-0723-6 SN - 978-1-6654-0722-9 U6 - https://doi.org/10.1109/CSNet52717.2021.9614275 SN - 2768-0029 ER - TY - GEN A1 - Lehniger, Kai A1 - Saad, Abdelaziz A1 - Langendörfer, Peter T1 - Finding Gadgets in Incremental Code Updates for Return-Oriented Programming Attacks on Resource-Constrained Devices T2 - Annals of Telecommunications Y1 - 2022 U6 - https://doi.org/10.1007/s12243-022-00917-8 SN - 0003-4347 VL - 78 SP - 209 EP - 229 ER - TY - GEN A1 - Amatov, Batyi A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Return-Oriented Programming Gadget Catalog for the Xtensa Architecture T2 - 6th International Workshop on Security, Privacy and Trust in the Internet of Things (SPT-IoT 2022) Y1 - 2022 SN - 978-1-6654-1647-4 SN - 978-1-6654-1648-1 U6 - https://doi.org/10.1109/PerComWorkshops53856.2022.9767489 ER - TY - GEN A1 - Lehniger, Kai A1 - Schölzel, Mario A1 - Jelonek, Jonas A1 - Tabatt, Peter A1 - Aftowicz, Marcin A1 - Langendörfer, Peter T1 - Combination of ROP Defense Mechanisms for Better Safety and Security in Embedded Systems T2 - 25th Euromicro Conference on Digital Systems Design (DSD 2022), Maspalomas, Spain, 31 August 2022 - 02 September 2022 Y1 - 2022 SN - 978-1-6654-7404-7 SN - 978-1-6654-7405-4 U6 - https://doi.org/10.1109/DSD57027.2022.00070 SN - 2771-2508 ER - TY - GEN A1 - Tabatt, Peter A1 - Jelonek, Jonas A1 - Schölzel, Mario A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Code Mutation as a Mean Against ROP Attacks for Embedded Systems T2 - 11th Mediterranean Conference on Embedded Computing (MECO 2022), Budva, Montenegro, 07-10 June 2022 Y1 - 2022 SN - 978-1-6654-6828-2 SN - 978-1-6654-6827-5 U6 - https://doi.org/10.1109/MECO55406.2022.9797185 SN - 2637-9511 ER - TY - GEN A1 - Aftowicz, Marcin A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Scalable FPGA Hardware Accelerator for SVM Inference T2 - Proc. 10th International Conference on Cyber-Physical Systems and Internet-of-Things (CPS&IoT 2022) Y1 - 2022 SN - 978-1-6654-6828-2 SN - 978-1-6654-6827-5 U6 - https://doi.org/10.1109/MECO55406.2022.9797110 SN - 2637-9511 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Through the Window: On the Exploitability of Xtensa’s Register Window Overflow T2 - 32nd International Telecommunication Networks and Applications Conference (ITNAC 2022), Wellington, New Zealand, 30 November 2022 - 02 December 2022 Y1 - 2022 SN - 978-1-6654-7103-9 SN - 978-1-6654-7104-6 U6 - https://doi.org/10.1109/ITNAC55475.2022.9998407 SN - 2474-154X SP - 353 EP - 358 ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Comment on ‘‘RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices’’ T2 - IEEE Access N2 - This is a comment on “RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices.” RIO prevents finding gadgets for return-oriented programming attacks by encrypting return instructions. This paper shows flaws in the design of RIO that allow for the easy retrieval of the plaintext return instructions without decrypting them. Additionally, changes are proposed to improve upon the original idea. KW - ARM KW - Internet of Things KW - Return-oriented programming KW - Security Y1 - 2025 U6 - https://doi.org/10.1109/ACCESS.2025.3568598 SN - 2169-3536 VL - 13 SP - 90358 EP - 90361 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Lehniger, Kai A1 - Langendörfer, Peter T1 - Investigating compact shadow stacks for the Xtensa LX architecture T2 - 2025 14th Mediterranean Conference on Embedded Computing (MECO) N2 - This paper presents a compact shadow stack implementation for the Xtensa LX architecture, implemented for an ESP32 microcontroller. The implementation is done by changing the register window exception handlers in the FreeRTOS operating system. In a second implementation the shadow stack was extended to all register values, not just return addresses. This not only increases security but also performance, reducing the overhead from 17.220% to 13.529%, in the worst-case-scenario. The paper also suggests future improvements that could decrease the overhead even further. KW - Xtensa KW - ESP32 KW - Return address protection KW - Shadow stack Y1 - 2025 SN - 979-8-3315-1341-2 U6 - https://doi.org/10.1109/MECO66322.2025.11049161 SP - 1 EP - 6 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Aftowicz, Marcin A1 - Fritscher, Markus A1 - Lehniger, Kai A1 - Wenger, Christian A1 - Langendörfer, Peter A1 - Brzozowski, Marcin T1 - Hardware-friendly Nyström approximation for water treatment anomaly detection T2 - IECON 2024 - 50th Annual Conference of the IEEE Industrial Electronics Society : proceedings N2 - This paper presents an approach to accelerate One-Class Support Vector Machines (SVM) using a hardware-friendly kernel that doesn't rely on multiplication operations, thus adaptable to hardware platforms. Leveraging Nyström approximation, we implemented a pipeline and compared its performance against a software implementation using libsvm. Furthermore, we evaluated the efficiency of our approach by deploying it on an FPGA. Our experiments, conducted on the SWaT dataset, demonstrate a 50x speedup using the FPGA implementation, achieving a classification time of 21 microseconds per instance. Importantly, we find no degradation in performance, as measured by the f-score of the attack class in the test set. This study explores the potential of hardware acceleration in optimizing anomaly detection systems for real-time applications. KW - OCSVM KW - FPGA KW - Nyström KW - Anomaly Detection KW - SWaT Y1 - 2024 SN - 978-1-6654-6454-3 U6 - https://doi.org/10.1109/IECON55916.2024.10905880 SP - 1 EP - 7 PB - Institute of Electrical and Electronics Engineers (IEEE) CY - Piscataway, NJ ER - TY - GEN A1 - Lehniger, Kai A1 - Langendorfer, Peter T1 - Elevating parallel shadow stack concepts for architectures with register windows T2 - IEEE transactions on dependable and secure computing N2 - Register windows are a processor feature that was originally developed to reduce the frequency for register spilling. This paper investigates how this mechanism can be used to implement a parallel shadow stack to protect return addresses from being corrupted. Furthermore, multiple improvements based on properties directly following the usage of register windows are proposed. Different configurations of parallel shadow stacks are evaluated based on prototype implementations on an ESP32 microcontroller and tested with different benchmarks. Performance overheads below 0.01% for CoreMark, below 3% for the worst case in MbedsTLS, and a worst case scenario of 22.153% for a recursive function show that our concepts are able to be efficiently developed even for embedded devices like the ESP32. KW - Buffer overflow KW - Shadow stack KW - Return-oriented programming KW - Register windows KW - Xtensa KW - ESP32 Y1 - 2025 U6 - https://doi.org/10.1109/TDSC.2025.3604556 SN - 1545-5971 SN - 1941-0018 SP - 1 EP - 18 PB - Institute of Electrical and Electronics Engineers (IEEE) CY - Piscataway, NJ ER -