@misc{RennerPozzobon, author = {Renner, Sebastian and Pozzobon, Enrico}, title = {SIM SIMulator}, series = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, journal = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, abstract = {Der Vortrag pr{\"a}sentierte ein Tool, das die Simulation einer SIM-Karte durch einen Standard-Mikrocontroller erm{\"o}glicht. Mit diesem T{\"a}uschungsman{\"o}ver kann die Authentifizierung des 3G-Mobilfunkstandards seitens der SIM-Karte umgangen werden. Tritt zus{\"a}tzliche Hardware hinzu, die eine 3G-Basisstation vort{\"a}uscht, l{\"a}sst sich eine Man-in-the-Middle-Attacke im 3G-Netz durchf{\"u}hren. In diesem Szenario ist es m{\"o}glich, die sensiblen Kommunikationsdaten, also den gesamten Datenverkehr beispielsweise zwischen einem Pkw und den Backend-Servern des Herstellers, auszulesen und zu untersuchen. Zudem eignet sich das Tool zum Pentesten von Modems oder SIM- beziehungsweise Smartcard-Applikationen. Der komplette Aufbau des sogenannten SIMulators ist als Open-Source-Software frei verf{\"u}gbar und auf GitHub abrufbar.}, language = {en} } @misc{WeissPozzobon, author = {Weiss, Nils and Pozzobon, Enrico}, title = {IOT Backdoors in Cars}, series = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, journal = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, abstract = {Connecting cheap IoT devices to the safety-critical network of a car can be an extremely bad idea, but at least it allows us to hack together our own automotive gadget. This talk explains the complete procedure involved in transforming a cheap OBD GSM dongle designed for fleet management into a open source automotive hacking tool. First, the hardware reverse engineering is demonstrated, showing how each component is interconnected and working together. With this knowledge, it was possible to capture the communication of the GSM module and understand the OTA protocol used by this dongle, which can be used to extract the firmware. A quick reverse engineering of the software will show that no cryptographic authentication is used for the OTA updates, and therefore a pirate GSM BTS can be used to obtain remote code execution. After that, a new open source firmware is written for the device, which can easily be extended and controlled remotely with the LUA scripting language. Examples on how hacking this dongle remotely can affect the safety of the driver will be also given.}, language = {en} } @misc{WeissPozzobon, author = {Weiss, Nils and Pozzobon, Enrico}, title = {Automotive Penetration Testing with Scapy}, series = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, journal = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, abstract = {This talk will provide a general overview on how Scapy can be used for automotive penetration testing. All present features of Scapy for automotive penetration will be introduced and explained. Also an overview of higher level automotive protocols will be given. As automotive penetration testing becomes more important, the lack of free tools for automotive network penetration testing led us to integrate new features in Scapy. Scapy is a well established framework for packet manipulation. The flexibility of Scapy allowed us to implement automotive interfaces (CAN) and automotive protocols (ISOTP, GMLAN, UDS, DoIP, OBD-II). This talk explains the basics of these automotive protocols, the workflow with Scapy for automotive network penetration testing. A live demonstration with some embedded hardware will be given.}, language = {en} } @inproceedings{TaoLiuMottoketal., author = {Tao, Ye and Liu, Guozhu and Mottok, J{\"u}rgen and Hackenberg, Rudolf and Hagel, Georg and Mottok, J{\"u}rgen}, title = {Just-in-Time Teaching in software engineering: A Chinese-German empirical case study}, series = {2014 IEEE Global Engineering Education Conference (EDUCON), 3-5 April 2014, Istanbul, Turkey}, booktitle = {2014 IEEE Global Engineering Education Conference (EDUCON), 3-5 April 2014, Istanbul, Turkey}, publisher = {IEEE}, doi = {10.1109/EDUCON.2014.6826220}, pages = {983 -- 986}, abstract = {Learning centered teaching becomes an important factor in a global perspective of learning software engineering. The Just-in-Time Teaching approach is used in a Chinese-German empirical case study. In a one year terminated project we will analyze the performance of our students in an active learning scenario with Just-in-Time Teaching and Peer Instruction. We will contribute an inter-cultural comparison of achieved competencies by student's self-assessment and teacher's observation.}, language = {en} } @inproceedings{YeTaoGuozhuLiuMottoketal., author = {Ye Tao, and Guozhu Liu, and Mottok, J{\"u}rgen and Hackenberg, Rudolf and Hagel, Georg}, title = {Just-in-Time-Teaching experience in a Software Design Pattern course}, series = {2015 IEEE Global Engineering Education Conference (EDUCON), 18-20 March 2015, Tallinn, Estonia}, booktitle = {2015 IEEE Global Engineering Education Conference (EDUCON), 18-20 March 2015, Tallinn, Estonia}, pages = {915 -- 919}, language = {en} } @inproceedings{TaoLiuMottoketal., author = {Tao, Ye and Liu, Guozhu and Mottok, J{\"u}rgen and Hackenberg, Rudolf and Hagel, Georg}, title = {Ranking task activity in teaching software engineering}, series = {IEEE Global Engineering Education Conference (EDUCON), 10-13 April 2016, Abu Dhabi, UAE}, booktitle = {IEEE Global Engineering Education Conference (EDUCON), 10-13 April 2016, Abu Dhabi, UAE}, doi = {10.1109/EDUCON.2016.7474678}, pages = {1023 -- 1027}, abstract = {In this research, we investigate the possibility of applying ranking task activity in teaching and learning software engineering courses. We introduce three types of ranking tasks, conceptual-, contextual- and sequential ranking questions, which cover most core topics such as requirement analysis, architecture design and quality validation in the course. We have also done experiments on a group of students to see if ranking tasks could increase their conceptual knowledge in specific areas. Assessments were given in order to evaluate the effectiveness of this activity, showing an obvious increase in complex conceptual understanding.}, language = {en} } @inproceedings{RennerPozzobonMottoketal., author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen and Hackenberg, Rudolf}, title = {Benchmarking Software Implementations of 1st Round Candidates of the NIST LWC Project on Microcontrollers}, series = {3rd Lightweight Cryptography Workshop at NIST, Gaithersburg, USA}, booktitle = {3rd Lightweight Cryptography Workshop at NIST, Gaithersburg, USA}, abstract = {This paper introduces a custom framework for benchmarking software implementations from the National Institute of Standards and Technology (NIST) Lightweight Cryptography (LWC) project on embedded devices. We present the design and core functions of the framework and apply it to various NIST LWC authenticated encryption with associated data (AEAD) ciphers. Altogether, we evaluate the speed of 213 submitted algorithm vari-ants on four different microcontroller units (MCUs), including 32 bit ARM and 8 bit AVR architectures. To allow a more meaningful comparison, we also conduct code size tests on all four boards and RAM utilization tests on one test platform.}, language = {en} } @inproceedings{HanschStaudteGerhageretal., author = {Hansch, G. and Staudte, Ch. and Gerhager, S. and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {Migration path for secure and economic smart power grid devices with transitional smart metering support}, series = {Applied Research Conference 2012 (ARC 2012), 25./26. June 2012 Nuremberg}, booktitle = {Applied Research Conference 2012 (ARC 2012), 25./26. June 2012 Nuremberg}, editor = {Mottok, J{\"u}rgen and Ziemann, Olaf}, publisher = {Shaker}, address = {Aachen}, isbn = {2012 978-3-8440-1093-0}, pages = {63 -- 69}, language = {en} } @inproceedings{PozzobonWeissRenneretal., author = {Pozzobon, Enrico and Weiss, Nils and Renner, Sebastian and Hackenberg, Rudolf}, title = {A Survey on Media Access Solutions for CAN Penetration Testing}, series = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, booktitle = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, abstract = {Controller Area Network (CAN) is still the most used network technology in today's connected cars. Now and in the near future, penetration tests in the area of automotive security will still require tools for CAN media access. More and more open source automotive penetration tools and frameworks are presented by researchers on various conferences, all with different properties in terms of usability, features and supported use-cases. Choosing a proper tool for security investigations in automotive network poses a challenge, since lots of different solutions are available. This paper compares currently available CAN media access solutions and gives advice on competitive hard-and software tools for automotive penetration testing.}, language = {en} } @article{KahlKrauseHackenbergetal., author = {Kahl, Matthias and Krause, Veronika and Hackenberg, Rudolf and Ul Haq, Anwar and Horn, Anton and Jacobsen, Hans-Arno and Kriechbaumer, Thomas and Petzenhauser, Michael and Shamonin (Chamonine), Mikhail and Udalzow, Anton}, title = {Measurement system and dataset for in-depth analysis of appliance energy consumption in industrial environment}, series = {tm - Technisches Messen}, volume = {86}, journal = {tm - Technisches Messen}, number = {1}, publisher = {De Gruyter}, doi = {10.1515/teme-2018-0038}, pages = {1 -- 13}, abstract = {To support a rational and efficient use of electrical energy in residential and industrial environments, Non-Intrusive Load Monitoring (NILM) provides several techniques to identify state and power consumption profiles of connected appliances. Design requirements for such systems include a low hardware and installations costs for residential, reliability and high-availability for industrial purposes, while keeping invasive interventions into the electrical infrastructure to a minimum. This work introduces a reference hardware setup that allows an in depth analysis of electrical energy consumption in industrial environments. To identify appliances and their consumption profile, appropriate identification algorithms are developed by the NILM community. To enable an evaluation of these algorithms on industrial appliances, we introduce the Laboratory-measured IndustriaL Appliance Characteristics (LILAC) dataset: 1302 measurements from one, two, and three concurrently running appliances of 15 appliance types, measured with the introduced testbed. To allow in-depth appliance consumption analysis, measurements were carried out with a sampling rate of 50 kHz and 16-bit amplitude resolution for voltage and current signals. We show in experiments that signal signatures, contained in the measurement data, allows one to distinguish the single measured electrical appliances with a baseline machine learning approach of nearly 100\% accuracy.}, language = {en} } @inproceedings{HackenbergWeissRenneretal., author = {Hackenberg, Rudolf and Weiss, Nils and Renner, Sebastian and Pozzobon, Enrico}, title = {Extending Vehicle Attack Surface Through Smart Devices}, series = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, booktitle = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, publisher = {IARIA}, isbn = {978-1-61208-582-1}, pages = {131 -- 135}, abstract = {Modern cars include more and more features that first emerged from the consumer electronics industry. Technologies like Bluetooth and Internet-connected services found their way into the vehicle industry. The secure implementation of these functions presents a great challenge for the manufacturers because products originating from the consumer industry can often not be easily transferred to the safety-sensitive traffic environment due to security concerns. However, common automotive interfaces like the diagnostics port are now also used to implement new services into the car. With dongles designed to read out certain vehicle data and transfer it to the Internet via the cellular network, the owner can access information about gas consumption or vehicle location through a mobile phone app, even when he is away from the car. This paper wants to emphasize new threats that appear due to the ongoing interconnection in modern cars by discussing the security of the diagnostics interface in combination with the use of an Internet-connected dongle. Potential attack vectors, as well as proof-of-concept exploits will be shown and the implications of security breaches on the safe state of the vehicle will be investigated.}, language = {en} } @misc{Weiss, author = {Weiss, Nils}, title = {Vulnerabilities of OBD2 Dongles}, series = {RCAR Annual Conference, 2018, Munich, Germany}, journal = {RCAR Annual Conference, 2018, Munich, Germany}, language = {en} } @misc{Weiss, author = {Weiss, Nils}, title = {Vulnerabilities of Connected Cars and beyond}, series = {Applied Research Colloquium, 2019, Universit{\`a} Padua, Italy}, journal = {Applied Research Colloquium, 2019, Universit{\`a} Padua, Italy}, language = {en} }