TY - CHAP A1 - Braun, Oskar A1 - Hörnemann, Jan A1 - Pohlmann, Norbert A1 - Urban, Tobias A1 - Große-Kampmann, Matteo T1 - Different Seas, Different Phishes: Large-Scale Analysis of Phishing Simulations Across Different Industries T2 - ASIA CCS '25: Proceedings of the 20th ACM Asia Conference on Computer and Communications Security. Hanoi Vietnam, August 25 - 29, 2025 N2 - Phishing is an increasing threat to the security of end-users, networks, and organizations. Phishing simulations via email are a widespread tool used to measure user awareness, especially in workplace settings. However, current studies focusing on large-scale analysis of phishing simulations often have issues: The phishing simulations were conducted using a small sample size (mostly one or two organizations), or while many emails are sent, the analysis focuses only on specific companies. This study analyzes phishing simulations conducted over three years at 36 organizations with over 68 000 delivered emails. We compare different dimensions of the organizations where these simulations were conducted, such as the economic sector and departments. Furthermore, we evaluate various dimensions of phishing simulation campaigns, such as detection difficulty and the scenario under which the simulation occurs. Our findings indicate significant disparities in the results, such as the industry sector in which the company operates. Moreover, we find substantial differences between the success rates of varying scenarios used for phishing emails. KW - phishing KW - awareness KW - end-users KW - phishing simulations Y1 - 2025 SN - 979-8-4007-1410-8 U6 - https://doi.org/10.1145/3708821.3733905 VL - 2025 SP - 1520 EP - 1534 PB - Association for Computing Machinery (ACM) CY - New York ER - TY - CHAP A1 - Böttger, Christian A1 - Hosseini, Henry A1 - Utz, Christine A1 - Demir, Nurullah A1 - Hörnemann, Jan A1 - Wressnegger, Christian A1 - Hupperich, Thomas A1 - Pohlmann, Norbert A1 - Große-Kampmann, Matteo A1 - Urban, Tobias T1 - Privacy from 5 PM to 6 AM: Tracking and Transparency Mechanisms in the HbbTV Ecosystem T2 - 2025 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). 23-26 June 2025, Naples, Italy. Conference Proceedings N2 - Hybrid broadcast broadband television (HbbTV) is an evolving technology that connects linear TV with modern HTML5 applications, delivering extras like games, videos, and online shopping. However, its bidirectional transmission functionality raises privacy concerns, as it introduces new tracking methods for TV channels. While previous studies focused on security issues or user awareness of HbbTV privacy challenges, a detailed examination of the tracking and transparency mechanisms of the HbbTV ecosystem is still missing. This study fills this gap by extensively analyzing these features within the European HbbTV ecosystem, and in particular within German-language TV channels. We monitored more than 350 TV channels for over 400 hours, evaluating 1) prevalent HbbTV tracking methods, 2) consent notice prevalence and user interactions, and 3) privacy policy disclosures. Our findings indicate that the HbbTV tracking system operates independently of the Web, consent notices exploit system constraints to influence users, and privacy policies often do not align with actual data practices. KW - HbbTV KW - smart TV KW - privacy KW - privacy policies Y1 - 2025 SN - 979-8-3315-1201-9 U6 - https://doi.org/10.1109/DSN64029.2025.00017 SN - 2158-3927 VL - 2025 PB - IEEE ER - TY - CHAP A1 - Springer, Raphael A1 - Schmitz, Alexander A1 - Leinweber, Artur A1 - Urban, Tobias A1 - Dietrich, Christian J. T1 - Padding Matters - Exploring Function Detection in PE Files: Data/Toolset T2 - CODASPY '25: Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, June 4-6 2025, Pittsburgh PA USA N2 - Function detection is a well-known problem in binary analysis. While prior work has focused on Linux/ELF, Windows/PE binaries have only partially been considered. This paper introduces FuncPEval, a dataset for Windows x86 and x64 PE files, featuring Chromium and the Conti ransomware, along with ground truth data for 1,092,820 function starts. Utilizing FuncPEval, we evaluate five heuristics-based (Ghidra, IDA, Nucleus, rev.ng, SMDA) and three machine-learning-based (DeepDi, RNN, XDA) function start detection tools. Among these, IDA achieves the highest F1-score (98.44%) for Chromium x64, while DeepDi closely follows (97%) but stands out as the fastest. Towards explainability, we examine the impact of padding between functions on the detection results, finding all tested tools, except rev.ng, are susceptible to randomized padding. The randomized padding significantly diminishes the effectiveness of the RNN, XDA, and Nucleus. Among the learning-based tools, DeepDi exhibits the least sensitivity, while Nucleus is the most adversely affected among the non-learning-based tools. KW - Binary Code Analysis KW - Function Detection KW - Malware Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-48386 SN - 979-8-4007-1476-4 VL - 2025 SP - 179 EP - 184 PB - Association for Computing Machinery (ACM) CY - New York ER - TY - CHAP A1 - Hörnemann, Jan A1 - Pohlmann, Norbert A1 - Urban, Tobias A1 - Große-Kampmann, Matteo T1 - Sharing is Caring: Towards Analyzing Attack Surfaces on Shared Hosting Providers T2 - Sicherheit 2024. Lecture Notes in Informatics (LNI), Full Paper Session 7 – Netzwerk- und Softwaresicherheit. Worms. 09.-11.04.2024 N2 - Abstract In this paper, we shed light on shared hosting services’ security and trust implications and measure their attack surfaces. To do so, we analyzed 30 shared hosters and found that all of them might leak relevant information, which could be abused unnoticed. An adversary could use this attack surface to covertly extract data from various third parties registered with a shared hoster. Furthermore, we found that most hosters suffer from vulnerabilities that can be used by an internal attacker (i.e., someone using the service) to compromise other hosted services or the entire system. KW - shared hosting KW - data leaks KW - cloud computing Y1 - 2024 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-47500 SP - 217 EP - 229 PB - Gesellschaft für Informatik e.V. CY - Bonn ER - TY - CHAP A1 - Steinböck, Magdalena A1 - Bleier, Jakob A1 - Rainer, Mikka A1 - Urban, Tobias A1 - Utz, Christine A1 - Lindorfer, Martina T1 - Comparing Apples to Androids: Discovery, Retrieval, and Matching of iOS and Android Apps for Cross-Platform Analyses T2 - MSR '24: Proceedings of the 21st International Conference on Mining Software Repositories N2 - Abstract For years, researchers have been analyzing mobile Android apps to investigate diverse properties such as software engineering practices, business models, security, privacy, or usability, as well as differences between marketplaces. While similar studies on iOS have been limited, recent work has started to analyze and compare Android apps with those for iOS. To obtain the most representative analysis results across platforms, the ideal approach is to compare their characteristics and behavior for the same set of apps, e. g., to study a set of apps for iOS and their respective counterparts for Android. Previous work has only attempted to identify and evaluate such cross-platform apps to a limited degree, mostly comparing sets of apps independently drawn from app stores, manually matching small sets of apps, or relying on brittle matches based on app and developer names. This results in (1) comparing apps whose behavior and properties significantly differ, (2) limited scalability, and (3) the risk of matching only a small fraction of apps. In this work, we propose a novel approach to create an extensive dataset of cross-platform apps for the iOS and Android ecosystems. We describe an analysis pipeline for discovering, retrieving, and matching apps from the Apple App Store and Google Play Store that we used to create a set of 3,322 cross-platform apps out of 10,000 popular apps for iOS and Android, respectively. We evaluate existing and new approaches for cross-platform app matching against a set of reference pairs that we obtained from Google's data migration service. We identify a combination of seven features from app store metadata and the apps themselves to match iOS and Android apps with high confidence (95.82 %). Compared to previous attempts that identified 14 % of apps as cross-platform, we are able to match 34 % of apps in our dataset. To foster future research in the cross-platform analysis of mobile apps, we make our pipeline available to the community. KW - iOS KW - Android KW - mobile apps KW - app retrieval KW - app matching KW - app stores Y1 - 2024 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-47495 UR - https://dl.acm.org/doi/10.1145/3643991.3644896 SP - 348 EP - 360 PB - ACM Digital Library ER - TY - CHAP A1 - Hörnemann, Jan A1 - Braun, Oskar A1 - Theis, Daniel A1 - Pohlmann, Norbert A1 - Urban, Tobias A1 - Große-Kampmann, Matteo T1 - Exploring the Effects of Cybersecurity Awareness and Decision-Making Under Risk T2 - Science of Cyber Security. 6th International Conference, SciSec 2024, Copenhagen, Denmark, August 14–16, 2024, Proceedings N2 - Abstract This paper challenges the conventional assumption in cybersecurity that users act as rational actors. Despite numerous technical solutions, awareness campaigns, and organizational strategies aimed at bolstering cybersecurity, these often overlook the prevalence of non-rational user behavior. Our study, involving a survey of 208 participants, empirically demonstrates this aspect. We found that a significant portion of users (55.3%) would accept a substantial risk (35%) to click on a potentially malicious link or attachment. This propensity increases to 61% when users are led to believe there is a 65% chance of facing no adverse consequences. To address this irrationality, we explored the efficacy of nudging mechanisms within email systems. Our qualitative user study revealed that incorporating a simple colored nudge in the email intably enhance the ability of users to discern malicious emails, improving decision-making accuracy by an average of 10%. KW - Economics of Cybersecurity KW - User Behavior KW - Behavioral Economics Y1 - 2025 U6 - https://doi.org/10.1007/978-981-96-2417-1_11 SP - 196 EP - 216 PB - Springer Nature ER - TY - CHAP A1 - Böttger, Christian A1 - Demir, Nurullah A1 - Hörnemann, Jan A1 - Acharyi, Bhupendra A1 - Holz, Thorsten A1 - Pohlmann, Norbert A1 - Große-Kampmann, Matteo A1 - Urban, Tobias T1 - Understanding Regional Filter Lists: Efficacy and Impact T2 - Proceedings on Privacy Enhancing Technologies N2 - Filter lists are used by various users, tools, and researchers to identify tracking technologies on the Web. These lists are created and maintained by dedicated communities. Aside from popular blocking lists (e.g., EasyList), the communities create region-specific blocklists that account for trackers and ads that are only common in these regions. The lists aim to keep the size of a general blocklist minimal while protecting users against region-specific trackers. In this paper, we perform a large-scale Web measurement study to understand how different region-specific filter lists (e.g., a blocklist specifically designed for French users) protect users when visiting websites. We define three privacy scenarios to understand when and how users benefit from these regional lists and what effect they have in practice. The results show that although the lists differ significantly, the number of rules they contain is unrelated to the number of blocked requests. We find that the lists’ overall efficacy varies notably. Filter lists also do not meet the expectation that they increase user protection in the regions for which they were designed. Finally, we show that the majority of the rules on the lists were not used in our experiment and that only a fraction of the rules would provide comparable protection for users. KW - user tracking KW - tracking protection KW - filter lists KW - web privacy KW - adblocker Y1 - 2025 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:hbz:1010-opus4-47195 VL - 2025 IS - 2 SP - 309 EP - 324 ER - TY - CHAP A1 - Urban, Tobias A1 - Tatang, Dennis A1 - Degeling, Martin A1 - Holz, Thorsten A1 - Pohlmann, Norbert T1 - A Study on Subject Data Access in Online Advertising after the GDPR T2 - Konferenz: 14th DPM International Workshop on Data Privacy Management, 26. September 2019 in Luxemburg Y1 - 2019 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/08/398-A-Study-on-Subject-Data-Access-in-Online-Advertising-after-the-GDPR-Prof.-Norbert-Pohlmann-1.pdf ER - TY - CHAP A1 - Püsche, Andreas A1 - Bothe, David A1 - Sachweh, Sabine A1 - Niemeyer, Marco A1 - Pohlmann, Norbert A1 - Kunold, Ingo ED - IEEE - Institute of Electrical and Electronics Engineers, T1 - Concept of Smart Building Cyber-physical Systems Including Tamper Resistant Endpoints T2 - Konferenz: International IEEE Conference and Workshop in Óbuda on Electrical and Power Engineering (CANDO-EPE), 20.-21. November 2018 in Budapest Y1 - 2018 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/02/391-Concept-of-Smart-Building-Cyber-physical-Systems-Including-Tamper-Resistant-Endpoints-Prof.-Norbert-Pohlmann.pdf SN - 978-1-7281-1155-1 U6 - https://doi.org/10.1109/CANDO-EPE.2018.8601130 SP - 000127 EP - 000132 ER - TY - CHAP A1 - Püsche, Andreas A1 - Bothe, David A1 - Sachweh, Sabine A1 - Pohlmann, Norbert ED - Großmann, Uwe ED - Kunold, Ingo ED - Engels, Christoph T1 - Concept of a Life-Cycle Management with Tamper Resistant Distributed Cyber-Physical Systems T2 - Smart Energy 2018. Vom Smart Home bis zur Smart City - Aspekte der Digitalisierung Y1 - 2018 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/02/389-Concept-of-a-Life-Cycle-Management-with-Tamper-Resistant-Distributed-Cyber-Physical-Systems-Prof.-Norbert-Pohlmann.pdf SN - 978-3-86488-144-2 SP - 211 EP - 222 PB - vwh CY - Glückstadt ER - TY - CHAP A1 - Cagnazzo, Matteo A1 - Pohlmann, Norbert ED - Schartner, Peter ED - Pohlmann, Norbert T1 - Verwendung von Geolokationsdaten als Angriffsvektor für Social Engineering T2 - D·A·CH Security 2018. Bestandsaufnahme, Konzepte, Anwendungen, Perspektiven Y1 - 2018 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/02/387-Verwendung-von-Geolokation-als-Angriffsvektor-f%C3%BCr-Social-Engineering-Prof.-Norbert-Pohlmann.pdf SN - 978-3-00-060424-9 SP - 383 EP - 391 PB - syssec CY - Frechen ER - TY - CHAP A1 - Riedel, René A1 - Pohlmann, Norbert ED - Schartner, Peter ED - Pohlmann, Norbert T1 - Risikobasierte und adaptive Authentifizierung T2 - D·A·CH Security 2018. Bestandsaufnahme, Konzepte, Anwendungen, Perspektiven Y1 - 2018 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/02/386-Risikobasierte-und-adaptive-Authentifizierung-Prof.-Norbert-Pohlmann.pdf SN - 978-3-00-060424-9 SP - 360 EP - 371 PB - syssec CY - Frechen ER - TY - CHAP A1 - Cagnazzo, Matteo A1 - Hertlein, Markus A1 - Holz, Thorsten A1 - Pohlmann, Norbert T1 - Threat Modeling for Mobile Health Systems T2 - Konferenz: IoT-Health 2018: IRACON Workshop on IoT enabling technologies in healthcare, 15. April 20158, in Barcelona (Spanien) Y1 - 2018 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/07/375-Threat-Modeling-for-Mobile-Health-Systems-in-Proceedings-of-the-Conference-Prof.-Norbert-Pohlmann.pdf ER - TY - CHAP A1 - Urban, Tobias A1 - Riedel, René A1 - Schmuntzsch, Ulrike A1 - Pohlmann, Norbert A1 - Rötting, Matthias T1 - Riddle me this! Context Sensitive CAPTCHAs” T2 - Konferenz: EuroUSEC 2017 Workshop. The 2nd European Workshop on Usable Security. 29. April 2017 in Paris, Frankreich Y1 - 2017 UR - https://norbert-pohlmann.com/wp-content/uploads/2018/01/367-Riddle-me-this-Context-Sensitive-CAPTCHAs-Prof.-Norbert-Pohlmann.pdf ER - TY - CHAP A1 - Cagnazzo, Matteo A1 - Hertlein, Markus A1 - Pohlmann, Norbert T1 - Interconnected, Secured and Authenticated Medical Devices T2 - Smart innovation, systems and technology (SIST) Y1 - 2017 UR - https://norbert-pohlmann.com/wp-content/uploads/2017/03/354-Interconnected-Secured-and-Authenticated-Medical-Devices-Prof.-Norbert-Pohlmann.pdf SN - 2190-3018 ER - TY - CHAP A1 - Spooren, Sebastian A1 - Pohlmann, Norbert ED - Horster, Patrick ED - Schartner, Peter T1 - Verfügbarkeit und Notfallplanung mit Hilfe der Visualisierung T2 - Proceedings der DACH Security Konferenz 2009 – Bestandsaufnahme, Konzepte, Anwendungen und Perspektiven Y1 - 2009 UR - https://norbert-pohlmann.com/wp-content/uploads/2015/08/244-Verf%C3%BCgbarkeit-und-Notfallplanung-mit-Hilfe-der-Visualisierung-Prof.-Norbert-Pohlmann.pdf SP - 222 EP - 231 PB - syssec Verlag CY - Klagenfurt ER - TY - CHAP A1 - Urban, Tobias A1 - Degeling, Martin A1 - Holz, Thorsten A1 - Pohlmann, Norbert T1 - “Your Hashed IP Address: Ubuntu.” Perspectives on Transparency Tools for Online Advertising T2 - Konferenz: 35th Annual Computer Security Applications Conference (ACSAC 2019), 9.-13. Dezember 2019 in San Juan (Puerto Rico) Y1 - 2019 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/08/402-Your-Hashed-IP-Address-Ubuntu-Perspectives-on-Transparency-Tools-for-Online-Advertising-Prof.-Norbert-Pohlmann.pdf ER - TY - CHAP A1 - Cagnazzo, Matteo A1 - Holz, Thorsten A1 - Pohlmann, Norbert ED - Sako, Kazue ED - Schneider, Steve ED - Ryan, Peter Y. A. T1 - GDPiRated – Stealing Personal Information On- and Offline T2 - Computer Security – ESORICS 2019. 24th European Symposium on Research in Computer Security, Luxembourg, September 23–27, 2019, Proceedings, Part II Y1 - 2019 UR - https://norbert-pohlmann.com/wp-content/uploads/2019/08/400-GDPiRated-Stealing-Personal-Information-On-and-Offline-Prof.-Norbert-Pohlmann.pdf SN - 978-3-030-29961-3 U6 - https://doi.org/10.1007/978-3-030-29962-0_18 SP - 367 EP - 386 PB - Springer CY - Cham ER - TY - CHAP A1 - Dietrich, Christian J. A1 - Bureau, Pierre-Marc T1 - Hiding in Plain Sight - Advances in Malware Covert Communication Channels T2 - Konferenz: Blackhat Europe. 10.-13. November 2015 in Amsterdam N2 - Steganography, the art of concealing information in different types of medias, is a very old practice. Yet, it only recently started being used by malware operators on a large scale. Malware programmers and operators are increasing their efforts in developing covert communication channels between infected computers and their command and control servers. In addition to steganography, recent examples include hiding communication in inconspicuous network traffic such as DNS queries or HTTP 404 error messages. When used properly, these covert communication channels can bypass many automated detection mechanisms and render malware communication difficult to detect and block. From an attacker's perspective, covert communication channels are a valuable addition because they allow messages to blend in with legitimate traffic and thus significantly lower the chance of being detected even when inspected by a human analyst. This presentation studies recent advances in covert communication channels used by real-world malware. First, we will show how steganography has recently been used in three different malware families (Stegoloader, Vawtrak, and Lurk). We will dive into the implementation details on how steganography is implemented and discuss the strengths and weaknesses of each approach. Furthermore, we will detail and compare the usage of inconspicuous carrier protocols for covert communication channels in malware. Examples will span commodity cybercrime as well as targeted attack malware. The cases that are discussed in this presentation are based on real life incidents. While it is easy to speculate how covert communication channels might be used by malicious actors, documentation of real-world cases is sparse. Yet covert communication channels have arrived in both, the commodity cybercrime and targeted attack world. It is thus vital to understand the status-quo and identify current trends in cybercriminal and targeted attack malware. As such, we believe that it is mandatory to highlight what is currently being used in the wild. Y1 - 2015 UR - https://www.blackhat.com/docs/eu-15/materials/eu-15-Bureau-Hiding-In-Plain-Sight-Advances-In-Malware-Covert-Communication-Channels-wp.pdf UR - https://www.blackhat.com/docs/eu-15/materials/eu-15-Bureau-Hiding-In-Plain-Sight-Advances-In-Malware-Covert-Communication-Channels.pdf ER - TY - CHAP A1 - Urban, Tobias A1 - Riedel, René A1 - Schmuntzsch, Ulrike A1 - Pohlmann, Norbert ED - Schartner, Peter ED - Pohlmann, Norbert ED - Arbeitskonferenz D-A-CH Security, T1 - Kontextsensitive CAPTCHAS im Online-Banking T2 - D-A-CH Security 2018. Bestandsaufnahme, Konzepte, Anwendungen, Perspektiven N2 - In der modernen Informationsgesellschaft nehmen Online-Transaktionen einen wichtigen Teil unseres täglichen Lebens ein. In dieser Arbeit stellen wir ein nutzerzentriertes Protokoll vor, dass es Nutzern erlaubt vertrauenswürdige und sichere Transkationen durchzuführen selbst wenn sie ein nicht vertrau-enswürdiges oder mit Schadsoftware infiziertes Gerät nutzen. Das Protokoll nutzt einen CAPTCHA-artigen Ansatz, der verhindert, dass ein Angreifer eine Transaktion verändert ohne, dass Server oder Client dies bemerken. Dazu stellen wir dem Nutzer eine Aufgabe die kontextsensitive Informationen der Transaktion enthält. Die Aufgabe wird so gestellt, dass sie einfach von Menschen lösbar ist aber nur schwer automatisiert gelöst werden kann. Zur Evaluation des Systems haben wir eine Nutzerstudie (n=30) durchgeführt und berechnet mit welcher Wahrscheinlichkeit ein Angreifer erfolgreich die richtige Antwort auf die Frage erraten kann. Wir zeigen, dass ein Großteil der Transaktionen (> 94%) geschützt werden kann während das System selbst nutzbar bleibt. Y1 - 2018 SN - 978-3-00-060424-9 SP - 346 EP - 359 PB - syssec CY - Frechen ER - TY - CHAP A1 - Urban, Tobias A1 - Riedel, René A1 - Paulisch, Christine A1 - Pohlmann, Norbert ED - Schartner, Peter ED - Pohlmann, Norbert ED - Arbeitskonferenz D-A-CH Security, T1 - Sei gewarnt! Vorhersage von Angriffen im Online-Banking T2 - D-A-CH Security 2018. Bestandsaufnahme, Konzepte, Anwendungen, Perspektiven N2 - In diesem Artikel wird ein Alert-System für das Online-Banking vorgestellt, welches das Schutzniveau im Kontext von Social-Engineering-Angriffen sowohl clientseitig als auch serverseitig erhöhen soll. Hierfür wird durch das Alert-System ein kontinuierliches Lagebild über die aktuelle Gefahrenlage beim Online-Banking erstellt. Bei konkretem Bedarf wird der Nutzer punktuell vor aktuellen Betrugsmaschen gewarnt und zielgerichtet über Schutzvorkehrungen und Handlungsempfehlungen informiert. Für die Berechnung der aktuellen Gefahrenlage wurden unterschiedliche off-the-shelf-Algorithmen des Maschinellen Lernens verwendet und miteinander verglichen. Die Effektivität des Alert-Systems wurde anhand von echten Betrugsfällen evaluiert, die bei einer Bankengruppe in Deutschland aufgetreten sind. Zusätzlich wurde die Usability des Systems in einer Nutzerstudie mit 50 Teilnehmern untersucht. Die ersten Ergebnisse zeigen, dass die verwendeten Verfahren dazu geeignet sind, die Gefahrenlage im Online-Banking zu beurteilen und dass ein solches Alert-System auf hohe Akzeptanz bei Nutzern stößt. Y1 - 2018 SN - 978-3-00-060424-9 SP - 151 EP - 163 PB - syssec CY - Frechen ER - TY - CHAP A1 - Urban, Tobias A1 - Tatang, Dennis A1 - Holz, Thorsten A1 - Pohlmann, Norbert ED - Lopez, Javier ED - Zhou, Jianying ED - Soriano, Miguel T1 - Towards Understanding Privacy Implications of Adware and Potentially Unwanted Programs T2 - Computer Security. ESORICS 2018. Lecture Notes in Computer Science N2 - Web advertisements are the primary financial source for many online services, but also for cybercriminals. Successful ad campaigns rely on good online profiles of their potential customers. The financial potentials of displaying ads have led to the rise of malware that injects or replaces ads on websites, in particular, so-called adware. This development leads to always further optimized and customized advertising. For these customization's, various tracking methods are used. However, only sparse work has gone into privacy issues emerging from adware. In this paper, we investigate the tracking capabilities and related privacy implications of adware and potentially unwanted programs (PUPs). Therefore, we developed a framework that allows us to analyze any network communication of the Firefox browser on the application level to circumvent encryption like TLS. We use this to dynamically analyze the communication streams of over 16,000 adware or potentially unwanted programs samples that tamper with the users' browser session. Our results indicate that roughly 37% of the requests issued by the analyzed samples contain private information and are accordingly able to track users. Additionally, we analyze which tracking techniques and services are used. Y1 - 2018 SN - 978-3-319-99072-9 U6 - https://doi.org/10.1007/978-3-319-99073-6_22 SP - 449 EP - 469 ER - TY - CHAP ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - ISSE 2015. Highlights of the Information Security Solutions Europe 2015 Conference Y1 - 2015 SN - 978-3-658-10933-2 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - ISSE 2014 Securing electronic business processes. Highlights of the Information Security Solutions Europe 2014 Conference Y1 - 2014 SN - 978-3-658-06707-6 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - ISSE 2013 Securing electronic business processes. Highlights of the Information security solutions Europe 2013 conference Y1 - 2013 SN - 978-3-658-03370-5 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - ISSE 2012 Securing electronic business processes. Highlights of the Information Security Solutions Europe 2012 Conference Y1 - 2012 SN - 978-3-658-00332-6 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP ED - Pohlmann, Norbert ED - Reimer, Helmut ED - Schneider, Wolfgang T1 - Securing electronic business processes. Highlights of the information security solutions Europe 2011 conference Y1 - 2012 SN - 978-3-8348-1911-6 PB - Vieweg + Teubner CY - Wiesbaden ER - TY - CHAP ED - Pohlmann, Norbert ED - Reimer, Helmut ED - Schneider, Wolfgang T1 - Securing electronic business processes. Highlights of the information security solutions Europe 2010 conference Y1 - 2011 SN - 978-3-8348-1438-8 PB - Vieweg + Teubner CY - Wiesbaden ER - TY - CHAP ED - Pohlmann, Norbert ED - Reimer, Helmut ED - Schneider, Wolfgang T1 - Securing electronic business processes. Highlights of the Information Security Solutions Europe 2009 Conference Y1 - 2009 SN - 978-3-8348-0958-2 PB - Vieweg + Teubner CY - Wiesbaden ER - TY - CHAP ED - Pohlmann, Norbert ED - Reimer, Helmut ED - Schneider, Wolfgang T1 - Securing electronic business processes. Highlights of the Information Security Solutions Europe 2008 Conference Y1 - 2008 SN - 978-3-8348-0660-4 PB - Vieweg + Teubner CY - Wiesbaden ER - TY - CHAP ED - Pohlmann, Norbert ED - Reimer, Helmut ED - Schneider, Wolfgang T1 - Securing electronic business processes. Highlights of the Information Security Solutions Europe/SECURE 2007 Conference Y1 - 2007 SN - 978-3-8348-0346-7 PB - Vieweg CY - Wiesbaden ER - TY - CHAP ED - Paulus, Sachar ED - Pohlmann, Norbert ED - Reimer, Helmut T1 - Securing electronic business processes. Highlights of the Information Security Solutions Europe 2006 Conference Y1 - 2006 SN - 978-3-8348-0213-2 PB - Vieweg CY - Wiesbaden ER - TY - CHAP ED - Paulus, Sachar ED - Pohlmann, Norbert ED - Reimer, Helmut T1 - ISSE 2005 Securing Electronic Business Processes. Highlights of the Information Security Solutions Europe 2005 Conference Y1 - 2005 SN - 978-3-8348-0011-4 PB - Vieweg CY - Wiesbaden ER - TY - CHAP ED - Paulus, Sachar ED - Pohlmann, Norbert ED - Reimer, Helmut T1 - ISSE 2004 - Securing Electronic Business Processes. Highlights of the Information Security Solutions Europe 2004 Conference Y1 - 2004 SN - 978-3-528-05910-1 PB - Vieweg CY - Wiesbaden ER - TY - CHAP ED - Paulus, Sachar ED - Pohlmann, Norbert ED - Reimer, Helmut T1 - Securing electronic business processes. Highlights of the Information Security Solutions Europe 2003 Conference Y1 - 2004 SN - 978-3-528-05887-6 PB - Vieweg CY - Wiesbaden ER - TY - CHAP A1 - Urban, Tobias A1 - Pohlmann, Norbert T1 - Sehen heißt glauben: Aufdeckung von Webseiten Manipulation T2 - Konferenz: DACH Security. 26.-27. September 2016 in Klagenfurt Y1 - 2016 ER - TY - CHAP A1 - Cagnazzo, Matteo A1 - Hertlein, Markus A1 - Pohlmann, Norbert T1 - An Usable Application for Authentication, Communication and Access Management in the Internet of Things T2 - Information and Software Technologies. ICIST 2016. Communications in Computer and Information Science Y1 - 2016 SN - 978-3-319-46253-0 U6 - https://doi.org/10.1007/978-3-319-46254-7_58 SP - 722 EP - 731 PB - Springer CY - Cham ER - TY - CHAP A1 - Pohlmann, Norbert A1 - Hertlein, Markus A1 - Manaras, Pascal ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - Bring Your Own Device For Authentication (BYOD4A) – The Xign–System T2 - ISSE 2015. Highlights of the Information Security Solutions Europe 2015 Conference Y1 - 2015 SN - 978-3-658-10933-2 U6 - https://doi.org/10.1007/978-3-658-10934-9 SP - 240 EP - 251 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP A1 - González Robles, Antonio A1 - Pohlmann, Norbert A1 - Engling, Christoph A1 - Jäger, Hubert A1 - Ernst, Edmund ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - Doubtless Identification and Privacy Preserving of User in Cloud Systems T2 - ISSE 2015. Highlights of the Information Security Solutions Europe 2015 Conference Y1 - 2015 SN - 978-3-658-10933-2 U6 - https://doi.org/10.1007/978-3-658-10934-9 SP - 98 EP - 109 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP A1 - Pohlmann, Norbert A1 - Sparenberg, Michael A1 - Siromaschenko, Illya A1 - Kilden, Kilian ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - Secure Communication and Digital Sovereignty in Europe T2 - ISSE 2014 Securing Electronic Business Processes. Highlights of the Information Security Solutions Europe 2014 Conference Y1 - 2017 SN - 978-3-658-06707-6 SP - 155 EP - 170 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP A1 - González Robles, Antonio A1 - Pohlmann, Norbert T1 - IdP zur Verifikation der vertrauenswürdigen digitalen Identität T2 - Konferenz: DACH Security. 16.-17. September 2014 in Graz Y1 - 2017 ER - TY - CHAP A1 - Pohlmann, Norbert ED - Ruland, Christoph T1 - The next step in IT security after Snowden T2 - 2nd International Communications Colloquium Y1 - 2017 SN - 978-3-8440-2834-8 SP - 11 EP - 19 PB - Shaker CY - Aachen ER - TY - CHAP A1 - Fourné, Marcel A1 - Stegemann, Kevin A1 - Petersen, Dominique A1 - Pohlmann, Norbert ED - Linawati, ED - Mahendra, Made Sudiana ED - Neuhold, Erich J. ED - Tjoa, A Min ED - You, Ilsun T1 - Aggregation of Network Protocol Data Near Its Source T2 - Information and communication technology. Second IFIP TC 5/8 international conference. Proceedings Y1 - 2017 SN - 978-3-642-55031-7 SP - 482 EP - 492 PB - Springer CY - Heidelberg ER - TY - CHAP A1 - Speier, Andreas A1 - Fein, Christofer A1 - Bothe, David A1 - Reich, Eric A1 - Pohlmann, Norbert ED - Pohlmann, Norbert ED - Reimer, Helmut ED - Schneider, Wolfgang T1 - Draft of a Dynamic Malware Detection on Trustworthy Endpoints T2 - ISSE 2013 Securing Electronic Business Processes. Highlights of the Information Security Solutions Europe 2013 Conference Y1 - 2017 SN - 978-3-658-03370-5 SP - 3 EP - 11 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP A1 - Petersen, Dominique A1 - Pohlmann, Norbert ED - Fraunhofer-Einrichtung für Angewandte und Integrierte Sicherheit -AISEC-, Garching, ED - Zeilinger, Markus ED - Schoo, Peter ED - Hermann, Eckehard T1 - An Ideal Internet Early Warning System T2 - Advances in IT early warning Y1 - 2017 SN - 978-3-8396-0474-8 SP - 9 EP - 21 PB - Fraunhofer-Verl. CY - Stuttgart ER - TY - CHAP A1 - Dietrich, Christian J. A1 - Rossow, Christian A1 - Pohlmann, Norbert ED - Shin, Sung Y. ED - Maldonado, José Carlos T1 - Exploiting Visual Appearance to Cluster and Detect Rogue Software T2 - SAC '13 Proceedings of the 28th Annual ACM Symposium on Applied Computing Y1 - 2017 SN - 978-1-4503-1656-9 U6 - https://doi.org/10.1145/2480362.2480697 SP - 1776 EP - 1783 PB - ACM CY - New York, NY ER - TY - CHAP A1 - Feld, Sebastian A1 - Pohlmann, Norbert A1 - Sparenberg, Michael A1 - Wichmann, Bastian C. ED - Reimer, Helmut ED - Pohlmann, Norbert ED - Schneider, Wolfgang T1 - Analyzing G-20's Key Autonomous Systems and their Intermeshing using AS-Analyzer T2 - ISSE 2012 Securing Electronic Business Processes : Highlights of the Information Security Solutions Europe 2012 Conference Y1 - 2017 SN - 978-3-658-00332-6 SP - 228 EP - 243 PB - Springer Vieweg CY - Wiesbaden ER - TY - CHAP A1 - Dietrich, Christian J. A1 - Rossow, Christian A1 - Pohlmann, Norbert T1 - CoCoSpot: Clustering and recognizing botnet command and control channels using traffic analysis T2 - Computer Networks Y1 - 2017 U6 - https://doi.org/https://doi.org/10.1016/j.comnet.2012.06.019 SN - 1389-1286 VL - 57 IS - 2 SP - 475 EP - 486 ER - TY - CHAP A1 - Rossow, Christian A1 - Dietrich, Christian J. A1 - Grier, Chris A1 - Kreibich, Christian A1 - Paxson, Vern A1 - Pohlmann, Norbert A1 - Bos, Herbert A1 - Van Steen, Maarten ED - Institute of Electrical and Electronics Engineers (IEEE), T1 - Prudent Practices for Designing Malware Experiments: Status Quo and Outlook T2 - IEEE Symposium on Security and Privacy (SP), 2012. 20 - 23 May 2012, San Francisco, California, USA. Proceedings Y1 - 2017 SN - 978-1-4673-1244-8 U6 - https://doi.org/10.1109/SP.2012.14 SP - 65 EP - 79 PB - IEEE CY - Piscataway, NJ ER - TY - CHAP A1 - Dietrich, Christian J. A1 - Rossow, Christian A1 - Pohlmann, Norbert T1 - eID Online Authentication Network Threat Model, Attacks and Implications T2 - Konferenz: 19. DFN-Workshop „Sicherheit in vernetzten Systemen“, 21.-22. Februar 2012 in Hamburg Y1 - 2017 ER -