SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.
We are going to present our social snapshot forensic tool at the Annual Computer Security Applications Conference (ACSAC) 2011. Abstract: Recently, academia and law enforcement alike have shown a strong demand for data that is collected from online social networks. In this work, we present a novel method for… Read More
On ARES’ last day, an informal workshop on research collaborations was held. Participants from Japan were Prof. Dr. Ryoichi Sasaki Tokyo Denki University, Prof. Dr. Noboru Sonehara, National Institute of Informatics, Prof. Dr. Isao Echizen, National Institute of Informatics, Dr. Sven Wohlgemuth, National Institute of Informatics.
In August we will present our work on cloud storage security at the 20th USENIX Security Symposium in San Francisco. The paper, in essence, outlines new attacks on cloud storage services that use server-side data deduplication. It includes a security analysis of Dropbox, a popular cloud storage service. By… Read More
Rails 3.0.5 doesn’t validate the input for the X-Forwarded-For field in the header sent by clients with a class C remote-addr. (see: TRUSTED_PROXIES). (Security Focus, more details…)
“Gilbert Wondracek at the Vienna University of Technology in Austria and his colleagues built a history-stealing website aimed at groups on Xing, a business-orientated social network. Mr Wondracek’s analysis of over 6,500 Xing groups, containing a total of more than 1.8m users, suggested that his rogue site would be able… Read More
Andreas Rauber has been very successful. He brought several new EU projects to the center: APARSEN, TIMBUS and Mumia. Moreover, we will start with INMOTOS and we hope to attract one or two ERCIM fellows. …more information will be posted soon…… Read More
Together with sipgate and ISMK Stralsund, Gabriel Gegenhuber, researcher at SBA Research and University of Vienna, and Michael Pucher, researcher at SBA research, discovered and investigated a vulnerability in the Voice of LTE (VoLTE) stack that is broadly used within MediaTek-based smartphones. ∞
In the Mediatek modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. ∞