Adrian Dabrowski gives a talk about “Browser History Stealing with Captive Wi-Fi Portals” at the Mobile Security Technologies (MoST) 2016, held as part of the IEEE Computer Society Security and Privacy Workshops, in conjunction with the IEEE Symposium on Security and Privacy in San José.

Abstract: In this paper we show that HSTS headers and long term cookies (such as those used for user tracking) are so prevailing that they allow a malicious Wi-Fi operator to gain significant knowledge about the past browsing history of users. We demonstrate how to combine both into a history stealing attack by including specially crafted references into a captive portal or by injecting them into legitimate HTTP traffic.

More information can be found here.

We are proud to announce that the ITEA2-action DIAMONDS where SBA Research participated through the MobseTip project received the prestigious EUREKA-award.

For more information on relevant project aspects please contact Dimitris Simos.

Damjan Buhov presents today our paper “Pin It! Improving Android Network Security At Runtime” (by Damjan Buhov, Markus Huber, Georg Merzdovnik, and Edgar Weippl) at the IFIP Networking 2016 Conference. IFIP Networking is a CORE A-ranked conference.

Aaron Zauner, one of our researchers, has gotten a talk accepted at Blackhat USA 2016. Together with Sean Devlin, Hanno Böck and Philipp Jovanovic they identified a nonce re-use attack in the TLS GCM modes that can be used to inject additional content in the worst case. Overall, they identified more than 70,000 vulnerable websites on the Internet. You can read the abstract here.

Update: the corresponding paper is now online, you can find it here.

News coverage: ARS Technica

Dimitris Simos gives a talk on May, 11^th about “Combinatorial Coverage Analysis of Subsets of the TLS Cipher Suite Registry” joint work with Kristoffer Kleine (SBA Research), Rick Kuhn (NIST), Raghu Kacker (NIST).

HCSS 2016 takes place from May 10^th to May 12^th in Annapolis, MD, USA. HCSS is organized by the NITRD group and brings together researchers from academia, industry and government agencies.