Meldungen des Lehrstuhls NDS
ALPACA-Attack: Cross-Protocol-Attacks
10.06.2021 - Robert Merget
In cooperation with the university Paderborn and Münster University of Applied Scienceshaben, scientists from the chair of Network- and Data security discovered a new flaw in the specification of TLS. The vulnerability is called ALPACA and exploits a weakness in the authentication of TLS for cross-protocol attacks. The attack allows an attacker to steal cookies or perform cross-site-scripting (XSS) if the specific conditions for the attack are met.
Kompletter ArtikelAttacks on PDF Certification
25.05.2021 - Simon Rohlmann
At the "IEEE Symposium on Security and Privacy 2021" we published a new paper on PDF security: "Breaking the Specification: PDF Certification".
We present two novel attacks on certified documents: Sneaky Signature and Evil Annotation Attack. We also demonstrate how an attacker can gain rights to execute arbitrary JavaScript code in Adobe Acrobat.
More information can be found on pdf-insecurity.org and in our blogpost "Attacks on PDF Certification"
PDF Insecurity at NDSS 2021
04.03.2021 - Vladislav Mladenov
Recently, we have published two papers on the "NDSS Symposium 2021".
Our first paper is "Processing Dangerous Paths - On Security and Privacy of the Portable Document Format" and deals with the security issues in PDF files. In the paper, we answer the question "What could go wrong if you open a PDF file?".
Our second paper "Shadow Attacks: Hiding and Replacing Content in Signed PDFs" presents novel attacks on PDF signatures. The attacks allow the manipulation of digitally signed PDF documents without causing any warning by opening the file.
More information can be found on "pdf-insecurity.org", in our blogposts ("Blogpost: PDF Dangerous Paths", "Blogpost: PDF Shadow Attacks"), and videos ("Youtube: PDF Dangerous Paths", "Youtube: PDF Shadow Attacks").
Raccoon Attack: A new attack on TLS
14.09.2020 - Robert Merget
In Kooperation mit der Universität Paderborn, der Tel Aviv University und dem BSI haben NDS Wissenschaftler eine neue Schwachstelle im TLS Standard entdeckt. Bei der Schwachstelle, welche die Forscher "Raccoon" getauft haben, handelt es sich um eine Timing Schwachstellen in der Spezifikation von TLS. Mittels neuer Techniken können unter gewissen Umständen TLS-DH(E) Verbindungen entschlüsselt werden. Mehr Informationen finden sie auf https://raccoon-attack.com
T0RTT at PETS 2020
30.03.2020 - Sebastian Lauer
In cooperation with scientists from the Universities of Paderborn and Wuppertal we have published the paper "T0RTT: Non-Interactive Immediate Forward-Secure Single-Pass Circuit Construction" at the 20th Privacy Enhancing Technologies Symposium.
Our paper deals with the question whether it is possible to speed up the circuit construction in Tor without sacrificing security properties such as forward security.
More infos can be found "here"