Cryptographic Enforcement of Segregation of Duty Thomas Maus published in Magdeburger Journal zur Sicherheitsforschung (2017, #14, p. 858-870) Info Workflows with Segregation-of-Duty requirements or involving multiple parties with non-aligned interests (typically mutually distrustful) pose interesting challenges in …

Read More

Social Engineering - The Most Underestimated APT Hacking the Human Operating System Dominique C. {Brack} published in Magdeburger Journal zur Sicherheitsforschung (2017, #14, p. 830-857) Info Social Engineering is an accepted APT and is going to stay. Most of the high-value hacking attacks feature components of social …

Read More

HVACKer Bridging the Air-Gap by Manipulating the Environment Temperature Yisroel Mirsky and Mordechai Guri and Yuval Elovici published in Magdeburger Journal zur Sicherheitsforschung (2017, #14, p. 815-829) Info Modern corporations physically separate their sensitive computational infrastructure from public or other …

Read More

CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy Lukas Weichselbaum and Michele Spagnuolo and Sebastian Lekies and Artur Janc published in Magdeburger Journal zur Sicherheitsforschung (2017, #14, p. 779-796) Info _Content Security Policy is a web platform mechanism …

Read More

Revisiting SOHO Router Attacks Álvaro {Folgado Rueda} and José Antonio {Rodríguez García} and Iván {Sanz de Castro} published in Magdeburger Journal zur Sicherheitsforschung (2017, #14, p. 797-814) Info Domestic routers have lately been targeted by cybercrime due to the huge amount of well-known vulnerabilities which …

Read More

BadGPO Using Group Policy Objects for Persistence and Lateral Movement Immanuel Willi and Yves Kraft published in Magdeburger Journal zur Sicherheitsforschung (2017, #13, p. 772-778) Info Group Policy is a feature which provides centralized management and configuration functions for the Microsoft operating system, …

Read More

It is about the administrative costs Marcus J. Ranum published in Magdeburger Journal zur Sicherheitsforschung (2017, #13, p. 751-753) Info Everything that's old is new again, and if you work in security long enough, you'll see the same ideas re-invented and marketed as the new new thing. Or, you see solutions in …

Read More

Malicious Hypervisor Threat Phase Two: How to Catch the Hypervisor Mikhail Utin published in Magdeburger Journal zur Sicherheitsforschung (2017, #13, p. 754-771) Info In this article we're addressing the matters discussed at DeepSec 2014 (Utin M. 2014) and 2016 (Utin M. 2016) including the current status of the …

Read More

Applicability of Criminal Law and Jus ad Bellum to Cyber-Incidents Oscar Serrano and Florin-Răzvan Radu and Ele-Marit Eomois published in Magdeburger Journal zur Sicherheitsforschung (2016, #12, p. 715-724) Info Despite current efforts to adapt existing legal instruments to regulate hostile activities in cyber space, …

Read More

Bypassing McAfee’s Application Whitelisting for Critical Infrastructure Systems René Freingruber published in Magdeburger Journal zur Sicherheitsforschung (2016, #12, p. 705-714) Info This paper describes the results of the research conducted by SEC Consult Vulnerability Lab on the security of McAfee Application …

Read More