Johannes

Practice real-world security challenges in a fun and legal way! On-site hacking competition organized by @LosFuzzys

A CTF is a hacking contest. Its a safe, legal, and free (as in free beer) opportunity to learn about hacking or test your hacking skills. Everyone with a computer and an internet connection is welcome. You don't have to be present at Linuxtage - but it is more fun if you are! We welcome people with different skill levels; a curious beginner is as much welcome as an experienced person. We also embrace different skill sets and diverse backgrounds by providing different categories and levels of challenges. You can register and access the CTF here: https://linuxtage.fuzzy.land/ The CTF is already live, so you can start solving challenges right away.

Other people: Lena Markus Schiffermüller Marcel Nageler Yuma Buchrieser David Muckenschnabl

In this talk, we will explore adversarial attacks on neural networks. We will show how it is possible to make neural networks believe that turtles look like weapons or any other kind of object.

In recent years, AI systems have shown incredible abilities, such as playing chess, driving cars, recognizing speech, diagnosing cancer, and recognizing different kinds of objects. But there are cases in which AIs fail in strange ways. In this talk, we will explore adversarial attacks on neural networks. The goal is to create images that look unsuspicious to humans but can trick AI into believing that it sees something entirely different. We will show how it is possible to make neural networks believe that turtles look like weapons or any other kind of object. This talk will cover: - What kinds of adversarial attacks are there? - How do they work? - What are the consequences for security and safety in AI technology?

In this talk, I will give an overview of the past, present, and possible future of physical security enclosures, i.e., the physical boundary that protects Hardware Security Modules (HSMs) and separates the untrusted outside from the secret data inside the module. I will present an analysis of the hardware security features in some selected HSMs, ranging from sensitive carbon meshes, over light detectors, up to temperature sensors. Since the security of these solutions has recently been questioned and some of them have been discontinued, new technologies have been proposed by several research groups, which will be presented in the second half of my talk. I will give insight into the current research regarding future solutions whose security is based on Physical Unclonable Functions (PUFs). Via this technology, cryptographic keys are extracted from intrinsic manufacturing variation of the enclosure itself. Thus, a violation of the delicate enclosure results in immediate loss of information and thereby voids cryptographic keys - in theory. Finally, I will discuss existing drawbacks and issues which have to be resolved, which currently prevent PUFs from protecting HSMs.

Hardware Security modules (HSMs) in servers, such as for VPN or banking applications, are commonly protected via physical security enclosures. This boundary, which consists of a conductive mesh that entirely surrounds the module under protection, is continuously monitored to detect any physical intrusion and subsequently wipe critical data. Since attack tools have improved and some enclosure solutions have been discontinued, a desire for a new technology has emerged. At first, I present state-of-the-art solutions for HSMs which conform up to the highest security level: FIPS 140-2 level 4. Knowledge about these solutions was gained by accurate disassembly of such modules, obtained via a famous online market place. While some solutions have a very delicate mesh surrounding the entire device, others have additional light and temperature sensors that are countermeasures against common physical attacks. However, many physical security enclosures have been discontinued, sometimes due to suspected insecurity, thus, there is demand for a successor. The second part of my presentation focuses on a novel technology for enclosures, based on Physical Unclonable Functions (PUFs). These PUFs, which are currently investigated by several research groups, are uncontrollable minuscule manufacturing variations which are present, for example, in a conductive mesh of a security enclosure. One solution, that I am doing research at, is able to extract femto-farad (10^-15) capacitance variations from electric traces contained in the enclosure. Cryptographic keys are derived from the PUF which is subsequently used to encrypt the underlying system data. If an attacker damages the enclosure in an attempt to gain access, these delicate variations are altered, the key changes, and critical data cannot be recovered anymore. Despite PUFs provide real tamper-sensitive key storage, they are accompanied by some drawbacks, e.g., sensitivity to environmental conditions, aging, etc. which have to be tackled via additional means. Finally, I will discuss the current status of the development of PUF enclosures and outline the issues that have to be resolved to enable PUF-based security enclosures to secure future HSMs. (I will try to bring some real-world samples, so that there is the option to have a close look after the talk. However, I have to check this with my institute first.) About the presenter: I am currently doing my PhD at a research institute that focuses on embedded security. I am in the final phase of my dissertation about physical security enclosures, based on PUFs. This offers me a deep insight into the current development status of Physical Security Enclosures. In this talk, I want to share my experience with various solutions, from an analysis of a few up to the development of others. My goal is to discuss novel PUF-based solutions openly to raise awareness and to encourage more research into this interesting direction - from attacks up to countermeasures.

Almost every microcontroller features firmware readout protection. It aims at securing the code, algorithms, and cryptographic keys against unauthorized access. Despite datasheets are promising strong security, our research shows that this is often far from being true. In this talk we want to shed light onto the "why?" and especially "how?" we approach the security testing of such protection mechanisms. Furthermore, we will talk about our attempts, discussions, and hassles from the vulnerability disclosure process - from successful ones to dead ends.

Since several years, we, Johannes and Marc, do practical research in the field of embedded system security at a research institute. In this talk, we want to give an insight into the daily work as hardware security researchers. This ranges from giving recommendations on how to secure systems up to verifying microcontroller security in real environments. However, no practical experience and information on the resilience of common microcontrollers is publicly available - a gap we want to close. Especially when trying to make use of the integrated security features, their effectiveness often collapses quickly due to design weaknesses. Our focus lies on firmware protection mechanisms since they often are the root of security in embedded systems. During our research we were able to circumvent several mechanisms implemented from different manufacturers. In most cases, each attack requires only low-priced equipment, thereby increasing the impact of each weakness and resulting in a severe threat altogether. We will present one of those attacks, which can be performed within minutes, on stage. Due to the severe impact of these results, we immediately informed the manufacturers in a coordinated disclosure process. However, this is often not as simple as expected and maybe even risky. In this talk we will shortly state the chosen approach and will then compare our expectations on coordinated disclosure with the real reactions of the addressed manufacturers - ranging from a friendly discussion, over tricking-into-NDA, up to ghosting. Finally we will give some ideas on how to read between the lines in datasheets. Additionally, we will outline the legal gray area of applied security research in academia.

Other people: marc