News
Next Seminar on 05.06.2024
Written on 31.05.2024 10:56 by Niklas Medinger
Dear All,
The next seminar(s) take place on 05.06.2024 at 14:00 (Session A) and 14:00 (Session B).
Session A: (14:00-15:30)
Rizgar Ahmed, Robin Wiesen, Dana Siberski
https://cispa-de.zoom.us/j/96786205841?pwd=M3FOQ3dSczRabDNLb3F1czVXVUpvdz09
Meeting-ID: 967 8620 5841
Kenncode: BT!u5=
Session B: (14:00-15:30)
Thomas Helbrecht, Philipp Baus, Ujjval Desai
https://cispa-de.zoom-x.de/j/66136901453?pwd=YVBSZU9peUpvUlk4bWp3MDR4cGlUUT09
Session A:
14:00 - 14:30
Speaker: Rizgar Ahmed
Type of talk: Bachelor Intro
Advisor: Robert Künnemann, Kevin Morio
Title: Automatically Extracting Protocol Message Formats Using the Grammar-Based Fuzzer ISLa
Research Area:
RA2: Reliable Security Guarantees
Abstract:
The secure implementation of cryptographic protocols is essential for maintaining the confidentiality and integrity of communications in today's interconnected world. Despite advances in formal verification tools such as Tamarin, a significant gap remains between verified protocol designs and their real-world implementations. One critical challenge is that the structure and formats of transmitted messages are often not explicitly defined or are obfuscated within the implementation, making the verification process even harder.
In this thesis, we aim to develop an approach that closes this gap by automatically extracting message formats. Our approach is based on the ISLa constraint solver, a tool that allows us to define detailed constraints on inputs that are difficult or even impossible to express with grammar alone. We start by writing a grammar for the format strings, then use the ISLa fuzzer to generate these format strings, using the ISLa constraint language and iterative refining these constraints until we identify the correct formats.
14:30 - 15:00
Speaker: Robin Wiesen
Type of talk: Bachelor Intro
Advisor: Dr. Sven Bugiel
Title: Selective Permissions for Android's SDK Runtime
Research Area: RA4: Secure Mobile and Autonomous Systems
Abstract: In the original Android sandboxing model, third-party libraries are executed within the sandbox of the host app and inherit all its privileges (permissions, file system access, etc.). This lack of privilege separation exposes users to a higher risk in the presence of vulnerable or privacy-invasive libraries.
With the introduction of the SDK Runtime in Android 13, it is officially supported for the first time to run compatible SDKs in a dedicated environment with separate permissions. However, the current design is primarily tailored to the requirements of advertising libraries and therefore only offers a fixed set of permissions.
The goal of this thesis is to demonstrate that the SDK Runtime could serve as a flexible solution to compartmentalize app components by lifting the restriction of fixed permissions. To this end, we develop a library that can be integrated at the application layer and allows runtime-enabled SDKs (RE-SDKs) to trigger a permission request in the host app. Since RE-SDKs cannot request additional permissions on their own, the host app acts as a proxy and relays requests between the SDK and the Android framework.
Extending the scope of the SDK Runtime beyond ad libraries would allow developers to realize the principle of least privilege, contributing to the security and privacy of users.
15:00 - 15:30
Speaker: Dana Siberski
Type of talk: Bachelor Intro
Advisor: Dr. Dominic Steinhöfel
Title: Structure-Aware String Insertion for ISLa
Research Area: RA5
Abstract:
Automatic input generation (fuzzing) is a well-known method for software testing. It works by generating various random inputs on which to test a target program. To ensure that the deeper logic of a program is reached, some fuzzing tools use grammars and specification languages to restrict the generated inputs. Different ways to describe program inputs for fuzzing have been developed, including the input specification language ISLa. One advantage of fuzz testing is the ability to test a program on a huge number of diverse inputs. This requires the efficient generation of semantically varied inputs. We propose structure-aware string insertion to improve the efficiency of the generator based on ISLa.
ISLa extends context-free grammars with quantors and structural predicates. During the generation process, one challenge is solving properties described by existential quantors (e.g.: ”a table header must exist”). In the ISLa generator, inputs are first generated without fulfilling all properties. We solve existential properties by generating an input snippet based on the generated input and the property. We insert this snippet into the original input to create a valid input. To preserve grammatical correctness, we use derivation trees during the insertion process.
Structural predicates further restrict valid insertions (e.g. ”a table header must exist before the table”). We consider these predicates during the insertion process to avoid invalid insertions and improve the generator’s efficiency. Structure-aware string insertion limits resulting derivation trees and inputs in size while producing various semantically different, valid results.
Session B:
14:00 - 14:30
Speaker: Thomas Helbrecht
Type of talk: Master Intro
Advisor: Dr.-Ing. Ben Stock
Title: Warning: Overload. Comparing console messages across time and browsers.
Research Area: 5
Abstract:
Console messages are a commonly used mechanism by developers for debugging websites from within the browser. Similarly, browser vendors use them to express issues they might observe when rendering a website, for instance, failing requests or invalid javascript. While developers can utilize the standardized Console API in JavaScript, browser developers emit console messages from within the browser implementation, raising questions about vendor differences when producing console output.
Despite its high usefulness, prior work insufficiently covered this mechanism, often considering it only as a subordinate part of a specific domain, for instance, when implementing browser APIs or for deprecation signaling. Additionally, larger-scale empirical measurements comparing browser vendors' console output remain unperformed, and questions about differences in console messaging across browser versions are left unanswered.
In this thesis, we will investigate console messaging on public websites from the perspective of different browser engines. In order to accomplish this, we will develop an automated crawling pipeline capable of harvesting console output at scale. Afterwards, we will compare the console messaging behavior across browser versions in a controlled test environment (a test web application causing console messages), which will also be a product of our work. By applying this approach, we aim to gather insights about differences in the produced console messages across time.
14:30 - 15:00
Speaker: Philipp Baus
Type of talk: Master Intro
Advisor: Ben Stock, Jannis Rautenstrauch
Title: Escaping the Cookie Prison: An in-depth analysis of Storage Access API Usage on the Web
Research Area: RA5
Abstract:
The increasing importance of online privacy has led to the adoption of storage partitioning techniques designed to mitigate cross-site tracking by isolating browser storage. While these measures are crucial for enhancing user privacy, they introduce significant compatibility challenges for websites that rely on third-party cookies for essential functionalities, such as authentication, analytics, and third-party services. To address these challenges, the Storage Access API was introduced, allowing websites to request unpartitioned cookie access. However, granting access to the wrong websites poses significant security risks, as it could re-enable cross-site tracking and undermine user privacy protections. Through a comprehensive analysis of various websites from different popularity ranges, this work aims to uncover the intentions behind the Storage Access API usage on the web, as well as how the API could be improved to prevent malicious use cases in the future. Our work can help to contribute to a privacy-preserving web by uncovering the diverse intentions behind the use of the Storage Access API and proposing enhancements to the API that safeguard user privacy.
15:00 - 15:30
Speaker: Ujjval Desai
Type of talk: Master Final
Advisor: Prof. Dr. Lucjan Hanzlik
Title: Practical and Distributed Attestation Infrastructure for Fast IDentity Online (FIDO) with Attributes
Research Area: RA1: Trustworthy Information Processing
Abstract:
In the current digital landscape, the importance of web authentication is underscored, and the Fast IDentity Online (FIDO2) protocol plays a crucial role. FIDO2 enables seamless user authentication across various online services on both mobile and desktop platforms. It adopts a passwordless authentication approach grounded in cryptography and biometric verification, utilizing common devices for secure access. Despite its advantages, FIDO2 cannot aggregate user attributes during authentication, a gap addressed by Fast IDentity Online with Anonymous Credentials (FIDO-AC). However, this method also has its downsides, because of the requirement to have a mediator present locally as depending entirely on trusted third-party execution was seen as unreliable, and external mediators lacked enough motivation as incentives.
To overcome these challenges, we propose relocating the mediator service to a remote server and accessing it whenever attestation is required. However, even with this improvement, the single mediator remains a potential single point of failure. To mitigate this risk, we intend to introduce multiple mediators that will work collaboratively to provide the necessary attestation. Additionally, to motivate trusted third parties, we plan to provide appropriate incentives to the mediators for their remuneration. Furthermore, to safeguard sensitive operations against unauthorized access or manipulation, we establish a Trusted Execution Environment (TEE) for the mediator service utilizing a secure SGX Enclave.