On Technical Security Issues in Cloud Computing
- Meiko Jensen, Jörg Schwenk, Nils Gruschka, Luigi Lo Iacono
- Computer ScienceIEEE International Conference on Cloud Computing
- 21 September 2009
This paper focuses on technical security issues arising from the usage of Cloud services and especially by the underlying technologies used to build these cross-domain Internet-connected collaborations.
On the Security of TLS-DHE in the Standard Model
- Tibor Jager, Florian Kohlar, Sven Schäge, Jörg Schwenk
- Computer Science, MathematicsAnnual International Cryptology Conference
- 19 August 2012
The notion of authenticated and confidential channel establishment ACCE is defined as a new security model which captures precisely the security properties expected from TLS in practice, and the combination of the TLS Handshake with data encryption in the TLS Record Layer can be proven secure in this model.
On Breaking SAML: Be Whoever You Want to Be
- Juraj Somorovsky, Andreas Mayer, Jörg Schwenk, M. Kampmann, Meiko Jensen
- Computer ScienceUSENIX Security Symposium
- 8 August 2012
An in-depth analysis of 14 major SAML frameworks is described and it is shown that 11 of them, including Salesforce, Shibboleth, and IBM XS40, have critical XML Signature wrapping (XSW) vulnerabilities.
How Secure is TextSecure?
- Tilman Frosch, Christian Mainka, Christoph Bader, Florian Bergsma, Jörg Schwenk, Thorsten Holz
- Computer ScienceEuropean Symposium on Security and Privacy
- 21 March 2016
It is formally prove that - if key registration is assumed to be secure - TextSecure's push messaging can indeed achieve most of the claimed security goals.
All your clouds are belong to us: security analysis of cloud management interfaces
- Juraj Somorovsky, M. Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka, Luigi Lo Iacono
- Computer ScienceCloud Computing Security Workshop
- 21 October 2011
This research results are alarming: in regards to the Amazon EC2 and S3 services, the control interfaces could be compromised via the novel signature wrapping and advanced XSS techniques and the Eucalyptus control interfaces were vulnerable to classical signature wrapping attacks, and had nearly no protection against XSS.
SoK: Single Sign-On Security — An Evaluation of OpenID Connect
- Christian Mainka, Vladislav Mladenov, Jörg Schwenk, Tobias Wich
- Computer ScienceEuropean Symposium on Security and Privacy
- 26 April 2017
This paper systematically analyze well-known attacks on SSO protocols and adapt these on OpenID Connect, and addresses the existing problems in a Practical Offensive Evaluation of Single Sign-On Services (PrOfESSOS), the authors' open source implementation for a fully automated evaluation-as-a-Service for SSO.
Provably secure browser-based user-aware mutual authentication over TLS
- S. Gajek, M. Manulis, A. Sadeghi, Jörg Schwenk
- Computer ScienceACM Asia Conference on Computer and…
- 18 March 2008
This work proposes a protocol that allows the user to identify the server based on human perceptible authenticators (e.g., picture, voice) and proves the security of this protocol by refining the game-based security model of Bellare and Rogaway and presenting a proof of concept implementation.
Penetration Testing Tool for Web Services Security
- Christian Mainka, Juraj Somorovsky, Jörg Schwenk
- Computer ScienceIEEE Eighth World Congress on Services
- 24 June 2012
An overview of the design decisions and evaluation of four Web Services frameworks and their resistance against WS-Addressing spoofing and SOAPAction spoofing attacks is given.
More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema
- Paul Rösler, Christian Mainka, Jörg Schwenk
- Computer ScienceEuropean Symposium on Security and Privacy
- 24 April 2018
A comprehensive and realistic security model is provided that reveals that strong security properties, such as Future Secrecy, which is a core part of the one-to-one communication in the Signal protocol, do not hold for its group communication.
On the Security of TLS 1.3 and QUIC Against Weaknesses in PKCS#1 v1.5 Encryption
- Tibor Jager, Jörg Schwenk, Juraj Somorovsky
- Computer Science, MathematicsConference on Computer and Communications…
- 12 October 2015
Two attacks which transfer the potential weakness of prior TLS versions to two recently proposed protocols that do not even support PKCS#1 v1.5 are described, namely Google's QUIC protocol and TLS~1.3.
...
...