Two of the students who have written their thesis with us won an award for outstanding theses in the context of IT security.
We congratulate Simon Nachtigall on his first place with the topic of “Evaluation of TLS session tickets” in the “Master’s Thesis” category and Nico Heitmann on another first place in the category “Bachelor’s Thesis” with the topic “Security Analysis of the Web Conferencing System BigBlueButton”.
Do you use S/MIME or OpenPGP to secure your emails? Do you think that validating e-mail signatures is easy? If your answer is yes, you should take a look at our study published together with our colleagues from Karlsruhe Institute of Technology, Münster University of Applied Sciences, and Ruhr University Bochum.
Together with our colleagues from the Ruhr University Bochum, we have published our paper on combinatorial testing of TLS implementations. The paper is presented at USENIX Security in Boston this week.
Together with Robert Merget, we gave a hands-on tutorial on TLS 1.3 and how you can analyze it with TLS-Attacker. The tutorial was recorded and is now available on YouTube.
We published a new attack called ALPACA. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one…
In cooperation with /upb/hack, we organize an IT Security "Stammtisch". The topics in the first months include Content Security Policy, OpenID Connect, and PDF security.
We are searching for motivated students, who would like to work on CTF challenges and further maintain or develop the CTF platform developed by the students of UPB.