Recently, our team member Andreas Poller gave an interview at Deutschlandfunk. The radio report shone a light on the reasons why the German Federal Office for Information Security (BSI) asked us to investigate TrueCrypt, how we executed the study, and what common users shall consider when using harddisk encryption.
The interview is available in German here.
Cross-posted from Secure Software Engineering
Recently, our team member Andreas Poller gave an interview at Deutschlandfunk. The radio report shone a light on the reasons why the German Federal Office for Information Security (BSI) asked us to investigate TrueCrypt, how we executed the study, and what common users shall consider when using harddisk encryption.
The interview is available in German here.
Cross-posted from Secure Software Engineering
We are happy to announce our new publication “Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques” which will be presented at NDSS 2016. Harvester combines static and dynamic code analysis techniques to extract runtime values (e.g. URLs, SMS messages/numbers, etc.) from Android binaries. Furthermore, it can also be used for de-obfuscating Android applications. More details can be found here.
Looking forward to a great conference.
Cross-posted from Secure Software Engineering
We are happy to announce our new publication “Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques” which will be presented at NDSS 2016. Harvester combines static and dynamic code analysis techniques to extract runtime values (e.g. URLs, SMS messages/numbers, etc.) from Android binaries. Furthermore, it can also be used for de-obfuscating Android applications. More details can be found here.
Looking forward to a great conference.
Cross-posted from Secure Software Engineering
As a follow up to our BlackHat EU 2015 presentation about benign applications not securing user data in the cloud (Backend-as-a-Service) we also looked into malicious applications whether we can find similar data leakages. In a collaboration with McAfee Security Lab (Intel Security Lab) we analyzed 294,817 malware-laden mobile apps and found that 16 of them are connected with vulnerable Backend-as-a-Service instances implemented in Facebook Parse. Since the malware authors did not secure the backend (BaaS-backend) securely we had access to the complete database including Command&Control (C&C) communications and tasks for victims. This gave us very interesting insights about current state-of-the-art C&C communication/protocols in the context of mobile malware.
The results were presented at VirusBulletin 2015 and AVAR 2015. More details can be looked up from our whitepaper and the corresponding slides. This project is also part of McAfee’s Q4 Threat report.
Media report:
Cross-posted from Secure Software Engineering
As a follow up to our BlackHat EU 2015 presentation about benign applications not securing user data in the cloud (Backend-as-a-Service) we also looked into malicious applications whether we can find similar data leakages. In a collaboration with McAfee Security Lab (Intel Security Lab) we analyzed 294,817 malware-laden mobile apps and found that 16 of them are connected with vulnerable Backend-as-a-Service instances implemented in Facebook Parse. Since the malware authors did not secure the backend (BaaS-backend) securely we had access to the complete database including Command&Control (C&C) communications and tasks for victims. This gave us very interesting insights about current state-of-the-art C&C communication/protocols in the context of mobile malware.
The results were presented at VirusBulletin 2015 and AVAR 2015. More details can be looked up from our whitepaper and the corresponding slides. This project is also part of McAfee’s Q4 Threat report.
Media report:
Cross-posted from Secure Software Engineering
As I announced a few weeks ago, in 2016 I will be moving to the University of Paderborn to start a tenured professorship there. As part of this move, I am looking for a number of new Ph.D. students and also PostDocs. The positions come with full funding for a number of years. You can find more information about these positions here. As stated, please direct your applications to se-jobs.cs@upb.de
If you have a deep interest in software engineering, especially software security, the I am very much looking forward to your application!
Cross-posted from Secure Software Engineering
As I announced a few weeks ago, in 2016 I will be moving to the University of Paderborn to start a tenured professorship there. As part of this move, I am looking for a number of new Ph.D. students and also PostDocs. The positions come with full funding for a number of years. You can find more information about these positions here. As stated, please direct your applications to se-jobs.cs@upb.de
If you have a deep interest in software engineering, especially software security, the I am very much looking forward to your application!
Cross-posted from Secure Software Engineering
There is a growing use of empirical research methods to address cyber security challenges. This workshop aims to contribute to developing a common understanding of these methods and to set guidelines for using them for the different sub-disciplines including, but not limited to: security in software engineering, network security, security in social networks, and usable security. Researchers who work with these methods are encouraged to submit their work to the workshop and share their findings and experience. The submission deadline is January 4th, 2016. More information are available here.
Cross-posted from Secure Software Engineering
There is a growing use of empirical research methods to address cyber security challenges. This workshop aims to contribute to developing a common understanding of these methods and to set guidelines for using them for the different sub-disciplines including, but not limited to: security in software engineering, network security, security in social networks, and usable security. Researchers who work with these methods are encouraged to submit their work to the workshop and share their findings and experience. The submission deadline is January 4th, 2016. More information are available here.
Cross-posted from SEEBlog
