supervised theses | Christian Mainka

84 Total. 42 Bachelor. 42 Master.

2024

October

Bachelor

Enhancing Web Security and Privacy with the Federated Credential Management (FedCM) API

Selina Danelzik

Oct 2024

@thesis{danelzikEnhancingWebSecurity2024,
  type = {bathesis},
  title = {Enhancing {{Web Security}} and {{Privacy}} with the {{Federated Credential Management}} ({{FedCM}}) {{API}}},
  author = {Danelzik, Selina},
  date = {2024-10-01},
  institution = {Ruhr University Bochum},
  pagetotal = {184},
  month = oct,
}

September

Master
Exploring the Opportunity Window: How Attackers Can Bypass Google Safe Browsing

Christian Krug

Sep 2024

Abs Bib

Google Safe Browsing is one of the major countermeasures against phishing. Little is known about how it works and how effective it is at blocking phishing websites. In this thesis, we analyze the internals of Safe Browsing to understand how it functions, measure the opportunity window to evaluate its effectiveness at preventing phishing, and present various novel attacks against Safe Browsing that allow attackers to run phishing campaigns without being detected.
@thesis{krugExploringOpportunityWindow2024, type = {mathesis}, title = {Exploring the {{Opportunity Window}}: {{How Attackers Can Bypass Google Safe Browsing}}}, author = {Krug, Christian}, date = {2024-09-26}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {82}, month = sep, }

July

Master
Semi-Automated Black-Box Security Analysis of the CMS Signature Verification on the Example of PDF-Viewers

Robin Beermann

Jul 2024

Abs Bib

SARCASM’s features are demonstrated on the example of signatures in PDF files. Previous research revealed multiple flaws in the signature validation of PDF-Viewers. Those attacks base on manipulations of PDF elements and leave the included CMS data structure unaltered. However, in recent years successful trickeries against verifiers of CMS signatures in S/MIME and XML signatures in other document formats were performed. In each case for some presented attacks mainly or solely the included signatures were manipulated. Based on a thesis of Nico Beckenkamp [10] signature forgery attack vectors are semi-automatically created with SARCASM. The resulting files are tested against current versions of a selection of four PDF-Viewers. Two of them could be tricked to present a forged document as validly signed to the user.
@thesis{beermannSemiAutomatedBlackBoxSecurity2024b, type = {mathesis}, title = {Semi-{{Automated Black-Box Security Analysis}} of the {{CMS Signature Verification}} on the Example of {{PDF-Viewers}}}, author = {Beermann, Robin}, date = {2024-07-29}, langid = {english}, pagetotal = {222}, month = jul, }
Master
Systematic Security Analysis of Redaction-Tools for PDF Documents

Vincent Reckendrees

Jul 2024

Abs Bib

PDF documents are an integral part of the daily work for millions of people nowadays. When documents are published, they sometimes contain sensitive information that should not be available to the public. To remove confidential information from a document before it is published, most PDF tools include a redaction feature. However, removing information from a document so that no one can recover them is not a trivial task. Because PDF redaction is not a standardized process, PDF tool developers use different approaches, which has led to numerous cases of insecure redactions in the past. This thesis systematically analyzes the security of redaction tools for PDF documents. A requirement list was developed for the analysis, defining the output of a secure redaction process. The list includes test cases to verify the secure execution of various types of redactions. All test cases were executed for a set of PDF redaction software. Subsequently, an analysis tool was developed to enable the automatic evaluation of redaction test cases. The evaluation of executed test cases revealed redaction vulnerabilities in every analyzed redaction software, posing a significant risk for the confidentiality of published redacted documents. To support future evaluation of redacted PDF documents, the feasibility of automatically detecting insecurely redacted PDFs was examined.
@thesis{reckendreesSystematicSecurityAnalysis2024a, type = {mathesis}, title = {Systematic {{Security Analysis}} of {{Redaction-Tools}} for {{PDF Documents}}}, author = {Reckendrees, Vincent}, date = {2024-07-16}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {152}, month = jul, }

February

Master
Systematic Analysis of the PDF Landscape

Alexander Wortmann

Feb 2024

Abs Bib

Since PDFs were introduced in 1993, they became increasingly popular due to the large variety of functions they provide and, hence, the number of use cases in which they can be used. Today, the standard found its way into daily digital reality. This, in combination with the pallet of functionality, makes this file type interesting for attackers that use it as an entry point for various attack types, most commonly downloading or hiding further malicious scripts and malware. Within this work, we derive an overview of the structure and features that real-world PDFs use. For this reason, we create a dataset of PDF samples, from which we extract the corresponding information. For analysis, we modify an existing parser and create a custom parsing approach to extract information from unparseable files. With the resulting database, we analyze the structural di erences over time between 2010 and 2023. Additionally, we take a closer look into signature and encryption dictionaries that contain information about the specifics of the file signature and encryption. We find that, in the context of the current PDF standard 2.0, most files do use insecure parameters. With signed files, more than 26% use insecure features. Finally, we compare benign and malicious files in two stages. At first, we only regard files from expert sample sets where files are already categorized as benign or malicious and compare their structure. Furthermore, we use the binomial test to check if significant di erences in the use of various names exist between them. In step two, we use the PDF malware detection tool Hidost to categorize a subset of our collected files and do the same. We find that malicious and benign files show di erences in structure and the use of certain functionalities, represented by names.
@thesis{wortmannSystematicAnalysisPDF2024, type = {mathesis}, title = {Systematic {{Analysis}} of the {{PDF Landscape}}}, author = {Wortmann, Alexander}, date = {2024-02-08}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {112}, month = feb, }

2023

November

Bachelor
Modellierung Der Single Sign-On Developer- Dokumentationen von Identity Providern Und Identity Brokern Als JSON

Richard Hildebrandt

Nov 2023

Abs Bib

Diese Bachelorarbeit präsentiert eine Untersuchung von Identity Providern (IdP) und Identity Brokern (IdB) im Kontext von Single-Sign-On (SSO). Zunächst werden 18 der am weitesten verbreiteten IdPs anhand einer ausgewählten Studie identifiziert, während zwei populäre IdBs durch Internetrecherche ermittelt werden. Die Entwicklerdokumentationen von Apple, Google und Facebook werden daraufhin intensiv auf ihre SSO-relevanten Aspekte untersucht. Basierend auf dieser Analyse wird ein JSON-Schema entwickelt, das die spezifischen Konfigurationen für die Implementierung von SSO mit einem IdP sowohl für Menschen als auch für Maschinen verständlich macht. Die ausgewählten IdPs und IdBs werden in dieses Schema überführt. Dabei werden Anpassungen vorgenommen, um Abweichungen vom Standard und Eigenentwicklungen adäquat zu berücksichtigen. Das Hauptziel dieser Arbeit besteht darin, die Implementierung von IdPs zu vereinfachen. Dies ermöglicht es in der Forschung, die Sicherheit von verschiedenen IdPs zu untersuchen, insbesondere im Hinblick auf Eigenentwicklungen und Abweichungen vom Standard. Dieser Ansatz trägt zur Erweiterung des Verständnisses von Sicherheitsaspekten in der SSO-Technologie bei und legt den Grundstein für weiterführende Forschungen im Bereich der digitalen Identitätssicherheit.
@thesis{hildebrandtModellierungSingleSignOn2023, type = {bathesis}, title = {Modellierung Der {{Single Sign-On Developer- Dokumentationen}} von {{Identity Providern}} Und {{Identity Brokern}} Als {{JSON}}}, author = {Hildebrandt, Richard}, date = {2023-11-26}, langid = {english}, pagetotal = {63}, month = nov, }
Bachelor
Systematische Sicherheitsanalyse von PAdES- Signaturen

Lilian Weigt

Nov 2023

Abs Bib

In dieser Thesis wird der PAdES-Standard in Hinblick auf seine Unterschiede zu klassischen PDF-Signaturen, sowie seine Sicherheit untersucht. Es wird zunächst eine Übersicht über die grundlegenden Elemente gegeben, welche für diese Thesis relevant sind. Hierzu gehört der Aufbau eines PDF-Dokuments und die Einbindung von digitalen Signaturen in diese Struktur. Anschließend wird eine Gegenüberstellung des PAdES-Standards mit klassischen PDF-Signaturen vorgenommen, welche auch die zusätzlichen Elementen des PAdES-Standard beleuchtet. Die Sicherheitsanalyse erfolgt auf Basis bereits bekannter Angri e auf klassische PDF-Signaturen und präsentiert außerdem weitere PAdES-spezifische Angri smöglichkeiten. Unter Verwendung von erstellten Proofs of Concept erfolgt das Testen der diskutierten Angri e anhand einer gewählten Anwendung. Es kann festgestellt werden, dass der PAdES-Standard in Bezug auf seine Sicherheit ebenso abhängig von den einzelnen Implementierungen der Signaturvalidierung ist wie klassische PDF-Signaturen. Die zusätzlichen Elemente des Standards bieten keinen Schutz gegenüber den bekannten Angri svektoren und bieten unter bestimmten Voraussetzungen sogar Raum für weitere Angri e.
@thesis{weigtSystematischeSicherheitsanalysePAdES2023, type = {bathesis}, title = {Systematische Sicherheitsanalyse von PAdES- Signaturen}, author = {Weigt, Lilian}, date = {2023-11-20}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {78}, month = nov, }

October

Master
Traffic Analysis of Single Sign-On Authentication Schemes

Benno Droste

Oct 2023

Abs Bib

This thesis provides a comprehensive overview of the web landscape supporting single sign-on (SSO) functionality via social logins. It provides a detailed analysis of the prevalence and distribution of the two protocols OAuth 2.0 and OpenID Connect, including their various flows and configurations. It highlights the extent to which best security practices are followed in the execution of these protocols and what additional security measures are taken by the parties involved. In a large-scale analysis, security shortcomings are described in detail, both on the client side and on the side of the identity providers under consideration. In order to support this analysis, a framework for processing traffic records has been created and complemented by a comprehensive test suite as part of this thesis.
@thesis{drosteTrafficAnalysisSingle2023, type = {mathesis}, title = {Traffic {{Analysis}} of {{Single Sign-On Authentication Schemes}}}, author = {Droste, Benno}, date = {2023-10-17}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {84}, month = oct, }
Bachelor
Cross-Site Leaks In The Wild

Max Rull

Oct 2023

Abs Bib

This thesis delves into the realm of Cross-Site Leaks (XS-Leaks) in web browsers and their ecosystem. The significance of this topic is underscored by the potential security implications of such leaks. Despite prior research, such as the Leaky Web paper which analyzed XS-Leaks in a dataset of 100 websites, there remains a gap in understanding the broader prevalence of these leaks [10]. This work aims to bridge that gap by extending the analysis to the Tranco Top 1000 websites. Out of these, 802 domains were accessible, and accounts were created on 432 of those. Using the AutoLeak tool, 334 of these sites were found to have XS-Leaks. The methodology employed involves a meticulous data gathering setup and process, with an emphasis on understanding the intricacies of stable and user-friendly website development. Challenges encountered during data gathering, such as domain inaccessibility and specific prerequisites for account creation, are also discussed. Preliminary findings indicate that a significant percentage of domains exhibited detectable differences, shedding light on the widespread nature of XS-Leaks. This research not only contributes new insights to the field but also offers recommendations for future work and exploration.
@thesis{rullCrossSiteLeaksWild2023, type = {bathesis}, title = {Cross-{{Site Leaks In The Wild}}}, author = {Rull, Max}, date = {2023-10-18}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {64}, month = oct, }
Master
On the Security and Privacy of Single Sign-On Logins in Single-Page Applications

Katharina Utz

Oct 2023

Abs Bib

Single-Page Applications (SPAs) are web applications that do not reload during any kind of user action. All page components are dynamically updated and integrated into an initial HTML document that forms the basis of the SPA. To the best of our knowledge, no formal definition of SPAs exist besides this characterization. In this thesis we provide the first technical definition for SPAs. We implement a tool for automated website analysis regarding the compliance with our defined criteria for SPAs. In our analysis of websites of the Tranco top 100 list we detected 15 websites fulfilling our SPA criteria. In addition, we discovered another 22 SPAs from websites in the categories of social media, streaming or entertainment, which generally show a high percentage of SPAs. Next to the investigation of real-word SPAs, we focus on the subject of Single SignOn (SSO). Previous research on SSO has already been performed in the areas of cloud computing or mobile native applications. Based on the found SPAs, we investigate implementation and security aspect of SSO on SPAs in the wild. We found that 48% of the SPAs examined use a dual-window SSO flow that allows the SPA to maintain a zero page reload behavior during SSO execution. Furthermore, we detected SSO token inside browser storage in 35% of the SPAs, leading to a flaw in security and privacy protection.
@thesis{utzSecurityPrivacySingle2023, type = {mathesis}, title = {On the {{Security}} and {{Privacy}} of {{Single Sign-On Logins}} in {{Single-Page Applications}}}, author = {Utz, Katharina}, date = {2023-10-16}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {120}, month = oct, }

Master

Konzeption und Implementierung einer DevSecOpsToolchain auf Kubernetes-Basis für den Einsatz in der Lehre und Forschung

Moritz Weibler

Oct 2023

Bib

@thesis{weiblerKonzeptionUndImplementierung2023,
  type = {mathesis},
  title = {Konzeption und Implementierung einer DevSecOpsToolchain auf Kubernetes-Basis für den Einsatz in der Lehre und Forschung},
  author = {Weibler, Moritz},
  date = {2023-10-16},
  institution = {Ruhr University Bochum},
  langid = {ngerman},
  pagetotal = {117},
  month = oct,
}

September

Bachelor
Demystifying Scan Configurations for Single Sign- On Detection in the Wild

Sebastian Bensing

Sep 2023

Abs Bib

This thesis demystifies the scan configuration for Single Sign-On (SSO) detection in the wild. SSO allows users to log in with one Identity Providers (IdP) account on a supported site. This feature has the advantage that users can reduce the total number of accounts because one fits multiple. Because of the reduced number of accounts, the risk of attacks rises. However, there are some standards like OAuth or OpenIdConnect for SSO. Security issues are still possible when implementation diverges. The implementation is one reason why it is necessary to verify the implemented flows. There are more research questions. To answer all these questions correctly, the researcher has to scan the Internet extensively. For the identification of the best scan configuration, we use the tool SSO-Monitor. The tool supports different detection strategies, like keyword-based or logo-based recognition, which allow us to test for the ideal configuration over an extensive range. This thesis is limited to the test categories: user agent, browser extension, login page detection strategies, recognition detection strategies, and geolocation. We showed that the operating system in the user agent does not play any role, browser extensions to solve cookies are not comparable, and we need every page detection and recognition strategy.
@thesis{bensingDemystifyingScanConfigurations2023, type = {bathesis}, title = {Demystifying {{Scan Configurations}} for {{Single Sign- On Detection}} in the {{Wild}}}, author = {Bensing, Sebastian}, date = {2023-09-19}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {54}, month = sep, }
Bachelor
Leaky SSO: Investigating the Privacy of Single Sign-On in the Real World

Henry Schulte

Sep 2023

Abs Bib

Single Sign-On bezeichnet ein technisches Konzept für den delegierten Abruf von Informationen eines Nutzerprofils durch eine dritte Partei. In dieser Forschungsarbeit wird die Privatsphäre verschiedener Implementierungsvarianten von Single Sign-On auf 100 Webseiten untersucht. Dazu wird ein auf dem Automatisierungsframework Playwright basierender Ansatz zur teil-automatisierten Durchführung von Single Sign-On und der nachfolgenden Analyse entwickelt und angewandt. Basierend auf den daraus gewonnenen Erkenntnissen wird gezeigt, dass manche Implementierungen Tracking der Webaktivitäten eines Nutzers über verschiedene Webseiten hinweg ermöglichen. Weiterhin wird herausgestellt, dass ungefähr die Hälfte der untersuchten Webseiten nicht transparent damit umgehen, welche Daten sie zu welchem Zweck im Rahmen von Single Sign-On anfordern.
@thesis{schulteLeakySSOInvestigating2023, type = {bathesis}, title = {Leaky SSO: Investigating the Privacy of Single Sign-On in the Real World}, author = {Schulte, Henry}, date = {2023-09-18}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {59}, month = sep, }
Master
Fully Automated Discovery and Analysis of REST-APIs

Florian Stuhlmann

Sep 2023

Abs Bib

This thesis aims to utilize description files of RESTful APIs for conducting a security analysis of APIs at scale. We evaluate the security expressiveness of multiple API description languages and systematize the results. We establish and execute a methodology to collect API description files at a large scale and then utilize the resulting files for a security analysis. We implement applicable Extensible Markup Language (XML)- and JSON Web Token (JWT)-based attacks. Our study employs the RESTAttacker framework developed in a prior thesis. While our approach did not uncover any vulnerabilities, we explain its limitations and suggest areas for further investigation.
@thesis{stuhlmannFullyAutomatedDiscovery2023, type = {mathesis}, title = {Fully {{Automated Discovery}} and {{Analysis}} of {{REST-APIs}}}, author = {Stuhlmann, Florian}, date = {2023-09-20}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {89}, month = sep, }

August

Bachelor
SSO-History: On the Historic Development of the Single Sign-On Landscape, Security, and Privacy

Mirko Szonn

Aug 2023

Abs Bib

Die Thematik des Single Sign-On sowie seiner zugehörigen Protokolle wurde bereits eingehend von zahlreichen Forschern untersucht. Weniger umfassend erforscht ist bislang die Entwicklung von Single Sign-On. Die vorliegende Arbeit zeigt die Entwicklung der Landschaft, Sicherheit und des Datenschutzes auf. Dabei wird das Wayback Archive verwendet, um für den Zeitraum von 2012 bis 2022 Authentifizierungsanfragen zu analysieren. Die zu analysierenden Webseiten werden einer Tranco-Liste mit 1000 Einträgen entnommen. Zunächst werden für die Einträge jedes Jahr Snapshots aus dem Wayback Archive gesammelt. Anschließend werden die Einträge der Tranco-Liste mit Hilfe einer Entity Map in Unternehmensgruppen (Aliase) zusammengefasst. Die Snapshots werden sortiert und für jeden Alias wird pro Jahr ein Snapshot aufgerufen. Hierbei wird erfasst, ob eine Möglichkeit zum Single Sign-On Login vorhanden ist und um welche es sich handelt. Wenn eine Login-Möglichkeit vorhanden ist, wird versucht, diese auszuführen, um die zugehörige Authentifizierungsanfrage zu sammeln. Die Login-Möglichkeiten prägen die Landschaft des Single Sign-On. In diesem Zusammenhang zeigte sich über die Jahre hinweg die Etablierung von Facebook und Google als die größten Identity Provider. Die Authentifizierungsanfragen werden hinsichtlich des verwendeten Protokolls, ihrer Sicherheitsparameter und der angefragten Daten analysiert. Dabei wurden OAuth 2.0 und OpenID Connect 1.0 als die am meisten verbreiteten Protokolle festgestellt. Zudem wurde ein gesteigertes Bewusstsein der Entwickler im Bezug auf Sicherheitsaspekte erkannt. Außerdem konnte erkannt werden, dass im Laufe der Jahre weniger sensible Daten angefragt wurden. Der Vergleich der gewonnenen Ergebnisse mit anderen Arbeiten zeigte, dass das Wayback Archive zwar wertvolle Einblicke bietet, jedoch einen großen Einfluss auf die erhobenen Daten hat. Zum Vergleich mit dieser Thesis werden andere Arbeiten benötigt, die die Entwicklung von Single Sign-On analysieren.
@thesis{szonnSSOHistoryHistoricDevelopment2023, type = {bathesis}, title = {{{SSO-History}}: {{On}} the {{Historic Development}} of the {{Single Sign-On Landscape}}, {{Security}}, and {{Privacy}}}, author = {Szonn, Mirko}, date = {2023-08-16}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {87}, month = aug, }

May

Bachelor
DNS over HTTPS Services in the Wild

Marcel Tobias Artz

May 2023

Abs Bib

DNS over HTTPS (DoH) is a network protocol for sending and receiving DNS queries over HTTPS. Using HTTPS, DoH protects against eavesdropping on plaintext DNS messages, DNS forging, and altering. RFC 8484 defines the DoH standard but does not provide an implementation reference for DoH servers. Thus, it is the responsibility of DoH service providers to implement the rules and recommendations of the standard. Moreover, to set independently suitable HTTP headers. This thesis presents a comprehensive analysis of publicly available DoH services. We review the specifications and recommendations of RFC 8484, look at the software used by DoH services, and present DoH connection details obtained through our queries. We present the DoH Service Analyzer (DOHSA), which we developed for large-scale analysis. DOHSA automates the creation of a list of DoH services to be analyzed, asynchronously queries the services and systematically creates evaluation tables. Our results show that most services behave in a standard-compliant manner. Nevertheless, there are considerable differences between the services for DoH responses, which enables initial possibilities for fingerprinting specific DoH software. However, these initial observations require further research.
@thesis{artzDNSHTTPSServices2023, type = {bathesis}, title = {{{DNS}} over {{HTTPS Services}} in the {{Wild}}}, author = {Artz, Marcel Tobias}, date = {2023-05-08}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {158}, month = may, }

April

Bachelor
Vollautomatisierte Single Sign-On Detektion auf Grundlage von Bilderkennung

Maik Hagelüken

Apr 2023

Abs Bib

Das Ziel dieser Arbeit ist es, einen Algorithmus für die automatisierte Detektion von Single Sign-On (SSO) auf Websites zu entwickeln. Dieser ermittelt mithilfe von Bilderkennung auf einem Screenshot der jeweiligen Login-Seite, ob und wo sich das Logo eines Identity Providers für Single Sign-On auf der Website befindet. Hierbei soll der Algorithmus eine hohe Detektionsrate aufweisen und gleichzeitig performant bleiben. Am Anfang der Arbeit wurde dazu ein Algorithmus bereitgestellt, welcher Logos auf Bildern wiederfinden konnte. Um diesen zu optimieren, wurden systematische Untersuchungen der Parameter durchgeführt, indem mehrere Herangehensweisen erprobt und evaluiert wurden. Dabei wurden 6 Kernparameter identifiziert, die Einfluss auf das Ergebnis haben: Größe der Bilder, oberer und unterer Detektionsgrenzwert, oberer und unterer Skalierungsgrenzwert sowie die Anzahl an Skalierungsschritten. Die Performance wurde währenddessen mittels der durchschnittlich benötigten Zeit pro Analyse bewertet. Anhand der Übereinstimmungsrate des Template Matching Algorithmus konnte abgeschätzt werden, wie gut dieser mit die Logos mit den vorgenommenen Anpassungen wiedererkennen konnte. Dabei stellte sich heraus, dass das Herunterskalieren des Screenshots bei fixiertem Template (IdP Logo) die effizienteste Lösung bei möglichst hoher Detektionsrate ist. Eine weitere Erkenntnis der Evalierung war zudem, dass die Analyse von einem zugeschnittenen Screenshot, welcher eine 60% kleinere Breite hat, nicht immer eine Verbesserung der Performance einbringen konnte. Damit wurde gezeigt, dass eine Teilbetrachtung des Screenshots nicht zwangsweise eine Verbesserung darstellt. False-Positives konnten mittels einer Verifizierung nach der Analyse nahezu vollständig eliminiert werden. Der mit dieser Erkenntnis ausgearbeitete Algorithmus kann durch seine niedrige Analysedauer von durchschnittlich 0.03 Sekunden pro Template sehr performant Übereinstimmungen finden. Durch die Verwendung von verschiedenen Variationen eines Logos und der anschließenden automatisierten Verifizierung ist der Algorithmus darüber hinaus verlässlich und ermöglicht eine großflächige Untersuchung der Implementierung von Single Sign-On auf Websites jeglicher Art.
@thesis{hageluekenVollautomatisierteSingleSignOn2023, type = {bathesis}, title = {Vollautomatisierte Single Sign-On Detektion auf Grundlage von Bilderkennung}, author = {Hagelüken, Maik}, date = {2023-04-25}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {43}, month = apr, }
Bachelor
Analysis of the Long-Term Archiving Portable Document Format: PDF/A

Chuong Nguyen

Apr 2023

Abs Bib

PDF/A is a standard introduced by ISO with the goal of archiving electronic documents for a long time. This variant of the PDF specification restricts features that could negatively impact the longevity and preservation of the PDF document. These restrictions ensure accurate processing of the document, despite the long time span and constant technological changes. PDF/A enables the digital archiving of documents, including invoices, contracts, and digitalized historical documents. Another use case of PDF/A is the long-term archiving of signed files. Digital signatures ensure message integrity, message authentication and non-repudiation of the signer A legal foundation is set by the European Union. In this bachelor’s thesis, we analyze the characteristics of the PDF/F specification and evaluate the current state of PDF/A support in PDF applications. In total, we evaluate 32 applications regarding PDF/A compatibility. We show which tools for PDF/A are implemented by each evaluated software, e.g. conformance check or conversion tool. Additionally, we investigate the software behavior when processing a PDF/A document that contains non-compliant features. For digital signatures, we re-evaluate proposed attack classes for regular PDF but in the context of PDF/A. Our evaluation points out the trade-off between error tolerance and standard conformity to retain the user experience in the applications.
@thesis{nguyenAnalysisLongTermArchiving2023, type = {bathesis}, title = {Analysis of the {{Long-Term Archiving Portable Document Format}}: {{PDF}}/{{A}}}, author = {Nguyen, Chuong}, date = {2023-04-23}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {70}, month = apr, }

2022

November

Master
Security Evaluation Of PDF Libraries

Viktor Baier

Nov 2022

Abs Bib

The Portable Document Format (PDF) is the industry standard within the area of document description formats. Its worldwide recognition requires close attention when it comes to security of PDF documents. During the last years, researchers of Ruhr-Universität Bochum have summarized and further developed different attack vectors against the PDF specification. Various PDF viewer applications were vulnerable to those attacks. The target of this thesis is the security evaluation of PDF libraries against those attacks. For this purpse a set of six libraries (pdfrw, PyPDF4, pikepdf, pfminer, PDFBox and poppler) has been chosen for analysis. It turns out that only two types of attacks are successful against those PDF libraries. The analysis has been performed using a systematic approach for each library in four steps. First, the library code is understood and potential attacks are identified using a manual static code analysis. In a second step, customized code is written that potentially triggers the attacks. This code is executed in the third step. The execution happens in an analysis environment which has been created for this thesis. The environment enables easy retesting, flexible onboarding of further libraries and detection of successful attacks. In the fourth and last step the results are verified.
@thesis{baierSecurityEvaluationPDF2022, type = {mathesis}, title = {Security {{Evaluation Of PDF Libraries}}}, author = {Baier, Viktor}, date = {2022-11-01}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {94}, month = nov, }

August

Bachelor
Visual Signature Spoofing in PDFs

Tobias Friese

Aug 2022

Abs Bib

The Portable Document Format (PDF) is widely used to exchange digital documents. PDFs also provide a way to sign documents with digital signatures. When a PDF is signed, PDF applications display signature indicators, which provide information about the signature, in their user interface (UI). Users rely on these signature indicators to decide whether a document is signed, and by whom. In this thesis, we introduce visual signature spoofing to PDFs. Using PDF features, visual signature spoofing imitates signature indicators to make users believe an unsigned PDF is signed. We discuss the signature indicators’ behavior, which has to be spoofed, and propose techniques to imitate the behavior with PDF features from the PDF 2.0 specification. The techniques are then tested by creating PDFs which spoof signatures in three commonly used PDF applications. We find that the spoofability of the signature indicators is very dependent on the support of JavaScript the PDF applications provide. With insufficient JavaScript support, it was not possible to spoof basic behavior, like the correct positioning of signature indicators. Because of this, it was only possible to create a successful visual signature spoof for Adobe Acrobat Reader DC. However, even the spoof for Adobe Acrobat Reader DC has some limitations, which are present in every spoof. These general limitations include lag, differences in appearance like the color scheme of popup windows, and missing interactions, like draggable UI elements which cannot be moved. The limitations provide a good way for users to identify visual signature spoofing.
@thesis{frieseVisualSignatureSpoofing2022, type = {bathesis}, title = {Visual {{Signature Spoofing}} in {{PDFs}}}, author = {Friese, Tobias}, date = {2022-08-06}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {77}, month = aug, }

May

Bachelor
Automatic Detection of Insecure PostMessage Usages in Single Sign-On

Joshua Kim

May 2022

Abs Bib

Service Providers (SPs), for example, web-shops or social media websites make use of Single Sign-On (SSO) to provide users the possibility to quickly get access to the SPs resources and functionalities. Therefore, the users are redirected to an Identity Provider (IdP) on which they authenticate themselves once. In this thesis, it is shown that some SPs make use of custom designed SSO protocol flows in which the log in page of the IdP is opened in an additional popup window. Furthermore, it is outlined that different implementation methods are used, one of which utilizes the postMessage API. Moreover, this bachelor’s thesis deals with the automatic analysis of such SSO implementations and identification of insecure postMessage usages. Therefore, a methodology is presented and implemented in the form of a browser extension for Google Chrome. The described methodology includes the detection of custom SSO implementations and approaches for static and dynamic JavaScript analysis. The goal of the JavaScript analysis is to identify the implementation’s type and detect insecure postMessage handlers. For the static approach, this thesis explains how JavaScript is abstracted into a graph and how this representation is used to programmatically analyze JavaScript. In addition to that, the tool Iroh.js is integrated for dynamic code analysis. Finally, the introduced extension is used to perform a scan on 1000 SPs with the focus on the IdPs Google, Apple, and Facebook. In summary, the scan exposes 151 SPs that implement a custom SSO flow of which 19 make use of at least one insecure postMessage handler in the log in page or the popup window. In addition, this thesis presents an examination of the affected SPs and shows that two SPs leak private information and one SP leaks authorization data through insecure postMessage handlers.
@thesis{kimAutomaticDetectionInsecure2022, type = {bathesis}, title = {Automatic {{Detection}} of {{Insecure PostMessage Usages}} in {{Single Sign-On}}}, author = {Kim, Joshua}, date = {2022-05-10}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {91}, month = may, }
Bachelor
Analysis of the Financial-Grade API (FAPI)

Johanna Schenkel

May 2022

Abs Bib PDF

The financial-grade API (FAPI) offers secure and interoperable profiles for OAuth and OpenID Connect. It was created to fit the high-security standard needed to deal with sensitive data such as banking details. The profiles employ existing security measures of the OpenID Connect and OAuth standardizations, such as JWT-Secured Authorization Request (JAR), Pushed Authorization Request (PAR) or Mutual TLS (MTLS). With concepts as sender-constrained access token, signed requests and secure client authentication, the FAPI aims to protect APIs with high risks. Interoperability is achieved by limiting possible configurations and a certification process offered by the OpenID Foundation. Thus, the FAPI profiles ensure compatibility between FAPI certified clients and authorization servers. This bachelor’s thesis aims to evaluate the security promised by the FAPI. Therefore, we outlined the security extensions employed by the FAPI. We explained the FAPI profiles and highlighted their differences. Additionally, we compared the security features used by the FAPI to features used by OAuth and OpenID Connect. Then, we set up a FAPI-certified client and authorization server and created a testing tool. The tool verifies the functionality of the setup and enables further manual testing in the environment. It relies on the mitmproxy addon framework. Moreover, we created a security catalog, including known attacks on OAuth and OpenID Connect and the FAPI’s countermeasures. In summary, we extracted the variety of security measures the FAPI employs. We showed the security improvements the FAPI provides. These include interoperability, enforcement of security best practices, and security extensions. We provide comparison tables of features and a security catalog of know attacks and the FAPI’s countermeasures. These may serve as a reference for future work. We created a testing tool for a FAPI-certified implementation. The implementation can easily be extended for further testing.
@thesis{schenkelAnalysisFinancialGradeAPI2022, type = {bathesis}, title = {Analysis of the {{Financial-Grade API}} ({{FAPI}})}, author = {Schenkel, Johanna}, date = {2022-05-09}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {127}, month = may, }

April

Bachelor
Classification of Common Attacks in Microsoft Active Directory Networks from a Red Team’s Perspective

Simon Lachnit

Apr 2022

Abs Bib

In this thesis, we identify common attack techniques against Active Directory networks and classify them according to their suitability for use in a Red Team assessment. To this end, we elaborate for each selected attack the necessary preconditions as well as the objectives that can be achieved with the attack. Further, we develop a methodology that allows to objectively assess the “loudness” of an attack, that is, the likelihood that its execution will be detected. We derive the proposed criteria for assessing an attack’s “loudness” from the criteria used to classify the detection capabilities of intrusion detection systems. Based on this methodology, we propose a scoring system that allows for a quantitative comparison of the “loudness” of the attacks. To the best of our knowledge, such a methodology does not yet exist. We then use this methodology to evaluate the “loudness” of the analyzed attacks in a practical and reproducible test environment. The results can be used by Red Teams to assist in deciding the next step to take to achieve their objective while avoiding detection.
@thesis{lachnitClassificationCommonAttacks2022, type = {bathesis}, title = {Classification of Common Attacks in {{Microsoft Active Directory}} Networks from a {{Red Team}}'s Perspective}, author = {Lachnit, Simon}, date = {2022-04-11}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {114}, month = apr, }

February

Master
Automated Security Analysis of Unauthorized Access in Real-World REST APIs

Christoph Heine

Feb 2022

Abs Bib

The thesis investigates the feasibility of automated, tool-based security analysis in the context of Unauthorized Access. In this context, we present REST-Attacker, our proof-of-concept implementation of a REST API analysis tool. We examine both theoretical and practical considerations for realizing REST security analysis. The REST architecture style and its implementations are evaluated regarding their potential for practical analysis as well as automated testing of security best practices. We show that REST implementations have sufficient structural similarities that enable a general, implementation-agnostic security analysis. Based on the experience of implementing REST-Attacker, we discuss the challenges involved in the testing established REST API security best practices in regards to access control. Limitations of the implemented security checks are examined. In particular, we investigate how well automated test generation can be realized. Our observations indicate that tool-based analysis can support an evaluation significantly, but is currently limited by the availability of machine-readable descriptions, input generation for parameters, and server-side rate limits. Last but not least, we present a security evaluation of six real-world REST API implementations of the services GitHub, GitLab, Microsoft, Spotify, YouTube, and Zoom. The evaluation is based on the results acquired by testing the APIs with REST-Attacker. We show that REST-Attacker could identify violations of security best practices in all examined REST APIs.
@thesis{heineAutomatedSecurityAnalysis2022, type = {mathesis}, title = {Automated {{Security Analysis}} of {{Unauthorized Access}} in {{Real-World REST APIs}}}, author = {Heine, Christoph}, date = {2022-02-09}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {147}, month = feb, }

2021

November

Master
On the Security of DNS over HTTPS

Friedrich Holzner

Nov 2021

Abs Bib

DNS over HTTPS (DoH) encrypts DNS to prevent on-path eavesdroppers from accessing DNS messages. DoH uses the standard HTTPS port 443 and thus hides within web communications. To investigate the security of DoH environments, we create an evaluation catalog based on a comprehensive analysis of relevant literature. We conduct a manual security analysis to evaluate a set of DoH clients, DoH resolver implementations, and public DoH resolvers against this catalog. To this end, we create a container-based lab environment running DoH implementations and tools to analyze the DoH message flow. We have findings in six out of 12 test classes that could compromise the security or privacy of DoH users. We propose a DoH XS leak attack, which leaks domains accessed by users of a private DoH resolver. We also deal with the privacy implication of DoH. It turns out that the use of DoH can improve users’ privacy, but DoH alone is not enough to prevent the tracking of web users. Our findings undermine that current DoH implementations do not fully protect the confidentiality and integrity of DNS, but the use of DoH still provides added value in DNS security.
@thesis{holznerSecurityDNSHTTPS2021, type = {mathesis}, title = {On the {{Security}} of {{DNS}} over {{HTTPS}}}, author = {Holzner, Friedrich}, date = {2021-11-15}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {128}, month = nov, }

October

Bachelor
Die Wirksamkeit von Antivirus-Programmen in der Erkennung von PDF-Malware

Vincent König

Oct 2021

Abs Bib

Diese Arbeit befasst sich mit der Erkennung von PDF-Malware. Es werden zehn verschiedene Antivirus-Programme miteinander verglichen. Hierzu wird eine statische sowie dynamische Analyse durchgeführt. Für die dynamische Analyse werden die beiden PDF-Betrachtungsprogramme Foxit Reader und Adobe Acrobat Reader verwendet.
@thesis{koenigWirksamkeitAntivirusProgrammenErkennung2021, type = {bathesis}, title = {Die Wirksamkeit von Antivirus-Programmen in der Erkennung von PDF-Malware}, author = {König, Vincent}, date = {2021-10-28}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {73}, month = oct, }

September

Bachelor
A Security Analysis on Pdf Redaction

Nikolas Hardt

Sep 2021

Abs Bib

In the following bachelor thesis, the redaction quality of redaction tools is analyzed. Considered were the tools Acrobat DC, Foxit Pdf, Nitro Pro, Pdf online, Pdf Element, Kofax and Libre office draw. Seven test cases were created to objectively measure the redaction quality for different scenarios.
@thesis{hardtSecurityAnalysisPdf2021, type = {bathesis}, title = {A Security Analysis on Pdf Redaction}, author = {Hardt, Nikolas}, date = {2021-09-29}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {37}, month = sep, }

June

Master
Sicherheit von VBA Signaturen

Björn Brixner

Jun 2021

Abs Bib

Die Ergebnisse einer Studie von Accenture zu den konkreten Sicherheitsvorfällen oder Typen von Internetkriminalität auf Unternehmen in den Vereinigten Staaten, Deutschland, Japan, Großbritannien, Frankreich, Italien und Australien im Jahr 2017 zeigt, dass 98% der befragten Unternehmen bereits von Malware betroffen waren. Ebenso waren 69% Opfer einer Phishing oder Social Engineering Attacke [44]. Infizierte Makro Dokumente in Microsoft Word oder Excel scheinen für Angreifer ein lukratives Ziel darzustellen, um dem Opfer mit einem vermeintlich vertrauenswürdigen Dokument Schadcode unterzuschieben. Mit diesem Trick wurde in den letzten Jahren vermehrt die Schadsoftware Emotet verteilt, sodass Bundesamt für Sicherheit in der Informationstechnik (BSI) und Bundeskriminalamt (BKA) vor den Gefahren durch Mailanhänge warnen [2]. Der Einsatz von digitalen Signaturen im Bereich von Visual Basic for Applications (VBA) scheint auf den ersten Blick einen Schutz vor infizierten Makros zu bieten. Dabei können Makros nur noch ausgeführt werden, sofern diese zuvor von einer vertrauenswürdigen Quelle signiert wurden. Die Sicherheit dieser Signaturen sollte jedoch auf deren Zuverlässigkeit untersucht werden und stellt den Hauptteil dieser Arbeit dar. Dabei wurden die Microsoft Office Versionen 2013, 2016, 2019 und Microsoft 365 auf Schwachpunkte in Zusammenarbeit mit VBA Signaturen untersucht. Im Rahmen dieser Arbeit wurden verschiedene Wege aufgedeckt, welche eine Schwächung oder Umgehung der digitalen Signatur ermöglichen. Zum Teil führte dabei die Kombination altbekannter Schwachstellen zu neuen Erkenntnissen und weiteren neuen Schwachstellen. Einerseits konnten dadurch Sandbox Systeme ausgetrickst und ebenso zwei Schwachstellen bei Microsoft adressiert werden. Solange durch Microsoft keine Sandbox Lösung, wie Microsoft Defender Application Guard for Office, für die breite Masse angeboten wird, bleiben Angriffe mittels Social Engineering in Kombination mit Office Makros ein valides Angreifermodell für Kriminelle. VBA Signaturen können dabei nur einen Teil zur Erhöhung der Sicherheit einbringen, wobei einige Details hierbei beachtet werden sollten.
@thesis{brixnerSicherheitVBASignaturen2021, type = {mathesis}, title = {Sicherheit von VBA Signaturen}, author = {Brixner, Björn}, date = {2021-06-21}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {102}, month = jun, }

March

Master

Security Evaluation and Classication of Malicious PDFs in the Wild

Jonas Bläsche

Mar 2021

Bib

@thesis{blascheSecurityEvaluationClassication2021,
  type = {mathesis},
  title = {Security {{Evaluation}} and {{Classication}} of {{Malicious PDFs}} in the Wild},
  author = {Bläsche, Jonas},
  date = {2021-03},
  institution = {University of Konstanz},
  url = {https://hgisvn.nds.ruhr-uni-bochum.de/svn/nds/repos_diplom/Diplom_Master/2020/jonas_blaesche/},
  langid = {english},
  pagetotal = {93},
  month = mar
}

Master
Evaluating the Security of (Microsoft) Office Open XML

Daniel Hirschberger

Mar 2021

Abs Bib

Office Open XML is an ISO standard for office documents (ISO-29500). This is the format that Microsoft Office products use. It is a zip file that contains XML to represent the document data. The standard includes support for digital signatures but does not describe document encryption. Therefore Microsoft has implemented the encryption themselves. This thesis analyzes the security of Office Open XML in regards to document signatures, vulnerabilities in the XML parser and document encryption. The implementation of the signature validation logic is shown to have a serious flaw which leads to one novel attack and a novel attack class. The Hidden Style Attack alters the display of a Word document after it was signed. The attack class of Document Wrapping attacks use the mismatch between signature logic and application logic to display a valid signature for content that was not signed. There are 3 variants in this attack class, the strongest attack can forge a universal signature for all modern Office documents and only requires one signed Excel document. The IncludePicture Switch Attack uses Fields to replace images in the signed document without invalidating the signature. The XML parser is shown to be vulnerable to XML External Entity Expansion but is only exploitable as a Denial of Service attack. Request Forgery, File Inclusion and custom XSLT transformation were not possible. Finally, the encryption is analyzed and deemed secure for current standards.
@thesis{hirschbergerEvaluatingSecurityMicrosoft2021, type = {mathesis}, title = {Evaluating the {{Security}} of ({{Microsoft}}) {{Office Open XML}}}, author = {Hirschberger, Daniel}, date = {2021-03-28}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {88}, month = mar, }

2020

December

Master
Security Analysis of Real-Life OpenID Connect Implementations

Christian Fries

Dec 2020

Abs Bib PDF

Single Sign-On with OpenID Connect is a widely adopted delegated authentication protocol. It is a layer above OAuth 2.0 which provides delegated authorization. This protocol framework allows users to connect several Service Providers with their account, identified from a single Identity Provider. The development of several extensions and additional features is still in progress. Previous work has revealed that not all implementations strictly follow the OpenID Connect specification. This master’s thesis has aimed to unveil security flaws in OpenID Connect Certified implementations with well-known attack methods. For this purpose, we present a novel and sustainable lab environment based on Docker, which offers an expandable platform. We intend this lab for developers and penetration-testers to test Service Providers and Identity Providers in a real-world scenario. It aims to lower the initial effort to analyze the implementations automatically and manually. Therefore, we included the tool PrOfESSOS for automatic tests. Together with MitMProxy, we supplied a debugging interface and created a Command-line Interface to perform manual tests with support of PrOfESSOS. In summary, we have selected six Identity Provider and eight Service Provider with support of Implicit Flow and Hybrid Flow. For a comprehensive security analysis, we tested them against eleven Service Provider attacks and seven Identity Provider attacks in different variations. We have disclosed twelve implementation flaws and reported them to the developers in a responsible disclosure process.
@thesis{christianfriesSecurityAnalysisRealLife2020, type = {mathesis}, title = {Security {{Analysis}} of {{Real-Life OpenID Connect Implementations}}}, author = {{Christian Fries}}, date = {2020-12-20}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {99}, month = dec, }
Bachelor
Documentation and Security Evaluation of Real Life Single Sign-On

Cihan Kahriman

Dec 2020

Abs Bib

Der Aufwand von Anmeldeverfahren bei unterschiedlichen Webseiten kann durch die Verwendung von Single Sign-On reduziert werden. Single Sign-On beschreibt das Konzept, bei dem ein Nutzer sich nur einmal bei einer zentralen Instanz authentifizieren muss, um auf mehrere Anwendungen, die ebenfalls eine Authentifizierung erfordern, zugreifen zu können. Ziel der Arbeit ist es, die Implementierungen von Single Sign-On im Internet zu dokumentieren und sie auf ihre Sicherheit zu evaluieren. Der Fokus liegt auf den Single Sign-On Implementierungen mit dem OAuth 2.0 Framework und dem OpenID Connect Protokoll. Im ersten Teil der Arbeit werden alle Webseiten der Moz 500 auf die Verwendung von Single Sign-On untersucht. Die versendeten Single Sign-On Nachrichten werden in HAR-Dateien für die jeweilige Webseite festgehalten. Die HAR-Dateien können für weitere Analysen wiederverwendet werden. Aus der Dokumentation geht hervor, dass OAuth 2.0 von der Mehrheit der Webseiten präferiert wird. Außerdem wird die Verwendung von Sicherheitsparametern von fast jeder dritten Webseite vernachlässigt. Im zweiten Teil der Arbeit werden die Single Sign-On Implementierungen auf ihre Sicherheit evaluiert. Dazu werden zwei Cross-Site-Request-Forgery Angriffe auf die Webseiten durchgeführt. Die Angriffe werden für jede Webseite individuell angepasst, um Validierungsmaßnahmen der Webseiten zu umgehen. Die Ergebnisse zeigen, dass jede dritte Single Sign-On Implementierung aufgrund von fehlkonfigurierten Sicherheitsparametern verwundbar für die Angriffe ist. Der Autor informiert die betroffenen Webseiten über die Sicherheitslücken und hilft bei der Verbesserung der Single Sign-On Implementierungen.
@thesis{kahrimanDocumentationSecurityEvaluation2020, type = {bathesis}, title = {Documentation and Security Evaluation of Real Life Single Sign-On}, author = {Kahriman, Cihan}, date = {2020-12-11}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {55}, month = dec, }

November

Master

Systematic Security Analysis of Signed PDF Documents

David Frederic Dankelmann

Nov 2020

Bib

@thesis{dankelmannSystematicSecurityAnalysis2020,
  type = {mathesis},
  title = {Systematic {{Security Analysis}} of {{Signed PDF Documents}}},
  author = {Dankelmann, David Frederic},
  date = {2020-11-17},
  institution = {Ruhr University Bochum},
  langid = {english},
  pagetotal = {113},
  month = nov,
}

October

Master
Security and Privacy of Social Logins

Louis Christopher Jannett

Oct 2020

Abs Bib PDF

Single Sign-On allows users to sign in once on a trusted Identity Provider and have their identities verified by each Service Provider they access afterward. Two protocols have gained widespread adoption in the wild: OAuth 2.0 is a delegated authorization protocol that was introduced in 2012 and extended two years later by the delegated authentication protocol OpenID Connect 1.0. This master’s thesis addresses three problems in Single Sign-On: (1) Real-world implementations on Identity Providers and Service Providers have proven to not strictly follow the standard specifications, which can result in negative effects on the implementation security and user privacy. Previous work has only focused on implementation flaws but failed to give in-depth insights into the underlying protocols. (2) Web technologies were refined over time to provide new capabilities for improved user experiences. The postMessage API is nowadays commonly used in cross-origin communication setups, including Single Sign-On implementations. The security implications of utilizing this API in Single Sign-On setups were not thoroughly analyzed yet. (3) Some Identity Providers provide “zero-click” authentication flows. Since sensitive identity information is transferred between independent parties, these flows can enable new privacy attacks. To complement these problems, this thesis first presents in-depth protocol descriptions of Single Sign-On solutions provided by Apple, Google, and Facebook. The real-world impact of postMessage security in Single Sign-On is evaluated based on widely-used Identity Providers and Service Providers. As a result, several postMessage attacks in Single Sign-On implementations are revealed to motivate security recommendations for future developments. Finally, this thesis describes two privacy attacks in Single Sign-On that are based on Cross-Site Leaks and demonstrates various privacy concerns of non-interactive sign-in flows on real-world Identity Providers.
@thesis{jannettSecurityPrivacySocial2020, type = {mathesis}, title = {Security and {{Privacy}} of {{Social Logins}}}, author = {Jannett, Louis Christopher}, date = {2020-10-15}, institution = {Ruhr University Bochum}, url = {https://www.nds.ruhr-uni-bochum.de/media/nds/arbeiten/2020/10/29/Masterarbeit_Louis_Jannett_Security_and_Privacy_of_Social_Logins.pdf}, langid = {english}, pagetotal = {162}, month = oct, }

September

Master
Single Sign-On Security: Security Analysis of Real-Life OpenID Connect Implementations

Lauritz Holtmann

Sep 2020

Abs Bib PDF

OpenID Connect 1.0 is an authentication protocol that extends the OAuth 2.0 Authorization Framework. A typical OpenID Connect 1.0 setup involves three parties: an End-User who wants to sign-in at a service, the OpenID Provider that authenticates the End-User and a Relying Party that provides a service to the End-User. Implementing Single Sign-On protocols like OpenID Connect enables Service Providers to delegate authorization and authentication tasks to a dedicated third party. This decentralized scenario comes with flexibility for implementing entities and usability benefits for End-Users but also introduces new challenges regarding secure and reliable authentication mechanisms. In this thesis, three novel variants of attacks on OpenID Connect implementations and two attacks on the OpenID Connect specification are presented. Besides these novel attacks, four Identity Provider and five Service Provider implementations are evaluated against a set of previously known attacks and requirements resulting from the specification and current security best practices. During the execution of the analysis, NodeJS implementations of the Identity Provider and Service Provider parts of the OpenID Connect specification were created, which are also introduced in this thesis. Finally, common vulnerability patterns observed within the set of OpenID Connect implementations are derived and recommendations for additions to the OpenID Connect security considerations are given.
@thesis{holtmannSingleSignOnSecurity2020, type = {mathesis}, title = {Single {{Sign-On Security}}: {{Security Analysis}} of Real-Life {{OpenID Connect Implementations}}}, author = {Holtmann, Lauritz}, date = {2020-09-30}, institution = {Ruhr University Bochum}, url = {https://www.nds.ruhr-uni-bochum.de/media/nds/arbeiten/2020/11/30/Masterarbeit_Lauritz_Holtmann_Single_Sign-On_Security.pdf}, langid = {english}, pagetotal = {151}, month = sep, }

June

Bachelor
Security Analysis of Authentication in Kubernetes

Ibrahim Akkulak

Jun 2020

Abs Bib

The structure of complex IT infrastructures is changing rapidly. The introduction of Kubernetes started a new epoch of containerized applications. It increased the availability and scalability of complex infrastructures. In addition to these aspects, Kubernetes also changed the product development cycle so that developers can focus more on developing the main application instead of the architecture it runs on. As technology is improving, reliance on it increases, and the security aspect becomes even more critical. Because security can be looked at in many ways, a specific focus for this thesis has to be chosen. Its primary focus is going to be on the authentication and the access control behind Kubernetes. The analysis of the OpenID Connect Flow in Kubernetes is the backbone of this work. Its implementation in Kubernetes is opposite the standard, especially Kubernetes does only JSON Web Token validation. Furthermore, potential perceived flaws are going to be listed. Their execution and the results are explained in more detail. Moreover, an estimation if the OpenID Connect authentication possibility is a security risk for a Kubernetes cluster is presented.
@thesis{akkulakSecurityAnalysisAuthentication2020, type = {bathesis}, title = {Security {{Analysis}} of {{Authentication}} in {{Kubernetes}}}, author = {Akkulak, Ibrahim}, date = {2020-06}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {69}, month = jun }

May

Master
Sicherheitsanalyse von OpenDocument v1.2

Steve Martin

May 2020

Abs Bib

Das vom Technical Comitee of Organization for the Advancement of Structured Information Standards (OASIS) spezifizierte und im Jahr 2006 in der internationalen Norm ISO/IEC 26300 veröffentlichte Open Document Format for Office Applications (ODF) ist ein quelloffener Standard für Büroanwendungen. Ursprünglich wurde ODF von Sun Microsystems entwickelt. Der ODF-Standard wird sowohl in freien als auch proprietären Programmen verwendet, um beispielsweise Präsentationen, Kalkulationstabellen, Textverarbeitungsdateien und Diagramme in einem einheitlichen Format darzustellen. In dieser Masterarbeit wird der ODF-Standard analysiert und dokumentiert. Mit dem Ziel potenzielle Schwachstellen aufzuweisen, ist der Fokus dieser Untersuchung vor allem auf die IT-sicherheitstechnischen Aspekte gerichtet. Auf Basis dieser Analysen erfolgt eine Evaluierung, in welcher potenzielle Schwachstellen aufgedeckt und nachgewiesen werden sollen.
@thesis{martinSicherheitsanalyseOpenDocumentV12020, type = {mathesis}, title = {Sicherheitsanalyse von OpenDocument v1.2}, author = {Martin, Steve}, date = {2020-05-01}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {130}, month = may, }

January

Bachelor
Evaluierung der Sicherheit von JavaScript in PDFs an dem Beispiel von Adobe Acrobat Reader DC

Christian Pressler

Jan 2020

Abs Bib

PDF ist ein weltweit verwendetes Dateiformat und meistens die erste Wahl, wenn es um den Austausch von elektronischen Dokumenten geht. Die Integration von Java- Script durch die von Adobe Produkten gestellte JavaScript API bietet unter Anderem die Möglichkeit, Eingabevalidierungen in digitalen Formularen vorzunehmen, Verbindungen mit Datenbanken zu erstellen, Sicherheitsrichtlinien zu verwalten und das Aussehen, wie auch den Inhalt einer PDF-Datei dynamisch zu verändern. Diese und weitere JavaScript basierten Aktionen werden durch entsprechende API-Aufrufe ausgeführt, die in dieser Arbeit auf ihre Funktionalität und Anwendbarkeit in Hinsicht auf die Sicherheit untersucht und getestet werden.
@thesis{presslerEvaluierungSicherheitJavaScript2020, type = {bathesis}, title = {Evaluierung der Sicherheit von JavaScript in PDFs an dem Beispiel von Adobe Acrobat Reader DC}, author = {Pressler, Christian}, date = {2020-01-17}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {99}, month = jan, }
Master
Security Evaluation of Google Pay API as a Payment Tokenization Protocol

Andreas Riebel

Jan 2020

Abs Bib

Online payment systems have contributed decisively to the growth in e-commerce in recent years. Since its relaunch in January 2018, Google Pay has aimed to simplify the checkout experience in web shops or at the Point of Sale in retail stores. A merchant, who wants to link Google Pay to his online shop, has to implement the Google Pay API or activate the service in his online store platform. This thesis provides a security evaluation of Google Pay API and takes similarities to multi-party tokenization protocols into consideration. During the research the prerequisites, workflow, and messages exchanged were analyzed. This also included cross-document messages in accordance with the HTML5 standard, which act as the communication vehicle between the web shop and Google Pay. Dedicated attacks, derived from typical SSO protocol attack patterns were applied. The result was that two out of ten attacks succeeded. One attack addressed the authorization of a merchant to create payment tokens; the other dealt with the integrity of the transactional data. The potential impact of both was assessed and counter-measures proposed. These findings further emphasize the necessity of authorization and integrity verification with a multi-party protocol.
@thesis{riebelSecurityEvaluationGoogle2020, type = {mathesis}, title = {Security {{Evaluation}} of {{Google Pay API}} as a {{Payment Tokenization Protocol}}}, author = {Riebel, Andreas}, date = {2020-01-25}, institution = {Ruhr University Bochum}, langid = {english}, month = jan, }

2019

November

Master
Fiddling with PKCS#7 Signatures on the Example of PDF

Nico Beckenkamp

Nov 2019

Abs Bib

The Public-Key Cryptography Standard#7 (PKCS#7) was originally developed by the RSA corporation introducing a standard allowing among other features signing arbitrary content. With the adoption of the standard in an RFC and the usage in multiple popular formats like S/MIME emails or PDF signatures it is used in various environments including corporations and governmental institutions. Due to its great compatibility, the PDF standard is well suited for document exchange as well as digital contracts. As adequate digital signatures today have the same legal value as a handwritten signature, flaws in the signature validation potentially have a huge impact considering their goals to protect the integrity, authenticity and non-repudiation. In contrast to previous research on PDF signatures and PDFs in general, focusing on the features defined in the PDF standard, another approach is considered in this thesis taking a closer look at the embedded PKCS#7 signature. In this thesis four different approaches for signature forgery based on the PKCS#7 signature structure are explored including attacks on the signature validation as well as approaches focusing on the validation of a trusted identity. Beside the signature forgery attacks the possibility of URL Invocation is covered as well. For both attack classes additional tests with the use of PDF features are considered. All developed attack vectors are evaluated for 27 PDF applications across the three operating systems Windows, macOS and Linux (Ubuntu), revealing vulnerabilities in more than 80% of the tested applications. Most of the attacks solely rely on changes applied to the PKCS#7 signature structure and thus might be applicable to other standards based on this signature structure.
@thesis{beckenkampFiddlingPKCSSignatures2019, type = {mathesis}, title = {Fiddling with {{PKCS}}\#7 {{Signatures}} on the {{Example}} of {{PDF}}}, author = {Beckenkamp, Nico}, date = {2019-11-19}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {187}, month = nov, }
Master
Sicherheitsanalyse und Evaluierung von signierten PDF Dokumenten

Simon Rohlmann

Nov 2019

Abs Bib

Diese Arbeit befasst sich mit der Sicherheit von digitalen Signaturen in PDF Dokumenten. Hierfür wurde die Funktionsweise eingebauter Methoden zur Modifikationserkennung betrachtet und das Verhalten verschiedener PDF Betrachtungsprogramme im Manipulationsfall analysiert. Darüber hinaus wurden Manipulationsmöglichkeiten in Verbindung von signierten PDF Dokumenten und enthaltenen Schriftarten entwickelt. Weitere Analysefelder dieser Arbeit stellen die Angriffsklassen Incremental Saving und Shadow Attack dar. Beide bieten die Möglichkeit den Inhalt von signierten PDF Dokumenten zu manipulieren. Um die Ziele dieser Arbeit zu erreichen, wurden Exploits für jede vorgestellte Angriffstechnik entwickelt und unter 18 PDF Betrachtungsprogrammen ausgewertet. Dabei ließen sich für jedes PDF Betrachtungsprogramm mindestens zwei Schwachstellen ausmachen.
@thesis{rohlmannSicherheitsanalyseUndEvaluierung2019, type = {mathesis}, title = {Sicherheitsanalyse und Evaluierung von signierten PDF Dokumenten}, author = {Rohlmann, Simon}, date = {2019-11-14}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {112}, month = nov, }

September

Bachelor
Systematisierung Und Bewertung Aktueller VoIP Instant Messaging-Protokolle Anhand Ihrer Sicherheitseigenschaften

Moritz Sonntag

Sep 2019

Abs Bib

Die vorliegende Bachelorarbeit befasst sich mit einer Analyse der Sicherheitseigenschaften von aktuellen Voice over IP-Protokollen im Instant Messaging. Dafür fand eine kriteriengestützte Auswahl aktueller Instant Messenger statt, aus der insgesamt zehn Applikationen resultierten. Für die Analyse wurde ein Sicherheitsmodell entwickelt. Dieses wurde so gewählt, dass es die variierenden Möglichkeiten, eine Voice over IP-Kommunikation aufzubauen und zu schützen, in der Analyse berücksichtigt. Die Protokolle, die von den Instant Messengern für die Voice over IP Kommunikation verwendet werden, wurden im Rahmen dieser Arbeit recherchiert und die Funktionsweise beschrieben. Die Instant Messenger wurden in das jeweilige Sicherheitsmodell eingeordnet und anhand der geforderten Sicherheitseigenschaften des Modells überprüft.
@thesis{sonntagSystematisierungUndBewertung2019, type = {bathesis}, title = {Systematisierung Und Bewertung Aktueller {{VoIP}} Instant Messaging-Protokolle Anhand Ihrer Sicherheitseigenschaften}, author = {Sonntag, Moritz}, date = {2019-09}, institution = {Ruhr University Bochum}, month = sep }

July

Master
Security Evulation and Classification of Vulnerabilities in REST API Management Frameworks

Tobias Moritz Gruber

Jul 2019

Abs Bib

This master thesis covers authentication and authorization procedures used to protect REST APIs. It analysis different REST API Management Frameworks and Gateways for vulnerabilities in their authentication and authorization implementations. This work focuses on JSON Web Tokens, OAuth 2.0, OpenID Connect and Access Tokens. The vulnerabilities found in this analysis are used to validate the OWASP API Security Top 10 to determine if it is a good basis for a methodology for testing REST APIs. In this master thesis it was found that the tested REST API Management Frameworks and Gateways are vulnerable to different vulnerabilities and that the OWASP API Security Top 10 is a valid basis for a methodology for security analysis of REST APIs.
@thesis{gruberSecurityEvulationClassification2019, type = {mathesis}, title = {Security Evulation and Classification of Vulnerabilities in {{REST API}} Management Frameworks}, author = {Gruber, Tobias Moritz}, date = {2019-07}, institution = {Ruhr University Bochum}, month = jul }

June

Bachelor
Differential Fuzzing of XPath

Mirko Budszuhn

Jun 2019

Abs Bib

The XML file format is an established standard for data exchange especially in web services. It is used in multiple standards like SAML and SOAP and thus it is fundamental for Service Oriented Architectures. To navigate XML documents XPath is often used, for example, to specify which XML element is signed. However, the XPath standard is quite complex and as such, not trivial to implement. In conjunction with security standards on top of XML like XML Signatures, inconsistencies in the evaluation of XPath expressions might lead to severe security flaws. This thesis presents a fully automated differential fuzzing tool capable of generating random XPath expressions, evaluating those expressions in different XPath libraries and analyzing the results. In our evaluation we discovered several inconsistencies in XPath evaluations. Finally, we discuss the impact of these inconsistencies with respect to the security and reveal novel threats which can be targeted by future research.
@thesis{budszuhnDifferentialFuzzingXPath2019, type = {bathesis}, title = {Differential Fuzzing of {{XPath}}}, author = {Budszuhn, Mirko}, date = {2019-06}, institution = {Ruhr University Bochum}, month = jun }

April

Master
Security Analysis of Single Sign-on Implementations

Nils Engelbertz

Apr 2019

Abs Bib

One of the most promising approaches to analyze the security of a Single SignOn (SSO) library is to use a practical offensive approach and execute attacks and security checks in an automatic manner. This thesis provides extensions to Practical Offensive Evaluation of SSO Security (PrOfESSOS), an existing security evaluation tool for OpenID Connect and, in addition, offers a prototype implementation that showcases a fully automated test approach that can be easily integrated into a continuous development process. Furthermore, ready to use configurations of a number of OpenID Connect (OIDC) implementations are provided to demonstrate the applicability of the approach.
@thesis{engelbertzSecurityAnalysisSingle2019, type = {mathesis}, title = {Security Analysis of Single Sign-on Implementations}, author = {Engelbertz, Nils}, date = {2019-04}, institution = {Ruhr University Bochum}, month = apr }

2018

December

Master
On the End-to-End Security of Group Chats in Instant Messaging Protocols

Paul Rösler

Dec 2018

Abs Bib

Secure instant messaging is utilized in two variants: one-to-one communication and group communication. While the first variant has received much attention lately (Frosch et al., EuroS&P16; Cohn-Gordon et al., EuroS&P17; Kobeissi et al., EuroS&P17), little is known about the cryptographic mechanisms and security guarantees of secure group communication in instant messaging. In this thesis, we investigate group communication security mechanisms of three major massaging applications: Signal, WhatsApp, and Threema. We first introduce the scientific background of theoretical and practical approaches to define and analyze secure group instant messaging. Then this thesis mainly consists of the results, the author (together with Mainka and Schwenk) published as the article “More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema” in the proceedings of 3rd IEEE European Symposium on Security and Privacy (Euro S&P 2018). To approach an investigation of group instant messaging protocols in this publication, we provide a comprehensive and realistic attacker model. This model combines security and reliability goals from various related literature to capture relevant properties for communication in dynamic groups. Thereby we also consider the satisfiability of the definitions with respect to the instant delivery of messages. Since the analyzed protocols and their implementations are mostly undocumented for the public and two out of three applications among them are closed source, we are the first to describe the group protocols employed in Signal, WhatsApp, and Threema. By applying our model on these protocols, we reveal several shortcomings with respect to our security definition. Therefore we propose generic countermeasures to enhance the protocols regarding the required security and reliability goals. Our systematic analysis reveals that 1. the communications’ integrity – represented by the integrity of all exchanged messages – and 2. the groups’ closeness – represented by the members’ ability of managing the group – are not end-to-end protected. We additionally show that strong security properties, such as Future Secrecy which is a core part of the one-to-one communication in the Signal protocol, do not hold for group communication.
@thesis{roslerEndtoEndSecurityGroup2018, type = {mathesis}, title = {On the {{End-to-End Security}} of {{Group Chats}} in {{Instant Messaging Protocols}}}, author = {Rösler, Paul}, date = {2018-12-06}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {59}, month = dec, }

November

Master
Security of PDF Signatures

Karsten Meyer zu Selhausen

Nov 2018

Awarded Abs Bib PDF

Awarded with the Eurobits Excellence Award 2019

The Portable Document Format (PDF) is probably the most common file format for the exchange of digital documents of any type. Almost every company and governmental institution uses PDF files for communication and digital contracts due its universal compatibility. As these environments rely on the content of the documents it is necessary to secure them. The application of a digital signature is suitable for this task and allows to secure digital documents in terms of integrity, authenticity and non-repudiation. In recent years digital signatures gained the same legal status as handwritten signatures in many circumstances. There are even cases where digitally signed documents are mandatory. PDF files support the application of digital signatures natively. Due to the combination of PDF’s advantages and the security of digital signatures, signed PDF files have become popular for the exchange of secure digital documents. Despite the fact that the PDF version introducing native digital signatures was published in 1999 there has been little to no research on the security of digital signatures embedded in PDF files in the past. Given the crucial environments signed PDF files are used in - including the judicial system, tax matters and all sorts of legally binding contracts - it is necessary to evaluate whether it is possible to bypass the protection of signatures in PDF files. This thesis contains the systematic and comprehensive evaluation of the security of PDF signatures. A total of 34 applications for different operating systems has been evaluated using different attacks from three novel attack classes. The evaluation results are alarming as vulnerabilities have been found in all but 4 applications. Details of the successful attacks have been given to the applications’ vendors to enable them to fix the identified vulnerabilities.
@thesis{karstenmeyerzuselhausenSecurityPDFSignatures2018, type = {mathesis}, title = {Security of {{PDF Signatures}}}, author = {{Karsten Meyer zu Selhausen}}, date = {2018-11-25}, institution = {Ruhr University Bochum}, addendum = {Eurobits Excellence Award 2019}, langid = {english}, pagetotal = {116}, month = nov, }

September

Bachelor
Evaluation der Sicherheit des ”Amazon Pay”-Dienstes

Lauritz Holtmann

Sep 2018

Abs Bib

E-Wallet-Dienste und damit einhergehend das zugrundeliegende Cashier-as-a-Service (CaaS)-Modell gewinnen immer mehr an Bedeutung. Neben Marktführer Paypal konnte sich Amazon mit seinem Dienst Amazon Pay in den letzten Jahren nach Marktanteilen Platz zwei unter den E-Wallets sichern [14]. Diese Bachelorarbeit geht zunächst auf den allgemeinen Protokollablauf ein und beschreibt die Implementierungen des Dienstes in den Erweiterungen für Magento und Typo3. Im Folgenden wird aufgezeigt, welche grundlegenden strukturellen Probleme der aktuelle Protokollablauf aufweist, und welche Angriffe sich hieraus ergeben. Anschließend werden Probleme verschiedener Encodings aufgezeigt und wird näher auf die damit einhergehenden Angriffe (Markup Injektion, Unterdrücken von E-Mails) eingegangen.
@thesis{holtmannEvaluationSicherheitAmazon2018, type = {bathesis}, title = {Evaluation der Sicherheit des ''Amazon Pay''-Dienstes}, author = {Holtmann, Lauritz}, date = {2018-09-24}, institution = {Ruhr University Bochum}, langid = {ngerman}, month = sep, }

July

Bachelor
Automating Single Sign-On Logins on Android Devices

Michael Sehring

Jul 2018

Abs Bib

Users increasingly rely on mobile applications for access to sensitive data. This puts the user’s data at risk of being stolen or modified by malicious apps. App markets such as the Google Play Store regulate available apps, but we still lack support for automatic detection and analysis of mobile app login flows. This thesis will introduce an approach for the detection of Single Sign-On (SSO) in Android apps. We apply this approach on 21401 apps and verify the results of 100 apps manually. Further, we show the feasibility to automate the SSO login process by using User Interface (UI) automation tools as a first step towards automated penetration testing.
@thesis{sehringAutomatingSingleSignOn2018, type = {bathesis}, title = {Automating {{Single Sign-On Logins}} on {{Android Devices}}}, author = {Sehring, Michael}, date = {2018-07-24}, institution = {Ruhr University Bochum}, langid = {english}, pagetotal = {57}, month = jul, }

2017

June

Master
Kryptografie Im Browser

Alexander Jakimowic

Jun 2017

Abs Bib

In dieser Arbeit untersuchen wir die Funktionalität bzw. Umsetzung zweier, sich noch in der Entwicklung befindenden Techniken - die WebCrypto API und das Token Binding Protokoll. Beide haben gemein, dass sie die im Browser bereits integrierten kryptografischen Funktionen einerseits zugänglich machen, bzw. andererseits nutzen, um altbekannte Probleme im Bereich der Browser-Sicherheit zu beseitigen. Dabei werden die Techniken detailliert vorgestellt und moderne Browser und Server Implementierungen im Hinblick auf Umsetzung von Features und mögliche neue Angriffsszenarien untersucht.
@thesis{jakimowicKryptografieImBrowser2017, type = {mathesis}, title = {Kryptografie Im Browser}, author = {Jakimowic, Alexander}, date = {2017-06-02}, institution = {Ruhr University Bochum}, month = jun, }

March

Bachelor

Analyzing State-of-the-Art Audio-Visual Authentication Systems on the Web

Thomas Kraft

Mar 2017

Bib

@thesis{kraftAnalyzingStateoftheartAudiovisual2017,
  type = {bathesis},
  title = {Analyzing State-of-the-Art Audio-Visual Authentication Systems on the Web},
  author = {Kraft, Thomas},
  date = {2017-03},
  institution = {Ruhr University Bochum},
  month = mar
}

2016

December

Master

Feingranularer Schutz von Microsoft Office Dokumenten Am Beispiel von Word

Martin Grothe

Dec 2016

Bib PDF

@thesis{grotheFeingranularerSchutzMicrosoft2016,
  type = {mathesis},
  title = {Feingranularer Schutz von Microsoft Office Dokumenten Am Beispiel von Word},
  author = {Grothe, Martin},
  date = {2016-12},
  institution = {Ruhr University Bochum},
  month = dec
}

November

Bachelor
Security Analysis of XML Parser in c, C++ and iOS with DTD Attacks

Nico Beckenkamp

Nov 2016

Abs Bib

XML is used in a huge range of applications. To extract information of a XML document XML parsers are used which leads to a huge distribution of the parsers over different devices. There are many known attacks against XML using the Document Type Definition of a XML document [1] [2] [3] which allow denial of service attacks or extraction of information from the XML processing host. Depending on the parser those attacks are even possible if the parser is used in the default configuration. Additionally, configuring the parser is often challenging due to bad documentations and unexpected behaviours of parser options. In his master thesis Späth [4] analysed 27 XML parser in 6 different programming languages and examined their behaviour. However, two of the most common programming languages (C and C++ [5]) were not analysed as well as XML parsers that can be used on the iOS platform. Within this thesis we will analyse 13 XML parsers which are written in C, C++ or are available for the iOS platform and continue the analysis of Späth. To allow a comparison of the analysis results we adopt the test methodology with some minor changes. We will develop a secure configuration for each parser as far as the parser options allow a secure configuration. Afterwards, we will provide a summary and overview of the different parsers and illustrate the general behaviour of the parsers from a security perspective.
@thesis{beckenkampSecurityAnalysisXML2016, type = {bathesis}, title = {Security Analysis of {{XML}} Parser in c, {{C}}++ and {{iOS}} with {{DTD}} Attacks}, author = {Beckenkamp, Nico}, date = {2016-11}, institution = {Ruhr University Bochum}, month = nov }
Master
On the (in-)Security of JavaScript Object Signing and Encryption

Dennis Detering

Nov 2016

Abs Bib PDF

JavaScript Object Signing and Encryption describes how to apply encryption and signing algorithms to JSON-based data structures. Despite their young age, the all together five new specifications have already been implemented in several major protocols, frameworks and applications. Those include Single Sign-on (SSO) protocols like OpenID Connect, the Automatic Certificate Management Environment (ACME) protocol, Apache’s CXF Webservice Framework and the IBM DataPower Gateway solution. This thesis investigates the security of these specifications, presents several practically applicable attacks on library level and introduces a newly developed Burp Suite extension to assist in performing security analyses on implementing applications. The attacks include the removal or faking of signatures to break the integrity of messages and the recovery of encrypted data containing symmetric keys to break the confidentiality of hidden contents. Apart from the attacks themselves, this thesis provides recommended countermeasures to the mentioned vulnerabilities. All libraries, which were found to be vulnerable during investigation, have been fixed in close communication with the maintainers.
@thesis{deteringSecurityJavaScriptObject2016, type = {mathesis}, title = {On the (in-)Security of {{JavaScript Object Signing}} and {{Encryption}}}, author = {Detering, Dennis}, date = {2016-11-18}, institution = {Ruhr University Bochum}, url = {https://www.nds.ruhr-uni-bochum.de/media/nds/arbeiten/2017/05/07/Masterthesis_Security-of-JOSE_Detering-FINAL.pdf}, langid = {english}, pagetotal = {82}, month = nov, }

October

Bachelor
Sicherheitsüberprüfung von Weitverbreiteten Web Service Frameworks Mit WS-Attacker

Karsten Meyer zu Selhausen

Oct 2016

Abs Bib Code

In dieser Bachelorarbeit wird die Sicherheit einer Auswahl von weitverbreiteten Web Service Frameworks untersucht. Dabei wird mithilfe des Tools „WS-Attacker“ überprüft, ob die Standardkonfiguration der untersuchten Frameworks anfällig für verschiedene Angriffe ist. Zunächst wird beschrieben, wie eine Testumgebung, in der für die ausgewählten Frameworks Beispiel Web Services zur Verfügung stehen, eingerichtet werden kann. Anschließend wird der Ablauf und die Ergebnisse einer Sicherheitsüberprüfung dieser Beispiel Web Services mit „WS-Attacker“ erläutert. Die Ziele der Arbeit sind neben dem Erstellen einer einsatzbereiten Testumgebung und dem Erlangen eines Überblicks über die Sicherheit einiger weitverbreiteter Web Service Frameworks, eine ausführliche Dokumentation der durchgeführten Schritte zu erstellen. Besonderer Fokus bei der Anfertigung dieser Dokumentation soll auf Problemen, die während dem Einrichten der Testumgebung oder der Durchführung der Sicherheitsüberprüfung aufgetreten sind, liegen.
@thesis{karstenmeyerzuselhausenSicherheitsuberprufungWeitverbreitetenWeb2016, type = {bathesis}, title = {Sicherheitsüberprüfung von Weitverbreiteten Web Service Frameworks Mit {{WS-Attacker}}}, author = {{Karsten Meyer zu Selhausen}}, date = {2016-10}, institution = {Ruhr University Bochum}, month = oct }

September

Bachelor
Security and Privacy Analysis of the HTTP/2 Protocol

Hendrik Gehne

Sep 2016

Abs Bib

HTTP/2 is a new version of the Hypertext Transfer Protocol which is used on the internet to exchange data between a client and a server. The most prominent use case of HTTP is visiting and interacting with websites via an internet browser. HTTP/2 is the successor of HTTP/1.1 and is based on Googles SPDY. Next to describing the functionality, this thesis takes a look at the changes regarding security and privacy, HTTP/2 introduces. Additionally, this thesis deals with the implementation status on the server and the client side as well as the distribution of the protocol and HTTP/2 web servers. Based on the results, this thesis will point out advantages and risks of using HTTP/2 in regard to security and privacy as well as risks in the implementations.
@thesis{gehneSecurityPrivacyAnalysis2016, type = {bathesis}, title = {Security and Privacy Analysis of the {{HTTP}}/2 Protocol}, author = {Gehne, Hendrik}, date = {2016-09}, institution = {Ruhr University Bochum}, month = sep }

Bachelor

Cashier-as-a-Service Based Webshops Overview and Steps towards Security Testing

Daniel Hirschberger

Sep 2016

Bib PDF

@thesis{hirschbergerCashierasaServiceBasedWebshops2016,
  type = {bathesis},
  title = {Cashier-as-a-{{Service}} Based {{Webshops Overview}} and {{Steps}} towards {{Security Testing}}},
  author = {Hirschberger, Daniel},
  date = {2016-09-16},
  institution = {Ruhr University Bochum},
  url = {https://www.nds.ruhr-uni-bochum.de/media/ei/arbeiten/2016/09/27/thesis_single_page.pdf},
  langid = {english},
  pagetotal = {43},
  month = sep,
}

June

Bachelor

Angriffe Auf Moderne Single Sign-on Protokolle Mit BurpSuite

Maxim Makulski

Jun 2016

Bib

@thesis{makulskiAngriffeAufModerne2016,
  type = {bathesis},
  title = {Angriffe Auf Moderne Single Sign-on Protokolle Mit {{BurpSuite}}},
  author = {Makulski, Maxim},
  date = {2016-06},
  institution = {Ruhr University Bochum},
  month = jun
}

May

Master

Sicherheitsanalyse von OpenID Connect Auf Bestehende Implementierungen

Daniel Hütten

May 2016

Bib

@thesis{huttenSicherheitsanalyseOpenIDConnect2016,
  type = {mathesis},
  title = {Sicherheitsanalyse von {{OpenID}} Connect Auf Bestehende Implementierungen},
  author = {Hütten, Daniel},
  date = {2016-05},
  institution = {Ruhr University Bochum},
  month = may
}

March

Bachelor
Angriffe Auf Microsoft RMS

Kevin Böhl

Mar 2016

Abs Bib PDF

In dieser Bachelorarbeit werden Schwachstellen der Rights Management Services von Microsoft in Windows Server 2012 R2 untersucht. Ein erstes Ziel ist es ein Programm vorzustellen, welches es einem Angreifer erlaubt, auf ein mit RMS geschütztes Word-Dokument, auf welches er nur lesend zugreifen darf, Vollzugriff zu erlangen. Des Weiteren werden zwei weitere Angriffe untersucht, nämlich ob ein Benutzer ein RMS geschütztes Dokument im Namen eines anderen Benutzers erstellen kann und ob es möglich ist, Vollzugriff auf ein geschütztes Dokument zu erlangen, wenn nicht einmal das Leserecht gesetzt ist.
@thesis{bohlAngriffeAufMicrosoft2016, type = {bathesis}, title = {Angriffe Auf {{Microsoft RMS}}}, author = {Böhl, Kevin}, date = {2016-03}, institution = {Ruhr University Bochum}, month = mar }

2015

December

Master
Automatic Recognition, Processing and Attacking of Single Sign-On Protocols with Burp Suite

Tim Guenther

Dec 2015

Abs Bib PDF

EsPReSSO does not only wake tired people all over the world but is now also a simple tool to use for recognition and attacking of Single Sign-On (SSO). Single Sign-On is supported by a huge amount of web services and web applications. The major protocols are SAML, BrowserID, OpenID and the OAuth based protocols, namely OpenID Connect, Facebook Connect and Microsoft Account. In order to help researchers to distinguish between these protocols, EsPReSSO offers an automatic identification and presentation of the major protocols by analyzing the browser’s HTTP traffic. Moreover, with the integration of the famous web service attacking tool, WS-Attacker [1], it is possible to attack SAML with over 200 vectors. This thesis will present the fundamentals required to understand EsPReSSO and its internal structure.
@thesis{guentherAutomaticRecognitionProcessing2015, type = {mathesis}, title = {Automatic {{Recognition}}, {{Processing}} and {{Attacking}} of {{Single Sign-On Protocols}} with {{Burp Suite}}}, author = {Guenther, Tim}, date = {2015-12-10}, institution = {Ruhr University Bochum}, url = {https://www.nds.ruhr-uni-bochum.de/media/ei/arbeiten/2016/07/26/MasterThesis_2.pdf}, langid = {english}, pagetotal = {51}, month = dec, }

November

Bachelor
Sicherheitsanalyse von OpenID Connect Implementierungen

Dennis Hooghoff

Nov 2015

Abs Bib

Die OpenID Connect Spezifikation wurde 2014 veröffentlicht. Diese erweitert das OAuth 2.0 Protokoll um Authentifizierung. Durch die dezentrale Struktur und die damit verbundene Skalierbarkeit, sowie der Interoperabilität und das einfache Design, ist es als Alternative zur Single Sign-On Lösung SAML anzusehen. Heute gibt es unterschiedliche Software, die bereits die OpenID Connect Spezifikation implementieren. Dabei beruht die Sicherheit des Protokolls zum großen Teil auf TLS. Nichtsdestotrotz können bei kleinsten Abweichungen von der Spezifikation gravierende Sicherheitslücken entstehen, was schlimmstenfalls zum Identitätsdiebstahl führen kann. Dementsprechend ist es notwendig, sicherheitskritische Protokollabläufe zu identifizieren und auf Gefahren zu untersuchen. In dieser Arbeit werden deshalb zunächst diese Protkollabläufe beschrieben, die Attacken dazu vorgestellt, Beispielimplementierungen untersucht, sowie anschließend Webseiten vorgestellt, die den OpenID Connect Standard implementieren.
@thesis{hooghoffSicherheitsanalyseOpenIDConnect2015, type = {bathesis}, title = {Sicherheitsanalyse von {{OpenID}} Connect Implementierungen}, author = {Hooghoff, Dennis}, date = {2015-11}, institution = {Ruhr University Bochum}, month = nov }

October

Bachelor
Sicherheitsanalyse von Facebook-Login Auf Android Systemen

Waldemar Lotuchow

Oct 2015

Abs Bib

Facebook-Login wird immer häufiger in mobilen Anwendungen verwendet. Für die Integration von Facebook-Login stellt Facebook neben SDKs z.B. für Android, iOS, JavaScript und weiteren Plattformen, auch ausführliche Dokumentationen zur Verfügung [1]. Allerdings gibt Facebook kaum Informationen zum verwendeten Protokoll, bis auf die Tatsache, dass es sich bei diesem Single sign-on Verfahren um eine Variante des OAuth 2.0 Protokolls handelt. Deshalb soll in dieser Arbeit zunächst, durch eine Analyse des Netzwerkverkehrs, der genaue Protokollablauf beschrieben werden, welcher zwischen dem Smartphone und dem FacebookServer abläuft. Da OAuth nicht für mobile Endgeräte konzipiert wurde, soll in einem weiteren Schritt, mithilfe des von Facebook zur Verfügung gestellten SDKs für Android, die Implementierung genauer untersucht werden, um herauszufinden ob bzw. wie OAuth 2.0 auch auf Android Systemen sicher verwendet werden kann.
@thesis{lotuchowSicherheitsanalyseFacebookloginAuf2015, type = {bathesis}, title = {Sicherheitsanalyse von Facebook-Login Auf Android Systemen}, author = {Lotuchow, Waldemar}, date = {2015-10}, institution = {Ruhr University Bochum}, month = oct }
Master
Security Implications of DTD Attacks Against a Wide Range of XML Parsers

Christopher Späth

Oct 2015

Abs Bib PDF

The Extensible Markup Language (XML) is extensively used today in applications, protocols and databases. It is platform independent and allows description and easy access to structured data. Technically, a parser processes an input XML document to translate a byte-stream into a structure that can be used by APIs in programming languages like Python, Java or PHP. DTDs (DTDs) enable the author of the XML document to describe the structure (grammar) of the XML document and therefore check the document for validity. Besides a validity check DTDs also introduce basics storage units, called entities. These are the cause of a series of vulnerabilities, which can be assigned to different classes. (1.) Denial-of-Service (DoS) attacks (billion laugh attack) force the parser to process an input XML document of several hundred bytes, which then expands its size during processing up to several tera- or petabytes of data. (2.) XML External Entity (XXE) attacks aim to read arbitrary data on a server’s filesystem by only invoking the parsing process of an XML document. (3.) URL Invocation (URL Invocation) attacks use the parser to invoke a request on another system, which can be any system the server can access. This is highly problematic because an attacker may retrieve information about internal systems or misuse the server for Server Side Request Forgery Attacks. DoS and XXE were first discovered back in 2002, and so it is surprisingly that the attacks are still working more than a decade later, even for companies like Facebook [Sil], Google [det], SAP NetWeaver [erpa] and Mobile Platform [erpb], Apple Office Viewer [app], mediawiki [wik], Adobe [thr] and Samsung SmartTVs [NSMS15]. In this presentation we contribute a comprehensive security analysis of 27 XML parsers in six popular programming languages: Ruby, .NET, PHP, Java, Python, Perl. We identify each parser’s default behavior with regard to security relevant parsing features by using 16 core tests. These core tests address DoS (3 tests), XXE (5 tests), URL Invocation (6 tests), XML Inclusions (XInclude) (1 test) and Extensible Stylesheet Language Transformations (XSLT) (1 test). We compute a “base vulnerability score” from these test results which is independent of the programming language and the parser. By extending these core tests with parser-specific tests, we investigate the implication of individual parser features and their interaction with one another on the overall security. This leads to an overall test set of more than 800 tests and on average 50 tests per parser. With this accumulated information we calculate another parser-dependant “extended vulnerability score”. These two scores enable a party to quickly make a sound decision regarding the security of an XML parser. Using the results of individual tests, a party can identify problematic settings or appropriate countermeasures for specific parser configurations.
@thesis{spathSecurityImplicationsDTD2015, type = {mathesis}, title = {Security {{Implications}} of {{DTD Attacks Against}} a {{Wide Range}} of {{XML Parsers}}}, author = {Späth, Christopher}, date = {2015-10-20}, institution = {Ruhr University Bochum}, url = {https://www.nds.ruhr-uni-bochum.de/media/nds/arbeiten/2015/11/04/spaeth-dtd_attacks.pdf}, langid = {english}, pagetotal = {576}, month = oct, }

September

Bachelor
Microsoft Azure - Design Und Architektur

Johanna Jupke

Sep 2015

Abs Bib

Microsoft bietet mit dem Produkt Azure eine Komplettlösung für Cloud-Plattformen an. Angeboten wird, neben der eigentlichen Cloud-Plattform, eine Vielzahl von Erweiterungen. Diese beinhalten, unter Anderem, die Einbindung von virtuellen Maschinen, eine Active Directory Einbindungen in der Cloud, sowie eine Rechteverwaltung. Die Einbindung von Onlinediensten und ein ortsunabhängiger Zugriff auf Daten, erhöhen das Interesse an Clouddiensten für viele Firmen. Durch sein vielseitiges Angebot ist Microsoft Azure ein attraktives Produkt in diesem Bereich. Bei der Auslagerung von Firmen- und Kundendaten auf eine Onlineplattform stellen sich jedoch einige Fragen. Welche Zugangsmöglichkeiten gibt es für die jeweilige Plattform und wie sicher sind diese? Gibt es Schwachstellen an denen Daten abhanden kommen könnten oder Täter in das System eindringen könnten? In wie weit kann der Cloud-Anbieter auf die Daten zugreifen und diese einsehen? Wie sicher ist ein Cloud-System als solches? Microsoft Azure ist eine Cloud-Plattform, die nach dem System „Pay-per-use“ aufgebaut ist. Bezahlt werden lediglich die Dienste, die eine Firma in Anspruch nimmt. Je nach Erweiterung geschieht dies pauschal pro Monat oder pro Zeitraum, die die Anwendung benutzt wurde. Dadurch kann eine Firma die Cloud optimal auf ihre Bedürfnisse anpassen. Allerdings muss bei diesem System jedes Produkt extra hinzu gebucht werden. Für einen ersten Eindruck befasst diese Bachelorarbeit sich mit der Active Directory Einbindung in Microsoft Azure, sowie der Active Directory (AD) Erweiterung „Azure Rights Management Service (RMS)“. Für die jeweiligen Identitäten wurden verschiedene Zugriffsmöglichkeiten und Anwendungen zur Analyse eingerichtet. Die Auswertung zeigt, dass Microsoft Azure zwar grundsätzlich die Protokolle OAuth 2.0 mit OpenID Connect 1.0 und SAML 2.0 verwendet, dies jedoch nicht genau nach der Dokumentation geschieht. Die Ausführung ist jeweils abhängig von den verwendeten Anwendungen und kann bei Drittanbieter Anwendungen nicht verändert werden. Die Sicherheit des Systems ist also von Microsoft Azure und den integrierten Anwendungen abhängig. Dabei fällt auf, dass Microsoft bei der Authentifizierung und Autorisierung nicht auf sein eigenes Produkt, Microsoft Konto, sondern auf die offenen Standards SAML und OAuth zurückgreift. Dies ermöglicht die Einbindung vieler existierender Onlineanwendungen, macht das System allerdings für generelle Angriffe auf die Protokolle verwundbar. Die Anmeldedaten selbst liegen in der jeweiligen Azure AD Instanz, wobei kein eigener Server dafür verwendet werden kann. Die Instanz wird auf dem Azure Server angelegt, von dem lediglich der Standort bestimmt werden kann. Die Daten innerhalb der Cloud sind also außerhalb der Firmeninfrastruktur abgelegt. Laut Microsoft werden diese Daten nicht von Microsoft eingesehen oder verwendet und nur bei Gerichtsbeschlüssen herausgegeben. Genehmigte Anwendungen und in die AD integrierte Anti-Malewarprogramm können jedoch auf die Daten zugreifen.[1] Zudem liegt die Haftung der Daten weiterhin bei der Firma selbst. Microsoft orientiert sich zwar an internationalen Standards wie dem ISO\IEC 27018:2014, Gesetzgebungen gelten jedoch regional. Durch Microsofts Firmenpolitik ist ein tiefer Einblick in die Programmzyklen und Sicherheitsmechanismen nur schwer möglich. Eine vollkommene Sicherheitseinstufung des Produkts ist demnach noch nicht möglich.
@thesis{jupkeMicrosoftAzureDesign2015, type = {bathesis}, title = {Microsoft Azure - Design Und Architektur}, author = {Jupke, Johanna}, date = {2015-09}, institution = {Ruhr University Bochum}, month = sep }
Bachelor
Incorporating DTLS into the Penetration Testing Framework TLS-Attacker

Florian Pfützenreuter

Sep 2015

Abs Bib

The TLS protocol is one of the most widely used cryptographic protocols. Used to secure HTTP, electronic mail traffic, virtual private networking and numerous other services, it plays an increasingly important role in providing confidentiality in numerous fields of the Internet. In 2007, the DTLS protocol was introduced as a variation of the TLS protocol to enable its usage in datagram environments. To allow practical security analysis of DTLS, this thesis covers the integration of DTLS into the open source penetration testing framework TLS-Attacker.
@thesis{pfutzenreuterIncorporatingDTLSPenetration2015, type = {bathesis}, title = {Incorporating {{DTLS}} into the Penetration Testing Framework {{TLS-Attacker}}}, author = {Pfützenreuter, Florian}, date = {2015-09}, institution = {Ruhr University Bochum}, month = sep }
Bachelor
Architektur- Und Sicherheitsanalyse von Tresorit Und Tresorit DRM

Paul Rösler

Sep 2015

Abs Bib PDF

Tresorit ist eines der bekanntesten Ende-zu-Ende verschlüsselten Cloud Speicher Systeme. Die Entwickler geben vor, durch die zusätzliche Absicherung mittels Microsoft Rights Management Services, einen umfangreicheren Schutz als vergleichbare Systeme zu bieten. Die Untersuchung der Sicherheit dieses Systems und speziell der Kombination der Absicherungstechniken war Ziel dieser Arbeit. Es konnte gezeigt werden, dass die zusätzliche Absicherung durch Microsoft Rights Management Services keinen erweiterten Zugriffsschutz vor Tresorit bot. Daraus folgte, dass das Vertrauen in Tresorit unabdingbar ist und die Schutzmaßnahmen nur gegenüber anderen Angreifern wirksam sind.
@thesis{roslerArchitekturUndSicherheitsanalyse2015, type = {bathesis}, title = {Architektur- Und Sicherheitsanalyse von Tresorit Und Tresorit {{DRM}}}, author = {Rösler, Paul}, date = {2015-09}, institution = {Ruhr University Bochum}, month = sep }

August

Bachelor
Analyse von Microsofts Rights Management Services in Windows Server 2012 R2

Jan Kaiser

Aug 2015

Abs Bib

In dieser Bachelorarbeit werden die Rights Management Services in Windows Server 2012 R2 von Microsoft analysiert. Das erste Ziel dieser Arbeit ist die Installation und Einrichtung der Services zu dokumentieren. Anschließend folgt die Analyse, dessen Ziel es ist, die genaue Funktionsweise der Rights Management Services herauszustellen. Ein weiteres Ziel ist das Ermitteln und Testen von Angreiferszenarien, um damit die Sicherheit der Services zu bewerten. Hierzu wird der Datenverkehr innerhalb der Testumgebung abgefangen, analysiert und ausgewertet. Weiterhin werden Dokumentationen und diverse Blogeinträge auf Internetseiten von Microsoft zu Rate gezogen.
@thesis{kaiserAnalyseMicrosoftsRights2015, type = {bathesis}, title = {Analyse von Microsofts Rights Management Services in Windows Server 2012 {{R2}}}, author = {Kaiser, Jan}, date = {2015-08}, institution = {Ruhr University Bochum}, month = aug }

Bachelor

Sicherheitsanalyse Des Single Sign-on Dienstes Microsoft-Konto

Simon Schwientek

Aug 2015

Bib

@thesis{schwientekSicherheitsanalyseSingleSignon2015,
  type = {bathesis},
  title = {Sicherheitsanalyse Des Single Sign-on Dienstes Microsoft-Konto},
  author = {Schwientek, Simon},
  date = {2015-08},
  institution = {Ruhr University Bochum},
  month = aug
}

July

Bachelor
Log Me in with Facebook: Security Analysis of Facebook Connect

Jacek Rzeniewicz

Jul 2015

Abs Bib

The Facebook Connect protocol is provided by Facebook. This allow users to connect their Facebook account with various applications. More than 7 million applications use the Facebook Connect protocol [1]. Therefore, it is of utmost importance to conduct a security analysis of the protocol in order to provide a secure connection for the users. The drawback with this application is, Facebook has not provided an official documentation of this protocol for public view. Henceforth, this thesis would be a documentation of the Facebook Connect protocol and its working order. It describes the messages that are exchanged between a user agent and Facebook and the function of each message. Two applications (good app and bad app) were registered on https://developers.facebook.com and embedded into a website. To gain deeper insight on the protocol, messages were intercepted and manipulated with BurpSuite [2]. Lastly, explanation on the possibility to change the content of the login window by taking control over JavaScript files are provided in this paper.
@thesis{rzeniewiczLogMeFacebook2015, type = {bathesis}, title = {Log Me in with Facebook: {{Security}} Analysis of Facebook Connect}, author = {Rzeniewicz, Jacek}, date = {2015-07}, institution = {Ruhr University Bochum}, month = jul }
Bachelor
Analysis of Encrypted Databases with CryptDB

Michael Skiba

Jul 2015

Abs Bib PDF

CryptDB is a MySQL proxy that allows SQL aware encryption inside existing database management systems. To offer the best possible protecting while enabling the greatest computational flexibility it relies on a new concept called onions, where different layers of encryption are wrapped around each other and are only revealed as necessary. While its concept to improve database security looks fresh and interesting from an academic standpoint we wanted to examine the usability in practical application to determine if a real world productive use is desirable. We have therefore benchmarked the performance of CryptDB and examined how well existing applications can be adapted for the use with a CryptDB setup.
@thesis{skibaAnalysisEncryptedDatabases2015, type = {bathesis}, title = {Analysis of Encrypted Databases with {{CryptDB}}}, author = {Skiba, Michael}, date = {2015-07}, institution = {Ruhr University Bochum}, month = jul }

February

Master
SSO Security in the Wild – an Automated Security Evaluation of OpenID Websites

Christian Koßmann

Feb 2015

Abs Bib

OpenID is a widespread Single Sign-on system in today’s Web. This thesis summarizes all known attacks on the OpenID protocol and presents a completely new attack called Same IdP Delegation. We provide a methodology for testing ten attacks automatically and implement an open source tool for the automated analysis of OpenID websites according to our methodology. Furthermore, we utilize the tool to evaluate 15 OpenID websites and present our findings.
@thesis{kossmannSSOSecurityWild2015, type = {mathesis}, title = {{{SSO}} Security in the Wild – an Automated Security Evaluation of {{OpenID}} Websites}, author = {Koßmann, Christian}, date = {2015-02}, institution = {Ruhr University Bochum}, month = feb }

January

Master
SOAKMS – a Service-Oriented Architecture Key-Management System

Christian Müller

Jan 2015

Abs Bib

The internet has revolutionized how today’s work is performed. Due to its omnipresence, location-independent collaboration is nothing exotic. Many different web-based services and applications exist that provide convenient ways for data storage, sharing, or collaborative document editing. However, control over the cloud-hosted data is transferred from the original owner to the service provider since the data is uploaded to the provider’s servers. This violates possible data con dentiality requirements because of the potential disclosure of information to the service provider This thesis provides the design and implementation of a system that provides con dentiality for cloud-hosted documents using a collaborative document editing website. It consists of two parts, i. e., a modular Key Management System (KMS) which is responsible for key, user, and group management, and a Google Chrome extension that resides inside a user’s browser and offers an Application Programming Interface (API) to perform cryptographic operations. For this purpose, the Web Cryptography API is utilized. The system allows for documents containing both encrypted and unencrypted sections, furthermore, it allows to control which groups have access to which of the encrypted sections. To enforce the access control, the extension communicates with the KMS in order to attain a user’s group membership which determines the access rights to the different document parts. Additionally, we provide security considerations that assess the system’s achieved level of security. We identi ed security threats for which we propose countermeasures for attack mitigation. In particular, a recommended countermeasure is to only use secure connection between any of the involved entities. Another improvement would be to generate a user key inside the browser using the extension, such that keys that are transferred from the KMS may be double-encrypted. Due to the status of the implementations, convenient graphical administrative functions are not yet available.
@thesis{mullerSOAKMSServiceorientedArchitecture2015, type = {mathesis}, title = {{{SOAKMS}} – a Service-Oriented Architecture Key-Management System}, author = {Müller, Christian}, date = {2015-01}, institution = {Ruhr University Bochum}, month = jan }
Master
Implementing a Java Card Virtual Machine on a Hardware Security Module

Thorsten Schreiber

Jan 2015

Abs Bib

This thesis is the implementation of a Java Card virtual machine on the hardware security module CryptoServer of the vendor Utimaco. It discusses the principles of HSMs and Java Card and gives a detailed documentation and a discussion of the implementation.
@thesis{schreiberImplementingJavaCard2015, type = {mathesis}, title = {Implementing a Java Card Virtual Machine on a Hardware Security Module}, author = {Schreiber, Thorsten}, date = {2015-01}, institution = {Ruhr University Bochum}, month = jan }

2014

December

Master
Intelligent and Fully-Automatic Detection of Denial-of-Service Weaknesses in Web Services

Christian Altmeier

Dec 2014

Abs Bib

Web services are a technology to integrate applications between heterogeneous IT architectures. By the use of standardized Web service-interfaces, information can be transferred easily in a decentralized, distributed environment. Through this it becomes feasible to offer software components as services. While much attention is paid to the security of the protocol itself, it is little talked about weaknesses which are linked to the underlying technology. Today’s internet relies heavily on XML-based Web services. The SOAP standard is one of the most established Web service technologies, which uses XML for the exchange of information. Denial of Service (DoS) attacks aim at the availability of applications and computer systems. They attempt to exceed the consumption of computational resources, like CPU time or memory, with the goal that the system is not available anymore for regular use. There are already some DoS attacks known which rely on the handling of XML data. Consequentially, some of these attacks are also possible against XML-based Web services, e.g. services that are using SOAP. Other DoS attacks try to exploit weaknesses which are located in the programming language itself. The complexity of DoS attacks makes it difficult to decide, whether a Web service, more accurate its implementation, is vulnerable to a given DoS attack or not. In this thesis an intelligent procedure is developed that is able to fully-automatically detect Denial of Service weaknesses in XML-based protocols. For this purpose both, a new library and a new plugin for the Web service penetration testing framework WS-Attacker is created. While the library is completely independent of any concrete protocol and is able to process arbitrary XML formats, the plugin configures the library and performs the attacks, generated by the library, against SOAP-based Web services. Moreover the library tries to detect thresholds used by the implementations. The Intelligent DoS Plugin and Library help to reduce the manual effort and costs needed to decide whether or not a Web service is vulnerable against a given DoS attack.
@thesis{altmeierIntelligentFullyautomaticDetection2014, type = {mathesis}, title = {Intelligent and Fully-Automatic Detection of Denial-of-Service Weaknesses in Web Services}, author = {Altmeier, Christian}, date = {2014-12}, institution = {Ruhr University Bochum}, month = dec }

October

Master
Single Sign-On - OpenID Connect(Ing) People. Security Analysis of the OpenID Connect Standard and Its Real-Life Implementations

Julian Krautwald

Oct 2014

Abs Bib PDF

OpenID Connect, as a combination of a Single Sign-On (SSO) and a delegated Authorization protocol, provides a highly security-critical service to be implemented by application developers. As, on the one hand, the open and decentralized structure of OpenID Connect brings flexibility and interoperability, it also makes verification of exchanged authentication and authorization tokens a non-trivial task. In this thesis we introduce five novel attacks on the protocol all resulting in unauthorized access of protected resources. All attacks described in this thesis target implementation flaws on either the Relying Party (RP) or the OpenID Provider (OP) side and are almost all applicable to other SSO systems. To demonstrate the real-life applicability of such attacks we also summarize the evaluation results of our security analysis of nine RP libraries, nine OP libraries as well as three OP implementations (running in open accessible productive systems) of the protocol. Associated to that, we introduce two self-developed proof-of-concept Java pentest applications for auditing OpenID Connect implementations.
@thesis{krautwaldSingleSignOpenIDConnecting2014, type = {mathesis}, title = {Single {{Sign-On}} - {{OpenID Connect}}(Ing) People. {{Security Analysis}} of the {{OpenID Connect Standard}} and Its Real-Life {{Implementations}}}, author = {Krautwald, Julian}, date = {2014-10}, institution = {Ruhr University Bochum}, url = {https://www.nds.ruhr-uni-bochum.de/media/ei/arbeiten/2016/07/26/MasterThesis_2.pdf}, langid = {english}, pagetotal = {87}, month = oct }

September

Bachelor
Systematic Analysis and Classication of XSLT Attacks

Tobias Moritz Gruber

Sep 2014

Abs Bib

Today XML is a widely used technology for saving and transferring data. To process a XML file and extract data, the W3C built XSLT. XSLT is a pattern based stylesheet, which is used to transform an XML document. To interact with the XML data an XSLT transformation can call functions to process the XML. These functions interact with the file system or execute different other tasks. This work tries to cover possible attacks that can be used when an attacker is able to inject a stylesheet in an XSLT application. For this purpose this thesis will introduce and review all functions available in XSLT for the three XSLT processors Libxslt, Saxon, and Xalan-J. These functions will be categorised and analysed with the focus on the impact and the usability, to build a model for attacking an XSLT application. With the help of this model, a developer should be able to check if his application is vulnerable to one of the defined threats. Finally this work will check the found vulnerabilities in the XSLT processors over the last years. This should help to determine which processor is secure, and can be used to build an XSLT application. The main goal of this thesis is to build a compendium for XSLT injection attacks. This is needed because there is no scientific work that tries to review XSLT exploits. Therefore this work will explain the basics of XSLT injection attacks, and will discuss ways to check the security of an existing application.
@thesis{gruberSystematicAnalysisClassication2014, type = {bathesis}, title = {Systematic Analysis and Classication of {{XSLT}} Attacks}, author = {Gruber, Tobias Moritz}, date = {2014-09}, institution = {Ruhr University Bochum}, month = sep }

August

Bachelor
Praktische Sicherheitsanalyse Des Mozilla Single Sign-on Protokolls BrowserID

Henning Thiel

Aug 2014

Abs Bib PDF

In dieser Bachelorarbeit wird die Funktionsweise und Sicherheit des Single Sign-on Protokolls BrowserID untersucht. Ziel dieser Arbeit ist es, das Protokoll detailliert zu analysieren und zu dokumentieren. Außerdem soll die Sicherheit des Protokolls überprüft werden, um mögliche Schwachstellen aufzuzeigen. Hierfür wird eine praktische Analyse des Protokolls durchgeführt. Das heißt, es werden die einzelnen Protokollnachrichten untersucht und dahingehend überprüft, ob ein Angreifer hier effektiv eingreifen könnte. Im weiteren Verlauf der Arbeit wird ein eigener Identity Provider implementiert. Mit diesem wird untersucht, inwieweit ein Angreifer Einfluss nehmen kann, wenn er nicht nur in der Rolle als Benutzer agieren kann. Dazu wird davon ausgegangen, dass ein Angreifer neben seiner Rolle als Benutzer einen Identity Provider betreibt. Dabei wird überprüft, ob er andere Benutzer impersonifizieren oder das Protokoll auf andere Weise manipulieren kann.
@thesis{thielPraktischeSicherheitsanalyseMozilla2014, type = {bathesis}, title = {Praktische Sicherheitsanalyse Des Mozilla Single Sign-on Protokolls {{BrowserID}}}, author = {Thiel, Henning}, date = {2014-08}, institution = {Ruhr University Bochum}, month = aug }

July

Master
Semi-Automatic Evaluation of Browser-Based Authentication Mechanisms

Marcel Bornhöfft

Jul 2014

Abs Bib

Potential adversaries are strongly attracted by authentication mechanisms, as flaws in their execution could expose a whole web application to malicious attacks. But complex authentication schemes are not easily analyzed. Authentication mechanisms, like for example Single Sign-On(SSO), involve a lot of tedious interactions, between the researcher and the assessed web applications, making it hard to concentrate on the points of the communication that really matter. In this thesis, the Login-Attacker Framework is presented, a semi-automatic, easy to use and expandable tool, which provides full access to all information a web browser gathers, while participating in an authentication scheme. Automatically repeated manipulations of the underlying HTTP messages then can be used for vulnerability assessment. The capabilities of the Login-Attacker Framework are demonstrated by attacking a test implementation compatible to the SAML Web Browser SSO Profile and automating the access to a real life web application that uses SSO as well.
@thesis{bornhofftSemiautomaticEvaluationBrowserbased2014, type = {mathesis}, title = {Semi-Automatic Evaluation of Browser-Based Authentication Mechanisms}, author = {Bornhöfft, Marcel}, date = {2014-07}, institution = {Ruhr University Bochum}, month = jul }
Master
Implementierung Einer Automatisierten Penetrations-Software Zur Erkennung Und Umgehung von Gegenmaßnahmen Für Die Ausführung Der Angriffe Auf Den XML Encryption-Standard

Dennis Kupser

Jul 2014

Abs Bib

Die beiden Standards XML Encryption und XML Signature werden für die Realisierung kryptographischer Sicherheitsmechanismen innerhalb der XML-Anwendungen verwendet. Dabei werden durch die Standards spezifiziert, wie die Sicherheitsdienste Vertraulichkeit, Integrität und Authentizität für XML-basierte Daten umgesetzt werden können. Sowohl der XML Encryption- als auch der XML Signature-Standard sind in XML-Frameworks von Unternehmen wie z.B. IBM, Apache oder Microsoft implementiert und finden unter anderem ihren konkreten Einsatz im Bereich der Internetanwendungen. Diese Anwendungen können z.B. in Form von SOAP-basierten Webservices für die Abwicklung von Geschäftsprozessen genutzt werden. In der vorliegenden Arbeit geht es im Kern um die Implementierung und Evaluierung eines Verfahrens zur automatisierten Schwachstellendetektion beliebiger XML-Anwendungen, die die beiden Standards XML Encryption und XML Signature verwenden. Basierend auf der Schwachstellendetektion soll die Anwendbarkeit der veröffentlichten Angriffe auf den symmetrischen und asymmetrischen Teil der XML EncryptionSpezifikation exemplarisch an SOAP-basierten Webservices geprüft werden. Dabei dient die Prüfung als Grundlage für die letztendliche Ausführung der XML Encryption-Angriffe. Somit wird im Wesentlichen mithilfe der XML-spezifischen Angriffe XML Signature Wrapping (XSW) und XML Encryption Wrapping (XEW) versucht diverse Sicherheitsmechanismen zu umgehen, um die existierenden Angriffe auf XML Encryption auszuführen. Zudem sollen die Implementierungen des Verfahrens zur Schwachstellendetektion und die der Angriffe als Proof-of-Concept-Erweiterungsmodul in die Penetrationstest-Applikation WSAttacker integriert werden.
@thesis{kupserImplementierungAutomatisiertenPenetrationssoftware2014, type = {mathesis}, title = {Implementierung Einer Automatisierten Penetrations-Software Zur Erkennung Und Umgehung von Gegenmaßnahmen Für Die Ausführung Der Angriffe Auf Den {{XML}} Encryption-Standard}, author = {Kupser, Dennis}, date = {2014-07}, institution = {Ruhr University Bochum}, month = jul }

June

Bachelor
Sourcecode Basierte Analyse Des InstantMessengers TextSecure

Dominik Preikschat

Jun 2014

Abs Bib

In dieser Arbeit wird der Instant Messenger TextSecure vorgestellt und die Ergebnisse der Quellcodeanalyse präsentiert. Ziel der Arbeit ist es, die Umsetzung des Messenger Protokolls offenzulegen. Dabei wird speziell auf die Sicherheit des Messengers eingegangen. Es wird gezeigt, wie die kryptografischen Primitiven AES (Advanced Encryption Standard) und ECC (Elliptic Curve Cryptography) eingesetzt wurden. Es wird gezeigt, wie eine sichere Kommunikation über eine Ende-zu-Ende Verschlüsselung sichergestellt und Authentizität gewährleistet werden soll. Innerhalb der Arbeit wird speziell auf die Protokolle des Messengers eingegangen. Es wird gezeigt wie die initiale Schlüsselerstellung funktioniert und auf welcher Basis der Schlüsselaustausch stattfindet. Außerdem wird auf die Schlüsselableitung und den Versand der Nachrichten eingegangen. TextSecure bietet für das Versenden von Nachrichten zwei Möglichkeiten an. Dabei kann der Versand der Nachricht über das Internet oder über das SMS-Protokoll erfolgen. Daher wird auf die Unterschiede der beiden Übertragungsarten in dieser Arbeit eingegangen. Die Analyse der Arbeit basiert dabei auf dem Quellcode des Instant Messengers, der von der der Firma Whispersystems zur Verfügung gestellt wird. Des Weiteren beschränkt sich die Arbeit auf die Sicherheitsaspekte der Android Anwendung. Für die Analyse wurde die Quellcodeversion vom Stand des 11.04.2014 verwendet: ef77dc9d6dcf35031aaf6933abe012c10aa4b0a3
@thesis{preikschatSourcecodeBasierteAnalyse2014, type = {bathesis}, title = {Sourcecode Basierte Analyse Des {{InstantMessengers TextSecure}}}, author = {Preikschat, Dominik}, date = {2014-06}, institution = {Ruhr University Bochum}, month = jun }

2013

December

Master
Sicherheitsanalyse von OAuth 2.0 mittels Web Angriffen auf bestehende Implementierungen

Christoph Nickel

Dec 2013

Abs Bib PDF

OAuth 2.0, ein offenes und standardisiertes Protokoll, wird für die sichere Autorisierung von DrittAnwendungen für die eingeschränkte Nutzung von HTTP Diensten verwendet. Es wird dabei von einer Vielzahl von Dienstanbietern, wie z.B. Google, Facebook oder Salesforce, implementiert. Da OAuth 2.0 jedoch nur TLS als einziges Sicherheitskonzept einsetzt, gab es in letzter Zeit mehrere Angriffe auf die einzelnen Implementationen bei den Dienstanbietern, welche das OAuth 2.0 Protokoll implementiert haben. Dementsprechend wird in dieser Arbeit eine Sicherheitsanalyse durchgeführt, welche allgemeine Protokolleigenschaften, das Verhalten des Protokolls auf bestimmte Ereignisse sowie die Auswirkungen von Änderungen an bestimmten Protokollparametern bei einzelnen Dienstanbietern überprüft. Darauf aufbauend wird ein Konzept sowie eine prototypische Implementierung für das automatisierte Testen des OAuth 2.0 Protokolls vorgestellt.
@thesis{nickelSicherheitsanalyseOAuthMittels2013, type = {mathesis}, title = {Sicherheitsanalyse von OAuth 2.0 mittels Web Angriffen auf bestehende Implementierungen}, author = {Nickel, Christoph}, date = {2013-12-01}, institution = {Ruhr University Bochum}, langid = {ngerman}, pagetotal = {90}, month = dec, }

January

Master
Implementation of DoS Attacks on Web Services Based on the Open Source Framework WS-Attacker

Andreas Falkenberg

Jan 2013

Abs Bib Code

Web services are a middle-ware based on established internet technologies and protocols such as XML, SOAP and HTTP. The Web service technology is marketed as the solution to easy data exchange between heterogeneous IT architectures. Besides the huge propagation of Web services throughout all major industries, Web service security is not fully understood to date. Due to the complex nature of the Web service technology an attacker can easily exhaust the resources of a Web service with relatively small malformed messages, leading to a Denial of Service (DoS) scenario. In this master thesis major SOAP based Web service specific DoS attacks were implemented. They were bundled in a newly created extension plugin for the WS-Attacker penetration testing framework. In order to evaluate the success of an attack a custom “attack success metric” was developed. The attack success is determined without having physical access to the machine, using a blackbox approach. With the DoS attack implementations at hand, a security expert can easily decide whether or not a Web service is vulnerable to the chosen DoS attacks.
@thesis{falkenbergImplementationDoSAttacks2013, type = {mathesis}, title = {Implementation of {{DoS}} Attacks on {{Web}} Services Based on the Open Source Framework {{WS-Attacker}}}, author = {Falkenberg, Andreas}, date = {2013-01}, institution = {Ruhr University Bochum}, month = jan }

2012

December

Master
Automated Penetration Testing for SAML-based SSO Frameworks

Benjamin Sanno

Dec 2012

Abs Bib PDF

Single Sign-on (SSO) is a beneficial solution to establish authentication among several parties. These entities are an Identity Provider (IdP), a Service Provider (SP) and a user. As well as SOAP, the SAML recommendation is an authentication framework based on XML Signature and is often used in the context of SSO. Unfortunately, XML Signature Wrapping (XSW) attacks exist, which pose a threat to those authentication frameworks. The reason for this is basically, that different SPs have proprietary implementations and therefore, some may be vulnerable. The approach of this work is to do a detailed security analysis of proprietary SAML implementations. Instead of doing the analysis manually, security of an SP can be measured automatically by a program. An automatic tool has been developed in this thesis and its task is to emulate all parties of the authentication process but the SP. As a result, a new product exists for developers and penetration testers. It is universally applicable and automatic, hence easy and quick to use. Its sophisticated software design is optimized in terms of extensibility and modularity. In addition, the test tool uses machine learning to deal with unexpected behavior of the SP. Finally, four service providers were tested. Three of these could not be outwitted using the test tool. One provider seems to be vulnerable. Despite the XSW attack is known since 2005, it still represents a serious threat to services.
@thesis{sannoAutomatedPenetrationTesting2012, type = {mathesis}, title = {Automated Penetration Testing for {{SAML-based SSO}} Frameworks}, author = {Sanno, Benjamin}, date = {2012-12}, institution = {Ruhr University Bochum}, month = dec }