% % This file was created by the TYPO3 extension % bib % --- Timezone: CEST % Creation date: 2024-04-25 % Creation time: 06-31-01 % --- Number of references % 12 % @Inproceedings { 2024_dahlmanns_ipv6-deployments, title = {Unconsidered Installations: Discovering IoT Deployments in the IPv6 Internet}, year = {2024}, month = {5}, day = {10}, abstract = {Internet-wide studies provide extremely valuable insight into how operators manage their Internet of Things (IoT) deployments in reality and often reveal grievances, e.g., significant security issues. However, while IoT devices often use IPv6, past studies resorted to comprehensively scan the IPv4 address space. To fully understand how the IoT and all its services and devices is operated, including IPv6-reachable deployments is inevitable-although scanning the entire IPv6 address space is infeasible. In this paper, we close this gap and examine how to best discover IPv6-reachable IoT deployments. To this end, we propose a methodology that allows combining various IPv6 scan direction approaches to understand the findability and prevalence of IPv6-reachable IoT deployments. Using three sources of active IPv6 addresses and eleven address generators, we discovered 6658 IoT deployments. We derive that the available address sources are a good starting point for finding IoT deployments. Additionally, we show that using two address generators is sufficient to cover most found deployments and save time as well as resources. Assessing the security of the deployments, we surprisingly find similar issues as in the IPv4 Internet, although IPv6 deployments might be newer and generally more up-to-date: Only 39\% of deployments have access control in place and only 6.2\% make use of TLS inviting attackers, e.g., to eavesdrop sensitive data.}, keywords = {Internet of Things, security, Internet measurements, IPv6, address generators}, tags = {internet-of-production}, publisher = {IEEE}, booktitle = {Proceedings of the 2024 IEEE/IFIP Network Operations and Management Symposium (NOMS '24), May 6-10, 2024, Seoul, Korea}, event_place = {Seoul, Korea}, event_name = {2024 IEEE Network Operations and Management Symposium}, event_date = {May 6-10, 2024}, state = {accepted}, reviewed = {1}, author = {Dahlmanns, Markus and Heidenreich, Felix and Lohm{\"o}ller, Johannes and Pennekamp, Jan and Wehrle, Klaus and Henze, Martin} } @Article { 2024_lohmoeller_sovereignty-survey, title = {The Unresolved Need for Dependable Guarantees on Security, Sovereignty, and Trust in Data Ecosystems}, journal = {Data \& Knowledge Engineering}, year = {2024}, month = {5}, day = {1}, volume = {151}, abstract = {Data ecosystems emerged as a new paradigm to facilitate the automated and massive exchange of data from heterogeneous information sources between different stakeholders. However, the corresponding benefits come with unforeseen risks as sensitive information is potentially exposed, questioning their reliability. Consequently, data security is of utmost importance and, thus, a central requirement for successfully realizing data ecosystems. Academia has recognized this requirement, and current initiatives foster sovereign participation via a federated infrastructure where participants retain local control over what data they offer to whom. However, recent proposals place significant trust in remote infrastructure by implementing organizational security measures such as certification processes before the admission of a participant. At the same time, the data sensitivity incentivizes participants to bypass the organizational security measures to maximize their benefit. This issue significantly weakens security, sovereignty, and trust guarantees and highlights that organizational security measures are insufficient in this context. In this paper, we argue that data ecosystems must be extended with technical means to (re)establish dependable guarantees. We underpin this need with three representative use cases for data ecosystems, which cover personal, economic, and governmental data, and systematically map the lack of dependable guarantees in related work. To this end, we identify three enablers of dependable guarantees, namely trusted remote policy enforcement, verifiable data tracking, and integration of resource-constrained participants. These enablers are critical for securely implementing data ecosystems in data-sensitive contexts.}, keywords = {Data sharing; Confidentiality; Integrity protection; Data Markets; Distributed databases}, tags = {internet-of-production}, url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2024/2024-lohmoeller-data-sovereignty-survey.pdf}, publisher = {Elsevier}, ISSN = {0169-023X}, DOI = {10.1016/j.datak.2024.102301}, reviewed = {1}, author = {Lohm{\"o}ller, Johannes and Pennekamp, Jan and Matzutt, Roman and Schneider, Carolin Victoria and Vlad, Eduard and Trautwein, Christian and Wehrle, Klaus} } @Inproceedings { 2023_lohmoeller_transparency, title = {Poster: Bridging Trust Gaps: Data Usage Transparency in Federated Data Ecosystems}, year = {2023}, month = {11}, day = {27}, keywords = {data usage control; data ecosystems; transparency logs}, url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2023/2023-lohmoeller-transparency.pdf}, publisher = {ACM}, booktitle = {Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS ’23), November 26-30, 2023, Copenhagen, Denmark}, event_place = {Copenhagen, Denmark}, event_date = {November 26-30, 2023}, ISBN = {979-8-4007-0050-7/23/11}, DOI = {10.1145/3576915.3624371}, reviewed = {1}, author = {Lohm{\"o}ller, Johannes and Vlad, Eduard and Dahlmanns, Markus and Wehrle, Klaus} } @Inproceedings { 2023_pennekamp_benchmarking_comparison, title = {Designing Secure and Privacy-Preserving Information Systems for Industry Benchmarking}, year = {2023}, month = {6}, day = {15}, volume = {13901}, pages = {489-505}, abstract = {Benchmarking is an essential tool for industrial organizations to identify potentials that allows them to improve their competitive position through operational and strategic means. However, the handling of sensitive information, in terms of (i) internal company data and (ii) the underlying algorithm to compute the benchmark, demands strict (technical) confidentiality guarantees—an aspect that existing approaches fail to address adequately. Still, advances in private computing provide us with building blocks to reliably secure even complex computations and their inputs, as present in industry benchmarks. In this paper, we thus compare two promising and fundamentally different concepts (hardware- and software-based) to realize privacy-preserving benchmarks. Thereby, we provide detailed insights into the concept-specific benefits. Our evaluation of two real-world use cases from different industries underlines that realizing and deploying secure information systems for industry benchmarking is possible with today's building blocks from private computing.}, note = {Lecture Notes in Computer Science (LNCS), Volume 13901}, keywords = {real-world computing; trusted execution environments; homomorphic encryption; key performance indicators; benchmarking}, tags = {internet-of-production}, url = {https://jpennekamp.de/wp-content/papercite-data/pdf/plv+23.pdf}, publisher = {Springer}, booktitle = {Proceedings of the 35th International Conference on Advanced Information Systems Engineering (CAiSE '23), June 12-16, 2023, Zaragoza, Spain}, event_place = {Zaragoza, Spain}, event_name = {35th International Conference on Advanced Information Systems Engineering (CAiSE '23)}, event_date = {June 12-16, 2023}, ISBN = {978-3-031-34559-3}, ISSN = {0302-9743}, DOI = {10.1007/978-3-031-34560-9_29}, reviewed = {1}, author = {Pennekamp, Jan and Lohm{\"o}ller, Johannes and Vlad, Eduard and Loos, Joscha and Rodemann, Niklas and Sapel, Patrick and Fink, Ina Berenice and Schmitz, Seth and Hopmann, Christian and Jarke, Matthias and Schuh, G{\"u}nther and Wehrle, Klaus and Henze, Martin} } @Article { 2023-circres-wu-comp-ecosystem, title = {Use of Computation Ecosystems to Analyze the Kidney-Heart Crosstalk}, journal = {Circulation research}, year = {2023}, month = {4}, day = {14}, volume = {132}, number = {8}, pages = {1084-1100}, misc2 = {Online}, language = {en}, DOI = {10.1161/CIRCRESAHA.123.321765}, reviewed = {1}, author = {Wu, Zhuojun and Lohm{\"o}ller, Johannes and Kuhl, Christiane and Wehrle, Klaus and Jankowski, Joachim} } @Inproceedings { 2022_lohmoeller_sovereignty, title = {On the Need for Strong Sovereignty in Data Ecosystems}, year = {2022}, month = {9}, day = {5}, volume = {3306}, pages = {51-63}, abstract = {Data ecosystems are the foundation of emerging data-driven business models as they (i) enable an automated exchange between their participants and (ii) provide them with access to huge and heterogeneous data sources. However, the corresponding benefits come with unforeseen risks as also sensitive information is potentially exposed. Consequently, data security is of utmost importance and, thus, a central requirement for the successful implementation of these ecosystems. Current initiatives, such as IDS and GAIA-X, hence foster sovereign participation via a federated infrastructure where participants retain local control. However, these designs place significant trust in remote infrastructure by mostly implementing organizational security measures such as certification processes prior to admission of a participant. At the same time, due to the sensitive nature of involved data, participants are incentivized to bypass security measures to maximize their own benefit: In practice, this issue significantly weakens sovereignty guarantees. In this paper, we hence claim that data ecosystems must be extended with technical means to reestablish such guarantees. To underpin our position, we analyze promising building blocks and identify three core research directions toward stronger data sovereignty, namely trusted remote policy enforcement, verifiable data tracking, and integration of resource-constrained participants. We conclude that these directions are critical to securely implement data ecosystems in data-sensitive contexts.}, tags = {internet-of-production}, url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-lohmoeller-deco.pdf}, publisher = {CEUR Workshop Proceedings}, booktitle = {Proceedings of the 1st International Workshop on Data Ecosystems (DEco '22), co-located with the 48th International Conference on Very Large Databases (VLDB '22), September 5-9, 2022, Sydney, Australia,}, event_place = {Sydney, Australia}, event_name = {International Workshop on Data Ecosystems (DEco '22)}, event_date = {September 5, 2022}, ISSN = {1613-0073}, reviewed = {1}, author = {Lohm{\"o}ller, Johannes and Pennekamp, Jan and Matzutt, Roman and Wehrle, Klaus} } @Inproceedings { 2022_dahlmanns_tlsiiot, title = {Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things}, year = {2022}, month = {5}, day = {31}, pages = {252-266}, abstract = {The ongoing trend to move industrial appliances from previously isolated networks to the Internet requires fundamental changes in security to uphold secure and safe operation. Consequently, to ensure end-to-end secure communication and authentication, (i) traditional industrial protocols, e.g., Modbus, are retrofitted with TLS support, and (ii) modern protocols, e.g., MQTT, are directly designed to use TLS. To understand whether these changes indeed lead to secure Industrial Internet of Things deployments, i.e., using TLS-based protocols, which are configured according to security best practices, we perform an Internet-wide security assessment of ten industrial protocols covering the complete IPv4 address space. Our results show that both, retrofitted existing protocols and newly developed secure alternatives, are barely noticeable in the wild. While we find that new protocols have a higher TLS adoption rate than traditional protocols (7.2 \% vs. 0.4 \%), the overall adoption of TLS is comparably low (6.5 \% of hosts). Thus, most industrial deployments (934,736 hosts) are insecurely connected to the Internet. Furthermore, we identify that 42 \% of hosts with TLS support (26,665 hosts) show security deficits, e.g., missing access control. Finally, we show that support in configuring systems securely, e.g., via configuration templates, is promising to strengthen security.}, keywords = {industrial communication; network security; security configuration}, tags = {internet-of-production, rfc}, url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2022/2022-dahlmanns-asiaccs.pdf}, publisher = {ACM}, booktitle = {Proceedings of the 2022 ACM Asia Conference on Computer and Communications Security (ASIACCS '22), May 30-June 3, 2022, Nagasaki, Japan}, event_place = {Nagasaki, Japan}, event_name = {ASIACCS '22}, event_date = {May 30-June 3, 2022}, ISBN = {978-1-4503-9140-5/22/05}, DOI = {10.1145/3488932.3497762}, reviewed = {1}, author = {Dahlmanns, Markus and Lohm{\"o}ller, Johannes and Pennekamp, Jan and Bodenhausen, J{\"o}rn and Wehrle, Klaus and Henze, Martin} } @Inproceedings { 2021_mitseva_sequences, title = {POSTER: How Dangerous is My Click? Boosting Website Fingerprinting By Considering Sequences of Webpages}, year = {2021}, month = {11}, day = {17}, pages = {2411-2413}, abstract = {Website fingerprinting (WFP) is a special case of traffic analysis, where a passive attacker infers information about the content of encrypted and anonymized connections by observing patterns of data flows. Although modern WFP attacks pose a serious threat to online privacy of users, including Tor users, they usually aim to detect single pages only. By ignoring the browsing behavior of users, the attacker excludes valuable information: users visit multiple pages of a single website consecutively, e.g., by following links. In this paper, we propose two novel methods that can take advantage of the consecutive visits of multiple pages to detect websites. We show that two up to three clicks within a site allow attackers to boost the accuracy by more than 20\% and to dramatically increase the threat to users' privacy. We argue that WFP defenses have to consider this new dimension of the attack surface.}, keywords = {Traffic Analysis; Website Fingerprinting; Web Privacy}, url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2021/2021-mitseva-fingerprinting-sequences.pdf}, publisher = {ACM}, booktitle = {Proceedings of the 28th ACM SIGSAC Conference on Computer and Communications Security (CCS '21), November 15-19, 2021, Seoul, Korea}, event_place = {Seoul, Korea}, event_date = {November 15-19, 2021}, ISBN = {978-1-4503-8454-4/21/11}, DOI = {10.1145/3460120.3485347}, reviewed = {1}, author = {Mitseva, Asya and Pennekamp, Jan and Lohm{\"o}ller, Johannes and Ziemann, Torsten and Hoerchner, Carl and Wehrle, Klaus and Panchenko, Andriy} } @Thesis { 2021_lohmoeller_industrial_tls, title = {An lnternet-Wide Study on TLS Usage in lndustrial Control Systems}, year = {2021}, month = {6}, school = {RWTH Aachen University}, type = {Master Thesis}, author = {Lohm{\"o}ller, Johannes} } @Inproceedings { 2020-dahlmanns-imc-opcua, title = {Easing the Conscience with OPC UA: An Internet-Wide Study on Insecure Deployments}, year = {2020}, month = {10}, day = {27}, pages = {101-110}, abstract = {Due to increasing digitalization, formerly isolated industrial networks, e.g., for factory and process automation, move closer and closer to the Internet, mandating secure communication. However, securely setting up OPC UA, the prime candidate for secure industrial communication, is challenging due to a large variety of insecure options. To study whether Internet-facing OPC UA appliances are configured securely, we actively scan the IPv4 address space for publicly reachable OPC UA systems and assess the security of their configurations. We observe problematic security configurations such as missing access control (on 24\% of hosts), disabled security functionality (24\%), or use of deprecated cryptographic primitives (25\%) on in total 92\% of the reachable deployments. Furthermore, we discover several hundred devices in multiple autonomous systems sharing the same security certificate, opening the door for impersonation attacks. Overall, in this paper, we highlight commonly found security misconfigurations and underline the importance of appropriate configuration for security-featuring protocols.}, keywords = {industrial communication; network security; security configuration}, tags = {internet-of-production, rfc}, url = {https://www.comsys.rwth-aachen.de/fileadmin/papers/2020/2020-dahlmanns-imc-opcua.pdf}, publisher = {ACM}, booktitle = {Proceedings of the Internet Measurement Conference (IMC '20), October 27-29, 2020, Pittsburgh, PA, USA}, event_place = {Pittsburgh, PA, USA}, event_name = {ACM Internet Measurement Conference 2020}, event_date = {October 27-29, 2020}, ISBN = {978-1-4503-8138-3/20/10}, DOI = {10.1145/3419394.3423666}, reviewed = {1}, author = {Dahlmanns, Markus and Lohm{\"o}ller, Johannes and Fink, Ina Berenice and Pennekamp, Jan and Wehrle, Klaus and Henze, Martin} } @Inproceedings { 2019_lohmoeller_fiware, title = {Application of the open-source cloud platform FIWARE for future building energy management systems}, year = {2019}, month = {11}, publisher = {IOP Publishing}, booktitle = {Journal of Physics: Conference Series 1343}, event_place = {EPFL Lausanne}, event_name = {CISBAT 2019}, event_date = {4-6 September 2019}, DOI = {10.1088/1742-6596/1343/1/012063}, extern = {1}, author = {Storek, Thomas and Lohm{\"o}ller, Johannes and K{\"u}mpel, Alexander and Baranski, Mark and M{\"u}ller, Dirk} } @Thesis { 2019_lohmoeller_fingerprinting, title = {Exploiting User Sessions for Website Fingerprinting}, year = {2019}, month = {3}, school = {RWTH Aachen University}, institute = {Communication and Distributed Systems}, type = {Bachelor Thesis}, author = {Lohm{\"o}ller, Johannes} }