IT-Security
COVID-19 Exposure Notifications
The Google/Apple Exposure Notifications protocol (GAEN) and COVID-19 contact tracings apps using it are probably among the most discussed tech topics of 2020. This talk gives a summary of how GAEN works and how it is used by COVID-19 tracing apps. It also aims to provide discussion points on how these apps could be improved to make them (more) useful in a pandemic.
The general concepts of the DP-3T protocol that forms the basis for GAEN has been discussed largely in media and is described even in the apps itself. I will explain the details of the GAEN protocol specifically as those are relevant to get better insights on privacy implications.
I will further outline how the protocol is used in practice, i.e. how apps are using it, which role Apple and Google have. The focus of this will be on the German Corona-Warn-App and the Android operating system.
In the end, I will present some of the valid criticisms against the protocol (and its realization), recently causing politicians to ask for "less privacy". I will present some attempts on solutions to improve the operating system and apps to tackle some of the issues. And will tell you how getting root access to your Android phone can finally save lives.
Additional information
| Type | Talk |
|---|---|
| Language | English |
More sessions
| 12/27/20 |
Ransomware is a type of malware that encrypts the files of infected hosts and demands payment, often in a cryptocurrency such as Bitcoin. In this talk, we present a measurement framework that we used to perform a large-scale, two-year, end-to-end measurement of ransomware payments, victims and operators.
|
| 12/27/20 |
On November 13., Nintendo launched its newest retro console, the Nintendo Game and Watch - but by then it was already hacked! In contrast to the other Nintendo classic consoles (NES & SNES), Nintendo upped their game this time: A locked processor, AES-CTR encrypted flash & co. made it significantly harder to hack it, but in the end it was still hacked - one day before release. This talk walks through the whole process of opening it up, exploiting the firmware up to bringing homebrew to a new ...
|
| 12/27/20 |
Ein Klick auf einen "Unsubscribe"-Link in einem Newsletter reicht oft aus, damit ein Angreifer eine Rufumleitung bei einer Zielperson einrichten kann. Damit lassen sich etwa die Passwörter von mit der Rufnummer verknüpften Google- oder Microsoft-Accounts zurücksetzen.
|
| 12/27/20 |
Load Value Injection (LVI) is a new class of transient-execution attacks exploiting microarchitectural flaws in modern processors to inject attacker data into a victim program and steal sensitive data and keys from Intel SGX, a secure vault in Intel processors for your personal data.
|
| 12/27/20 |
After the first unsuccessful deployment of voting machines in Germany about ten years ago, elements of electronic voting have reached elections again. Although there is now still a paper-trail, more and more essential steps, such as counting the votes, are moved into electronic systems. This change in the ballot-counting procedure took place mostly unnoticed by the public. We are two very concerned election workers who present our first-hand experience in this talk. We show that the current ...
|
| 12/28/20 |
How secure is the interface between baseband chips and iOS? While this interface should protect against escalations from the baseband into operating system components, its implementation is full of bugs. Fuzzing this interface is not only relevant to security, but also results in various funny effects, since the iPhone looses information about its identity and location, and eventually ends up in a state with a few thousand unread SMS that can no longer be deleted.
|
| 12/28/20 |
State-of-the-art report on Qualcomm DIAG diagnostic protocol research, its modern implementation as it appears in Hexagon basebands, advanced harnessing and reverse-engineering on modern off-the-shelf smartphones.
|
