IT-Security
Corona-Warn-App
Behind the scenes: Invisible, yet important
The German Corona-Warn-App was published on June 16, 2020 and has been downloaded more than 23 million times since then. Data privacy and security have been and are of most importance in this project – even when they are invisible to most users. In this session, Thomas Klingbeil, Solution Architect of the Corona-Warn-App, will shed some light on aspects such as plausible deniability and the risk calculation and show their influence on the overall architecture.
When looking at an mobile app, many people forget about the backend. However, especially when designing this component of the overall system it is very important, that it is not possible to learning about users' behaviours and the situation they are in, by observing the data traffic. For the Corona-Warn-App this specifically applies to the test results and the sharing of diagnosis keys in case of a positive diagnosis. To protect users (i.e. to create plausible deniability), the Corona-Warn-App uses a playbook, which simulates a realistically looking communication between mobile app and backend, even if there is no need for communication at that point of time. In this session, Thomas Klingbeil will shed light on those and other mostly invisible aspects of the app (e.g. the risk calculation).
Additional information
| Type | Talk |
|---|---|
| Language | English |
More sessions
| 12/27/20 |
Ransomware is a type of malware that encrypts the files of infected hosts and demands payment, often in a cryptocurrency such as Bitcoin. In this talk, we present a measurement framework that we used to perform a large-scale, two-year, end-to-end measurement of ransomware payments, victims and operators.
|
| 12/27/20 |
On November 13., Nintendo launched its newest retro console, the Nintendo Game and Watch - but by then it was already hacked! In contrast to the other Nintendo classic consoles (NES & SNES), Nintendo upped their game this time: A locked processor, AES-CTR encrypted flash & co. made it significantly harder to hack it, but in the end it was still hacked - one day before release. This talk walks through the whole process of opening it up, exploiting the firmware up to bringing homebrew to a new ...
|
| 12/27/20 |
Ein Klick auf einen "Unsubscribe"-Link in einem Newsletter reicht oft aus, damit ein Angreifer eine Rufumleitung bei einer Zielperson einrichten kann. Damit lassen sich etwa die Passwörter von mit der Rufnummer verknüpften Google- oder Microsoft-Accounts zurücksetzen.
|
| 12/27/20 |
Load Value Injection (LVI) is a new class of transient-execution attacks exploiting microarchitectural flaws in modern processors to inject attacker data into a victim program and steal sensitive data and keys from Intel SGX, a secure vault in Intel processors for your personal data.
|
| 12/27/20 |
After the first unsuccessful deployment of voting machines in Germany about ten years ago, elements of electronic voting have reached elections again. Although there is now still a paper-trail, more and more essential steps, such as counting the votes, are moved into electronic systems. This change in the ballot-counting procedure took place mostly unnoticed by the public. We are two very concerned election workers who present our first-hand experience in this talk. We show that the current ...
|
| 12/28/20 |
How secure is the interface between baseband chips and iOS? While this interface should protect against escalations from the baseband into operating system components, its implementation is full of bugs. Fuzzing this interface is not only relevant to security, but also results in various funny effects, since the iPhone looses information about its identity and location, and eventually ends up in a state with a few thousand unread SMS that can no longer be deleted.
|
| 12/28/20 |
State-of-the-art report on Qualcomm DIAG diagnostic protocol research, its modern implementation as it appears in Hexagon basebands, advanced harnessing and reverse-engineering on modern off-the-shelf smartphones.
|
