Prof. Dr.-Ing. Matthias Hollick

Security, QoS, and Resilience in Mobile Systems / Privacy and Trust in Cyber-physical and Mobile Systems / Cross-layer Optimization in Wireless Networks / Head

Contact Information

Pankratiusstraße 2
64289 Darmstadt
S2|20 205
mhollick@seemoo.tu-darmstadt.de
+49 6151 16-25470
+49 6151 16-25471

Biography

Dr. Matthias Hollick is a Full Professor of Computer Science at the Technical University of Darmstadt where he is heading the Secure Mobile Networking Lab (SEEMOO) since 2009. He is co-affiliated with the Electrical Engineering and Information Technology Department. His research has been published at top venues such as ACM CoNEXT, ACM IMWUT, ACM MobiCom, AMC MobiSys, ACM Sigmetrics, ACM WiSec, EWSN, IEEE ComST, IEEE JSAC, IEEE Infocom, IEEE JioT, IEEE S&P, IEEE TMC, IEEE/ACM ToN, NDSS, PETS, USENIX Security, and other renowned venues in the topic area of mobile and wireless systems and cybersecurity. The research of his team has been awarded with more than 15 best paper and demo awards including at ACM MobiCom, ACM IMWUT, EWSN, ACM WiSec, and IEEE DOCSS. The results of his research found their way into numerous highly visible open source software projects. He acts as the Speaker and Scientific Coordinator of the emergenCITY Research Center established in the Hessian State Excellence Initiative LOEWE in January 2020. He further act as the Deputy Speaker of the DFG Doctoral School on Privacy and Trust for Mobile Users and as the Co-Deputy Speaker of the DFG Collaborative Research Center 1053 MAKI on Multi-mechanisms Adaptation in the Future Internet.

Publications

Type

Year

Show awards only

No results match your search criteria.

2023 ACM 2023 CHI Conference on Human Factors in Computing Systems Conference

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Leon Würsching Florentin Putz Steffen Haesler Matthias Hollick

BibTeX DOI: 10.1145/3544548.3580993

Abstract

Modern smartphones support FIDO2 passwordless authentication using either external security keys or internal biometric authentication, but it is unclear whether users appreciate and accept these new forms of web authentication for their own accounts. We present the first lab study (N=87) comparing platform and roaming authentication on smartphones, determining the practical strengths and weaknesses of FIDO2 as perceived by users in a mobile scenario. Most participants were willing to adopt passwordless authentication during our in-person user study, but closer analysis shows that participants prioritize usability, security, and availability differently depending on the account type. We identify remaining adoption barriers that prevent FIDO2 from succeeding password authentication, such as missing support for contemporary usage patterns, including account delegation and usage on multiple clients.

2023 Sensors Article

Energy-Efficient Decentralized Broadcasting in Wireless Multi-Hop Networks

Artur Sterz Robin Klose Markus Sommer Jonas Höchst Jakob Link Bernd Simon Anja Klein Matthias Hollick Bernd Freisleben

PDF BibTeX DOI: 10.26083/tuprints-00024503

Abstract

Several areas of wireless networking, such as wireless sensor networks or the Internet of Things, require application data to be distributed to multiple receivers in an area beyond the transmission range of a single node. This can be achieved by using the wireless medium’s broadcast property when retransmitting data. Due to the energy constraints of typical wireless devices, a broadcasting scheme that consumes as little energy as possible is highly desirable. In this article, we present a novel multi-hop data dissemination protocol called BTP. It uses a game-theoretical model to construct a spanning tree in a decentralized manner to minimize the total energy consumption of a network by minimizing the transmission power of each node. Although BTP is based on a game-theoretical model, it neither requires information exchange between distant nodes nor time synchronization during its operation, and it inhibits graph cycles effectively. The protocol is evaluated in Matlab and NS-3 simulations and through real-world implementation on a testbed of 75 Raspberry Pis. The evaluation conducted shows that our proposed protocol can achieve a total energy reduction of up to 90% compared to a simple broadcast protocol in real-world experiments.

2023 WiSec '23: 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

DEMO: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

Markus Scheck Florentin Putz Frank Hessel Hermann Leinweber Jonatan Crystall Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00024180

Abstract

Smart speakers are highly privacy-sensitive devices: They are located in our homes and provide an Internet-enabled microphone, making them a prime target for attackers. The pairing between a client device and the speaker must be protected to prohibit adversaries from accessing the device. Most commercial protocols are vulnerable to nearby adversaries as they do not probe for human presence at the speaker or proximity between both devices. In addition to security, the protocol must provide a user-friendly way for initial bootstrapping of the speaker. We design an open pairing protocol for the establishment of a shared secret between both devices using acoustic messaging to guarantee proximity, and release our implementation for the smart speaker as well as Android and Linux clients as open-source software on GitHub.

2022 ACM Transactions on Sensor Networks Article

LoRaWAN Security: An Evolvable Survey on Vulnerabilities, Attacks and their Systematic Mitigation

Frank Hessel Lars Almon Matthias Hollick

BibTeX DOI: 10.1145/3561973

Abstract

The changing vulnerability and threat landscape constantly challenge the security of wireless communication standards and protocols. For the Internet of Things (IoT), LoRaWAN is one of the dominant technologies for urban environments, industrial settings, or critical infrastructures due to its low-power and long-range capabilities. LoRaWAN IoT deployments are expected to operate for multiple years or even decades. Hence, it is imperative to maintain operational security at all times while continuously evolving the security of the standard and its implementations. We survey LoRaWAN security and follow a systematic and evolvable approach that can be dynamically updated. To this end, we propose a novel methodology to create evolvable surveys which relate the analyzed critical security concepts, thus allowing IT security experts to reason about LoRaWAN security properties over time. With this, we provide a tool to hardware manufacturers, software developers and providers, and network operators to achieve sustainable security for IoT deployments.

2022 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Alexander Heinrich Niklas Bittner Matthias Hollick

BibTeX DOI: 10.1145/3507657.3528546

Abstract

Finder networks in general, and Apple's Find My network in particular, can pose a grave threat to users' privacy and even health if these networks are abused for stalking. Apple's release of the AirTag-a very affordable tracker covered by the nearly ubiquitous Find My network-amplified this issue. While Apple provides a stalking detection feature within its ecosystem, billions of Android users are still left in the dark. Apple recently released the Android app "Tracker Detect," which does not deliver a convincing feature set for stalking protection. We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices. We compare the performance of our solution with the Apple-provided one in iOS and study the use of AirGuard in the wild over multiple weeks using data contributed by tens of thousands of active users.

2022 ACM Transactions on Internet of Things Article

Next2You: Robust Copresence Detection Based on Channel State Information

Mikhail Fomichev Luis F. Abanto-Leon Max Stiegler Alejandro Molina Ramirez Jakob Link Matthias Hollick

PDF BibTeX DOI: 10.1145/3491244

Abstract

Context-based copresence detection schemes are a necessary prerequisite to building secure and usable authentication systems in the Internet of Things (IoT). Such schemes allow one device to verify proximity of another device without user assistance utilizing their physical context (e.g., audio). The state-of-the-art copresence detection schemes suffer from two major limitations: (1) they cannot accurately detect copresence in low-entropy context (e.g., empty room with few events occurring) and insufficiently separated environments (e.g., adjacent rooms), (2) they require devices to have common sensors (e.g., microphones) to capture context, making them impractical on devices with heterogeneous sensors. We address these limitations, proposing Next2You, a novel copresence detection scheme utilizing channel state information (CSI). In particular, we leverage magnitude and phase values from a range of subcarriers specifying a Wi-Fi channel to capture a robust wireless context created when devices communicate. We implement Next2You on off-the-shelf smartphones relying only on ubiquitous Wi-Fi chipsets and evaluate it based on over 95 hours of CSI measurements that we collect in five real-world scenarios. Next2You achieves error rates below 4%, maintaining accurate copresence detection both in low-entropy context and insufficiently separated environments. We also demonstrate the capability of Next2You to work reliably in real-time and its robustness to various attacks.

2022 Other

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

Patrick Leu Giovanni Camurati Alexander Heinrich Marc Roeschlin Claudio Anliker Matthias Hollick Capkun Srdjan Jiska Classen

PDF BibTeX DOI: 10.48550/arXiv.2111.05313

2022 30th USENIX Security Symposium (USENIX Security 21) Conference

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

Milan Stute Alexander Heinrich Jannik Lorenz Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020603

Abstract

Apple controls one of the largest mobile ecosystems, with 1.5 billion active devices worldwide, and offers twelve proprietary wireless Continuity services. Previous works have unveiled several security and privacy issues in the involved protocols. These works extensively studied AirDrop while the coverage of the remaining vast Continuity service space is still low. To facilitate the cumbersome reverse-engineering process, we describe the first guide on how to approach a structured analysis of the involved protocols using several vantage points available on macOS. Also, we develop a toolkit to automate parts of this otherwise manual process. Based on this guide, we analyze the full protocol stacks involved in three Continuity services, in particular, Handoff (HO), Universal Clipboard (UC), and Wi-Fi Password Sharing (PWS). We discover several vulnerabilities spanning from Bluetooth Low Energy (BLE) advertisements to Apple's proprietary authentication protocols. These flaws allow for device tracking via HO's mDNS responses, a denial-of-service (DoS) attack on HO and UC, a DoS attack on PWS that prevents Wi-Fi password entry, and a machine-in-the-middle (MitM) attack on PWS that connects a target to an attacker-controlled Wi-Fi network. Our PoC implementations demonstrate that the attacks can be mounted using affordable off-the-shelf hardware ($20 micro:bit and a Wi-Fi card). Finally, we suggest practical mitigations and share our findings with Apple, who have started to release fixes through iOS and macOS updates.

2022 Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies Article Postprint

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Matthias Gazzari Annemarie Mattmann Max Maass Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020660

Abstract

Wearables that constantly collect various sensor data of their users increase the chances for inferences of unintentional and sensitive information such as passwords typed on a physical keyboard. We take a thorough look at the potential of using electromyographic (EMG) data, a sensor modality which is new to the market but has lately gained attention in the context of wearables for augmented reality (AR), for a keylogging side-channel attack. Our approach is based on neural networks for a between-subject attack in a realistic scenario using the Myo Armband to collect the sensor data. In our approach, the EMG data has proven to be the most prominent source of information compared to the accelerometer and gyroscope, increasing the keystroke detection performance. For our end-to-end approach on raw data, we report a mean balanced accuracy of about 76 % for the keystroke detection and a mean top-3 key accuracy of about 32 % on 52 classes for the key identification on passwords of varying strengths. We have created an extensive dataset including more than 310 000 keystrokes recorded from 37 volunteers, which is available as open access along with the source code used to create the given results.

2022 43rd IEEE Symposium on Security and Privacy Conference

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Jiska Classen Francesco Gringoli Michael Hermann Matthias Hollick

Prof. Dr.-Ing. Matthias Hollick

Contact Information

Biography

Publications

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Energy-Efficient Decentralized Broadcasting in Wireless Multi-Hop Networks

DEMO: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

LoRaWAN Security: An Evolvable Survey on Vulnerabilities, Attacks and their Systematic Mitigation

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Next2You: Robust Copresence Detection Based on Channel State Information

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Effective Notification Campaigns on the Web: A Matter of Trust, Framing, and Support

Snail Mail Beats Email Any Day: On Effective Operator Security Notifications in the Internet

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Best Practices for Notification Studies for Security and Privacy Issues on the Internet

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Desynchronization and MitM Attacks Against Neighbor Awareness Networking Using OpenNAN

Leveraging Cross-Technology Broadcast Communication to build Gateway-Free Smart Homes

Connected Self-Organized Citizens in Crises: An Interdisciplinary Resilience Concept for Neighborhoods

Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions

Very Pwnable Network: Cisco AnyConnect Security Analysis

ARIstoteles - Dissecting Apple's Baseband Interface

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop

Happy MitM: Fun and Toys in Every Bluetooth Device

OpenHaystack: A Framework for Tracking Personal Bluetooth Devices via Apple's Massive Find My Network

FastZIP: faster and more secure zero-interaction pairing

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Polypyus - The Firmware Historian

Zero-Interaction Security-Towards Sound Experimental Validation

Dinosaur Resurrection: PowerPC Binary Patching for Base Station Analysis

Disrupting Continuity of Apple's Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Joint Relaying and Spatial Sharing Multicast Scheduling for mmWave Networks

Towards an Automated Monitoring of RF Activity in Low-Power Wireless Testbeds

Hardware-Accelerated Real-Time Stream Data Processing on Android with GNU Radio

Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets

ToothPicker: Apple Picking in the iOS Bluetooth Stack

Firmware Insider: Bluetooth Randomness is Mostly Random

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Attaching InternalBlue to the proprietary macOS IOBluetooth framework

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Concurrent Wireless Cut-Through Forwarding: Ultra Low-Latency Multi-Hop Communication for the IoT

NEAT-TCP: Generation of TCP Congestion Control Through Neuroevolution of Augmenting Topologies

Improving the Reliability of Bluetooth Low Energy Connections

Analyzing Bluetooth Low Energy Connections on Off-the-Shelf Devices

Cross-Technology Broadcast Communication between Off-The-Shelf Wi-Fi, BLE, and IEEE 802.15.4 Devices

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Empirical insights for designing Information and Communication Technology for International Disaster Response

Hybrid Precoding for Multi-Group Multicasting in mmWave Systems

SCAROS: A Scalable and Robust Self-backhauling Solution for Highly Dynamic Millimeter-Wave Networks

Riding the Waves: Decoding Asynchronous Multi-User MISO via Time-Variant Zero-Forcing

Zero-Interaction Security - Towards Sound Experimental Validation

Free Your CSI: A Channel State Information Extraction Platform For Modern Wi-Fi Chipsets

Benchmarking and Profiling the GNURadio Scheduler

The Emergency Responsive Digital City

Vacuums in the Cloud: Analyzing Security in a Hardened IoT Ecosystem

CBMoS: Combinatorial Bandit Learning for Mode Selection and Resource Allocation in D2D Systems

A Billion Open Interfaces for Eve and Mallory : MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

Reverse Engineering and Evaluating the Apple Wireless Direct Link Protocol

InternalBlue - Bluetooth Binary Patching and Experimentation Framework

Towards Transparency in Email Tracking

Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices

Perils of Zero-Interaction Security in the Internet of Things

Practical VLC to WiFi Handover Mechanisms

Transitions: A Protocol-Independent View of the Future Internet

On the Difficulties of Incentivizing Online Privacy through Transparency: A Qualitative Survey of the German Health Insurance Market

Sea of Lights: Practical Device-to-Device Security Bootstrapping in the Dark

The King is Dead Long Live the King! Towards Systematic Performance Evaluation of Heterogeneous Bluetooth Mesh Networks in Real World Environments

Bluemergency: Mediating Post-disaster Communication Systems using the Internet of Things and Bluetooth Mesh

A Billion Open Interfaces for Eve and Mallory: MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

Toxic Friends in Your Network: Breaking the Bluetooth Mesh Friendship Concept

TPy: A Lightweight Framework for Agile Distributed Network Experiments