Prof. Dr.-Ing. Matthias Hollick

Security, QoS, and Resilience in Mobile Systems / Privacy and Trust in Cyber-physical and Mobile Systems / Cross-layer Optimization in Wireless Networks / Head

Contact Information

Pankratiusstraße 2
64289 Darmstadt
S2|20 205
mhollick@seemoo.tu-darmstadt.de
+49 6151 16-25470
+49 6151 16-25471

Biography

Dr. Matthias Hollick is a Full Professor of Computer Science at the Technical University of Darmstadt where he is heading the Secure Mobile Networking Lab (SEEMOO) since 2009. He is co-affiliated with the Electrical Engineering and Information Technology Department. His research has been published at top venues such as ACM CoNEXT, ACM IMWUT, ACM MobiCom, AMC MobiSys, ACM Sigmetrics, ACM WiSec, EWSN, IEEE ComST, IEEE JSAC, IEEE Infocom, IEEE JioT, IEEE S&P, IEEE TMC, IEEE/ACM ToN, NDSS, PETS, USENIX Security, and other renowned venues in the topic area of mobile and wireless systems and cybersecurity. The research of his team has been awarded with more than 15 best paper and demo awards including at ACM MobiCom, ACM IMWUT, EWSN, ACM WiSec, and IEEE DOCSS. The results of his research found their way into numerous highly visible open source software projects. He acts as the Speaker and Scientific Coordinator of the emergenCITY Research Center established in the Hessian State Excellence Initiative LOEWE in January 2020. He further act as the Deputy Speaker of the DFG Doctoral School on Privacy and Trust for Mobile Users and as the Co-Deputy Speaker of the DFG Collaborative Research Center 1053 MAKI on Multi-mechanisms Adaptation in the Future Internet.

Publications

Type

Year

Show awards only

No results match your search criteria.

2023 Conference on Communications and Network Security (CNS 2023) Conference

BeamSec: A Practical mmWave Physical Layer Security Scheme Against Strong Adversaries

Afifa Ishtiaq Arash Asadi Ladan Khaloopour Waqar Ahmed Vahid Jamali Matthias Hollick

BibTeX DOI: 10.1109/CNS59707.2023.10289003

Abstract

The high directionality of millimeter-wave (mmWave) communication systems has proven effective in reducing the attack surface against eavesdropping, thus improving the physical layer security. However, even with highly directional beams, the system is still exposed to eavesdropping against adversaries located within the main lobe. In this paper, we propose BeamSec, a solution to protect the users even from adversaries located in the main lobe. The key feature of BeamSec are: (i) Operating without the knowledge of eavesdropper’s location/channel; (ii) Robustness against colluding eavesdropping attack and (iii) Standard compatibility, which we prove using experiments via our IEEE 802.11ad/ay-compatible 60 GHz phased-array testbed. Methodologically, BeamSec first identifies uncorrelated and diverse beampairs between the transmitter and receiver by analyzing signal characteristics available through standard-compliant procedures. Next, it encodes the information jointly over all selected beampairs to minimize information leakage. We study two methods for allocating transmission time among different beams, namely uniform allocation (no knowledge of the wireless channel) and optimal allocation for maximization of the secrecy rate (with partial knowledge of the wireless channel). Our experiments show that BeamSec outperforms the benchmark schemes against single and colluding eavesdroppers and enhances the secrecy rate by 79.8% over a random paths selection benchmark.

2023 Primary Conference on the Analysis of Mobile Phone Datasets in Social, Urban, Societal and Industrial Problems,NetMob ’23 Conference

Maintaining App Services in Disrupted Cities: A Crisis and Resilience Evaluation Tool

Leon Würsching Matthias Hollick

PDF BibTeX

Abstract

Disaster scenarios can disconnect entire cities from the core network (CN), isolating base stations (BSs) and disrupting the Internet connection of app services for many users. Such a disruption is particularly disastrous when it affects critical app services such as communication, information, and navigation. Deploying local app servers at the network edge can solve this issue but leaves mobile network operators (MNOs) faced with design decisions regarding the criticality of traffic flows, the BS topology, and the app server deployment. We present the Crisis and Resilience Evaluation Tool (CARET) for crisis-mode radio access networks RANs, enabling MNOs to make informed decisions about a city's RAN configuration based on real-world data of the NetMob23 dataset.

2023 29th Annual International Conference on Mobile Computing and Networking (ACM MobiCom '23) Conference

Introducing FreeSpeaker - A Modular Smart Home Hub Prototyping Platform

Hermann Leinweber Jonatan Crystall Frank Hessel Florentin Putz Matthias Hollick

BibTeX DOI: 10.1145/3570361.3614080

Abstract

Smart home speakers have become a commodity item in many households and provide interesting research opportunities in areas like wireless communication and human-computer interaction. Commercial devices do not provide sufficient access for many research tasks. We present a modular smart home hub designed specifically for research purposes. The electronic and mechanical components are designed with reproducibility in mind and can be easily recombined for a project's needs. Additionally, we show applications of the hub in different scenarios.

2023 17th ACM Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization (WiNTECH '23) Conference

Rolling the D11: An Emulation Game for the Whole BCM43 Family

Jakob Link David Breuer Francesco Gringoli Matthias Hollick

BibTeX DOI: 10.1145/3615453.3616520

Abstract

The D11 is Broadcom's proprietary IEEE 802.11 MAC implementation and an essential part of their WiFi chips. It is a microcontroller that orchestrates the Physical Layer and Radio Front-end implementation and is programmable through a custom microcode. We provide a new emulation framework for the D11 microcode and a corresponding firmware patch for the WiFi chip that enables essential debugging methods, including microcode breakpoints and D11 state extraction. This toolset allows researchers to analyze the D11 microcode in a controlled environment dynamically. To facilitate research on the D11, we provide an overview of state-of-the-art knowledge of the chip and publish all presented tools to the open-source community. We encourage everyone interested to enter the game, roll the D11, and provide new insights on Broadcom's MAC implementation.

2023 48th Conference on Local Computer Networks Conference

Energy-efficient Broadcast Trees for Decentralized Data Dissemination in Wireless Networks

Artur Sterz Robin Klose Markus Sommer Jonas Höchst Jakob Link Bernd Simon Anja Klein Matthias Hollick Bernd Freisleben

PDF BibTeX DOI: 10.1109/LCN58197.2023.10223400

Abstract

We present a novel multi-hop data dissemination protocol for wireless networks that minimizes the total energy consumption across an entire network by minimizing the transmission power at each hop. It is based on a game-theoretic model, constructs a spanning tree topology in a decentralized manner, and is usable in practice. We evaluate the protocol via simulation and a pratical implementation on a testbed of 75 Raspberry Pis, demonstrating that a total energy reduction of up to 90% can be achieved compared to a simple broadcast protocol.

2023 ACM 2023 CHI Conference on Human Factors in Computing Systems Conference

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Leon Würsching Florentin Putz Steffen Haesler Matthias Hollick

BibTeX DOI: 10.1145/3544548.3580993

Abstract

Modern smartphones support FIDO2 passwordless authentication using either external security keys or internal biometric authentication, but it is unclear whether users appreciate and accept these new forms of web authentication for their own accounts. We present the first lab study (N=87) comparing platform and roaming authentication on smartphones, determining the practical strengths and weaknesses of FIDO2 as perceived by users in a mobile scenario. Most participants were willing to adopt passwordless authentication during our in-person user study, but closer analysis shows that participants prioritize usability, security, and availability differently depending on the account type. We identify remaining adoption barriers that prevent FIDO2 from succeeding password authentication, such as missing support for contemporary usage patterns, including account delegation and usage on multiple clients.

2023 Sensors Article

Energy-Efficient Decentralized Broadcasting in Wireless Multi-Hop Networks

Artur Sterz Robin Klose Markus Sommer Jonas Höchst Jakob Link Bernd Simon Anja Klein Matthias Hollick Bernd Freisleben

PDF BibTeX DOI: 10.26083/tuprints-00024503

Abstract

Several areas of wireless networking, such as wireless sensor networks or the Internet of Things, require application data to be distributed to multiple receivers in an area beyond the transmission range of a single node. This can be achieved by using the wireless medium’s broadcast property when retransmitting data. Due to the energy constraints of typical wireless devices, a broadcasting scheme that consumes as little energy as possible is highly desirable. In this article, we present a novel multi-hop data dissemination protocol called BTP. It uses a game-theoretical model to construct a spanning tree in a decentralized manner to minimize the total energy consumption of a network by minimizing the transmission power of each node. Although BTP is based on a game-theoretical model, it neither requires information exchange between distant nodes nor time synchronization during its operation, and it inhibits graph cycles effectively. The protocol is evaluated in Matlab and NS-3 simulations and through real-world implementation on a testbed of 75 Raspberry Pis. The evaluation conducted shows that our proposed protocol can achieve a total energy reduction of up to 90% compared to a simple broadcast protocol in real-world experiments.

2023 WiSec '23: 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

DEMO: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

Markus Scheck Florentin Putz Frank Hessel Hermann Leinweber Jonatan Crystall Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00024180

Abstract

Smart speakers are highly privacy-sensitive devices: They are located in our homes and provide an Internet-enabled microphone, making them a prime target for attackers. The pairing between a client device and the speaker must be protected to prohibit adversaries from accessing the device. Most commercial protocols are vulnerable to nearby adversaries as they do not probe for human presence at the speaker or proximity between both devices. In addition to security, the protocol must provide a user-friendly way for initial bootstrapping of the speaker. We design an open pairing protocol for the establishment of a shared secret between both devices using acoustic messaging to guarantee proximity, and release our implementation for the smart speaker as well as Android and Linux clients as open-source software on GitHub.

2022 ACM Transactions on Sensor Networks Article

LoRaWAN Security: An Evolvable Survey on Vulnerabilities, Attacks and their Systematic Mitigation

Frank Hessel Lars Almon Matthias Hollick

BibTeX DOI: 10.1145/3561973

Abstract

The changing vulnerability and threat landscape constantly challenge the security of wireless communication standards and protocols. For the Internet of Things (IoT), LoRaWAN is one of the dominant technologies for urban environments, industrial settings, or critical infrastructures due to its low-power and long-range capabilities. LoRaWAN IoT deployments are expected to operate for multiple years or even decades. Hence, it is imperative to maintain operational security at all times while continuously evolving the security of the standard and its implementations. We survey LoRaWAN security and follow a systematic and evolvable approach that can be dynamically updated. To this end, we propose a novel methodology to create evolvable surveys which relate the analyzed critical security concepts, thus allowing IT security experts to reason about LoRaWAN security properties over time. With this, we provide a tool to hardware manufacturers, software developers and providers, and network operators to achieve sustainable security for IoT deployments.

2022 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Alexander Heinrich Niklas Bittner Matthias Hollick

BibTeX DOI: 10.1145/3507657.3528546

Abstract

Finder networks in general, and Apple's Find My network in particular, can pose a grave threat to users' privacy and even health if these networks are abused for stalking. Apple's release of the AirTag-a very affordable tracker covered by the nearly ubiquitous Find My network-amplified this issue. While Apple provides a stalking detection feature within its ecosystem, billions of Android users are still left in the dark. Apple recently released the Android app "Tracker Detect," which does not deliver a convincing feature set for stalking protection. We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices. We compare the performance of our solution with the Apple-provided one in iOS and study the use of AirGuard in the wild over multiple weeks using data contributed by tens of thousands of active users.

2022 ACM Transactions on Internet of Things Article

Next2You: Robust Copresence Detection Based on Channel State Information

Mikhail Fomichev Luis F. Abanto-Leon Max Stiegler Alejandro Molina Ramirez Jakob Link Matthias Hollick

PDF BibTeX DOI: 10.1145/3491244

Abstract

Context-based copresence detection schemes are a necessary prerequisite to building secure and usable authentication systems in the Internet of Things (IoT). Such schemes allow one device to verify proximity of another device without user assistance utilizing their physical context (e.g., audio). The state-of-the-art copresence detection schemes suffer from two major limitations: (1) they cannot accurately detect copresence in low-entropy context (e.g., empty room with few events occurring) and insufficiently separated environments (e.g., adjacent rooms), (2) they require devices to have common sensors (e.g., microphones) to capture context, making them impractical on devices with heterogeneous sensors. We address these limitations, proposing Next2You, a novel copresence detection scheme utilizing channel state information (CSI). In particular, we leverage magnitude and phase values from a range of subcarriers specifying a Wi-Fi channel to capture a robust wireless context created when devices communicate. We implement Next2You on off-the-shelf smartphones relying only on ubiquitous Wi-Fi chipsets and evaluate it based on over 95 hours of CSI measurements that we collect in five real-world scenarios. Next2You achieves error rates below 4%, maintaining accurate copresence detection both in low-entropy context and insufficiently separated environments. We also demonstrate the capability of Next2You to work reliably in real-time and its robustness to various attacks.

2022 Other

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

Patrick Leu Giovanni Camurati Alexander Heinrich Marc Roeschlin Claudio Anliker Matthias Hollick Capkun Srdjan Jiska Classen

PDF BibTeX DOI: 10.48550/arXiv.2111.05313

2022 30th USENIX Security Symposium (USENIX Security 21) Conference

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Alexander Heinrich Matthias Hollick Thomas Schneider Milan Stute Christian Weinert

PDF BibTeX DOI: 10.26083/tuprints-00020599

Abstract

Apple's offline file-sharing service AirDrop is integrated into more than 1.5 billion end-user devices worldwide. We discovered two design flaws in the underlying protocol that allow attackers to learn the phone numbers and email addresses of both sender and receiver devices. As a remediation, we study the applicability of private set intersection (PSI) to mutual authentication, which is similar to contact discovery in mobile messengers. We propose a novel optimized PSI-based protocol called PrivateDrop that addresses the specific challenges of offline resource-constrained operation and integrates seamlessly into the current AirDrop protocol stack. Using our native PrivateDrop implementation for iOS and macOS, we experimentally demonstrate that PrivateDrop preserves AirDrop's exemplary user experience with an authentication delay well below one second. We responsibly disclosed our findings to Apple and open-sourced our PrivateDrop implementation.

2022 Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies Article Postprint

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Matthias Gazzari Annemarie Mattmann Max Maass Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020660

Abstract

Wearables that constantly collect various sensor data of their users increase the chances for inferences of unintentional and sensitive information such as passwords typed on a physical keyboard. We take a thorough look at the potential of using electromyographic (EMG) data, a sensor modality which is new to the market but has lately gained attention in the context of wearables for augmented reality (AR), for a keylogging side-channel attack. Our approach is based on neural networks for a between-subject attack in a realistic scenario using the Myo Armband to collect the sensor data. In our approach, the EMG data has proven to be the most prominent source of information compared to the accelerometer and gyroscope, increasing the keystroke detection performance. For our end-to-end approach on raw data, we report a mean balanced accuracy of about 76 % for the keystroke detection and a mean top-3 key accuracy of about 32 % on 52 classes for the key identification on passwords of varying strengths. We have created an extensive dataset including more than 310 000 keystrokes recorded from 37 volunteers, which is available as open access along with the source code used to create the given results.

2022 43rd IEEE Symposium on Security and Privacy Conference

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Jiska Classen Francesco Gringoli Michael Hermann Matthias Hollick

Prof. Dr.-Ing. Matthias Hollick

Contact Information

Biography

Publications

BeamSec: A Practical mmWave Physical Layer Security Scheme Against Strong Adversaries

Maintaining App Services in Disrupted Cities: A Crisis and Resilience Evaluation Tool

Introducing FreeSpeaker - A Modular Smart Home Hub Prototyping Platform

Rolling the D11: An Emulation Game for the Whole BCM43 Family

Energy-efficient Broadcast Trees for Decentralized Data Dissemination in Wireless Networks

FIDO2 the Rescue? Platform vs. Roaming Authentication on Smartphones

Energy-Efficient Decentralized Broadcasting in Wireless Multi-Hop Networks

DEMO: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

LoRaWAN Security: An Evolvable Survey on Vulnerabilities, Attacks and their Systematic Mitigation

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Next2You: Robust Copresence Detection Based on Channel State Information

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

Best Practices for Notification Studies for Security and Privacy Issues on the Internet

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Snail Mail Beats Email Any Day: On Effective Operator Security Notifications in the Internet

Effective Notification Campaigns on the Web: A Matter of Trust, Framing, and Support

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Desynchronization and MitM Attacks Against Neighbor Awareness Networking Using OpenNAN

Leveraging Cross-Technology Broadcast Communication to build Gateway-Free Smart Homes

Connected Self-Organized Citizens in Crises: An Interdisciplinary Resilience Concept for Neighborhoods

Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions

Very Pwnable Network: Cisco AnyConnect Security Analysis

ARIstoteles - Dissecting Apple's Baseband Interface

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop

Happy MitM: Fun and Toys in Every Bluetooth Device

OpenHaystack: A Framework for Tracking Personal Bluetooth Devices via Apple's Massive Find My Network

FastZIP: faster and more secure zero-interaction pairing

Dinosaur Resurrection: PowerPC Binary Patching for Base Station Analysis

Polypyus - The Firmware Historian

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Zero-Interaction Security-Towards Sound Experimental Validation

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Disrupting Continuity of Apple's Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Joint Relaying and Spatial Sharing Multicast Scheduling for mmWave Networks

Towards an Automated Monitoring of RF Activity in Low-Power Wireless Testbeds

Hardware-Accelerated Real-Time Stream Data Processing on Android with GNU Radio

Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets

ToothPicker: Apple Picking in the iOS Bluetooth Stack

Firmware Insider: Bluetooth Randomness is Mostly Random

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Attaching InternalBlue to the proprietary macOS IOBluetooth framework

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Concurrent Wireless Cut-Through Forwarding: Ultra Low-Latency Multi-Hop Communication for the IoT

NEAT-TCP: Generation of TCP Congestion Control Through Neuroevolution of Augmenting Topologies

Improving the Reliability of Bluetooth Low Energy Connections

Analyzing Bluetooth Low Energy Connections on Off-the-Shelf Devices

Cross-Technology Broadcast Communication between Off-The-Shelf Wi-Fi, BLE, and IEEE 802.15.4 Devices

SEMUD: Secure multi-hop device-to-device communication for 5G public safety networks

A Billion Open Interfaces for Eve and Mallory : MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

One Billion Apples' Secret Sauce: Recipe for the Apple Wireless Direct Link Ad hoc Protocol

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Demo: Linux Goes Apple Picking: Cross-Platform Ad hoc Communication with Apple Wireless Direct Link

Empirical insights for designing Information and Communication Technology for International Disaster Response

SCAROS: A Scalable and Robust Self-backhauling Solution for Highly Dynamic Millimeter-Wave Networks

Hybrid Precoding for Multi-Group Multicasting in mmWave Systems

Riding the Waves: Decoding Asynchronous Multi-User MISO via Time-Variant Zero-Forcing

Zero-Interaction Security - Towards Sound Experimental Validation

Free Your CSI: A Channel State Information Extraction Platform For Modern Wi-Fi Chipsets

Benchmarking and Profiling the GNURadio Scheduler

The Emergency Responsive Digital City

Vacuums in the Cloud: Analyzing Security in a Hardened IoT Ecosystem

CBMoS: Combinatorial Bandit Learning for Mode Selection and Resource Allocation in D2D Systems

Reverse Engineering and Evaluating the Apple Wireless Direct Link Protocol

InternalBlue - Bluetooth Binary Patching and Experimentation Framework

Towards Transparency in Email Tracking

Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices

Perils of Zero-Interaction Security in the Internet of Things

Practical VLC to WiFi Handover Mechanisms