Prof. Dr.-Ing. Matthias Hollick

  2022  15th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Alexander Heinrich Niklas Bittner Matthias Hollick

BibTeX DOI: 10.1145/3507657.3528546

Abstract

Finder networks in general, and Apple’s Find My network in particular, can pose a grave threat to users’ privacy and even health if these networks are abused for stalking. Apple’s release of the AirTag-a very affordable tracker covered by the nearly ubiquitous Find My network-amplified this issue. While Apple provides a stalking detection feature within its ecosystem, billions of Android users are still left in the dark. Apple recently released the Android app “Tracker Detect,” which does not deliver a convincing feature set for stalking protection. We reverse engineer Apple’s tracking protection in iOS and discuss its features regarding stalking detection. We design “AirGuard” and release it as an Android app to protect against abuse by Apple tracking devices. We compare the performance of our solution with the Apple-provided one in iOS and study the use of AirGuard in the wild over multiple weeks using data contributed by tens of thousands of active users.

  2022  ACM Transactions on Internet of Things Article

Next2You: Robust Copresence Detection Based on Channel State Information

Mikhail Fomichev Luis F. Abanto-Leon Max Stiegler Alejandro Molina Ramirez Jakob Link Matthias Hollick

PDF BibTeX DOI: 10.1145/3491244

Abstract

Context-based copresence detection schemes are a necessary prerequisite to building secure and usable authentication systems in the Internet of Things (IoT). Such schemes allow one device to verify proximity of another device without user assistance utilizing their physical context (e.g., audio). The state-of-the-art copresence detection schemes suffer from two major limitations: (1) they cannot accurately detect copresence in low-entropy context (e.g., empty room with few events occurring) and insufficiently separated environments (e.g., adjacent rooms), (2) they require devices to have common sensors (e.g., microphones) to capture context, making them impractical on devices with heterogeneous sensors. We address these limitations, proposing Next2You, a novel copresence detection scheme utilizing channel state information (CSI). In particular, we leverage magnitude and phase values from a range of subcarriers specifying a Wi-Fi channel to capture a robust wireless context created when devices communicate. We implement Next2You on off-the-shelf smartphones relying only on ubiquitous Wi-Fi chipsets and evaluate it based on over 95 hours of CSI measurements that we collect in five real-world scenarios. Next2You achieves error rates below 4%, maintaining accurate copresence detection both in low-entropy context and insufficiently separated environments. We also demonstrate the capability of Next2You to work reliably in real-time and its robustness to various attacks.

  2022 Other

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

Patrick Leu Giovanni Camurati Alexander Heinrich Marc Roeschlin Claudio Anliker Matthias Hollick Capkun Srdjan Jiska Classen

PDF BibTeX DOI: 10.48550/arXiv.2111.05313

  2022  ARES 2021: The 16th International Conference on Availability, Reliability and Security Conference Postprint

Best Practices for Notification Studies for Security and Privacy Issues on the Internet

Max Maass Henning Pridöhl Dominik Herrmann Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00021773

Abstract

Researchers help operators of vulnerable and non-compliant internet services by individually notifying them about security and privacy issues uncovered in their research. To improve efficiency and effectiveness of such efforts, dedicated notification studies are imperative. As of today, there is no comprehensive documentation of pitfalls and best practices for conducting such notification studies, which limits validity of results and impedes reproducibility. Drawing on our experience with such studies and guidance from related work, we present a set of guidelines and practical recommendations, including initial data collection, sending of notifications, interacting with the recipients, and publishing the results. We note that future studies can especially benefit from extensive planning and automation of crucial processes, i. e., activities that take place well before the first notifications are sent.

  2022  Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies Article Postprint

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Matthias Gazzari Annemarie Mattmann Max Maass Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020660

Abstract

Wearables that constantly collect various sensor data of their users increase the chances for inferences of unintentional and sensitive information such as passwords typed on a physical keyboard. We take a thorough look at the potential of using electromyographic (EMG) data, a sensor modality which is new to the market but has lately gained attention in the context of wearables for augmented reality (AR), for a keylogging side-channel attack. Our approach is based on neural networks for a between-subject attack in a realistic scenario using the Myo Armband to collect the sensor data. In our approach, the EMG data has proven to be the most prominent source of information compared to the accelerometer and gyroscope, increasing the keystroke detection performance. For our end-to-end approach on raw data, we report a mean balanced accuracy of about 76 % for the keystroke detection and a mean top-3 key accuracy of about 32 % on 52 classes for the key identification on passwords of varying strengths. We have created an extensive dataset including more than 310 000 keystrokes recorded from 37 volunteers, which is available as open access along with the source code used to create the given results.

  2022  43rd IEEE Symposium on Security and Privacy Conference

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Jiska Classen Francesco Gringoli Michael Hermann Matthias Hollick

BibTeX

  2022  ARES 2021: The 16th International Conference on Availability, Reliability and Security Conference Postprint

Snail Mail Beats Email Any Day: On Effective Operator Security Notifications in the Internet

Max Maass Marc-Pascal Clement Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00021794

Abstract

In the era of large-scale internet scanning, misconfigured websites are a frequent cause of data leaks and security incidents. Previous research has investigated sending automated email notifications to operators of insecure or compromised websites, but has often met with limited success due to challenges in address data quality, spam filtering, and operator distrust and disinterest. While several studies have investigated the design and phrasing of notification emails in a bid to increase their effectiveness, the use of other contact channels has remained almost completely unexplored due to the required effort and cost. In this paper, we investigate two methods to increase notification success: the use of letters as an alternative delivery medium, and the description of attack scenarios to incentivize remediation. We evaluate these factors as part of a notification campaign utilizing manually-collected address information from 1359 German website operators and focusing on unintentional information leaks from web servers. We find that manually collected addresses lead to large increases in delivery rates compared to previous work, and letters were markedly more effective than emails, increasing remediation rates by up to 25 percentage points. Counterintuitively, providing detailed descriptions of possible attacks can actually decrease remediation rates, highlighting the need for more research into how notifications are perceived by recipients.

  2022  30th USENIX Security Symposium (USENIX Security 21) Conference

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Alexander Heinrich Matthias Hollick Thomas Schneider Milan Stute Christian Weinert

PDF BibTeX DOI: 10.26083/tuprints-00020599

Abstract

Apple’s offline file-sharing service AirDrop is integrated into more than 1.5 billion end-user devices worldwide. We discovered two design flaws in the underlying protocol that allow attackers to learn the phone numbers and email addresses of both sender and receiver devices. As a remediation, we study the applicability of private set intersection (PSI) to mutual authentication, which is similar to contact discovery in mobile messengers. We propose a novel optimized PSI-based protocol called PrivateDrop that addresses the specific challenges of offline resource-constrained operation and integrates seamlessly into the current AirDrop protocol stack. Using our native PrivateDrop implementation for iOS and macOS, we experimentally demonstrate that PrivateDrop preserves AirDrop’s exemplary user experience with an authentication delay well below one second. We responsibly disclosed our findings to Apple and open-sourced our PrivateDrop implementation.

  2022  The 21st Privacy Enhancing Technologies Symposium Conference

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Alexander Heinrich Milan Stute Tim Kornhuber Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020598

Abstract

Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available.

  2022  30th USENIX Security Symposium (USENIX Security 21) Conference

Effective Notification Campaigns on the Web: A Matter of Trust, Framing, and Support

Max Maass Alina Stöver Henning Pridöhl Sebastian Bretthauer Dominik Herrmann Matthias Hollick Indra Spiecker

PDF BibTeX DOI: 10.26083/tuprints-00020574

Abstract

Misconfigurations and outdated software are a major cause of compromised websites and data leaks. Past research has proposed and evaluated sending automated security notifications to the operators of misconfigured websites, but encountered issues with reachability, mistrust, and a perceived lack of importance. In this paper, we seek to understand the determinants of effective notifications. We identify a data protection misconfiguration that affects 12.7 % of the 1.3 million websites we scanned and opens them up to legal liability. Using a subset of 4754 websites, we conduct a multivariate randomized controlled notification experiment, evaluating contact medium, sender, and framing of the message. We also include a link to a public web-based self-service tool that is run by us in disguise and conduct an anonymous survey of the notified website owners (N=477) to understand their perspective. We find that framing a misconfiguration as a problem of legal compliance can increase remediation rates, especially when the notification is sent as a letter from a legal research group, achieving remediation rates of 76.3 % compared to 33.9 % for emails sent by computer science researchers warning about a privacy issue. Across all groups, 56.6 % of notified owners remediated the issue, compared to 9.2 % in the control group. In conclusion, we present factors that lead website owners to trust a notification, show what framing of the notification brings them into action, and how they can be supported in remediating the issue.

  2022  30th USENIX Security Symposium (USENIX Security 21) Conference

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

Milan Stute Alexander Heinrich Jannik Lorenz Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020603

Abstract

Apple controls one of the largest mobile ecosystems, with 1.5 billion active devices worldwide, and offers twelve proprietary wireless Continuity services. Previous works have unveiled several security and privacy issues in the involved protocols. These works extensively studied AirDrop while the coverage of the remaining vast Continuity service space is still low. To facilitate the cumbersome reverse-engineering process, we describe the first guide on how to approach a structured analysis of the involved protocols using several vantage points available on macOS. Also, we develop a toolkit to automate parts of this otherwise manual process. Based on this guide, we analyze the full protocol stacks involved in three Continuity services, in particular, Handoff (HO), Universal Clipboard (UC), and Wi-Fi Password Sharing (PWS). We discover several vulnerabilities spanning from Bluetooth Low Energy (BLE) advertisements to Apple’s proprietary authentication protocols. These flaws allow for device tracking via HO’s mDNS responses, a denial-of-service (DoS) attack on HO and UC, a DoS attack on PWS that prevents Wi-Fi password entry, and a machine-in-the-middle (MitM) attack on PWS that connects a target to an attacker-controlled Wi-Fi network. Our PoC implementations demonstrate that the attacks can be mounted using affordable off-the-shelf hardware ($20 micro:bit and a Wi-Fi card). Finally, we suggest practical mitigations and share our findings with Apple, who have started to release fixes through iOS and macOS updates.

  2021  Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies Article

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Matthias Gazzari Annemarie Mattmann Max Maass Matthias Hollick

BibTeX DOI: 10.1145/3494986

Abstract

Wearables that constantly collect various sensor data of their users increase the chances for inferences of unintentional and sensitive information such as passwords typed on a physical keyboard. We take a thorough look at the potential of using electromyographic (EMG) data, a sensor modality which is new to the market but has lately gained attention in the context of wearables for augmented reality (AR), for a keylogging side-channel attack. Our approach is based on neural networks for a between-subject attack in a realistic scenario using the Myo Armband to collect the sensor data. In our approach, the EMG data has proven to be the most prominent source of information compared to the accelerometer and gyroscope, increasing the keystroke detection performance. For our end-to-end approach on raw data, we report a mean balanced accuracy of about 76 % for the keystroke detection and a mean top-3 key accuracy of about 32 % on 52 classes for the key identification on passwords of varying strengths. We have created an extensive dataset including more than 310 000 keystrokes recorded from 37 volunteers, which is available as open access along with the source code used to create the given results.

  2021  19th ACM International Symposium on Mobility Management and Wireless Access (MobiWac’21) Conference

Desynchronization and MitM Attacks Against Neighbor Awareness Networking Using OpenNAN

Lars Almon Arno Krause Oliver Fietze Matthias Hollick

PDF BibTeX DOI: 10.1145/3479241.3486689

  2021  17th International Conference on distributed Computing in sensor systems (DCOSS 2021) Conference

Leveraging Cross-Technology Broadcast Communication to build Gateway-Free Smart Homes

Hannah Brunner Rainer Hofmann Markus Schuss Jakob Link Matthias Hollick Carlo Alberto Boano Kay Römer

BibTeX DOI: 10.1109/DCOSS52077.2021.00014

  2021  2021 Conference on Computer Supported Cooperative Work and Social Computing Conference

Connected Self-Organized Citizens in Crises: An Interdisciplinary Resilience Concept for Neighborhoods

Steffen Haesler Ragnar Mogk Florentin Putz Kevin Logan Nadja Thiessen Katharina Kleinschnitger Lars Baumgärtner Jan-Philipp Stroscher Christian Reuter Michèle Knodt Matthias Hollick

PDF BibTeX DOI: 10.1145/3462204.3481749

  2021  4th International Workshop on Emerging Technologies for Authorization and Authentication Conference

Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions

Florentin Putz Steffen Schön Matthias Hollick

PDF BibTeX DOI: 10.1007/978-3-030-93747-8_2

Abstract

The FIDO2 standards for strong authentication on the Internet define an extension interface, which allows them to flexibly adapt to future use cases. The domain of establishing new FIDO2 extensions, however, is currently limited to web browser developers and members of the FIDO alliance. We show how researchers and developers can design and implement their own extensions for using FIDO2 as a well-established and secure foundation to demonstrate innovative authentication concepts or to support custom deployments. Our open-source implementation targets the full FIDO2 stack, such as the Chromium web browser and hardware tokens, to enable tailor-made authentication based on the power of the existing FIDO2 ecosystem. To give an overview of existing extensions, we survey all published FIDO2 extensions by manually inspecting the source code of major web browsers and authenticators. Their current design, however, hinders the implementation of custom extensions, and they only support a limited number of extensions out of the box. We discuss weaknesses of current implementations and identify the lack of extension pass-through as a major limitation in current FIDO2 clients.

  2021  IEEE Conference on Communications and Network Security Conference

Very Pwnable Network: Cisco AnyConnect Security Analysis

Gerbert Roitburd Matthias Ortmann Matthias Hollick Jiska Classen

BibTeX DOI: 10.1109/CNS53000.2021.9705023

Abstract

Corporate Virtual Private Networks (VPNs) enable users to work from home or while traveling. At the same time, VPNs are tied to a company’s network infrastructure, forcing users to install proprietary clients for network compatibility reasons. VPN clients run with high privileges to encrypt and reroute network traffic. Thus, bugs in VPN clients pose a substantial risk to their users and in turn the corporate network. Cisco, the dominating vendor of enterprise network hardware, offers VPN connectivity with their AnyConnect client for desktop and mobile devices. While past security research primarily focused on the AnyConnect Windows client, we show that Linux and iOS are based on different architectures and have distinct security issues. Our reverse engineering as well as the follow-up design analysis and fuzzing reveal 13 new vulnerabilities. Seven of these are located in the Linux client. The root cause for privilege escalations on Linux is anchored so deep in the client’s architecture that it only got patched with a partial workaround. A similar analysis on iOS uncovers three AnyConnect-specific bugs as well as three general issues in iOS network extensions, which apply to all kinds of VPNs and are not restricted to AnyConnect.

  2021  26th European Symposium on Research in Computer Security (ESORICS 2021) Conference

ARIstoteles - Dissecting Apple’s Baseband Interface

Tobias Kröll Stephan Kleber Frank Kargl Matthias Hollick Jiska Classen

BibTeX DOI: 10.1007/978-3-030-88418-5_7

  2021  30th USENIX Security Symposium Conference

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Alexander Heinrich Matthias Hollick Thomas Schneider Milan Stute Christian Weinert

PDF BibTeX

Abstract

Apple’s offline file-sharing service AirDrop is integrated into more than 1.5 billion end-user devices worldwide. We discovered two design flaws in the underlying protocol that allow attackers to learn the phone numbers and email addresses of both sender and receiver devices. As a remediation, we study the applicability of private set intersection (PSI) to mutual authentication, which is similar to contact discovery in mobile messengers. We propose a novel optimized PSI-based protocol called PrivateDrop that addresses the specific challenges of offline resource-constrained operation and integrates seamlessly into the current AirDrop protocol stack. Using our native PrivateDrop implementation for iOS and macOS, we experimentally demonstrate that PrivateDrop preserves AirDrop’s exemplary user experience with an authentication delay well below one second. We responsibly disclosed our findings to Apple and open-sourced our PrivateDrop implementation.

  2021  14th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

Happy MitM: Fun and Toys in Every Bluetooth Device

Jiska Classen Matthias Hollick

BibTeX DOI: 10.1145/3448300.3467822

  2021  14th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop

Alexander Heinrich Matthias Hollick Thomas Schneider Milan Stute Christian Weinert

PDF BibTeX DOI: 10.1145/3448300.3468252

Abstract

Apple’s file-sharing service AirDrop leaks phone numbers and email addresses by exchanging vulnerable hash values of the user’s own contact identifiers during the authentication handshake with nearby devices. In a paper presented at USENIX Security’21, we theoretically describe two attacks to exploit these vulnerabilities and propose “PrivateDrop” as a privacy-preserving drop-in replacement for Apple’s AirDrop protocol based on private set intersection. In this demo, we show how these vulnerabilities are efficiently exploitable via Wi-Fi and physical proximity to a target. Privacy and security implications include the possibility of conducting advanced spear phishing attacks or deploying multiple “collector” devices in order to build databases that map contact identifiers to specific locations. For our proof-of-concept, we leverage a custom rainbow table construction to reverse SHA-256 hashes of phone numbers in a matter of milliseconds. We discuss the trade-off between success rate and storage requirements of the rainbow table and, after following responsible disclosure with Apple, we publish our proof-of-concept implementation as “AirCollect” on GitHub.

  2021  14th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

OpenHaystack: A Framework for Tracking Personal Bluetooth Devices via Apple’s Massive Find My Network

Alexander Heinrich Milan Stute Matthias Hollick

BibTeX DOI: 10.1145/3448300.3468251

Abstract

OpenHaystack is an open-source framework for locating personal Bluetooth devices using Apple’s Find My Network. A user can integrate it into Bluetooth-capable devices, such as notebooks, or create custom tracking accessories that can be attached to personal items (key rings, backpacks, etc.). We provide firmware images for the Nordic nRF5 chips and the ESP32. We show that they consume little energy and run from a single coin cell for a year. Our macOS application can locate personal accessories. Finally, we make both application and firmware available on GitHub.

  2021  19th Annual International Conference on Mobile Systems, Applications, and Services Conference

FastZIP: faster and more secure zero-interaction pairing

Mikhail Fomichev Julia Hesse Lars Almon Timm Lippert Jun Han Matthias Hollick

BibTeX DOI: 10.1145/3458864.3467883

Abstract

With the advent of the Internet of Things (IoT), establishing a secure channel between smart devices becomes crucial. Recent research proposes zero-interaction pairing (ZIP), which enables pairing without user assistance by utilizing devices’ physical context (e.g., ambient audio) to obtain a shared secret key. The state-of-the-art ZIP schemes suffer from three limitations: (1) prolonged pairing time (i.e., minutes or hours), (2) vulnerability to brute-force offline attacks on a shared key, and (3) susceptibility to attacks caused by predictable context (e.g., replay attack) because they rely on limited entropy of physical context to protect a shared key. We address these limitations, proposing FastZIP, a novel ZIP scheme that significantly reduces pairing time while preventing offline and predictable context attacks. In particular, we adapt a recently introduced Fuzzy Password-Authenticated Key Exchange (fPAKE) protocol and utilize sensor fusion, maximizing their advantages. We instantiate FastZIP for intra-car device pairing to demonstrate its feasibility and show how the design of FastZIP can be adapted to other ZIP use cases. We implement FastZIP and evaluate it by driving four cars for a total of 800 km. We achieve up to three times shorter pairing time compared to the state-of-the-art ZIP schemes while assuring robust security with adversarial error rates below 0.5%.

  2021  28th Network and Distributed System Security Symposium (NDSS 2021) Conference

Dinosaur Resurrection: PowerPC Binary Patching for Base Station Analysis

Uwe Müller Eicke Hauck Timm Welz Jiska Classen Matthias Hollick

PDF BibTeX DOI: 10.14722/bar.2021.23009

  2021  28th Network and Distributed System Security Symposium (NDSS 2021) Conference

Polypyus - The Firmware Historian

Jan Friebertshäuser Florian Kosterhon Jiska Classen Matthias Hollick

PDF BibTeX DOI: 10.14722/bar.2021.23004

  2021  IEEE Transactions on Dependable and Secure Computing Article

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Milan Stute Florian Kohnhauser Lars Baumgärtner Lars Almon Matthias Hollick Stefan Katzenbeisser Bernd Freisleben

PDF BibTeX DOI: 10.26083/tuprints-00017838

Abstract

During disasters, existing telecommunication infrastructures are often congested or even destroyed. In these situations, mobile devices can form a backup communication network for civilians and emergency services using disruption-tolerant networking (DTN) principles. Unfortunately, such distributed and resource-constrained networks are particularly susceptible to a wide range of attacks such as terrorists trying to cause more harm. In this paper, we present RESCUE, a resilient and secure device-to-device communication framework for emergency scenarios that provides comprehensive protection against common attacks. RESCUE features a minimalistic DTN protocol that, by design, is secure against notable attacks such as routing manipulations, dropping, message manipulations, blackholing, or impersonation. To further protect against message flooding and Sybil attacks, we present a twofold mitigation technique. First, a mobile and distributed certificate infrastructure particularly tailored to the emergency use case hinders the adversarial use of multiple identities. Second, a message buffer management scheme significantly increases resilience against flooding attacks, even if they originate from multiple identities, without introducing additional overhead. Finally, we demonstrate the effectiveness of RESCUE via large-scale simulations in a synthetic as well as a realistic natural disaster scenario. Our simulation results show that RESCUE achieves very good message delivery rates, even under flooding and Sybil attacks.

  2021  Proceedings on Privacy Enhancing Technologies Article

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Alexander Heinrich Milan Stute Tim Kornhuber Matthias Hollick

BibTeX DOI: 10.2478/popets-2021-0045

  2021  GetMobile: Mobile Computing and Communications Article Postprint

Zero-Interaction Security-Towards Sound Experimental Validation

Mikhail Fomichev Max Maass Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00018518

Abstract

Reproducibility and realistic datasets are crucial for advancing research. Unfortunately, they are often neglected as valid scientific contributions in many young disciplines, with computer science being no exception. In this article, we show the challenges encountered when reproducing the work of others, collecting realistic data in the wild, and ensuring that our own work is reproducible in turn. The presented findings are based on our study investigating the limits of zero-interaction security (ZIS)- a novel concept, leveraging sensor data collected by Internet of Things (IoT) devices to pair or authenticate devices. In particular, we share our experiences in reproducing five state-of-the-art ZIS schemes, collecting a comprehensive dataset of sensor data from the real world, evaluating these schemes on the collected data, and releasing the data, code, and documentation to facilitate reproducibility of our results.

  2021  WiSec ‘20: 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference Postprint

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Alexander Heinrich Milan Stute Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00017839

Abstract

The market for Bluetooth Low Energy (BLE) devices is booming and, at the same time, has become an attractive target for adversaries. To improve BLE security at large, we present BTLEmap, an auditing application for BLE environments. BTLEmap is inspired by network discovery and security auditing tools such as Nmap for IP-based networks. It allows for device enumeration, Generic Attribute Profile (GATT) service discovery, and device fingerprinting. It also features a BLE advertisement dissector, data exporter, and a user-friendly UI including a proximity view. BTLEmap currently runs on iOS and macOS using Apple’s CoreBluetooth API but also accepts alternative data inputs such as a Raspberry Pi to overcome the restricted vendor API. The open-source project is under active development and will provide more advanced capabilities such as long-term device tracking (in spite of MAC address randomization) in the future.

  2021  30th USENIX Security Symposium Conference

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

Milan Stute Alexander Heinrich Jannik Lorenz Matthias Hollick

PDF BibTeX

Abstract

Apple controls one of the largest mobile ecosystems, with 1.5 billion active devices worldwide, and offers twelve proprietary wireless Continuity services. Previous works have unveiled several security and privacy issues in the involved protocols. These works extensively studied AirDrop while the coverage of the remaining vast Continuity service space is still low. To facilitate the cumbersome reverse-engineering process, we describe the first guide on how to approach a structured analysis of the involved protocols using several vantage points available on macOS. Also, we develop a toolkit to automate parts of this otherwise manual process. Based on this guide, we analyze the full protocol stacks involved in three Continuity services, in particular, Handoff (HO), Universal Clipboard (UC), and Wi-Fi Password Sharing (PWS). We discover several vulnerabilities spanning from Bluetooth Low Energy (BLE) advertisements to Apple’s proprietary authentication protocols. These flaws allow for device tracking via HO’s mDNS responses, a denial-of-service (DoS) attack on HO and UC, a DoS attack on PWS that prevents Wi-Fi password entry, and a machine-in-the-middle (MitM) attack on PWS that connects a target to an attacker-controlled Wi-Fi network. Our PoC implementations demonstrate that the attacks can be mounted using affordable off-the-shelf hardware ($20 micro:bit and a Wi-Fi card). Finally, we suggest practical mitigations and share our findings with Apple, who have started to release fixes through iOS and macOS updates.

  2020  Proceedings of the ACM on Measurement and Analysis of Computing Systems Article

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

Luis F. Abanto-Leon Andreas Bäuml Gek Hong Sim Matthias Hollick Arash Asadi

PDF BibTeX DOI: 10.1145/3428329

  2020  Transactions on Dependable and Secure Computing Article

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Milan Stute Florian Kohnhäuser Lars Baumgärtner Lars Almon Matthias Hollick Stefan Katzenbeisser Bernd Freisleben

PDF BibTeX DOI: 10.1109/TDSC.2020.3036224

  2020  21st IEEE International Symposium on World of Wireless, Mobile and Multimedia Networks (WoWMoM 2020) Conference

Joint Relaying and Spatial Sharing Multicast Scheduling for mmWave Networks

Gek Hong Sim Mahdi Mousavi Lin Wang Anja Klein Matthias Hollick

PDF BibTeX DOI: 10.1109/WoWMoM49955.2020.00033

  2020  3rd Workshop on Benchmarking Cyber-Physical Systems and Internet of Things (CPS-IoTBench 2020) Conference

Towards an Automated Monitoring of RF Activity in Low-Power Wireless Testbeds

Markus Schuß Carlo Alberto Boano Kay Römer Jakob Link Matthias Hollick

PDF BibTeX

  2020  Proceedings of the 14th International Workshop on Wireless Network Testbeds, Experimental evaluation & Characterization Conference

Hardware-Accelerated Real-Time Stream Data Processing on Android with GNU Radio

Bastian Bloessl Lars Baumgärtner Matthias Hollick

PDF BibTeX DOI: 10.1145/3411276.3412184

Abstract

With the ever-increasing performance of smartphones and tablets, they become viable platforms for applications that were, in the past, only possible on desktops or laptops. In this paper, we study their applicability for real-time stream-data processing, which is particularly interesting for Software Defined Radio (SDR) applications, enabling wireless measurement and experimentation campaigns on mobile platforms. To this end, we port GNU Radio, a state-of-theart, open source, real-time stream-data processing framework, to Android and evaluate its performance. We show that it is possible to fully benefit from available accelerators, i.e., Single Instruction Multiple Data (SIMD) and the Graphics Processing Unit (GPU), which provide considerable speedups and allow for efficient implementations. As a general-purpose real-time data processing framework, GNU Radio can provide the base for a wide range of applications. To demonstrate its flexibility, we provide example applications that implement FM and Wireless LAN (WLAN). Our toolchain is published as open source software, thus serving as an enabler for highly mobile SDR applications.

  2020  29th USENIX Security Symposium Conference

Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets

Jan Ruge Jiska Classen Francesco Gringoli Matthias Hollick

PDF BibTeX

  2020  29th USENIX Security Symposium Conference

ToothPicker: Apple Picking in the iOS Bluetooth Stack

Dennis Heinze Jiska Classen Matthias Hollick

PDF BibTeX

  2020  14th USENIX Workshop on Offensive Technologies (WOOT 2020) Conference

Firmware Insider: Bluetooth Randomness is Mostly Random

Jörn Tillmanns Jiska Classen Felix Rohrbach Matthias Hollick

PDF BibTeX

  2020  IEEE Internet of Things Journal Article

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Milan Stute Pranay Agarwal Abhinav Kumar Arash Asadi Matthias Hollick

PDF BibTeX DOI: 10.1109/JIOT.2020.2985044

  2020  WiSec 2020: 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Alexander Heinrich Milan Stute Matthias Hollick

PDF BibTeX DOI: 10.1145/3395351.3401796

  2020  IEEE DCOSS 2020: International Conference on Distributed Computing in Sensor Systems Conference

Concurrent Wireless Cut-Through Forwarding: Ultra Low-Latency Multi-Hop Communication for the IoT

Nicolás Himmelmann Dingwen Yuan Lars Almon Matthias Hollick

PDF BibTeX

  2020  IEEE International Conference on Communications (icc2020) Conference

NEAT-TCP: Generation of TCP Congestion Control Through Neuroevolution of Augmenting Topologies

Kay Luis Wallaschek Robin Klose Lars Almon Matthias Hollick

PDF BibTeX

Abstract

We present NEAT-TCP, a novel technique to automatically generate congestion control algorithms in a data-driven fashion while optimizing towards a specified global system utility. NEAT-TCP employs an artificial neural network (ANN) in each node and generates a population of ANNs by means of an evolutionary algorithm called NEAT. The ANNs run independently from each other at the communication endpoints and take only features as inputs that are locally available at these nodes. We define the system utility as a combined maximization of overall throughput and throughput fairness between flows according to Jain’s fairness index. The nodes are deployed in a grid topology in ns-3 simulations, which makes it particularly difficult to maximize the utility due to different interference levels for the data flows. In our experiments, NEAT-TCP achieves 69 % more fairness, 66 % less mean end-to-end delay and 71 % less packet loss in relation to TCP New Reno at the cost of 19 % less overall throughput, which meets our multi-criteria objective.

  2020  Embedded Wireless Systems and Networks (EWSN) Conference

Improving the Reliability of Bluetooth Low Energy Connections

Michael Spörk Jiska Classen Carlo Alberto Boano Matthias Hollick Kay Römer

PDF BibTeX

Abstract

o sustain a reliable data exchange, applications based on Bluetooth Low Energy (BLE) need to effectively blacklist channels and adapt the physical mode of an active connection at runtime. Although the BLE specification foresees the use of these two mechanisms, their implementation is left up to the radio vendors and has not been studied in detail yet. This paper fills this gap: we first investigate experimentally how to assess the quality of a BLE connection at runtime using information gathered from the radio. We then show how this information can be used to promptly blacklist poor channels and select a physical mode that sustains a high link-layer reliability while minimizing power consumption. We implement both mechanisms on two popular platforms and show experimentally that they allow to significantly improve the reliability of BLE connections, with a reduction in packet loss by up to 22 % compared to existing solutions.

  2020  International Conference on Embedded Wireless Systems and Networks (EWSN 2020) Conference

Cross-Technology Broadcast Communication between Off-The-Shelf Wi-Fi, BLE, and IEEE 802.15.4 Devices

Hannah Brunner Rainer Hofmann Markus Schuss Jakob Link Matthias Hollick Carlo Alberto Boano Kay Römer

PDF BibTeX

  2020  International Conference on Embedded Wireless Systems and Networks (EWSN 2020) Conference

Analyzing Bluetooth Low Energy Connections on Off-the-Shelf Devices

Jiska Classen Michael Spörk Carlo Alberto Boano Kay Römer Matthias Hollick

PDF BibTeX

  2020  IEEE Internet of Things Journal Article Postprint

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Milan Stute Pranay Agarwal Abhinav Kumar Arash Asadi Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013320

Abstract

IoT devices penetrate different aspects of our life including critical services, such as health monitoring, public safety, and autonomous driving. Such safety-critical IoT systems often consist of a large number of devices and need to withstand a vast range of known Denial-of-Service (DoS) network attacks to ensure a reliable operation while offering low-latency information dissemination. As the first solution to jointly achieve these goals, we propose LIDOR, a secure and lightweight multihop communication protocol designed to withstand all known variants of packet dropping attacks. Specifically, LIDOR relies on an end-to-end feedback mechanism to detect and react on unreliable links and draws solely on efficient symmetric-key cryptographic mechanisms to protect packets in transit. We show the overhead of LIDOR analytically and provide the proof of convergence for LIDOR which makes LIDOR resilient even to strong and hard-to-detect wormhole-supported grayhole attacks. In addition, we evaluate the performance via testbed experiments. The results indicate that LIDOR improves the reliability under DoS attacks by up to 91% and reduces network overhead by 32% compared to a state-of-the-art benchmark scheme.

  2020  International Journal of Disaster Risk Reduction Article

Empirical insights for designing Information and Communication Technology for International Disaster Response

Milan Stute Max Maass Tom Schons Marc-André Kaufhold Christian Reuter Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013309

Abstract

Due to the increase in natural disasters in the past years, Disaster Response Organizations (DROs) are faced with the challenge of coping with more and larger operations. Currently appointed Information and Communications Technology (ICT) used for coordination and communication is sometimes outdated and does not scale, while novel technologies have the potential to greatly improve disaster response efficiency. To allow adoption of these novel technologies, ICT system designers have to take into account the particular needs of DROs and characteristics of International Disaster Response (IDR). This work attempts to bring the humanitarian and ICT communities closer together. In this work, we analyze IDR-related documents and conduct expert interviews. Using open coding, we extract empirical insights and translate the peculiarities of DRO coordination and operation into tangible ICT design requirements. This information is based on interviews with active IDR staff as well as DRO guidelines and reports. Ultimately, the goal of this paper is to serve as a reference for future ICT research endeavors to support and increase the efficiency of IDR operations.

  2019  IEEE Journal on Selected Areas in Communications Article

SCAROS: A Scalable and Robust Self-backhauling Solution for Highly Dynamic Millimeter-Wave Networks

Andrea Patricia Ortiz Jimenez Arash Asadi Gek Hong Sim Daniel Steinmetzer Matthias Hollick

BibTeX DOI: 10.1109/JSAC.2019.2947925

  2019  IEEE Global Communications Conference (GLOBECOM) 2019 Conference

Riding the Waves: Decoding Asynchronous Multi-User MISO via Time-Variant Zero-Forcing

Robin Klose Matthias Hollick

PDF BibTeX

Abstract

uture wireless communication systems are envisioned to meet stringent latency requirements to support control applications and machine interactions. One important step in this direction is to eliminate waiting times in the protocol stack, which can be achieved by letting multiple nodes transmit the same data concurrently just when the data becomes available. This communication paradigm essentially enables wide-range broadcasting and low-latency flooding. However, imperfect transmitter synchronization may arise in such schemes, which causes signal incoherence, which in turn prohibits reception with conventional decoders. In this paper, we introduce time-variant zero-forcing (TVZF), a novel equalization technique that deals with non-stationary interferences. In doing so, TVZF relaxes the requirements for time and frequency synchronization in concurrent multi-user transmissions. We present a receiver design for asynchronous MU-MISO with IEEE 802.11g compliant signals and evaluate it with over-the-air transmissions in a WARP SDR testbed in LOS and NLOS scenarios. The relative timing and frequency offsets between concurrent transmitters are systematically tuned to assess our receiver’s performance in comparison to commodity hardware. For timing offsets up to the length of the cyclic prefix and frequency offsets up to 5 kHz, our receiver achieves average frame reception rates of 97 % and 92 % for LOS and NLOS, respectively.

  2019  2019 IEEE Global Communications Conference (GLOBECOM) Conference

Hybrid Precoding for Multi-Group Multicasting in mmWave Systems

Luis F. Abanto-Leon Matthias Hollick Gek Hong Sim

PDF BibTeX

Abstract

Multicast beamforming is known to improve spectral efficiency. However, its benefits and challenges for hybrid precoders design in millimeter-wave (mmWave) systems remain understudied. To this end, this paper investigates the first joint design of hybrid transmit precoders (with an arbitrary number of finite-resolution phase shifts) and receive combiners for mmWave multi-group multicasting. Our proposed design leverages semidefinite relaxation (SDR), alternating optimization and Cholesky matrix factorization to sequentially optimize the digital/analog precoders at the transmitter and the combiners at each receiver. By considering receivers with multiple- antenna architecture, our design remarkably improves the overall system performance. Specifically, with only two receive antennas the average transmit power per received message improves by $ 16.8\% $ while the successful information reception is boosted by $ 60\% $. We demonstrate by means of extensive simulations that our hybrid precoder design performs very close to its fully-digital counterpart even under challenging scenarios (i.e., when co-located users belong to distinct multicast groups).

  2019  GetMobile: Mobile Computing and Communications Article

Zero-Interaction Security - Towards Sound Experimental Validation

Mikhail Fomichev Max Maass Matthias Hollick

PDF BibTeX DOI: 10.1145/3372300.3372304

Abstract

Reproducibility and realistic datasets are crucial for advancing research. Unfortunately, they are often neglected as valid scientific contributions in many young disciplines, with computer science being no exception. In this article, we show the challenges encountered when reproducing the work of others, collecting realistic data in the wild, and ensuring that our own work is reproducible in turn. The presented findings are based on our study investigating the limits of zero-interaction security (ZIS)- a novel concept, leveraging sensor data collected by Internet of Things (IoT) devices to pair or authenticate devices. In particular, we share our experiences in reproducing five state-of-the-art ZIS schemes, collecting a comprehensive dataset of sensor data from the real world, evaluating these schemes on the collected data, and releasing the data, code, and documentation to facilitate reproducibility of our results.

  2019  13th International Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization (WiNTECH ’19) Conference

Free Your CSI: A Channel State Information Extraction Platform For Modern Wi-Fi Chipsets

Francesco Gringoli Matthias Schulz Jakob Link Matthias Hollick

PDF BibTeX DOI: 10.1145/3349623.3355477

Abstract

Modern wireless transmission systems heavily benefit from knowing the channel response. The evaluation of Channel State Information (CSI) during the reception of a frame preamble is fundamental to properly equalizing the rest of the transmission at the receiver side. Reporting this state information back to the transmitter facilitates mechanisms such as beamforming and MIMO, thus boosting the network performance. While these features are an integral part of standards such as 802.11ac, accessing CSI data on commercial devices is either not possible, limited to outdated chipsets or very inflexible. This hinders the research and development of innovative CSI-dependent techniques including localization, object tracking, and interference evaluation. To help researchers and practitioners, we introduce the nexmon CSI Extractor Tool. It allows per-frame CSI extraction for up to four spatial streams using up to four receive chains on modern Broadcom and Cypress Wi-Fi chips with up to 80MHz bandwidth in both the 2.4 and 5GHz bands. The tool supports devices ranging from the low-cost Raspberry Pi platform, over mobile platforms such as Nexus smartphones to state-of-the-art Wi-Fi APs. We release all tools and Wi-Fi firmware patches as extensible open source project. It includes our user-friendly smartphone application to demonstrate the CSI extraction capabilities in form of a waterfall diagram.

  2019  Proceedings of the GNU Radio Conference Article

Benchmarking and Profiling the GNURadio Scheduler

Bastian Bloessl Marcus Müller Matthias Hollick

PDF BibTeX

Abstract

From a technical perspective, GNURadio has two main assets: its comprehensive block library of optimized, state-of-the-art signal processing algorithms and its runtime environment. The latter manages the data flow and turns GNURadio in a real-time signal processing framework. In contrast to the block library, where it is easy to replace blocks with more efficient implementations, the runtime grew organically, which resulted in a complex system that is hard to maintain. At the same time, there are concerns about its performance. To understand the current implementation and explore opportunities for future improvements, we provide benchmarking and profiling results. We, furthermore, compare the performance of GNURadio’s default with a manually optimized configuration to show the potential of a more advanced scheduler.

  2019  2019 World Congress on Resilience, Reliability and Asset Management (WCRRAM) Conference

The Emergency Responsive Digital City

Matthias Hollick Anne Hofmeister Jens Ivo Engels Bernd Freisleben Gerrit Hornung Anja Klein Michèle Knodt Imke Lorenz Max Mühlhäuser Peter F. Pelz Annette Rudolph-Cleff Ralf Steinmetz Florian Steinke Oskar von Stryk

BibTeX

  2019  13th USENIX Workshop on Offensive Technologies (WOOT 19) Conference

Vacuums in the Cloud: Analyzing Security in a Hardened IoT Ecosystem

Fabian Ullrich Jiska Classen Johannes Eger Matthias Hollick

PDF BibTeX

  2019  IEEE Journal on Selected Areas in Communications Article

CBMoS: Combinatorial Bandit Learning for Mode Selection and Resource Allocation in D2D Systems

Andrea Patricia Ortiz Jimenez Arash Asadi Max Engelhardt Matthias Hollick Anja Klein

BibTeX DOI: 10.1109/JSAC.2019.2933764

  2019  28th USENIX Security Symposium (USENIX Security 19) Conference

A Billion Open Interfaces for Eve and Mallory : MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

Milan Stute Sashank Narain Alex Mariotto Alexander Heinrich David Kreitschmann Guevara Noubir Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013264

Abstract

Apple Wireless Direct Link (AWDL) is a key protocol in Apple’s ecosystem used by over one billion iOS and macOS devices for device-to-device communications. AWDL is a proprietary extension of the IEEE 802.11 (Wi-Fi) standard and integrates with Bluetooth Low Energy (BLE) for providing services such as Apple AirDrop. We conduct the first security and privacy analysis of AWDL and its integration with BLE. We uncover several security and privacy vulnerabilities ranging from design flaws to implementation bugs leading to a man-in-the-middle (MitM) attack enabling stealthy modification of files transmitted via AirDrop, denial-of-service (DoS) attacks preventing communication, privacy leaks that enable user identification and long-term tracking undermining MAC address randomization, and DoS attacks enabling targeted or simultaneous crashing of all neighboring devices. The flaws span across AirDrop’s BLE discovery mechanism, AWDL synchronization, UI design, and Wi-Fi driver implementation. Our analysis is based on a combination of reverse engineering of protocols and code supported by analyzing patents. We provide proof-of-concept implementations and demonstrate that the attacks can be mounted using a low-cost ($20) micro:bit device and an off-the-shelf Wi-Fi card. We propose practical and effective countermeasures. While Apple was able to issue a fix for a DoS attack vulnerability after our responsible disclosure, the other security and privacy vulnerabilities require the redesign of some of their services.

  2019  GetMobile: Mobile Computing and Communications Article

Reverse Engineering and Evaluating the Apple Wireless Direct Link Protocol

Milan Stute David Kreitschmann Matthias Hollick

BibTeX DOI: 10.1145/3351422.3351432

  2019  The 17th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys ’19) Conference

InternalBlue - Bluetooth Binary Patching and Experimentation Framework

Dennis Mantz Jiska Classen Matthias Schulz Matthias Hollick

BibTeX DOI: 10.1145/3307334.3326089

Abstract

Bluetooth is one of the most established technologies for short range digital wireless data transmission. With the advent of wearables and the Internet of Things (IoT), Bluetooth has again gained importance, which makes security research and protocol optimizations imperative. Surprisingly, there is a lack of openly available tools and experimental platforms to scrutinize Bluetooth. In par ticular, system aspects and close to hardware protocol layers are mostly uncovered. We reverse engineer multiple Broadcom Bluetooth chipsets that are widespread in off-the-shelf devices. Thus, we offer deep in sights into the internal architecture of a popular commercial family of Bluetooth controllers used in smartphones, wearables, and IoT platforms. Reverse engineered functions can then be altered with our InternalBlue Python framework—outperforming evaluation kits, which are limited to documented and vendor-defined functions. The modified Bluetooth stack remains fully functional and high-performance. Hence, it provides a portable low-cost research platform. InternalBlue is a versatile framework and we demonstrate its abilities by implementing tests and demos for known Bluetooth vulnerabilities. Moreover, we discover a novel critical security issue affecting a large selection of Broadcom chipsets that allows executing code within the attacked Bluetooth firmware. We further show how to use our framework to fix bugs in chipsets out of vendor support and how to add new security features to Bluetooth firmware.

  2019  7th Annual Privacy Forum (APF 2019) Conference

Towards Transparency in Email Tracking

Max Maass Stephan Schwär Matthias Hollick

PDF BibTeX DOI: 10.1007/978-3-030-21752-5_2

Abstract

Tracking technologies have become ubiquitous, not only on websites but also in email messages. However, while protection and transparency tools exist for the web, no such tools exist for email messages, thus obscuring privacy violations. We introduce the PrivacyMail platform to assist with the automated analysis of email messages. The platform automatically analyzes commercial mailing lists, making it easier to detect different forms of tracking. Our platform introduces transparency about the practices of companies, and serves as a tool for regulators, data protection professionals and consumers alike. Our preliminary results show widespread email tracking, where opening an email can result in information being sent to up to 13 third parties, in some cases disclosing the users’ email address in the process.

  2019  12th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec’19) Conference

Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices

Jiska Classen Matthias Hollick

BibTeX DOI: 10.1145/3317549.3319727

Abstract

Bluetooth is among the dominant standards for wireless short-range communication with multi-billion Bluetooth devices shipped each year. Basic Bluetooth analysis inside consumer hardware such as smartphones can be accomplished observing the Host Controller Interface (HCI) between the operating system’s driver and the Bluetooth chip. However, the HCI does not provide insights to tasks running inside a Bluetooth chip or Link Layer (LL) packets exchanged over the air. As of today, consumer hardware internal behavior can only be observed with external, and often expensive tools, that need to be present during initial device pairing. In this paper, we leverage standard smartphones for on-device Bluetooth analysis and reverse engineer a diagnostic protocol that resides inside Broadcom chips. Diagnostic features include sniffing lower layers such as LL for Classic Bluetooth and Bluetooth Low Energy (BLE), transmission and reception statistics, test mode, and memory peek and poke.

  2019  Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT) Article

Perils of Zero-Interaction Security in the Internet of Things

Mikhail Fomichev Max Maass Lars Almon Alejandro Molina Matthias Hollick

PDF BibTeX DOI: 10.1145/3314397

Abstract

The Internet of Things (IoT) demands authentication systems which can provide both security and usability. Recent research utilizes the rich sensing capabilities of smart devices to build security schemes operating without human interaction, such as zero-interaction pairing (ZIP) and zero-interaction authentication (ZIA). Prior work proposed a number of ZIP and ZIA schemes and reported promising results. However, those schemes were often evaluated under conditions which do not reflect realistic IoT scenarios. In addition, drawing any comparison among the existing schemes is impossible due to the lack of a common public dataset and unavailability of scheme implementations. In this paper, we address these challenges by conducting the first large-scale comparative study of ZIP and ZIA schemes, carried out under realistic conditions. We collect and release the most comprehensive dataset in the domain to date, containing over 4250 hours of audio recordings and 1 billion sensor readings from three different scenarios, and evaluate five state-of-the-art schemes based on these data. Our study reveals that the effectiveness of the existing proposals is highly dependent on the scenario they are used in. In particular, we show that these schemes are subject to error rates between 0.6% and 52.8%.

  2019  EWSN’19-International Conference on Embedded Wireless Systems and Networks Conference

Practical VLC to WiFi Handover Mechanisms

Richard Meister Jiska Classen Muhammad Saad Saud Marcos Katz Matthias Hollick

PDF BibTeX

Abstract

Visible light communication (VLC) is an emerging communication technology that perfectly integrates into crowded legacy radio frequency (RF) environments to increase bandwidth. Despite the fact that integrating these technologies would be beneficial for both of them, there is only little research on handover mechanisms, and most of it is simulation only. We design a software defined radio (SDR) based VLC+WiFi testbed in which both technologies can coexist, design handover mechanisms between VLC and WiFi, and evaluate them based on user-induced link blockage measurements in our testbed.

  2019  Wirtschaftsinformatik 2019 Conference

On the Difficulties of Incentivizing Online Privacy through Transparency: A Qualitative Survey of the German Health Insurance Market

Max Maass Nicolas Walter Dominik Herrmann Matthias Hollick

PDF BibTeX DOI: dx.10.25819/ubsi/1016

Abstract

Today, online privacy is the domain of regulatory measures and privacy-enhancing technologies. Transparency in the form of external and public assessments has been proposed for improving privacy and security because it exposes otherwise hidden deficiencies. Previous work has studied privacy attitudes and behavior of consumers. However, little is known on how organizations react to measures that employ public “naming and shaming” as an incentive for improvement. We performed the first study on this aspect by conducting a qualitative survey with 152 German health insurers. We scanned their websites with PrivacyScore.org to generate a public ranking and confronted the insurers with the results. We obtained a response rate of 27%. Responses ranged from positive feedback to legal threats. Only 12% of the sites - mostly non-responders - improved during our study. Our results show that insurers struggle due to unawareness, reluctance, and incapability, and demonstrate the general difficulties of transparency-based approaches.

  2019  Proceedings of the IEEE Article

Transitions: A Protocol-Independent View of the Future Internet

Bastian Alt Markus Weckesser Christian Becker Matthias Hollick Sounak Kar Robin Klose Roland Kluge Heinz Koeppl Wasiur R. KhudaBukhsh Manisha Luthra Mahdi Mousavi Max Mühlhäuser Martin Pfannemüller Amr Rizk Andy Schürr Ralf Steinmetz Anja Klein

BibTeX DOI: 10.1109/JPROC.2019.2895964

  2019  43rd IEEE Conference on Local Computer Networks (LCN) Conference

Sea of Lights: Practical Device-to-Device Security Bootstrapping in the Dark

Flor Álvarez Matthias Hollick

PDF BibTeX DOI: 10.1109/LCN.2018.8638102

Abstract

Practical solutions to bootstrap security in today’s information and communication systems critically depend on centralized services for authentication as well as key and trust management. This is particularly true for mobile users. Identity providers such as Google or Facebook have active user bases of two billion each, and the subscriber number of mobile operators exceeds five billion unique users as of early 2018. If these centralized services go completely ‘dark’ due to natural or man made disasters, large scale blackouts, or country-wide censorship, the users are left without practical solutions to bootstrap security on their mobile devices. Existing distributed solutions, for instance, the so-called web-of-trust are not sufficiently lightweight. Furthermore, they support neither cross-application on mobile devices nor strong protection of key material using hardware security modules. We propose Sea of Lights (SOL), a practical lightweight scheme for bootstrapping device-to-device security wirelessly, thus, enabling secure distributed self-organized networks. It is tailored to operate `in the dark’ and provides strong protection of key material as well as an intuitive means to build a lightweight web-of-trust. SOL is particularly well suited for local or urban operation in scenarios such as the coordination of emergency response, where it helps containing/limiting the spreading of misinformation. As a proof of concept, we implement SOL in the Android platform and hence test its feasibility on real mobile devices. We further evaluate its key performance aspects using simulation.

  2019  2019 IEEE 44nd Conference on Local Computer Networks (LCN) Conference

The King is Dead Long Live the King! Towards Systematic Performance Evaluation of Heterogeneous Bluetooth Mesh Networks in Real World Environments

Lars Almon Flor Álvarez Laurenz Kamp Matthias Hollick

BibTeX

Abstract

Wireless networks based on Bluetooth mesh (BM) promise a variety of Internet of Things applications from health- care monitoring to smart buildings. BM introduces a novel network concept that supports up to 32767 devices and 127 hops. So far no readily available dataset or toolset exists to perform systematic in-depth performance analysis of this standard. In this paper, we present insights on the performance and practical usability of BM. We conduct realistic smart office experiments with heterogeneous devices distributed throughout an area of approximately 1100m2. By varying network pa- rameters and BM node features, we collect the first public available BM dataset. Based on our experience, the use of current implementations is error-prone due to the complexity of BM. To facilitate researchers to conduct further experiments, we propose a toolset to configure and systematically evaluate BM performance. Finally we discuss several pitfalls that should be avoided in designing and deploying such networks.

  2019  9th IEEE Global Humanitarian Technology Conference (IEEE GHTC 2019) Conference

Bluemergency: Mediating Post-disaster Communication Systems using the Internet of Things and Bluetooth Mesh

Flor Álvarez Lars Almon Hauke Radtki Matthias Hollick

BibTeX

Abstract

Mobile devices have shown to be very useful during and post disaster. If the communication infrastructure breaks down, however, they become almost useless as most services rely on Internet connectivity. Building post-disaster networks based purely on smartphones remains a challenging task, and, as of today, no practical solutions exist. The rapidly growing Internet of Things (IoT) offers the possibility to improve this situation. With an increase in smart spaces such as smart homes and smart offices, we move towards digital cities that are deeply penetrated by IoT technology. Many IoT devices are battery powered and can aid in mediating an emergency network. In scenarios where the electrical grid is still operational, yet communication infrastructure failed, non-battery powered IoT devices can similarly help to relief congestion or build a backup network in case of cyber attacks. With the recent release of the Bluetooth Mesh standard, a common interface between mobile devices and the IoT has become available. The key idea behind this standard is to allow existing and new devices to build large-scale multi-hop sensor networks. By enabling hundreds of devices to communicate with each other, Bluetooth Mesh (BT MESH) becomes a practical technical solution for enabling communication post disaster. In this paper, we propose a novel emergency network concept that utilizes the parts of digital cities that remains operational in case of disaster, thus mediating large- scale post-disaster device-to-device communication. Since the Bluetooth Mesh standard is backwards compatible to Bluetooth 4.0, most of today’s mobile devices can join such a network. No special hardware or software modifications are necessary, especially no jail-breaking of the smartphones.

  2019  28th USENIX Security Symposium (USENIX Security ‘19) Conference

A Billion Open Interfaces for Eve and Mallory: MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

Milan Stute Sashank Narain Alex Mariotto Alexander Heinrich David Kreitschmann Guevara Noubir Matthias Hollick

PDF BibTeX

Abstract

Apple Wireless Direct Link (AWDL) is a key protocol in Apple’s ecosystem used by over one billion iOS and macOS devices for device-to-device communications. AWDL is a proprietary extension of the IEEE 802.11 (Wi-Fi) standard and integrates with Bluetooth Low Energy (BLE) for providing services such as Apple AirDrop. We conduct the first security and privacy analysis of AWDL and its integration with BLE. We uncover several security and privacy vulnerabilities ranging from design flaws to implementation bugs leading to a man-in-the-middle (MitM) attack enabling stealthy modification of files transmitted via AirDrop, denial-of-service (DoS) attacks preventing communication, privacy leaks that enable user identification and long-term tracking undermining MAC address randomization, and DoS attacks enabling targeted or simultaneous crashing of all neighboring devices. The flaws span across AirDrop’s BLE discovery mechanism, AWDL synchronization, UI design, and Wi-Fi driver implementation. Our analysis is based on a combination of reverse engineering of protocols and code supported by analyzing patents. We provide proof-of-concept implementations and demonstrate that the attacks can be mounted using a low-cost ($20) micro:bit device and an off-the-shelf Wi-Fi card. We propose practical and effective countermeasures. While Apple was able to issue a fix for a DoS attack vulnerability after our responsible disclosure, the other security and privacy vulnerabilities require the redesign of some of their services.

  2019  Security Standardisation Research Conference 2019 (ACM CCS Workshop) Conference

Toxic Friends in Your Network: Breaking the Bluetooth Mesh Friendship Concept

Flor Álvarez Lars Almon Ann-Sophie Hahn Matthias Hollick

BibTeX

Abstract

Bluetooth Low Energy is the dominant wireless technology empowering the Internet-of-Things. It has recently been amended with Bluetooth Mesh, which promises secure low energy multi-hop wireless connectivity with a software-only upgrade to existing Bluetooth devices. Bluetooth Mesh claims to be suitable for building large-scale multi-hop sensor networks with thousands of devices and up to 127 hops. In particular, it introduces the friendship concept, allowing low power Internet-of-Things devices to save energy by going into sleep mode, while their associated friend node caches their packets. In this paper, we show that the security model underlying the friendship concept introduces a number of simplifying assumptions that can be harnessed against the Bluetooth Mesh network. We demonstrate three fundamental vulnerabilities in the security model that lead to denial-of-service and impersonation attacks. Furthermore, we experimentally proof that our denial-of-service attack significantly affects the battery life of low power Internet-of-Things devices from a normal duration of two years to just few days. In addition, we introduce btlemesh, an open-source tool to analyze Bluetooth Mesh and perform the aforementioned security tests in practice. Finally, we discuss possible countermeasures to mitigate these vulnerabilities.

  2018  12th International Workshop on Wireless Network Testbeds, Experimental Evaluation & Characterization (WiNTECH ‘18) Conference

TPy: A Lightweight Framework for Agile Distributed Network Experiments

Daniel Steinmetzer Milan Stute Matthias Hollick

PDF BibTeX DOI: 10.1145/3267204.3267214

Abstract

Experimental validation of novel network solutions, protocols, and applications gains increasing importance. The complexity of today’s network systems makes evaluations in physical testbeds mandatory to capture real-world effects. However, this causes methodological and technical issues and challenges researchers in handling their agile testbed deployments. In contrast to Internet-scale testbeds, most agile experiments require specific topologies, specialized hardware, or a custom environment. They typically run only a few times and demand live user interaction. Existing management systems for Internet-scale testbeds do not accommodate these needs due to their complexity and maintenance overhead. In this paper, we present TPy, a lightweight and flexible framework to conduct distributed network experiments. TPy is written in Python and extendable via modules. To demonstrate its versatility and ease-of-use, we use TPy to perform experiments in the domains of millimeter-wave and secure multi-hop communications. We share TPy as open source software to support the community of experimental evaluation.

  2018  The 24th Annual International Conference on Mobile Computing and Networking (MobiCom ‘18) Conference

Demo: Linux Goes Apple Picking: Cross-Platform Ad hoc Communication with Apple Wireless Direct Link

Milan Stute David Kreitschmann Matthias Hollick

PDF BibTeX DOI: 10.1145/3241539.3267716

Abstract

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented wireless ad hoc protocol that Apple introduced around 2014 and which is the base for applications such as AirDrop and AirPlay. We have reverse engineered the protocol and explain its frame format and operation in our MobiCom ‘18 paper “One Billion Apples’ Secret Sauce: Recipe of the Apple Wireless Direct Link Ad hoc Protocol.” AWDL builds on the IEEE 802.11 standard and implements election, synchronization, and channel hopping mechanisms on top of it. Furthermore, AWDL features an IPv6-based data path which enables direct communication. To validate our own work, we implement a working prototype of AWDL on Linux-based systems. Our implementation is written in C, runs in userspace, and makes use of Linux’s Netlink API for interactions with the system’s networking stack and the pcap library for frame injection and reception. In our demonstrator, we show how our Linux system synchronizes to an existing AWDL cluster or takes over the master role itself. Furthermore, it can receive data frames from and send them to a MacBook or iPhone via AWDL. We demonstrate the data exchange via ICMPv6 echo request and replies as well as sending and receiving data over a TCP connection.

  2018  The 24th Annual International Conference on Mobile Computing and Networking (MobiCom ‘18) Conference

One Billion Apples’ Secret Sauce: Recipe for the Apple Wireless Direct Link Ad hoc Protocol

Milan Stute David Kreitschmann Matthias Hollick

PDF BibTeX DOI: 10.1145/3241539.3241566

Abstract

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented IEEE 802.11-based ad hoc protocol. Apple first introduced AWDL around 2014 and has since integrated it into its entire product line, including iPhone and Mac. While we have found that AWDL drives popular applications such as AirPlay and AirDrop on more than one billion end-user devices, neither the protocol itself nor potential security and Wi-Fi coexistence issues have been studied. In this paper, we present the operation of the protocol as the result of binary and runtime analysis. In short, each AWDL node announces a sequence of Availability Windows (AWs) indicating its readiness to communicate with other AWDL nodes. An elected master node synchronizes these sequences. Outside the AWs, nodes can tune their Wi-Fi radio to a different channel to communicate with an access point, or could turn it off to save energy. Based on our analysis, we conduct experiments to study the master election process, synchronization accuracy, channel hopping dynamics, and achievable throughput. We conduct a preliminary security assessment and publish an open source Wireshark dissector for AWDL to nourish future work.

  2018  CHANTS ‘18 - 13th Workshop on Challenged Networks Conference

Conducting a Large-scale Field Test of a Smartphone-based Communication Network for Emergency Response

Flor Álvarez Lars Almon Patrick Lieser Tobias Meuser Yannick Dylla Björn Richerzhagen Matthias Hollick Ralf Steinmetz

PDF BibTeX DOI: 10.1145/3264844.3264845

Abstract

Smartphone-based communication networks form a basis for services in emergency response scenarios, where communication infrastructure is impaired or overloaded. Still, their design and evaluation are largely based on simulations that rely on generic mobility models and weak assumptions regarding user behavior. For a realistic assessment, scenario-specific models are essential. To this end, we conducted a large-scale field test of a set of emergency services that relied solely on ad hoc communication. Over the course of one day, we gathered data from smartphones distributed to 125 participants in a scripted disaster event. In this paper, we present the scenario, measurement methodology, and a first analysis of the data. Our work provides the first trace combining user interaction, mobility, and additional sensor readings of a large-scale emergency response scenario, facilitating future research.

  2018  IEEE/ACM Transactions on Networking Article

An Online Context-Aware Machine Learning Algorithm for 5G mmWave Vehicular Communications

Gek Hong Sim Sabrina Klos Arash Asadi Anja Klein Matthias Hollick

BibTeX DOI: 10.1109/TNET.2018.2869244

  2018  MobiCom 2018 - 24th ACM Annual International Conference on Mobile Computing and Networking Conference

Adaptive Codebook Optimization for Beam-Training on Off-The-Shelf IEEE 802.11ad Devices

Joan Palacios Daniel Steinmetzer Adrian Loch Matthias Hollick Joerg Widmer

PDF BibTeX DOI: 10.1145/3241539.3241576

Abstract

Beamforming is vital to overcome the high attenuation in wireless millimeter-wave networks. It enables nodes to steer their antennas in the direction of communication. To cope with complexity and overhead, the IEEE 802.11ad standard uses a sector codebook with distinct steering directions. In current off-the-shelf devices, we find codebooks with generic pre-defined beam patterns. While this approach is simple and robust, the antenna modules that are typically deployed in such devices are capable of generating much more precise antenna beams. In this paper, we adaptively adjust the sector codebook of IEEE 802.11ad devices to optimize the transmit beam patterns for the current channel. To achieve this, we propose a mechanism to extract full channel state information (CSI) regarding phase and magnitude from coarse signal strength readings on off-the-shelf IEEE 802.11ad devices. Since such devices do not expose the CSI directly, we generate a codebook with phase-shifted probing beams that enables us to obtain the CSI by combining strategically selected magnitude measurements. Using this CSI, transmitters dynamically compute a transmit beam pattern that maximizes the signal strength at the receiver. Thereby, we automatically exploit reflectors in the environment and improve the received signal quality. Our implementation of this mechanism on off-the-shelf devices demonstrates that adaptive codebook optimization achieves a significantly higher throughput of about a factor of two in typical real-world scenarios.

  2018  Computer Communications Article

The Nexmon firmware analysis and modification framework: Empowering researchers to enhance Wi-Fi devices

Matthias Schulz Daniel Wegemer Matthias Hollick

PDF BibTeX DOI: 10.1016/j.comcom.2018.05.015

Abstract

The most widespread Wi-Fi enabled devices are smartphones. They are mobile, close to people and available in large quantities, which makes them perfect candidates for real-world wireless testbeds. Unfortunately, most smartphones contain closed-source FullMAC Wi-Fi chips that hinder the modification of lower-layer Wi-Fi mechanisms and the implementation of new algorithms. To enable researchers’ access to lower-layer frame processing and advanced physical-layer functionalities on Broadcom Wi-Fi chips, we developed the Nexmon firmware patching framework. It allows users to create firmware modifications for embedded ARM processors using C code and to change the behaviour of Broadcom’s real-time processor using Assembly. Currently, our framework supports nine Broadcom chips available in smartphones and Raspberry Pis. Our example patches enable monitor mode, frame injection, handling of ioctls, ucode compression, flashpatches, software-defined radio capabilities, channel state information extraction and access to debugging features. To enhance firmware analysis, we present a debugger application that directly accesses the debugging core of the ARM microcontroller executing the Wi-Fi firmware. Additionally, we discuss how Wi-Fi chips can be protected from malicious firmware while still allowing researchers to run custom code. Using Nexmon, researchers can unleash the full capabilities of off-the-shelf Wi-Fi devices.

  2018  6th IEEE Conference on Communications and Network Security (CNS 2018) Conference

ACE of Spades in the IoT Security Game: A Flexible IPsec Security Profile for Access Control

Santiago Aragon Marco Tiloca Max Maass Matthias Hollick Shahid Raza

PDF BibTeX DOI: 10.1109/CNS.2018.8433209

Abstract

The Authentication and Authorization for Constrained Environments (ACE) framework provides fine-grained access control in the Internet of Things, where devices are resource-constrained and with limited connectivity. The ACE framework defines separate profiles to specify how exactly entities interact and what security and communication protocols to use. This paper presents the novel ACE IPsec profile, which specifies how a client establishes a secure IPsec channel with a resource server, contextually using the ACE framework to enforce authorized access to remote resources. The profile makes it possible to establish IPsec Security Associations, either through their direct provisioning or through the standard IKEv2 protocol. We provide the first Open Source implementation of the ACE IPsec profile for the Contiki OS and test it on the resource-constrained Zolertia Firefly platform. Our experimental performance evaluation confirms that the IPsec profile and its operating modes are affordable and deployable also on constrained IoT platforms.

  2018  15th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON 2018) Conference

Fast and Infuriating: Performance and Pitfalls of 60 GHz WLANs Based on Consumer-Grade Hardware

Swetank Kumar Saha Hany Assasa Adrian Loch Naveen Muralidhar Prakash Roshan Shyamsunder Shivang Aggarwal Daniel Steinmetzer Dimitrios Koutsonikolas Joerg Widmer Matthias Hollick

PDF BibTeX DOI: 10.1109/SAHCN.2018.8397123

Abstract

Wireless networks operating in the 60 GHz band have the potential to provide very high throughput but face a number of challenges (e.g., high attenuation, beam training, and coping with mobility) which are widely accepted but often not well understood in practice. Understanding these challenges, and especially their actual impact on consumer-grade hardware is fundamental to fully exploit the high physical layer rates in the 60 GHz band. To this end, we perform an extensive measurement campaign using two commercial off-the-shelf 60 GHz routers in practical real-world environments. Our study is centered around two fundamental adaptation mechanisms in 60 GHz networks-beam training and rate control- whose interactions are key for performance. Understanding these interactions allows us to revisit a range of issues and provide much deeper insights into the reasons for specific performance compared to prior work on performance characterization. Further, our study goes beyond basic link characterization and explores for the first time practical considerations such as coverage and access point deployment. While some of our observations are expected, we also obtain highly surprising insights that challenge the prevailing wisdom in the community.

  2018  11th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

Beam-Stealing: Intercepting the Sector Sweep to Launch Man-in-the-Middle Attacks on Wireless IEEE 802.11ad Networks

Daniel Steinmetzer Yimin Yuan Matthias Hollick

PDF BibTeX DOI: 10.1145/3212480.3212499

Abstract

Millimeter-wave (mm-wave) communication systems provide high data-rates and enable emerging application scenarios, such as ‘information showers’ for location-based services. Devices are equipped with antenna arrays using dozens of elements to achieve high directionality and thus creating a signal beam that focuses only on a specific area-of-interest. This new communication paradigm of steerable links requires a rethinking of wireless networks and calls for efficient protocols to train the beam alignment among network nodes. The IEEE 802.1 lad standard defines the so-called sector sweep that sweeps through a predefined set of antenna-sectors to find the optimal antenna steerings. Such low-layer protocols lack proper security mechanisms and open unprecedented attack possibilities. Distant attackers might tamper with the beam-training and literally ‘steal’ the beam from other devices. In this work, we investigate the threat of such beam-stealing attacks that intercept the sector sweep. By injecting forged feedback, we force victims to steer their signals towards the attacker’s location. We implement a proof-of-concept on commercial off-the-shelf devices and evaluate the impacts on eavesdropping and acting as a Man-in-the-Middle (MITM). Our practical experiments in typical indoor scenarios reveal that beam-stealing increases the eavesdropping performance by 38% and allow a MITM to relay packets with an average error of only 1%. With these results, we emphasize the threat of beam-training attacks on mm-wave networks and aim to raise the awareness of attack vectors that are emerging with new low-layer amendments in next-generation wireless networks.

  2018  Proceedings of the 16th Annual International Conference on Mobile Systems, Applications, and Services Conference

Shadow Wi-Fi: Teaching Smartphones to Transmit Raw Signals and to Extract Channel State Information to Implement Practical Covert Channels over Wi-Fi

Matthias Schulz Jakob Link Francesco Gringoli Matthias Hollick

PDF BibTeX DOI: 10.1145/3210240.3210333

Abstract

Wi-Fi chips offer vast capabilities, which are not accessible through the manufacturers’ official firmwares. Unleashing those capabilities can enable innovative applications on off-the-shelf devices. In this work, we demonstrate how to transmit raw IQ samples from a large buffer on Wi-Fi chips. We further show how to extract channel state information (CSI) on a per frame basis. As a proof-of-concept application, we build a covert channel on top of Wi-Fi to stealthily exchange information between two devices by prefiltering Wi-Fi frames prior to transmission. On the receiver side, the CSI is used to extract the embedded information. By means of experimentation, we show that regular Wi-Fi clients can still demodulate the underlying Wi-Fi frames. Our results show that covert channels on the physical layer are practical and run on off-the-shelf smartphones. By making available our raw signal transmitter, the CSI extractor, and the covert channel application to the research community, we ensure reproducibility and offer a platform for further innovative applications on Wi-Fi devices.

  2018  2018 IEEE International Conference on Communications Workshops (ICC Workshops) Conference

Making Wi-Fi Fit for the Tactile Internet: Low-Latency Wi-Fi Flooding Using Concurrent Transmissions

Francesco Gringoli Robin Klose Matthias Hollick Nahla Ali

BibTeX DOI: 10.1109/ICCW.2018.8403487

Abstract

Real-time human-to-machine and machine-to-machine interactions at the edge of the Internet are the key drivers for research in high-speed and low-latency wireless communication. In order to meet the most stringent latency demands, such interactions should be carried out autonomously by groups of nodes at the edge, potentially resorting to specialized physical layer techniques. While past research has mostly focused on 5G cellular network technology, we assess the feasibility to utilize IEEE 802.11 (Wi-Fi) technology for this purpose. In contrast to existing work on macrodiversity schemes to enhance network capacities, we highlight the potential of macrodiversity to reduce the latency in one-to-many communication scenarios through concurrent network flooding. To this end, we study the practical feasibility of concurrent transmissions with IEEE 802.11, while taking the characteristics of both the DSSS PHY and the OFDM PHY of IEEE 802.11 into account. In particular, we quantify the impact of the limiting factors that impair the decodability of concurrent Wi-Fi transmissions and analyze their combined effects in simulations and practical SDR testbed experiments. In doing so, we also assess the capability of commodity hardware to decode concurrent Wi-Fi transmissions while deliberately introducing signal impairments by tuning the limiting factors. With this, we identify the key parameter limits to enable low-latency flooding at the edge with IEEE 802.11.

  2018  37th IEEE Conference on Computer Communications Conference

FML: Fast Machine Learning for 5G mmWave Vehicular Communications

Arash Asadi Gek Hong Sim Matthias Hollick Anja Klein Sabrina Müller

BibTeX DOI: 10.1109/INFOCOM.2018.8485876

  2018  IEEE INFOCOM 2018 - IEEE Conference on Computer Communications Conference

Optimal Joint Routing and Scheduling in Millimeter-Wave Cellular Networks

Dingwen Yuan Hsuan-Yin Lin Joerg Widmer Matthias Hollick

PDF BibTeX DOI: 10.1109/INFOCOM.2018.8485929

Abstract

Millimeter-wave (mmWave) communication is a promising technology to cope with the expected exponential increase in data traffic in 5G networks. mmWave networks typically require a very dense deployment of mmWave base stations (mmBS). To reduce cost and increase flexibility, wireless backhauling is needed to connect the mmBSs. The characteristics of mmWave communication, and specifically its high directionality, imply new requirements for efficient routing and scheduling paradigms. We propose an efficient scheduling method, so-called schedule-oriented optimization, based on matching theory that optimizes QoS metrics jointly with routing. It is capable of solving any scheduling problem that can be formulated as a linear program whose variables are link times and QoS metrics. As an example of the schedule-oriented optimization, we show the optimal solution of the maximum throughput fair scheduling (MTFS). Practically, the optimal scheduling can be obtained even for networks with over 200 mmBSs. To further increase the runtime performance, we propose an efficient edge-coloring based approximation algorithm with provable performance bound. It achieves over 80% of the optimal max-min throughput and runs 5 to 100 times faster than the optimal algorithm in practice. Finally, we extend the optimal and approximation algorithms for the cases of multi-RF-chain mmBSs and integrated backhaul and access networks.

  2018  PACM on Interactive, Mobile, Wearable and Ubiquitous Technologies (IMWUT) Conference

Anatomy of a Vulnerable Fitness Tracking System: Dissecting the Fitbit Cloud, App, and Firmware

Jiska Classen Daniel Wegemer Paul Patras Tom Spink Matthias Hollick

BibTeX

  2018   Tagung Software Engineering (SE) des Fachbereichs Softwaretechnik der Gesellschaft für Informatik Conference

A systematic approach to constructing families of incremental topology control algorithms using graph transformation

Roland Kluge Michael Stein Gergely Varró Andy Schürr Matthias Hollick Max Mühlhäuser

PDF BibTeX

Abstract

In this talk, we present results on integrating support for variability modeling into a correct-by-construction development methodology for topology control algorithms, as appeared online in the Software & Systems Modeling journal in 2017. A topology control algorithm reduces the size of the visible neighborhood of a node in a wireless communication network. At the same time, it must fulfill important consistency properties to ensure a high quality of service. In previous work, we proposed a constructive, model-driven methodology for designing individual topology control algorithms based on declarative graph constraints and graph transformation rules; the resulting algorithms are guaranteed to preserve the specified properties. Even though many topology control algorithms share substantial (structural) parts, few works leverage these commonalities at design time. In this work, we generalize our proposed construction methodology by modeling variability points to support the construction of families of algorithms. We show the applicability of our approach by reengineering six existing topology control algorithms and developing e-kTC, a novel energy-efficient variant of the topology control algorithm kTC. Finally, we evaluate a subset of the algorithms using a novel integration of a wireless network simulator and a graph transformation tool.

  2018  3rd NSF Millimeter-Wave RCN Workshop Conference

A Practical IEEE 802.11ad Research Platform: The Hidden Potential of Off -the-Shelf Devices

Daniel Steinmetzer Daniel Wegemer Matthias Hollick

BibTeX

  2018  24th Annual International Conference on Mobile Computing and Networking (ACM MobiCom 2018) Conference Postprint

One Billion Apples’ Secret Sauce: Recipe for the Apple Wireless Direct Link Ad hoc Protocol

Milan Stute David Kreitschmann Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013315

Abstract

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented IEEE 802.11-based ad hoc protocol. Apple first introduced AWDL around 2014 and has since integrated it into its entire product line, including iPhone and Mac. While we have found that AWDL drives popular applications such as AirPlay and AirDrop on more than one billion end-user devices, neither the protocol itself nor potential security and Wi-Fi coexistence issues have been studied. In this paper, we present the operation of the protocol as the result of binary and runtime analysis. In short, each AWDL node announces a sequence of Availability Windows (AWs) indicating its readiness to communicate with other AWDL nodes. An elected master node synchronizes these sequences. Outside the AWs, nodes can tune their Wi-Fi radio to a different channel to communicate with an access point, or could turn it off to save energy. Based on our analysis, we conduct experiments to study the master election process, synchronization accuracy, channel hopping dynamics, and achievable throughput. We conduct a preliminary security assessment and publish an open source Wireshark dissector for AWDL to nourish future work.

  2018  2018 ACM International Workshop on Wireless Network Testbeds, Experimental evaluation & Characterization (WiNTECH’18) Conference Postprint

TPy: A Lightweight Framework for Agile Distributed Network Experiments

Daniel Steinmetzer Milan Stute Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013317

Abstract

Experimental validation of novel network solutions, protocols, and applications gains increasing importance. The complexity of today’s network systems makes evaluations in physical testbeds mandatory to capture real-world effects. However, this causes methodological and technical issues and challenges researchers in handling their agile testbed deployments. In contrast to Internet-scale testbeds, most agile experiments require specific topologies, specialized hardware, or a custom environment. They typically run only a few times and demand live user interaction. Existing management systems for Internet-scale testbeds do not accommodate these needs due to their complexity and maintenance overhead. In this paper, we present TPy, a lightweight and flexible framework to conduct distributed network experiments. TPy is written in Python and extendable via modules. To demonstrate its versatility and ease-of-use, we use TPy to perform experiments in the domains of millimeter-wave and secure multi-hop communications. We share TPy as open source software to support the community of experimental evaluation.

  2018  24th Annual International Conference on Mobile Computing and Networking (ACM MobiCom 2018) Conference Postprint

Demo: Linux Goes Apple Picking: Cross-Platform Ad hoc Communication with Apple Wireless Direct Link

Milan Stute David Kreitschmann Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013316

Abstract

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented wireless ad hoc protocol that Apple introduced around 2014 and which is the base for applications such as AirDrop and AirPlay. We have reverse engineered the protocol and explain its frame format and operation in our MobiCom ‘18 paper “One Billion Apples’ Secret Sauce: Recipe of the Apple Wireless Direct Link Ad hoc Protocol.” AWDL builds on the IEEE 802.11 standard and implements election, synchronization, and channel hopping mechanisms on top of it. Furthermore, AWDL features an IPv6-based data path which enables direct communication. To validate our own work, we implement a working prototype of AWDL on Linux-based systems. Our implementation is written in C, runs in userspace, and makes use of Linux’s Netlink API for interactions with the system’s networking stack and the pcap library for frame injection and reception. In our demonstrator, we show how our Linux system synchronizes to an existing AWDL cluster or takes over the master role itself. Furthermore, it can receive data frames from and send them to a MacBook or iPhone via AWDL. We demonstrate the data exchange via ICMPv6 echo request and replies as well as sending and receiving data over a TCP connection.

  2017  2017 IEEE Global Humanitarian Technology Conference Conference Postprint

Emergency Communication in Challenged Environments via Unmanned Ground and Aerial Vehicles

Lars Baumgärtner Stefan Kohlbrecher Juliane Euler Tobias Ritter Milan Stute Christian Meurisch Max Mühlhäuser Matthias Hollick Oskar von Stryk Bernd Freisleben

PDF BibTeX DOI: 10.25534/tuprints-00013328

Abstract

Unmanned ground vehicles (UGVs) and unmanned aerial vehicles (UAVs) are promising assets to support rescue operations in natural or man-made disasters. Most UGVs and UAVs deployed in the field today depend on human operators and reliable network connections to the vehicles. However, network connections in challenged environments are often lost, thus control can no longer be exercised. In this paper, we present a novel approach to emergency communication where semi-autonomous UGVs and UAVs cooperate with humans to dynamically form communication islands and establish communication bridges between these islands. Humans typically form an island with their mobile devices if they are in physical proximity; UGVs and UAVs extend an island’s range by carrying data to a neighboring island. The proposed approach uses delay/disruption-tolerant networking for non-time critical tasks and direct mesh connections for prioritized tasks that require real-time feedback. The developed communication platform runs on rescue robots, commodity mobile devices, and various drones, and supports our operations and control center software for disaster management.

  2017  CoNEXT ’17: The 13th International Conference on emerging Networking EXperiments and Technologies Conference

Compressive Millimeter-Wave Sector Selection in Off-the-Shelf IEEE 802.11ad Devices

Daniel Steinmetzer Daniel Wegemer Matthias Schulz Jörg Widmer Matthias Hollick

BibTeX DOI: 10.1145/3143361.3143384

Abstract

Achieving data-rates of multiple Gbps in 60 GHz mm-wave communication systems requires efficient beam-steering algorithms. To find the optimal steering direction on IEEE 802.11ad compatible devices, state-of-the-art approaches sweep through all predefined antenna sectors. Recently, much more efficient alternatives, such as compressive path tracking, have been proposed, which scale well even with arrays with thousands of antenna elements. However, such have not yet been integrated into consumer devices. In this work, we adapt compressive path tracking for sector selection in off-the-shelf IEEE 802.11ad devices. In contrast to existing solutions, our compressive sector selection tolerates the imperfections of low-cost hardware, tracks beam directions in 3D and does not rely on pseudo-random beams. We implement our protocol on a commodity router, the TP-Link Talon AD7200, by modifying the sector sweep algorithm in the IEEE 802.11ad chip’s firmware. In particular, we modify the firmware to obtain the signal strength of received frames and to select custom sectors. Using this extension, we precisely measure the device’s sector patterns. We then select the best sector based on the measured patterns and sweep only through a subset of probing sectors. Our results demonstrate, that our protocol outperforms the existing sector sweep, increases stability, and speeds up the sector selection by factor 2.3.

  2017  20th ACM International Conference on Modeling, Analysis and Simulation of Wireless and Mobile Systems Conference

Reverse Engineering Human Mobility in Large-scale Natural Disasters

Milan Stute Max Maass Tom Schons Matthias Hollick

PDF BibTeX DOI: 10.1145/3127540.3127542

Abstract

Delay/Disruption-Tolerant Networks (DTNs) have been around for more than a decade and have especially been proposed to be used in scenarios where communication infrastructure is unavailable. In such scenarios, DTNs can offer a best-effort communication service by exploiting user mobility. Natural disasters are an important application scenario for DTNs when the cellular network is destroyed by natural forces. To assess the performance of such networks before deployment, we require appropriate knowledge of human mobility. In this paper, we address this problem by designing, implementing, and evaluating a novel mobility model for large-scale natural disasters. Due to the lack of GPS traces, we reverse-engineer human mobility of past natural disasters (focusing on 2010 Haiti earthquake and 2013 Typhoon Haiyan) by leveraging knowledge of 126 experts from 71 Disaster Response Organizations (DROs). By means of simulation-based experiments, we compare and contrast our mobility model to other well-known models, and evaluate their impact on DTN performance. Finally, we make our source code available to the public.

  2017  42nd Annual IEEE Conference on Local Computer Networks (LCN 2017) Conference

Unsupervised Traffic Flow Classification Using a Neural Autoencoder

Jonas Höchst Matthias Hollick Bernd Freisleben Lars Baumgärtner

BibTeX

Abstract

The delay and bandwidth requirements of today’s mobile applications differ widely depending on the functionality provided and the data transferred, such as uploading user generated multimedia content, playing online games, or streaming live videos. To perform resource management, mobile wireless networks can particularly profit from classifying and predicting mobile application traffic. State-of-the-art traffic classification approaches have various disadvantages: port-based classification methods can be circumvented by choosing non-standard ports, protocol fingerprinting can be confused by the use of encryption, and current supervised learning methods for analyzing the statistical properties of network flows try to detect predefined classes, such as e-mail or FTP traffic, learned during training. In this paper, we present a novel approach to unsupervised traffic flow classification using statistical properties of flows and clustering based on a neural autoencoder. In contrast to previous work, the neural autoencoder is used to automatically cluster traffic flows, for example, into downloads, uploads, or voice calls, independent of the particular network protocols, such as FTP or HTTP(S), used for performing these tasks. A novel time interval based feature vector construction and a semi-automatic cluster labeling method facilitate traffic flow classification independent of known traffic classes or classification constraints. An experimental evaluation of the proposed approach on real data captured from about 25 mobile devices performing daily work over a period of 4 months is presented. The obtained results show that 7 different classes of mobile traffic flows are detected with an average precision of 80% and an average recall of 75%, indicating the feasibility of our approach.

  2017  IEEE Conference on Local Computer Networks (LCN) Conference

SEDCOS: A Secure Device-to-Device Communication System for Disaster Scenarios

Florian Kohnhäuser Milan Stute Lars Baumgärtner Lars Almon Stefan Katzenbeisser Matthias Hollick Bernd Freisleben

BibTeX

  2017  11th Workshop on Wireless Network Testbeds, Experimental Evaluation & CHaracterization Conference

Nexmon: Build Your Own Wi-Fi Testbeds With Low-Level MAC and PHY-Access Using Firmware Patches on Off-the-Shelf Mobile Devices

Matthias Schulz Daniel Wegemer Matthias Hollick

PDF BibTeX

Abstract

The most widespread Wi-Fi enabled devices are smartphones. They are mobile, close to people and available in large quantities, which makes them perfect candidates for real-world wireless testbeds. Unfortunately, most smartphones contain closed-source FullMAC Wi-Fi chips that hinder the modification of lower-layer Wi-Fi mechanisms and the implementation of new algorithms. To enable researchers’ access to lower-layer frame processing and advanced physical-layer functionalities on Broadcom Wi-Fi chips, we developed the Nexmon firmware patching framework. It allows users to create firmware modifications for embedded ARM processors using C code and to change the behavior of Broadcom’s real-time processor using Assembly. Currently, our framework supports five Broadcom chips available in smartphones and Raspberry Pis. Our example patches enable monitor mode, frame injection, handling of ioctls, ucode compression and flashpatches. In a simple ping offloading example, we demonstrate how handling pings in firmware reduces power consumption by up to 165 mW and is nine times faster than in the kernel on a Nexus 5. Using Nexmon, researchers can unleash the full capabilities of off-the-shelf Wi-Fi devices.

  2017  IEEE Global Humanitarian Technology Conference (GHTC) Conference

A Practical and Secure Social Media Facility for Internet-Deprived Populations

Jeremy Lakeman Matthew Lloyd Romana Challans Angus Wallace Paul Gardner-Stephen Milan Stute Matthias Hollick

BibTeX

  2017  1st ACM Workshop on Millimeter Wave Networks and Sensing Systems (mmNets 2017) Conference

Mitigating Lateral Interference: Adaptive Beam Switching for Robust Millimeter-Wave Networks

Daniel Steinmetzer Adrian Loch Amanda García-García Jörg Widmer Matthias Hollick

BibTeX DOI: 10.1145/3130242.3130244

Abstract

Putting into practice ‘pseudo-wire’ links in wireless millimeter-wave (mm-wave) networks is challenging due to the significant side lobes of consumer-grade phased antenna arrays. Nodes should steer their beams such that they maximize the signal gain but also minimize interference from lateral directions via both their main lobe and their side lobes. Most importantly, interference can be caused by parallel operation of incompatible standards such as WiGig and IEEE 802.11ad and may change very fast. This timing requirement, prevents the use of existing beam switching solutions to mitigate interference. In this paper, we present an adaptive beam switching (ABS) mechanism that can deal with the above timescale issue in rapidly changing interference scenarios. Instead of performing a full beam sweep, the key idea is to only probe beampatterns at the receiver which are likely to avoid interference. In contrast to earlier work, our mechanism does not require any location information nor a detailed shape of the beampatterns. We exploit similarities among side lobes of beampatterns to estimate the performance of all beampatterns without sending extensive probes. To evaluate our mechanism in practice, we develop a customized research platform that allows us to control the beam-selection on low-cost IEEE 802.11ad routers. Experimental results with WiGig transceivers as interference source show that our adaptive beam switching mechanism achieves an average throughput gain of 60% and decreases the training time by 82.4% compared to the original IEEE 802.11ad behavior.

  2017  IEEE Communications Surveys & Tutorials Article

Survey and Systematization of Secure Device Pairing

Mikhail Fomichev Flor Álvarez Daniel Steinmetzer Paul Gardner-Stephen Matthias Hollick

BibTeX DOI: 10.1109/COMST.2017.2748278

Abstract

Secure Device Pairing (SDP) schemes have been developed to facilitate secure communications among smart devices, both personal mobile devices and Internet of Things (IoT) devices. Comparison and assessment of SDP schemes is troublesome, because each scheme makes different assumptions about out-of-band channels and adversary models, and are driven by their particular use-cases. A conceptual model that facilitates meaningful comparison among SDP schemes is missing. We provide such a model. In this article, we survey and analyze a wide range of SDP schemes that are described in the literature, including a number that have been adopted as standards. A system model and consistent terminology for SDP schemes are built on the foundation of this survey, which are then used to classify existing SDP schemes into a taxonomy that, for the first time, enables their meaningful comparison and analysis. The existing SDP schemes are analyzed using this model, revealing common systemic security weaknesses among the surveyed SDP schemes that should become priority areas for future SDP research, such as improving the integration of privacy requirements into the design of SDP schemes. Our results allow SDP scheme designers to create schemes that are more easily comparable with one another, and to assist the prevention of persisting the weaknesses common to the current generation of SDP schemes.

  2017  Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2017) Conference

DEMO: Demonstrating Reactive Smartphone-Based Jamming

Matthias Schulz Matthias Hollick Francesco Gringoli Efstathios Deligeorgopoulos

BibTeX DOI: 10.1145/3098243.3106022

Abstract

Reactive Wi-Fi jammers on off-the-shelf hardware that may facilitate mobile friendly jamming applications have only been shown recently. Until now, no demonstrators existed to reproduce the results obtained with these systems, hence, inhibiting re-use for further research or educational applications. In this work, we present an Android app that allows to create advanced jamming scenarios with four Nexus 5 smartphones. We use two of them to inject Wi-Fi frames with UDP payload, one to receive frames and analyze if they were corrupted and one that acts as a reactive jammer that selectively jams according to a UDP port. The user can choose between a simple reactive jammer and an acknowledging jammer. All jammers are implemented as Wi-Fi firmware patches by using the Nexmon framework. During the demonstration, users may adjust parameters of transmitted frames and observe the throughputs of correct and corrupted frames as bar graphs at the receiver. At the jamming node, users may design an arbitrary jamming signal in the frequency domain and adjust the jamming power, the target UDP port and the jammer type. The MAC addresses used during the experiments are hard coded to hinder users from simply abusing the app in other setups. Overall, the demonstration proofs that highly sophisticated Wi-Fi jammers can run on smartphones.

  2017  10th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2017) Conference

Massive reactive smartphone-based jamming using arbitrary waveforms and adaptive power control

Matthias Schulz Francesco Gringoli Michael Koch Daniel Steinmetzer Matthias Hollick

PDF BibTeX DOI: 10.1145/3098243.3098253

Abstract

It is not commonly known that off-the-shelf smartphones can be converted into versatile jammers. To understand how those jammers work and how well they perform, we implemented a jamming firmware for the Nexus 5 smartphone. The firmware runs on the real-time processor of the Wi-Fi chip and allows to reactively jam Wi-Fi networks in the 2.4 and 5 GHz bands using arbitrary waveforms stored in IQ sample buffers. This allows us to generate a pilot-tone jammer on off-the-shelf hardware. Besides a simple reactive jammer, we implemented a new acknowledging jammer that selectively jams only targeted data streams of a node while keeping other data streams of the same node flowing. To lower the increased power consumption of this jammer, we implemented an adaptive power control algorithm. We evaluated our implementations in friendly jamming scenarios to oppress non-compliant Wi-Fi transmissions and to protect otherwise vulnerable devices in industrial setups. Our results show that we can selectively hinder Wi-Fi transmissions in the vicinity of our jamming smartphone leading to an increased throughput for other nodes or no blockage of non-targeted streams on a jammed node. Consuming less than 300 mW when operating the reactive jammer allows mobile operation for more than 29 hours. Our implementation demonstrates that jamming communications was never that simple and available for every smartphone owner, while still allowing surgical jamming precision and energy efficiency. Nevertheless, it involves the danger of abuse by malicious attackers that may take over hundreds of devices to massively jam Wi-Fi networks in wide areas.

  2017  9th International Conference on Communication Systems and Networks (COMSNETS) Conference

mm-Wave on Wheels: Practical 60 GHz Vehicular Communication Without Beam Training

Adrian Loch Arash Asadi Gek Hong Sim Jörg Widmer Matthias Hollick

BibTeX DOI: 10.1109/COMSNETS.2017.7945351

  2017  Pervasive and Mobile Computing Article

Instrumenting Wireless Sensor Networks : A Survey on the Metrics That Matter

Dingwen Yuan Salil S. Kanhere Matthias Hollick

PDF BibTeX DOI: 10.1016/j.pmcj.2016.10.001

Abstract

Wireless Sensor Networks (WSN) are part of the technical fundament enabling the Internet of Things (IoT), where sensing and actuator nodes instantaneously interact with the environment at large. As such they become part of everyday life and drive applications as diverse as medical monitoring, smart homes, smart environment, and smart factories, to name but a few. To acquire data, individual sensors interact with the physical environment by sensing physical phenomena in proximity. The wireless network connectivity is leveraged to collect the raw data or pre-processed events, and to disseminate code, queries or commands. Actuating capabilities facilitate instant interactions with the environment or application processes. Experience on how to operate large scale heterogeneous WSNs in (critical) real-world applications is still scarce, and operational considerations are often an afterthought to WSN deployment. A principled look into the metrics, i.e., a standard or best practice of measurement of the vital parameters in WSNs is still missing. In this article, we contribute a survey on the most important metrics to characterize the performance of WSNs. We define an abstract system model for WSNs, take a look on what the WSN community considers metrics that matter, and categorize the metrics into scopes of relevance. We discuss the properties of the metrics as well as practical aspects on how to obtain and process them. Our survey can serve as a manual for implementors and operators of WSNs in the IoT.

  2017  16th International IFIP TC6 Networking Conference Conference

SEMUD: Secure Multi-hop Device-to-Device Communication for 5G Public Safety Networks

Milan Schmittner Arash Asadi Matthias Hollick

BibTeX DOI: 10.23919/IFIPNetworking.2017.8264846

  2017  IEEE WCNC Conference

Pseudo Lateration: Millimeter-Wave Localization Using a Single RF Chain

Joe Chen Daniel Steinmetzer Jiska Classen Edward Knightly Matthias Hollick

BibTeX

  2017  IFIP Networking Conference Postprint

SEMUD: Secure multi-hop device-to-device communication for 5G public safety networks

Milan Schmittner Arash Asadi Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013324

Abstract

Multi-hop Device-to-Device (D2D) communication has emerged as a key enabler for public safety applications in 5G networks. A failure of these applications would be catastrophic since they control vital human-in-the-loop services. As a result, it is of utmost importance to identify and mitigate security risks prior to commercial deployment. To this end, we devise SEMUD, the first secure multi-hop D2D solution for 5G mobile networks. It enables robust and secure communication even in the absence of supporting infrastructure. We design SEMUD to be compliant with 3GPP Proximity-based Services, the standard to implement D2D communications. We implement SEMUD in the ns-3 simulator and our testbed. Via extensive simulation, we assert its resilience against strong adversaries and attacks. Furthermore, we show the energy efficiency and achievable throughput of our proposal on real devices.

  2017  2017 IEEE 42nd Conference on Local Computer Networks (LCN) Conference

Lightweight Detection of Denial-of-Service Attacks on Wireless Sensor Networks Revisited

Michael Riecker Lars Almon Matthias Hollick

PDF BibTeX DOI: 10.1109/LCN.2017.110

Abstract

The resource-constrained nature of sensor nodes makes wireless sensor networks (WSNs) especially susceptible to denial-of-service (DoS) attacks. Due to the wireless communication medium, it is difficult to prevent attacks such as jamming. Hence, mechanisms to detect attacks during operation are required. The current generation of intrusion detection systems are still rather heavyweight, as some form of collaboration is typically needed. In this paper, we study the behavior of a large number of node-centric metrics under jamming and blackhole attacks, by applying a logistic regression. In our experiments, we vary several parameters, such as traffic intensity, transmission power, and attacker location. We consider the most common topologies in wireless sensor networks such as central data collection and meshed multi-hop networks by using the collection tree and the mesh protocol. The created regression models are then used to implement a fully localized intrusion detection system requiring no collaboration, showing that certain models can be generalized to different networks.

  2017  9th International Conference on Communication Systems & Networks Conference

mm-Broker: Managing Directionality and Mobility Issues of Millimeter-Wave via D2D Communication

Gek Hong Sim Arash Asadi Adrian Loch Matthias Hollick Jörg Widmer

BibTeX

  2017  IEEE International Workshop on Practical Issues in Building Sensor Network Applications Conference Postprint

SEDCOS: A Secure Device-to-Device Communication System for Disaster Scenarios

Florian Kohnhäuser Milan Stute Lars Baumgärtner Lars Almon Stefan Katzenbeisser Matthias Hollick Bernd Freisleben

PDF BibTeX DOI: 10.25534/tuprints-00013329

Abstract

During disasters, existing telecommunication infrastructures are often congested or even destroyed. In these situations, mobile devices can be interconnected using wireless ad hoc and disruption-tolerant networking to establish a backup emergency communication system for civilians and emergency services. However, such communication systems entail serious security risks, since adversaries may attempt to steal confidential data, fake notifications of emergency services, or perform denial-of-service (DoS) attacks. In this paper, we present SEDCOS, a secure device-to-device communication system for disaster scenarios. SEDCOS allows new users to join the network during disasters, mitigates flooding DoS attacks, and offers role revocation for detected adversaries to withdraw their permissions and exclude them from group communication. SEDCOS mitigates flooding DoS attacks and offers role revocation for detected adversaries to withdraw their permissions and exclude them from group communication. SEDCOS mitigates flooding DoS attacks and offers role revocation for detected adversaries to withdraw their permissions. We demonstrate the effectiveness of SEDCOS by large-scale network simulations.

  2017  2017 IEEE Symposium on Computers and Communications (ISCC) Conference

Dynamic Role Assignment in Software-Defined Wireless Networks

Pablo Graubner Markus Sommer Matthias Hollick Bernd Freisleben

PDF BibTeX DOI: 10.1109/ISCC.2017.8024619

Abstract

Software-defined networking paradigms have found their way into wireless edge networks, allowing network slicing, mobility management, and resource allocation. This paper presents dynamic role assignment as a novel approach to software-defined network topology management for wireless edge devices, such as laptops, tablets and smartphones. It combines the centralized control of wireless Network Interface Controller (NIC) modes with Network Function Virtualization (NFV) to integrate network topology transitions as well as network service and application service placement within a single mechanism. Our proposal is evaluated with respect to latency, bandwidth, and power consumption of the edge nodes. The experimental results show significant differences in both bandwidth (up to 18%) and power consumption (up to 15%) for playing different roles, and when using (a) a web proxy and (b) an intrusion prevention system as examples of application services.

  2016  41st Conference on Local Computer Networks (IEEE LCN, Demo Track) Conference

Panopticon: Supervising Network Testbed Resources

M. Werner D. Kratschmann Matthias Hollick

BibTeX

  2016  Proceedings 6th IEEE Global Humanitarian Technology Conference (GHTC) Conference

Maintaining both availability and integrity of communications: Challenges and guidelines for data security and privacy during disasters and crises

Flor Álvarez Paul Gardner-Stephen Matthias Hollick

PDF BibTeX DOI: 10.1109/GHTC.2016.7857261

Abstract

Communications play a vital role in the response to disasters and crises. However, existing communications infrastructure is often impaired, destroyed or overwhelmed during such events. This leads to the use of substitute communications solutions including analog two-way radio or unsecured internet access. Often provided by unknown third parties, these solutions may have less sophisticated security characteristics than is desirable. While substitute communications are often invaluable, care is required to minimize the risk to NGOs and individuals stemming from the use of communications channels with reduced or unknown security properties. This is particularly true if private information is involved, including the location and disposition of individuals and first responders. In this work we enumerate the principal risks and challenges that may arise, and provide practical guidelines for mitigating them during crises. We take plausible threats from contemporary disaster and crisis events into account and discuss the security and privacy features of state-of-the-art communications mechanisms.

  2016  6th Workshop on Security and Privacy in Smartphones and Mobile Devices Conference

Analyzing TETRA Location Privacy and Network Availability

Martin Pfeiffer Jan-Pascal Kwiotek Jiska Classen Robin Klose Matthias Hollick

PDF BibTeX DOI: 10.1145/2994459.2994463

Abstract

TETRA is a digital communication standard taking over from analog communication in various emergency services and governmental agencies in Europe since the late 1990s. TETRA has to meet stringent requirements for a dependable communication infrastructure as it is used in the public safety sector by professional users and first responders. In fact, TETRA is claimed to enhance resilience, security, and availability compared to former analog communication standards. In this paper, we demonstrate that TETRA’s location privacy and dependability can easily be undermined and weakened. In particular, TETRA devices can be localized by means of antenna arrays and direction finding techniques on the physical layer. Further, we practically evaluate the impact of various jamming and fuzzing attacks on two commonly used devices. The digital standard even raises new attack vectors, since regular beaconing enables localization of idle devices, and forged frames can provably crash devices.

  2016  3rd ACM Workshop on Visible Light Communication Systems Article

Opportunities and Pitfalls in Securing Visible Light Communication on the Physical Layer

Jiska Classen Daniel Steinmetzer Matthias Hollick

BibTeX

  2016  Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec 2016) Conference

DEMO: Using NexMon, the C-based WiFi firmware modification framework

Matthias Schulz Daniel Wegemer Matthias Hollick

BibTeX DOI: 10.1145/2939918.2942419

Abstract

FullMAC WiFi chips have the potential to realize modifications to WiFi implementations that exceed the limits of current standards or to realize the implementation of new standards, such as 802.11p, on off-the-shelve hardware. As a developer, one, however, needs access to the firmware source code to implement these modifications. In general, WiFi firmwares are closed source and do not allow any modifications. With our C-based programming framework, NexMon, we allow the extension of existing firmware of Broadcom’s FullMAC WiFi chips. In this work, we demonstrate how to get started by running existing example projects and by creating a new project to transmit arbitrary frames with a Nexus 5 smartphone.

  2016  Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec 2016) Conference

DEMO: Demonstrating Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Matthias Schulz Adrian Loch Matthias Hollick

BibTeX DOI: 10.1145/2939918.2942418

Abstract

After being widely studied in theory, physical layer security schemes are getting closer to enter the consumer market. Still, a thorough practical analysis of their resilience against attacks is missing. In this work, we use software-defined radios to implement such a physical layer security scheme, namely, orthogonal blinding. To this end, we use orthogonal frequency-division multiplexing (OFDM) as a physical layer, similarly to WiFi. In orthogonal blinding, a multi-antenna transmitter overlays the data it transmits with noise in such a way that every node except the intended receiver is disturbed by the noise. Still, our known-plaintext attack can extract the data signal at an eavesdropper by means of an adaptive filter trained using a few known data symbols. Our demonstrator illustrates the iterative training process at the symbol level, thus showing the practicability of the attack.

  2016  ACM Conference on Security and Privacy in Wireless and Mobile Networks 2016 (ACM WiSec’16) Conference

Far Away and Yet Nearby - A Framework for Practical Distance Fraud on Proximity Services for Mobile Devices (Demo)

Tobias Schultes Markus Grau Daniel Steinmetzer Matthias Hollick

BibTeX

  2016  Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec 2016) Conference

Trust The Wire, They Always Told Me!: On Practical Non-Destructive Wire-Tap Attacks Against Ethernet

Matthias Schulz Patrick Klapper Matthias Hollick Erik Tews

BibTeX DOI: 10.1145/2939918.2940650

Abstract

Ethernet technology dominates enterprise and home network installations and is present in datacenters as well as parts of the backbone of the Internet. Due to its wireline nature, Ethernet networks are often assumed to intrinsically protect the exchanged data against attacks carried out by eavesdroppers and malicious attackers that do not have physical access to network devices, patch panels and network outlets. In this work, we practically evaluate the possibility of wireless attacks against wired Ethernet installations with respect to resistance against eavesdropping by using off-the-shelf software-defined radio platforms. Our results clearly indicate that twisted-pair network cables radiate enough electromagnetic waves to reconstruct transmitted frames with negligible bit error rates, even when the cables are not damaged at all. Since this allows an attacker to stay undetected, it urges the need for link layer encryption or physical layer security to protect confidentiality.

  2016  IEEE Transactions on Information Forensics and Security Article

On the Privacy and Performance of Mobile Anonymous Microblogging

Marius Senftleben Ana Barroso Mihai Bucicoiu Matthias Hollick Stefan Katzenbeisser Erik Tews

BibTeX DOI: 10.1109/TIFS.2016.2541633

Abstract

Microblogging is a popular form of online social networking activity. It allows users to send messages in a one-to-many publish-subscribe manner. Most current service providers are centralized and deploy a client-server model with unencrypted message content. As a consequence, all user behavior can, by default, be monitored, and censoring based on message content can easily be enforced on the server side. A distributed, peer-to-peer microblogging system consisting of mobile smartphone-equipped users that exchange group encrypted messages in an anonymous and censorship-resistant manner can alleviate privacy and censorship issues. We experimentally evaluate message spread of such systems with simulations that run on a range of synthetic and real-world mobility inputs, thus extending the previous work. We show that such systems are feasible for a range of mobility and network settings, both under normal and under adversarial conditions, e.g., under the presence of nodes which jam the network or send spam.

  2016  Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec 2016) Conference

Profiling the Strength of Physical-Layer Security: A Study in Orthogonal Blinding

Yao Zheng Matthias Schulz Wenjing Lou Thomas Hou Matthias Hollick

BibTeX DOI: 10.1145/2939918.2939933

Abstract

Physical layer security for wireless communication is broadly considered as a promising approach to protect data confidentiality against eavesdroppers. However, despite its ample theoretical foundation, the transition to practical implementations of physical-layer security still lacks success. A close inspection of proven vulnerable physical-layer security designs reveals that the flaws are usually overlooked when the scheme is only evaluated against an inferior, single-antenna eavesdropper. Meanwhile, the attacks exposing vulnerabilities often lack theoretical justification. To reduce the gap between theory and practice, we posit that a physical-layer security scheme must be studied under multiple adversarial models to fully grasp its security strength. In this regard, we evaluate a specific physical-layer security scheme, i.e. orthogonal blinding, under multiple eavesdropper settings. We further propose a practical "ciphertext-only attack" that allows eavesdroppers to recover the original message by exploiting the low entropy fields in wireless packets. By means of simulation, we are able to reduce the symbol error rate at an eavesdropper below 1% using only the eavesdropper’s receiving data and a general knowledge about the format of the wireless packets.

  2016  IEEE Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) Conference

Xcastor: Secure and Scalable Group Communication in Ad Hoc Networks

Milan Schmittner Matthias Hollick

BibTeX

Abstract

Mobile ad hoc networks (MANETs) are emerging as a practical technology for emergency response communication in the case a centralized infrastructure malfunctions or is not available. Using smartphones as communication devices, MANETs may be readily established among the civilian population of affected areas. Beneficiaries would be civilian first responders, which may form small collaborating groups. Communication in such groups must be reliable for disaster response to be effective. In this paper, we address the issue of reliable group communication on the network layer. We design and implement the first secure explicit multicast routing protocol called Xcastor, in which we extend the secure and scalable routing concept of the Castor unicast routing protocol towards supporting reliable communication for large numbers of small groups. By simulation, we show significant performance improvements over Castor.

  2016  IFIP Networking Conference (IFIP Networking) Conference

STEAN: A Storage and Transformation Engine for Advanced Networking Context

Marc Werner Johannes Schwandke Matthias Hollick Oliver Hohlfeld Torsten Zimmermann Klaus Wehrle

BibTeX DOI: 10.1109/IFIPNetworking.2016.7497203

Abstract

Legacy Internet systems and protocols are mostly static and keep state information in silo-style storage, thus making state migration, transformation and re-use difficult. Software Defined Networking (SDN) approaches in unison with Network Functions Virtualization (NFV) allow for more flexibility, yet they are currently restricted to a limited set of state migration options. Impeding the sharing of networking and system state severely limits the ability to optimally manage resources and dynamically adapt to a desirable overall configuration. We propose a generalized way to collect, store, transform, and share context between NFs in both the legacy Internet and NFV/SDN-driven systems. To this end, we design and implement a Storage and Transformation Engine for Advanced Networking Context (STEAN), which constitutes a shared context storage, making network state information available to other systems and protocols. Its pivotal feature is the ability to allow for state transformation as well as for persisting state to enable future re-use. By means of experimentation, we show that STEAN covers a diverse set of challenging use cases in legacy systems as well as in NFV/SDN-enabled systems.

  2016  Millimeter-wave Networking Workshop (mmNet 2016) Article

mmTrace: Modeling Millimeter-wave Indoor Propagation with Image-based Ray-tracing

Daniel Steinmetzer Jiska Classen Matthias Hollick

BibTeX

  2016  IEEE Infocom 2016 Poster Presentation (Infocom’16 Posters) Conference

Exploring Millimeter-Wave Network Scenarios with Ray-tracing based Simulations in mmTrace

Daniel Steinmetzer Jiska Classen Matthias Hollick

BibTeX

  2016  2016 IEEE 17th International Symposium on A World of Wireless, Mobile and Multimedia Networks (WoWMoM) Conference Postprint

Xcastor: Secure and scalable group communication in ad hoc networks

Milan Schmittner Matthias Hollick

PDF BibTeX DOI: 10.25534/tuprints-00013322

Abstract

Mobile ad hoc networks (MANETs) are emerging as a practical technology for emergency response communication in the case a centralized infrastructure malfunctions or is not available. Using smartphones as communication devices, MANETs may be readily established among the civilian population of affected areas. Beneficiaries would be civilian first responders, which may form small collaborating groups. Communication in such groups must be reliable for disaster response to be effective. In this paper, we address the issue of reliable group communication on the network layer. We design and implement the first secure explicit multicast routing protocol called Xcastor, in which we extend the secure and scalable routing concept of the Castor unicast routing protocol towards supporting reliable communication for large numbers of small groups. By simulation, we show significant performance improvements over Castor.

  2015  31st Annual Computer Security Applications Conference (ACSAC 2015) Article

Using Channel State Information for Tamper Detection in the Internet of Things

Ibrahim Ethem Bagci Utz Roedig Ivan Martinovic Matthias Schulz Matthias Hollick

BibTeX

Abstract

Each 802.11n WiFi frame contains a preamble which allows a receiver to estimate the impact of the wireless channel and of the transmitter on the received signal. The estimation result - the CSI - is used by a receiver to extract the transmitted information. However, as the CSI depends on the communication environment and the transmitter hardware it can as well be used for security purposes. If an attacker tampers with a transmitter it will have an effect on the CSI measured at a receiver. Many IoT devices use WiFi for communication and CSI based tamper detection is a valuable building block for securing the future IoT. Unfortunately not only tamper events lead to CSI fluctuations; movement of people in the communication environment has an impact too. We propose to analyse CSI values of a transmission simultaneously at multiple receivers to improve distinction of tamper and movement events. A moving person has an impact on some but not all communication links between transmitter and the receivers. A temper event impacts on all links between transmitter and the receivers. The paper describes the necessary algorithms for the proposed tamper detection method. In particular we analyse the tamper detection capability in practical deployments with varying intensity of people movement. For example, in our experiments with low movement intensity it was possible to detect all tamper situations (TPR of one) while achieving a zero FPR.

  2015  13th International Conference on Advances in Mobile Computing and Multimedia (MoMM) Conference

Can I Help You Setting Your Privacy? A Survey-based Exploration of Users Attitudes towards Privacy Suggestions

Delphine Reinhardt Franziska Engelmann Matthias Hollick

BibTeX

  2015  IEEE 40th Conference on Local Computer Networks (LCN 2015) Article

Performance evaluation of delay-tolerant wireless friend-to-friend networks for undetectable communication

Ana Barroso Matthias Hollick

BibTeX DOI: 10.1109/LCN.2015.7366356

Abstract

Anonymous communication systems have recently increased in popularity in wired networks, but there are no adequate equivalent systems for wireless networks under strong surveillance. In this work we evaluate the performance of delay-tolerant friend-to-friend networking, which can allow anonymous communication in a wireless medium under strong surveillance by relying on trust relationships between the network’s users. Since strong anonymity properties incur in performance penalties, a good understanding of performance under various conditions is crucial for the successful deployment of such a system. We simulate a delay-tolerant friend-to-friend network in several scenarios using real-world mobility data, analyze the trade-offs of network-related parameters and offer a preliminary throughput estimation.

  2015  Pervasive and Mobile Computing Article

OFDMA for Wireless Multihop Networks: From Theory to Practice

Adrian Loch Matthias Hollick Alexander Kühne Anja Klein

BibTeX DOI: 10.1016/j.pmcj.2015.07.003

Abstract

Orthogonal Frequency-Division Multiple Access (OFDMA) enables nodes to exploit spatial diversity in Wireless Mesh Networks (WMNs). As a result, throughput improves significantly. While existing work often considers the physical layer only, using OFDMA in a WMN also affects the link and network layers. In particular, multi-hop forwarding may result in severe bottlenecks since OFDMA resource allocations are typically based on local information only. In this paper, we design a practical system that mitigates such bottlenecks. To this end, we allow for resource allocation based on channel and traffic conditions at the physical layer, per-subcarrier coding at the link layer, and per-subcarrier packet segmentation at the network layer. We implement our approach on software-defined radios and show that it provides significant throughput gains compared to traditional schemes.

  2015  IEEE Conference on Communications and Network Security (CNS) Conference

Practical Covert Channels for WiFi Systems

Jiska Classen Matthias Schulz Matthias Hollick

BibTeX

  2015  2nd ACM Workshop on Visible Light Communication Systems Conference

The Spy Next Door: Eavesdropping on High Throughput Visible Light Communications

Jiska Classen Joe Chen Daniel Steinmetzer Matthias Hollick Edward Knightly

BibTeX

  2015  IEEE Conference on Communications and Network Security 2015 (CNS) Conference

Eavesdropping with Periscopes: Experimental Security Analysis of Highly Directional Millimeter Waves

Daniel Steinmetzer Joe Chen Jiska Classen Edward Knightly Matthias Hollick

BibTeX DOI: 10.1109/CNS.2015.7346844

  2015  Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks (WiSec) Conference

Lockpicking Physical Layer Key Exchange: Weak Adversary Models Invite the Thief

Daniel Steinmetzer Matthias Schulz Matthias Hollick

BibTeX DOI: 10.1145/2766498.2766514

Abstract

Physical layer security schemes for wireless communications are currently crossing the chasm from theory to practice. They promise information-theoretical security, for instance by guaranteeing the confidentiality of wireless transmissions. Examples include schemes utilizing artificial interference—that is ’jamming for good’—to enable secure physical layer key exchange or other security mechanisms. However, only little attention has been payed to adjusting the employed adversary models during this transition from theory to practice. Typical assumptions give the adversary antenna configurations and transceiver capabilities similar to all other nodes: single antenna eavesdroppers are the norm. We argue that these assumptions are perilous and ’invite the thief’. In this work, we evaluate the security of a representative practical physical layer security scheme, which employs artificial interference to secure physical layer key exchange. Departing from the standard single-antenna eavesdropper, we utilize a more realistic multi-antenna eavesdropper and propose a novel approach that detects artificial interferences. This facilitates a practical attack, effectively ’lockpicking’ the key exchange by exploiting the diversity of the jammed signals. Using simulation and real-world software-defined radio (SDR) experimentation, we quantify the impact of increasingly strong adversaries. We show that our approach reduces the secrecy capacity of the scheme by up to 97% compared to single-antenna eavesdroppers. Our results demonstrate the risk unrealistic adversary models pose in current practical physical layer security schemes.

  2015  International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) Conference

APP and PHY in Harmony: Demonstrating Scalable Video Streaming Supported by Flexible Physical Layer Control

Denny Stohr Matthias Schulz Matthias Hollick Wolfgang Effelsberg

BibTeX

  2015  2nd International Conference on Networked Systems (Netsys) Conference

APP and PHY in Harmony: A Framework Enabling Flexible Physical Layer Processing to Address Application Requirements

Matthias Schulz Denny Stohr Stefan Wilk Benedikt Rudolph Matthias Hollick Wolfgang Effelsberg

PDF BibTeX DOI: 10.1109/NetSys.2015.7089076

Abstract

Mobile data traffic, particularly mobile video, grows at an unprecedented pace. Despite recent advances at the physical layer, today’s wireless network infrastructure cannot keep up with this growth. This is partially due to the missing flexibility to adapt the physical layer continuously to best support both application level as well as network requirements. In this paper we show how to harness the flexibility of advanced physical layers in practice. We designed and implemented a research platform that provides a flexible application-centric physical layer for Android smartphones using software-defined radios (SDRs) as radio interfaces. Our solution allows applications to define flows and apply per-flow settings that are mapped into distinct physical layer settings. As a proof-of-concept and for testbed evaluation, we implemented our system together with a mobile video streaming application. The latter uses a Motion-JPEG based lightweight scalable video codec (SVC) to generate incremental data flows. We show that our system maximizes video quality at the receiver’s side, while keeping the energy consumption at the transmitter at a minimum. Our solution demonstrates that jointly optimizing network traffic and application quality is feasible in practice using a flexible physical layer processing approach.

  2015  IEEE Wireless Communications Letters Article

Highly Efficient Known-Plaintext Attacks against Orthogonal Blinding based Physical Layer Security

Yao Zheng Matthias Schulz Wenjing Lou Thomas Hou Matthias Hollick

BibTeX DOI: 10.1109/LWC.2014.2363176

Abstract

In this letter, we describe highly effective known-plaintext attacks against physical layer security schemes. We substantially reduce the amount of required known-plaintext symbols and lower the symbol error rate (SER) for the attacker. In particular, we analyze the security of orthogonal blinding schemes that disturb an eavesdropper’s signal reception using artificial noise transmission. We improve the attack efficacy using fast converging optimization algorithms and combining the measurements of neighboring subchannels in a multicarrier system. We implement the enhanced attack algorithms by solving unregularized and regularized least squares problems. By means of simulation, we show that the performance of the new attack algorithms supersedes the normalized least mean square approach discussed in the work of Schulz et al., e.g., by lowering the eavesdropper’s SER by 82% while using 95% less known plaintext.

  2015  14th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE UbiSafe Symposium) Conference

A Distributed Reputation System for Certification Authority Trust Management

Jiska Classen Johannes Braun Florian Volk Matthias Hollick Johannes Buchmann Max Mühlhäuser

BibTeX

  2015  14th International Conference on Mobile and Ubiquitous Multimedia (MUM) Conference

Show Me Your Phone, I Will Tell You Who Your Friends Are: Analyzing Smartphone Data to Identify Social Relationships

Delphine Reinhardt Franziska Engelmann Andrey Moerov Matthias Hollick

BibTeX DOI: 10.1145/2836041.2836048

Abstract

Access control is a key principle to protect user privacy online. The combination of both the wealth of user-generated data in online social networks and overly complex user interfaces lead to a high user burden for privacy control, hence making the observance of the above principles difficult. We investigate how communication metadata on smartphones can facilitate providing tailored suggestions for restricted audience groups, thus limiting the sharing of data to the intended users only. To this end, we have performed a user study collecting a dataset including contact names, calls, SMS, MMS, and e-mail on personal smartphones in everyday use. In this paper, we examine which are the key features determining the social relationship category of a contact using machine learning. We obtain promising results for an automated classification of contacts into work-related, family-related and other social-interaction-related, thus enabling the possibility of user assistance for privacy control. Obtaining a more fine-grained categorization of the latter category into acquaintances, friends, and university-mates is shown to be difficult, since these categories blur in our study group.

  2014  11th International Conference on Mobile Ad Hoc and Sensor Systems (MASS) Conference

Building Cross-Layer Corridors in Wireless Multihop Networks

Adrian Loch Pablo Quesada Matthias Hollick Alexander Kühne Anja Klein

PDF BibTeX DOI: 10.1109/MASS.2014.19

Abstract

Corridor-based Routing widens traditional hop-by-hop paths to enable advanced physical layer mechanisms in Wireless Multihop Networks. The key concept is to let groups of nodes cooperate to jointly forward data. Instead of establishing a path formed by a fixed sequence of nodes, the network layer builds a “corridor” from source to destination to allow for such an approach. The corridor is divided into stages, which consist of the aforementioned groups of nodes. Existing mechanisms for Corridor-based Routing focus on the physical layer and assume a routing protocol that builds the corridor. In this paper, we design a corridor construction algorithm and a practical protocol that implements it. In particular, we address in detail the overhead introduced by our protocol, since this is crucial for performance and an open issue of Corridor-based Routing. We implement our approach both in simulation and practice. We obtain the turning point at which corridors become profitable and show that our protocol builds corridors, which enable throughput gains up to 74%.

  2014  11th International Symposium on Wireless Communications Systems (ISWCS’14) Conference

BER Enhancements for Practical Interference Alignment in the Frequency Domain

Alexander Kuehne Adrian Loch Thomas Nitsche Joerg Widmer Matthias Hollick Anja Klein

BibTeX DOI: 10.1109/ISWCS.2014.6933317

  2014  39th IEEE Conference on Local Computer Networks (LCN 2014) Conference

Practical OFDMA for Corridor-based Routing in Wireless Multihop Networks

Adrian Loch Matthias Hollick Alexander Kühne Anja Klein

PDF BibTeX DOI: 10.1109/LCN.2014.6925750

Abstract

Corridor-based Routing enables advanced physical layer schemes in Wireless Multihop Networks (WMNs). It widens paths in order to span multiple nodes per hop. As a result, groups of nodes cooperate locally at each hop to forward packets. Recent theoretical work suggests using Orthogonal Frequency-Division Multiple Access (OFDMA) in combination with Corridor-based Routing to improve throughput in WMNs. However, results focus on achievable capacity and do not consider practical issues such as modulation and coding schemes. In this paper, we study OFDMA for corridors in practice and implement it on software-defined radios. We show that OFDMA corridors provide significantly larger throughput gains when considering realistic modulation and coding, achieving up to 2x throughput gain compared to traditional routing not based on corridors.

  2014  15th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks Conference

Practical Interference Alignment in the Frequency Domain for OFDM-based Wireless Access Networks

Adrian Loch Thomas Nitsche Alexander Kuehne Matthias Hollick Joerg Widmer Anja Klein

BibTeX DOI: 10.1109/WoWMoM.2014.6918922

Abstract

Interference alignment (IA) is often considered in the spatial domain in combination with MIMO systems. In contrast, aligning interference in the frequency domain among multiple subcarriers can also benefit single-antenna OFDM-based access networks. It allows for flexible operation on a per-subcarrier basis. We investigate the gains achievable by frequency IA in practice for a scenario with multiple access points and clients. Previous work is predominantly theoretical and focuses on idealized cases where all nodes have the same average signal-to-noise ratio (SNR). On the contrary, in practical networks, nodes typically have heterogeneous SNRs depending on channel conditions, which might have a significant impact on IA performance. We tackle this problem by designing mechanisms that adaptively choose which nodes shall perform IA on which subcarriers depending on current channel conditions. We implement and validate our approach on software-defined radios. To the best of our knowledge, this is the first practical implementation of IA in the frequency domain. Our measurements show that (1) frequency IA is feasible in practice, and (2) choosing appropriate nodes and subcarriers overcomes the main limitations due to heterogeneous SNRs. Our mechanisms enable IA in scenarios where it would be infeasible otherwise, achieving throughput gains close to the 33% theoretical maximum.

  2014  39th IEEE Conference on Local Computer Networks (LCN) Conference

Making Active-Probing-Based Network Intrusion Detection in Wireless Multihop Networks Practical: A Bayesian Inference Approach to Probe Selection.

R. do Carmo J. Hoffmann V. Willert Matthias Hollick

BibTeX

  2014  39th IEEE Conference on Local Computer Networks (LCN) Conference

Dynamic Curve Adaptation for Geographic Routing in Wireless Multihop Networks

Adrian Loch Wei-Chih Hong Matthias Hollick

BibTeX DOI: 10.1109/LCN.2014.6925754

  2014  Proceedings of the 3rd Workshop of Software Radio Implementation Forum (SRIF 2014), co-located with ACM Sigcomm 2014 Conference

WARP Drive - Accelerating Wireless Multi-hop Cross-layer Experimentation on SDRs

Adrian Loch Matthias Schulz Matthias Hollick

BibTeX

  2014  Proceedings of the 15th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM 2014) Conference

How did you get here? PHY-Layer Path Signatures

Adrian Loch David Meier Matthias Hollick

BibTeX

  2014  15th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM 2014) Conference

Corridor-based Routing: Opening Doors to PHY-Layer Advances for Wireless Multihop Networks

Adrian Loch Matthias Hollick A. Kühne A. Klein

BibTeX DOI: 10.1109/WoWMoM.2014.6919011

Abstract

Today, the performance of routing mechanisms in Wireless Multihop Networks (WMNs) is still limited by the lower layers. While recent cross-layer approaches take advantage of the characteristics of the medium, they are often based on traditional physical layers such as OFDM. State-of-the-art techniques used in one-hop scenarios, such as OFDMA or MIMO, pose a significant challenge in practical multihop networks, since typically Channel State Information (CSI) at the transmitter is required. Due to its volatile nature, disseminating timely CSI in the network is often infeasible. We generalize Corridor-based Routing to enable advanced physical layers in WMNs. Instead of routing packets from node to node, we forward them along fully-connected groups of nodes. As a result (1) CSI only needs to be exchanged locally to enable cooperation in a group, and (2) groups can adaptively choose the best physical layer technique according to CSI. We investigate the benefits of Corridor-based Routing and present a protocol design that enables operation of corridors in WMNs.

  2014  International Conference on Intelligent Sensors, Sensor Networks and Information Processing (ISSNIP) Other

TrustMeter: A trust assessment scheme for collaborative privacy mechanisms in participatory sensing applications

Delphine Christin Daniel Rodriguez Pons-Sorolla Matthias Hollick Salil Kanhere

BibTeX

  2014  11th IEEE/IFIP Annual Conference on Wireless On-demand Network Systems and Services (WONS 2014) Conference

Analyzing Active Probing for Practical Intrusion Detection in Wireless Multihop Networks

Rodrigo do Carmo Matthias Hollick

BibTeX

  2014  Proceedings of the Network and Distributed System Security Symposium (NDSS 2014) Conference

Practical Known-Plaintext Attacks against Physical Layer Security in Wireless MIMO Systems

Matthias Schulz Adrian Loch Matthias Hollick

BibTeX

Abstract

Physical layer security schemes for wireless communication systems have been broadly studied from an information theory point of view. In contrast, there is a dearth of attack methodologies to analyze the achievable security on the physical layer. To address this issue, we develop a novel attack model for physical layer security schemes, which is the equivalent to known-plaintext attacks in cryptoanalysis. In particular, we concentrate on analyzing the security of orthogonal blinding schemes that disturb an eavesdropper’s signal reception using artificial noise transmission. We discuss the theory underlying our attack methodology and develop an adaptive filter trained by known-plaintext symbols to degrade the secrecy of orthogonal blinding. By means of simulation and measurements on real wireless channels using software-defined radios with OFDM transceivers, we obtain the operating area of our attack and evaluate the achievable secrecy degradation. We are able to reduce the secrecy of orthogonal blinding schemes to Symbol Error Rates (SERs) below 10% at an eavesdropper, with a knowledge of only a 3% of the symbols transmitted in typical WLAN frames.

  2014  11th European Conference on Wireless Sensor Networks (EWSN) Conference

Making ‘Glossy’ Networks Sparkle: Exploiting Concurrent Transmissions for Energy Efficient, Reliable, Ultra-low Latency Communication in Wireless Control Networks

Dingwen Yuan Michael Riecker Matthias Hollick

BibTeX

  2014  Proceedings of the 7th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2014) Conference

Short Paper: Gathering Tamper Evidence in Wi-Fi Networks Based on Channel State Information

Ibrahim Ethem Bagci Utz Roedig Matthias Schulz Matthias Hollick

BibTeX DOI: 10.1145/2627393.2627405

  2014  1st KuVS Workshop on Anticipatory Networks Conference

Mind the Gap – Understanding the Traffic Gap when Switching Communication Protocols

Marc Werner Tobias Lange Matthias Hollick Torsten Zimmermann Klaus Wehrle

BibTeX

Abstract

A large variety of routing protocols for Wireless Multihop Networks exists today. These protocols are tailored towards a specific networking scenario and cannot be easily adapted to suit the changing requirements of novel applications, organically growing networks, etc. Introducing a modular design allowing for dynamic switching between routing mechanisms is a promising approach to overcome this challenge. However, in the transition phase between mechanisms, a gap in network traffic can occur while the new protocol is initialized, thus effectively leaving the network disconnected. The resulting service interruption decreases the user experience and violates the quality of service requirements of, for example, multimedia applications such as Voice over IP. In this paper, we perform a measurement study to analyze the characteristic effects of switching between routing mechanisms on a wireless mesh testbed. Specifically, we analyze the switch between a link state and a distance vector routing mechanisms. The obtained results allow for identifying some key factors affecting the transition between mechanism.

  2014  Proceedings of the 39th IEEE Conference on Local Computer Networks (LCN) Conference

Measuring the Impact of Denial-of-Service Attacks on Wireless Sensor Networks

Michael Riecker D. Thies Matthias Hollick

BibTeX

  2013  Pervasive and Mobile Computing (PMC) Article

uSafe: A Privacy-aware and Participative Mobile Application for Citizen Safety in Urban Environments

Delphine Christin C. Roßkopf Matthias Hollick

BibTeX

  2013  Proceedings of the 11th International Conference on Advances in Mobile Computing and Multimedia (MoMM) Article

Raising User Awareness about Privacy Threats in Participatory Sensing Applications through Graphical Warnings

Delphine Christin M. Michalak Matthias Hollick

BibTeX

  2013  14th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM 2013) Conference

Practical OFDMA in Wireless Networks with Multiple Transmitter-Receiver Pairs

Adrian Loch Robin Klose Matthias Hollick Alexander Kuehne Anja Klein

BibTeX DOI: 10.1109/WoWMoM.2013.6583368

  2013  14th Workshop on Signal Processing Advances in Wireless Communications (SPAWC 2013) Conference

CSI Feedback in OFDMA Wireless Networks with Multiple Transmitter-Receiver Pairs

Adrian Loch Matthias Hollick Thomas Nitsche Joerg Widmer Alexander Kühne Anja Klein

PDF BibTeX DOI: 10.1109/SPAWC.2013.6612106

  2013  Proceedings of the 2nd Workshop of Software Radio Implementation Forum (SRIF 2013), co-located with ACM Sigcomm 2013 Conference

Evaluating Dynamic OFDMA Subchannel Allocation for Wireless Mesh Networks on SDRs

Robin Klose Adrian Loch Matthias Hollick

BibTeX

  2013  2013 Wireless Communications and Networking Conference (WCNC’13) Conference

Node Selection for Corridor-based Routing in OFDMA Multihop Networks

Alexander Kühne Adrian Loch Matthias Hollick Anja Klein

PDF BibTeX DOI: 10.1109/WCNC.2013.6554877

Abstract

In multi-hop networks, conventional forwarding along a unicast route forces the data transmission to follow a fixed sequence of nodes. In previous works, it has been shown that widening this path to create a corridor of forwarding nodes and applying OFDMA to split and merge the data as it travels through the corridor towards the destination node leads to considerable gains in achievable throughput compared to the case forwarding data along a unicast route. However, the problem of selecting potential nodes to act as forwarding nodes within the corridor has not been addressed in the literature, as in general a rather homogeneous network topology with equally spaced relay clusters per hop between source and destination node has been assumed. In this paper, a more realistic heterogeneous network is considered where the nodes in the area between source and destination are randomly distributed instead of being clustered with equal distance. A node selection scheme is presented which selects the forwarding nodes within the corridor based on a given unicast route between source and destination node. In simulations, it is shown that with the proposed node selection scheme, considerable throughput gains of up to 50 % compared to forwarding along unicast route can be achieved applying corridor-based routing in heterogeneous networks especially in sparse networks.

  2013  Proceedings of the 2013 IEEE International Conference on Sensing, Communication, and Networking (SECON 2013) Conference

A Rapid Prototyping Framework for Practical OFDMA Systems using Software Defined Radios

Robin Klose Adrian Loch Matthias Hollick

BibTeX

  2013  Proceedings of the 14th International Symposium on a World of Wireless, Mobile and Multimedia Networks (IEEE WoWMoM, D-SPAN Workshop) Conference

A Blueprint for Switching Between Secure Routing Protocols in Wireless Multihop Networks

M. Werner J. Kaiser Matthias Hollick E. Weingärtner K. Wehrle

BibTeX

Abstract

A plethora of (secure) routing protocols exists for wireless multihop networks. These protocols are mostly tailored to meet the performance and security requirements of specific application scenarios. As a result, the protocols cannot easily be adapted to novel application demands, organically growing networks, etc. We argue that the modular design of routing protocols and security mechanisms can remove the key limitations of today’s monolithic routing protocols. We show the feasibility of a modular routing approach for wireless multihop networks using the example of a wireless mesh network. In particular, we demonstrate that a dynamic switch between protocol modules is possible at runtime by means of simulation as well as testbed experimentation. We further demonstrate that the security associations and the key material can be reutilized for bootstrapping novel protocol modules, thus minimizing the control overhead.

  2013  Proceedings of the 14th IEEE International Workshop on Signal Processing Advances for Wireless Communications (SPAWC 2013) Conference

EVM and RSSI Link Quality Measurements in Frequency Selective Fading Channels

Thomas Nitsche Jörg Widmer Adrian Loch Matthias Hollick

BibTeX

  2013   Essener Workshop Neue Herausforderungen in der Netzsicherheit Conference

Not the Enemy but the Ally: Increasing the Security of Wireless Networks Using Smartphones (extended abstract)

Rodrigo do Carmo Marc Werner Paul Klobuszenski Matthias Hollick

BibTeX

  2013  Proceedings of the 2nd ACM workshop on Hot topics on wireless network security and privacy Article

DogoIDS: a mobile and active intrusion detection system for IEEE 802.11s wireless mesh networks

Rodrigo do Carmo Matthias Hollick

BibTeX DOI: 10.1145/2463183.2463187

Abstract

Wireless Mesh Networks (WMN) are particularly vulnerable to attacks, since they feature constraint nodes, multi-hop communication, and an open wireless communication channel. These features limit the feasibility of the deployment of contemporary Intrusion Detection Systems (IDS): centralized systems fail because there is no strict network boundary, and distributed and/or cooperative systems challenge the limited resources of the nodes. As a result, practical IDSs for WMNs are scarce, and existing systems are limited with respect to detection capabilities. In this paper we present the design, implementation, and evaluation of “DogoIDS”: an open source, mobile, active-probing-based intrusion detection system. Exploiting mobility allows to mitigate the limitations of distributed, node-dependent systems. The active nature of the system achieves detection capabilities beyond that of a purely passive system. We show the accuracy and speed of our prototype in a testbed WMN—based on the IEEE 802.11s standard—under realistic attacks.

  2013  17th International ITG Workshop on Smart Antennas (WSA’13) Conference

Spatial reuse in OFDMA multi-hop networks applying corridor-based routing

Alexander Kühne Adrian Loch Matthias Hollick Anja Klein

BibTeX

Abstract

In multi-hop networks, conventional forwarding along a unicast route forces the data transmission to follow a fixed sequence of nodes. In previous works, it has been shown that widening this path to create a corridor of forwarding nodes and applying OFDMA to split and merge the data as it travels through the corridor towards the destination node leads to considerable gains in achievable throughput compared to the case of forwarding data along a unicast route. However, the possibility of applying spatial reuse in such kind of networks has not been investigated. In this paper, three different schemes for spatial reuse in multi-hop OFDMA networks applying corridorbased routing are presented and compared to the case without spatial reuse. From simulations it can be seen that spatial reuse increases the throughput. For different signal-to-noise ratio regions, different schemes perform best due to the way the interference is handled by the schemes.

  2013  Proceedings of the 2013 Conference on Networked Systems (NetSys 2013) Conference

Face the Enemy: Attack Detection for Planar Graph Routing

Adrian Loch Matthias Hollick

BibTeX

  2013  Pervasive and Mobile Computing Article

Curve-based Planar Graph Routing with Guaranteed Delivery in Multihop Wireless Networks

Adrian Loch Hannes Frey Matthias Hollick

BibTeX DOI: doi:10.1016/j.pmcj.2013.03.004

Abstract

Localized geographic routing schemes operating on planar graphs promise scalability for use within large multihop wireless networks. However, none of the existing schemes is flexible enough to adapt the sequence of faces visited by the constructed path. Thus, real-world constraints may severely impact the network performance. To address this problem, we extend planar graph routing to allow the algorithm to forward packets along a sequence of faces intersected by any arbitrary curve. We analytically prove that this extended scheme is loop free and allows for guaranteed delivery. Furthermore, we investigate schemes for choosing curves dealing with imperfections in the network.

  2013  Pervasive and Mobile Computing Article

IncogniSense: An Anonymity-preserving Reputation Framework for Participatory Sensing Applications

Delphine Christin C. Roßkopf Matthias Hollick Leonardo Martucci Salil Kanhere

BibTeX

  2013  Information Security Technical Report (ISTR) Article

Share with Strangers: Privacy Bubbles as User-centered Privacy Control for Mobile Content Sharing Applications

Delphine Christin P. Sánchez López Andreas Reinhardt Matthias Hollick Michaela Kauer

BibTeX

  2013  38th IEEE Conference on Local Computer Networks (LCN) Conference

Let’s Talk Together: Understanding Concurrent Transmission in Wireless Sensor Networks

Dingwen Yuan Matthias Hollick

BibTeX

  2013  Proceedings of the 12th GI/ITG KuVS Fachgespräch Drahtlose Sensornetze (FGSN13) Conference

Weniger ist Mehr: Leichtgewichtige Metriken zur Erkennung von Denial-of-Service Angriffen in Drahtlosen Sensornetzen

Michael Riecker Matthias Hollick

BibTeX

  2013 Other

European Data Protection: Coming of Age

Delphine Christin Matthias Hollick

BibTeX

  2013  Accepted for publication in Proceedings of 38th Annual IEEE Conference on Local Computer Networks (LCN) Conference

On the Efficiency of Privacy-preserving Path Hiding for Mobile Sensing Applications

Delphine Christin Andreas Reinhardt Matthias Hollick

BibTeX

  2012  Proceedings of the 8th ACM International Symposium on QoS and Security for Wireless and Mobile Networks (ACM Q2SWinet) Conference

Signs of a Bad Neighborhood: A Lightweight Metric for Anomaly Detection in Mobile Ad Hoc Networks

R. do Carmo M. Werner Matthias Hollick

BibTeX

Abstract

Anomaly detection in wireless multihop networks is notoriously difficult: the wireless channel causes random errors in transmission and node mobility leads to constantly changing node neighborhoods. The Neighbor Variation Rate (NVR) introduced in this paper is a metric that quantitatively describes how the topology of the neighborhood of a node in a wireless multihop network evolves over time. We analyze the expressiveness of this metric under different speeds of nodes and measuring intervals and we employ it to detect anomalies in the network caused by malicious node activity. We validate our detection model and investigate its parameterization by means of simulation. We build a proof-of-concept and deploy it in a real-world IEEE 802.11s wireless mesh network composed of several static nodes and some mobile nodes. In real-world experiments, we mount attacks against the mesh network and analyze the expressiveness of NVR to characterize these attacks. In addition, we analyze the behavior of NVR when applied to an external dataset obtained from measurements of a real-world dynamic AODV-based mobile ad hoc network. Our results show that our metric is lightweight yet effective for anomaly detection in both stationary and mobile wireless multihop networks.

  2012 Other

DogoIDS: A Mobile and Active Intrusion Detection System for IEEE 802.11s Wireless Mesh Networks

Rodrigo do Carmo Matthias Hollick

BibTeX

  2012  Pervasive and Mobile Computing Article

Balancing energy efficiency and throughput fairness in IEEE 802.11 WLANs

Andres Garcia-Saavedra Pablo Serrano Albert Banchs Matthias Hollick

BibTeX

  2012  Proceedings of the 2nd IFIP Conference on Sustainable Internet and ICT for Sustainability (SustainIT) Conference

On the Accuracy of Appliance Identification Based on Distributed Load Metering Data.

Andreas Reinhardt Peter Baumann D. Burgstahler Matthias Hollick H. Chonov Marc Werner R. Steinmetz

BibTeX

Abstract

Dynamic load management, i.e., allowing electricity utilities to remotely turn electric appliances in households on or off, represents a key element of the smart grid. Appliances should however only be disconnected from mains when no negative side effects, e.g., loss of data or thawing food, are incurred thereby. This motivates the use of appliance identification techniques, which determine the type of an attached appliance based on the continuous sampling of its power consumption. While various implementations based on different sampling resolutions have been presented in existing literature, the achievable classification accuracies have rarely been analyzed. We address this shortcoming and evaluate the accuracy of appliance identification based on the characteristic features of traces collected during the 24 hours of a day. We evaluate our algorithm using more than 1,000 traces of different electrical appliances’ power consumptions. The results show that our approach can identify most of the appliances at high accuracy.

  2012  17th International OFDM-Workshop (InOWo’12) Conference

Opportunistic forwarding in multi-hop OFDMA networks with local CSI

A. Kühne A. Klein Adrian Loch Matthias Hollick

BibTeX

Abstract

In multi-hop networks, conventional unipath routing approaches force the data transmission to follow a fixed sequence of nodes. In this paper, we widen this path to create a corridor of forwarding nodes. Within this corridor, data can be split and joined at different nodes as the data travels through the corridor towards the destination node. To split data, decode-and-forward OFDMA is used since with OFDMA, one can exploit the benefits of opportunistically allocating different subcarriers to different nodes according to their channel conditions. To avoid interference, each subcarrier is only allocated once per hop. It is assumed that only local channel state information (CSI) for the next hop towards the destination is available at the nodes, i.e. it can not be guaranteed that a certain node is able to forward its received data in the next hop. This leads to additional transmission phases decreasing the overall network throughput. In this paper, different opportunistic forwarding algorithms are presented which differ in the resource allocation strategy and in the amount of cooperation required between the nodes. Simulations show that in multihop networks, corridor-based routing using opportunistic forwarding with a proper resource allocation strategy outperforms conventional unipath routing approaches in terms of achievable throughput, especially in case of a node drop out.

  2012  23rd IEEE International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC’12) Conference

Corridor-based Routing using Opportunistic Forwarding in OFDMA Multihop Networks

A. Kühne A. Klein Adrian Loch Matthias Hollick

BibTeX DOI: 10.1109/PIMRC.2012.6362553

Abstract

In multi-hop networks, conventional unipath routing approaches force the data transmission to follow a fixed sequence of nodes. In this paper, we widen this path to create a corridor of forwarding nodes. Within this corridor, data can be split and joined at different nodes as the data travels through the corridor towards the destination node. To split data, decode-and-forward OFDMA is used since with OFDMA, one can exploit the benefits of opportunistically allocating different subcarriers to different nodes according to their channel conditions. To avoid interference, each subcarrier is only allocated once per hop. For the presented scheme, the problem of optimizing the network throughput by means of resource and power allocation is formulated and two suboptimal algorithms are proposed to solve this problem with feasible effort. Simulations show that in multi-hop networks corridor-based routing using opportunistic forwarding outperforms conventional unipath routing approaches in terms of achievable throughput.

  2012   GI/ITG KuVS Fachgespräch “Drahtlose Sensornetze” (FGSN) Conference

Optimization and Scheduling of Wireless Sensor Networks for Periodic Control Systems

Dingwen Yuan Matthias Hollick

BibTeX

  2012  In Proceedings of Seventh International Conference on Availability, Reliability and Security (ARES 2012) Conference

Topology-Driven Secure Initialization in Wireless Sensor Networks: A Tool-Assisted Approach

Stanislaus Stelle Mark Manulis Matthias Hollick

BibTeX

  2012  13th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) Conference

Curve-based Planar Graph Routing with Guaranteed Delivery in Multihop Wireless Networks

Hannes Frey Matthias Hollick Adrian Loch

BibTeX DOI: 10.1109/WoWMoM.2012.6263689

Abstract

Localized geographic routing schemes operating on planar graphs promise scalability for use within large multihop wireless networks. Existing schemes base routing path construction on faces defined by the planar graph. Once running on a particular planar graph, none of the existing schemes is flexible enough to adapt the sequence of faces visited by the constructed path. Thus, real-world constraints such as network congestion, limited node energy levels, or non-cooperation of nodes might severely impact the performance and the robustness of existing planar graph routing variants. To address this problem, we extend planar graph routing with one further degree of freedom: control over the sequence of visited faces. Basically, our face routing extension now follows a sequence of faces intersected by any curve we can freely adjust. We investigate basic schemes for choosing curves dealing with imperfections in the network, and derive algorithms for routing and forwarding along these curves. We analytically prove that our scheme is loop free and allows for guaranteed delivery in arbitrary planar connected graphs. We implement curve-based routing and show its feasibility by means of a simulation study. As a proof-of-concept scenario, we investigate the case of non-cooperating nodes. Our results show that curve-based routing is able to sustain the delivery of packets where traditional schemes fail.

  2012  In Proceedings of 12th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM) Conference

Energy-efficient fair channel access for IEEE 802.11 WLANs

Andres Garcia-Saavedra Pablo Serrano Albert Banchs Matthias Hollick

BibTeX

  2012  16th International ITG Workshop on Smart Antennas (WSA’12) Conference

Two-Way Relaying for Multiple Applications in Wireless Sensor Networks

Z. Chen A. Kühne A. Klein A. Loch Matthias Hollick J. Widmer

BibTeX DOI: 10.1109/WSA.2012.6181227

Abstract

Recent work in wireless sensor networks implies possibilities of concurrent support of multiple applications. In this paper, we discuss a novel scheme called hybrid computation in two-way relaying, which introduces cooperation of three sensor nodes to support bi-directional communications of two applications. Applications in wireless sensor networks require different computations and forms of aggregation. In the proposed scheme, different computations at the intermediate node are integrated in a two-way relaying scheme. For computations and transmissions in the proposed scheme, data from all three nodes are considered.We propose a superposition coding protocol and a time division protocol to handle the transmission of the messages from the intermediate node. The problem of maximizing the sum rate is discussed. The results show that the superposition coding protocol outperforms the time division protocol.

  2012  Proceedings of the 10th IEEE International Conference on Pervasive Computing and Communications (PerCom) Conference

IncogniSense: An Anonymity-preserving Reputation Framework for Participatory Sensing Applications

Delphine Christin C. Roßkopf Matthias Hollick Leonardo Martucci Salil Kanhere

BibTeX

  2012  Proceedings of the 2012 IEEE International Symposium on A World of Wireless, Mobile and Multimedia Networks (WoWMoM) Conference

Tree-based Multi-Channel Convergecast in Wireless Sensor Networks

Dingwen Yuan Matthias Hollick

BibTeX DOI: 10.1109/WoWMoM.2012.6263713

  2012  Proceedings of the 37th IEEE Conference on Local Computer Networks (LCN) Conference

HOPSCOTCH: An Adaptive and Distributed Channel Hopping Technique for Interference Avoidance in Wireless Sensor Networks

Dingwen Yuan Michael Riecker Matthias Hollick

BibTeX

  2012   Essener Workshop “Neue Herausforderungen in der Netzsicherheit” Conference

It’s the Data that Matters! On the Detection of False Data in Wireless Sensor Networks

Michael Riecker Ana Barroso Matthias Hollick

BibTeX

  2012  Proceedings of the 37th IEEE Conference on Local Computer Networks (LCN) Conference

A Secure Monitoring and Control System for Wireless Sensor Networks

Michael Riecker R. Thome D. Yuan Matthias Hollick

BibTeX

  2012  Proceedings of the IEEE Conference on Cyber, Physical and Social Computing (CPSCom) Conference

On Data-centric Intrusion Detection in Wireless Sensor Networks

Michael Riecker Ana Barroso Matthias Hollick Sebastian Biedermann

BibTeX

  2011  The Journal of Systems & Software Article

A Survey on Privacy in Mobile Participatory Sensing Applications

Delphine Christin Andreas Reinhardt Salil Kanhere Matthias Hollick

BibTeX DOI: 10.1016/j.jss.2011.06.073

Abstract

The presence of multimodal sensors on current mobile phones enables a broad range of novel mobile applications. Environmental and user-centric sensor data of unprecedented quantity and quality can be captured and reported by a possible user base of billions of mobile phone subscribers worldwide. The strong focus on the collection of detailed sensor data may however compromise user privacy in various regards, e.g., by tracking a user’s current location. In this survey, we identify the sensing modalities used in current participatory sensing applications, and assess the threats to user privacy when personal information is sensed and disclosed. We outline how privacy aspects are addressed in existing sensing applications, and determine the adequacy of the solutions under real-world conditions. Finally, we present countermeasures from related research fields, and discuss their applicability in participatory sensing scenarios. Based on our findings, we identify open issues and outline possible solutions to guarantee user privacy in participatory sensing.

  2011  8th IEEE International Conference on Mobile Ad-hoc and Sensor Systems (MASS) Conference

Curve-based Planar Graph Routing in Multihop Wireless Networks

Hannes Frey Matthias Hollick Adrian Loch

BibTeX DOI: 10.1109/MASS.2011.127

Abstract

Scalability of routing algorithms is a critical issue in large multihop wireless networks. In this sense, approaches like localized geographic routing are very promising. Existing schemes base routing path construction on faces defined by the planar graph of the network. Once running on a particular planar graph, none of the existing schemes is flexible enough to adapt the sequence of faces visited by the constructed path. To address this problem, we extend planar graph routing with one further degree of freedom: control over the sequence of visited faces. Basically, our face routing extension now follows a sequence of faces intersected by any curve we can freely adjust. We motivate our work by discussing application scenarios that benefit from our scheme and suggest basic mechanisms for choosing appropriate curves. We further present preliminary results from an implementation of our curve-based routing scheme.

  2011  Proceedings of the 8th IEEE International Conference on Mobile Ad-hoc and Sensor Systems (MASS 2011) Conference

Privacy-preserving Collaborative Path Hiding for Participatory Sensing Applications

Delphine Christin J. Guillemet Andreas Reinhardt Matthias Hollick Salil Kanhere

BibTeX

Abstract

The presence of multimodal sensors on current mobile phones enables a broad range of novel mobile applications including, e.g., monitoring noise pollution or traffic and road con- ditions in urban environments. Data of unprecedented quantity and quality can be collected and reported by a possible user base of billions of mobile phone subscribers worldwide. The collection of detailed sensor and location data may however compromise user privacy. In this paper, we present a decentralized mechanism to preserve location privacy during the collection of sensor readings. As most sensor readings are geotagged, we propose to exchange them between users in physical proximity in order to jumble the paths followed by the users. We evaluate different strategies to exchange and report the sensor readings to the application using real-world GPS traces of mobile users. The results demonstrate the feasibility and efficacy of our proposed scheme, which can obfuscate up to 100% of the visited locations in the best instances.

  2011  Proceedings of the 3rd International Workshop on Security and Privacy in Spontaneous Interaction and Mobile Phone Use (IWSSI/SPMU) Conference

A Picture is Worth a Thousand Words: Privacy-aware and Intuitive Relationship Establishment in Online Social Networks

Delphine Christin Tobias Freudenreich Matthias Hollick

BibTeX

  2011  Proceedings of the 10th GI/ITG KuVS Fachgespräch Drahtlose Sensornetze (FGSN11) Conference

A Secure Monitoring and Control System for Wireless Sensor Networks

Michael Riecker W. Müller Matthias Hollick K. Saller

BibTeX

  2011  Proceedings of the 10th GI/ITG KuVS Fachgespräch Drahtlose Sensornetze (FGSN11) Conference

We Must Move - We Will Move: On Mobile Phones as Sensing Platforms

Delphine Christin Matthias Hollick

BibTeX

  2010  Forschen Article

Sichere Netze - Mit dem Nutzer im Zentrum (Invited Paper)

Matthias Hollick Thorsten Strufe Alejandro Buchmann

BibTeX

  2010  Proceedings of IEEE LCN 2010 Conference

The Rise and Fall of the AODV Protocol: A Testbed Study on Practical Routing Attacks

C. Gottron P. Larbig A. König Matthias Hollick R. Steinmetz

BibTeX

  2010  Proceedings of 9th GI/ITG KuVS Fachgespräch Drahtlose Sensornetze, Würzburg, Germany Conference

Fine-grained Access Control Enabling Privacy Support in Wireless Sensor Networks (Extended Abstract)

Delphine Christin Andreas Reinhardt Salil Kanhere Matthias Hollick

BibTeX

  2010  Proceedings of the 19th International Conference on Computer Communication Networks (ICCCN 2010) Conference

Security and Privacy Objectives for Sensing Applications in Wireless Community Networks (Invited Paper)

Delphine Christin Matthias Hollick Mark Manulis

BibTeX

  2010  Future Internet Article

Survey on Wireless Sensor Network Technologies for Industrial Automation: The Security and Quality of Service Perspectives

Delphine Christin Parag S. Mogre Matthias Hollick

BibTeX DOI: 10.3390/fi2020096

  2010  Journal of Communications and Networks (JCN) Article

On the Trade-Off between Throughput Maximization and Energy Consumption Minimization in IEEE 802.11 WLANs

P. Serrano Matthias Hollick A. Banchs

BibTeX

  2010  Proceedings of European Wireless 2010 Conference

On the Energy Efficiency of IEEE 802.11 WLANs

P. Serrano A. Garcia-Saavedra Matthias Hollick A. Banchs

BibTeX

  2010  Proceedings of the 7th European Conference on Wireless Sensor Networks (EWSN 2010) Conference

Trimming the Tree: Tailoring Adaptive Huffman Coding to Wireless Sensor Networks

Alexander Reinhard Delphine Christin Matthias Hollick Johannes Schmitt Parag S. Mogre Ralf Steinmetz

BibTeX

  2010  Wireless Communications and Mobile Computing Article

CORE: Centrally Optimized Routing Extensions for Efficient Bandwidth Management and Network Coding in the IEEE 802.16 MeSH Mode

Parag S. Mogre N. D'Heureuse Matthias Hollick R. Steinmetz

BibTeX

  2010  Wireless Communications and Mobile Computing Article

A Security Framework for Wireless Mesh Networks

Parag S. Mogre K. Graffi Matthias Hollick R. Steinmetz

BibTeX

  2009  Proceedings of IFIP Wireless Days 2009 Conference

Quality of Experience of Voice Communication in Large-Scale Mobile Ad Hoc Network

Christian Gottron André König Matthias Hollick Sonja Bergsträßer Tomas Hildebrandt Ralf Steinmetz

BibTeX

  2009  Proceedings of IEEE GLOBECOM 2009 Conference

An Analytical Model of Routing, Misbehavior, and Countermeasures in Mobile Ad Hoc Networks

André König Daniel Seither Matthias Hollick Ralf Steinmetz

BibTeX

  2009 Other

ContextFramework.KOM - Eine offene Middleware zur Integration heterogener Sensoren in eine Kontext-sensitive Kommunikationsplattform (Extended Abstract)

J. Schmitt M. Kropff Alexander Reinhard Matthias Hollick

BibTeX

  2009  Proceedings of the 9th Würzburg Workshop on IP: Joint ITG and Euro-NF Workshop Visions of Future Generation Networks (EuroView2009), Würzburg, Germany Conference

An Evaluation of Cooperative Decisions in Peer-to-Peer Systems - Mathematics vs. Testbed Studies (Abstract)

A. König Matthias Hollick R. Steinmetz

BibTeX

  2009  Proceedings of the Sixth Annual IEEE Communications Society Conference on Sensor, Mesh and Ad Hoc Communications and Networks (IEEE SECON 2009), Rome, Italy Conference

Stream-oriented Lossless Packet Compression in Wireless Sensor Networks

Andreas Reinhardt Matthias Hollick Ralf Steinmetz

BibTeX

  2009  Proceedings of the 34th IEEE Conference on Local Computer Networks (IEEE LCN 2009), Zurich, Switzerland Conference

Distributed Bandwidth Reservation Strategies to Support Efficient Bandwidth Utilization and QoS on a Per-Link Basis in IEEE 802.16 Mesh Networks

Parag S. Mogre Matthias Hollick R. Steinmetz V. Dadia S. Sengupta

BibTeX

  2009  WiMAX Evolution: Emerging Technologies and Applications Other

WiMAX Mesh Architectures and Network Coding

Parag S. Mogre Matthias Hollick C. Schwingenschlögl A. Ziller R. Steinmetz

BibTeX

  2009  Proceedings of the Sixth International ICST Conference on Heterogeneous Networking for Quality, Reliability, Security and Robustness (ICST QSHINE 2009), Las Palmas de Gran Canaria, Spain Conference

Throughput and Energy Efficiency in IEEE 802.11 WLANs: Friends or Foes?

P. Serrano A. Banchs L. Vollero Matthias Hollick

BibTeX

  2009  Proceedings of the 34th IEEE Conference on Local Computer Networks (IEEE LCN 2009), Zurich, Switzerland Conference

Incorporating Spatial Reuse into Algorithms for Bandwidth Management and Scheduling in IEEE 802.16j Relay Networks

Parag S. Mogre Matthias Hollick S. Dimitrov R. Steinmetz

BibTeX

  2009  Procedings of the IEEE International Conference on Communications (IEEE ICC 2009), Dresden, Germany Conference

A Stochastic Analysis of Secure Joint Decision Processes in Peer-to-Peer Systems

A. König Matthias Hollick R. Steinmetz

BibTeX

  2008  Procedings of 4th IEEE International Workshop on Wireless and Sensor Networks Security (IEEE WSNS 2008), Atlanta, USA Conference

Harnessing Delay Tolerance to Increase Delivery Ratios in Mobile Ad Hoc Networks with Misbehaving Nodes

André König Christian Gottron Matthias Hollick Ralf Steinmetz

BibTeX

  2008 Other

An Approach towards Adaptive Payload Compression in Wireless Sensor Networks (Extended Abstract)

Andreas Reinhardt Matthias Hollick Ralf Steinmetz

BibTeX

  2008  Proceedings of 5th Annual International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services (MobiQuitous 2008), Dublin, Ireland Conference

Exploiting Schelling Behavior for Improving Data Accessibility in Mobile Peer-to-Peer Networks

L. Vu K. Nahrstedt Matthias Hollick

BibTeX

  2008  Proceedings of the 1st IEEE International Workshop on Wireless Network Coding (IEEE WiNC 2008) co-located with IEEE SECON 2008, San Francisco, USA Conference

A Note on Practical Deployment editions for Network Coding in the IEEE 802.16 MeSH Mode

Parag S. Mogre Matthias Hollick M. Kropff R. Steinmetz C. Schwingenschlögl

BibTeX

  2008  Security and Communication Networks (SCN) Article

GeoSec - Quarantine Zones for Mobile Ad hoc Networks

A. König Matthias Hollick T. Krop R. Steinmetz

BibTeX

  2007  Proceedings of IEEE MASS 2007, Pisa, Italy Conference

A Case for Joint Routing and Scheduling and Network Coding in TDMA-based Wireless Mesh Networks: A Cross-layer Approach (Extended Abstract and Poster)

Parag S. Mogre N. D'Heureuse Matthias Hollick R. Steinmetz

BibTeX

  2007  Praxis der Informationsverarbeitung und Kommunikation (PIK), Special edition on Current Trends in Network and Service Management Article

Der Assistent in Hintergrund: Adaptives Kommunikationsmanagement durch Lernen vom Nutzer

J. Schmitt Matthias Hollick R. Steinmetz

BibTeX

  2007  Praxis der Informationsverarbeitung und Kommunikation (PIK), Special edition on Internet-Telefonie and Voice over IP Article

Dynamische Authentifizierung für Provider-übergreifende VoIP-Kommunikation

J. Schmitt T. Hecker Matthias Hollick Ralf Steinmetz

BibTeX

  2007  Proceedings of the 17th International Workshop on Network and Operating Systems Support for Digital Audio & Video (NOSSDAV 2007), Urbana-Champaign, IL, USA Conference

QoS in Wireless Mesh Networks: Challenges, Pitfalls and Roadmap to its Realization (Keynote Paper)

Parag S. Mogre Matthias Hollick R. Steinmetz

BibTeX

  2007  Proceedings of the 15th IEEE International Workshop on Quality of Service (IWQoS 2007), Evanston, IL, USA Conference

Slow and Steady: Modelling and Performance Analysis of the Network Entry Process in IEEE 802.16

Matthias Hollick Parag S. Mogre C. Schott Ralf Steinmetz

BibTeX

  2007  Proceedings of the 2nd ACM International Workshop on Wireless Network Testbeds, Experimental Evaluation and Characterization (WiNTECH 2007) co-located with ACM MobiCom 2007, Montreal, Canada Conference

JiST/MobNet: Combined Simulation, Emulation, and Real-world Testbed for Ad hoc Networks

T. Krop M. Bredel Matthias Hollick Ralf Steinmetz

BibTeX

  2007  Long-Term and Dynamical Aspects of Information Security: Emerging Trends in Information and Communication Security Conference

Geographically Secure Routing for Mobile Ad Hoc Networks: A Cross-Layer Based Approach

André König Matthias Hollick R. Ackermann R. Steinmetz

BibTeX

  2007  Proceedings of the 32nd IEEE Conference on Local Computer Networks (IEEE LCN 2007), Dublin, Ireland Conference

AntSec, WatchAnt and AntRep:Innovative Security Mechanisms for Wireless Mesh Networks

Parag S. Mogre K. Graffi Matthias Hollick R. Steinmetz

BibTeX

  2006  Proceedings of Seventh ACM International Symposium on Mobile Ad Hoc Networking and Computing (MobiHoc 2006), Montreal, Canada Conference

Crossing the Chasm with Ad hoc Networks - The Provider-mediated Communication Paradigm (Extended Abstract and Post)

T. Krop J. Widmer Matthias Hollick C. Prehofer Ralf Steinmetz

BibTeX

  2006  Proceedings of 2. Essener Workshop zu Neuen Herausforderungen in der Netzsicherheit (EWNS 2006), Essen, Germany Conference

Sicherheit und Verfügbarkeit in mobilen Ad hoc Netzen - Ein geographischer, schichtenübergreifender Ansatz (Abstract)

A. König Matthias Hollick J. Schmitt R. Steinmetz

BibTeX

  2006  Computer Communications Article

QoS Routing Open Agenda

X. Masip-Bruin M. Yannuzzi J. Domingo-Pascual A. Fonte M. Curado E. Monteiro F. Kuipers P. van Mieghem S. Avallone G. Ventre P. Aranda-Gutierrez Matthias Hollick R. Steinmetz L. Iannone K. Salamatian

BibTeX

  2006 Other

The IEEE 802.16-2004 MESH Mode Explained

Parag S. Mogre Matthias Hollick

BibTeX

  2005  Proceedings of Kommunikation in Verteilten Systemen (KiVS 2005), Workshop Peer-to-Peer-Systeme und -Anwendungen, Kaiserslautern, Germany Conference

Establishing P2P-Overlays for Ad Hoc Networks Using Provider Subscription

T. Krop M. Kappes Matthias Hollick

BibTeX

  2005  Proceedings of ACM MobiCom 2005, Köln, Germany Conference

Modeling Static and Dynamic Behavior of Routes in Mobile Ad hoc Networks (Extended Abstract and Poster)

T. Krop Matthias Hollick F. Krist Parag S. Mogre R. Steinmetz

BibTeX

  2005  Proceedings of 30th Annual IEEE Conference on Local Computer Networks (LCN2005), Sydney, Australia Conference

M2DR: A Near-optimal Multiclass Minimum-delay Routing Algorithm for Smart Radio Access Networks

Matthias Hollick Parag S. Mogre T. Krop H.-P. Huth J. Schmitt Ralf Steinmetz

BibTeX

  2004  Proceedings of Second International Conference on Wired/Wireless Internet Communications (WWIC 2004), Frankfurt (Oder), Germany Conference

The Ad Hoc On-Demand Distance Vector Protocol: An Analytical Model of the Route Acquisition Process

Matthias Hollick J. Schmitt C. Seipl Ralf Steinmetz

BibTeX

  2004  Proceedings of the 30th EUROMICRO Conference (EUROMICRO 2004), Rennes, France Conference

A Survey on Dependable Routing in Sensor Networks, Ad hoc Networks, and Cellular Networks

Matthias Hollick Ivan Martinovic T. Krop I. Rimac

BibTeX

  2003 Other

Modeling Mobility for Cellular Networks Based on Statistical Data Collection

Matthias Hollick T. Krop J. Schmitt

BibTeX

  2002  Enterprise Security Conference

Security for Ad-Hoc Service Information - Threat Analysis of the Service Location Protocol

Matthias Hollick Ralf Steinmetz

BibTeX

  2002 Other

The Ad Hoc On-Demand Distance Vector Protocol: An Analytical Model of the Route Acquisition Process

Matthias Hollick J. Schmitt

BibTeX

  2001  Innovative Anwendungen in Kommunikationsnetzen, Proceedings der 15. DFN-Arbeitstagung über Kommunikationsnetze, Düsseldorf, Germany Conference

Sicherheitsaspekte bei der Einsatzplanung von Microsoft Windows 2000

Matthias Hollick W. Rosenow T. Bormuth Ralf Steinmetz

BibTeX

  2001  Proceedings of Third International Conference on Information, Communications & Signal Processing (ICICS 2001), Singapore Conference

Security Issues in Group Integrity Management for Multimedia Multicasting

Andreas Meissner Lars Wolf Matthias Hollick Ralf Steinmetz

BibTeX

  2001  Proceedings of International Conference on Software, Telecommunications and Computer Networks (SoftCOM 2001), Split, Croatia Conference

Security Goals for Service Discovery in Ad-hoc Environments

Matthias Hollick Ralf Steinmetz

BibTeX

  2001  Third International Workshop on Networked Group Communication Conference

A Security Model for Multicast Group Integrity Management

Matthias Hollick Andreas Meissner L. Wolf Ralf Steinmetz

BibTeX

  1999 Other

Schwerpunktentwicklungen der Computertechnik und Telekommunikation, Benutzungsmodelle und Werkzeuge: Zukünftige Entwicklung von Kommunikationstechnologie und Multimedia

Ralf Steinmetz Matthias Hollick

BibTeX