Prof. Dr.-Ing. Matthias Hollick

Security, QoS, and Resilience in Mobile Systems / Privacy and Trust in Cyber-physical and Mobile Systems / Cross-layer Optimization in Wireless Networks / Head

Contact Information

Pankratiusstraße 2
64289 Darmstadt
S2|20 205
mhollick@seemoo.tu-darmstadt.de
+49 6151 16-25470
+49 6151 16-25471

Biography

Dr. Matthias Hollick is a Full Professor of Computer Science at the Technical University of Darmstadt where he is heading the Secure Mobile Networking Lab (SEEMOO) since 2009. He is co-affiliated with the Electrical Engineering and Information Technology Department. His research has been published at top venues such as ACM CoNEXT, ACM IMWUT, ACM MobiCom, AMC MobiSys, ACM Sigmetrics, ACM WiSec, EWSN, IEEE ComST, IEEE JSAC, IEEE Infocom, IEEE JioT, IEEE S&P, IEEE TMC, IEEE/ACM ToN, NDSS, PETS, USENIX Security, and other renowned venues in the topic area of mobile and wireless systems and cybersecurity. The research of his team has been awarded with more than 15 best paper and demo awards including at ACM MobiCom, ACM IMWUT, EWSN, ACM WiSec, and IEEE DOCSS. The results of his research found their way into numerous highly visible open source software projects. He acts as the Speaker and Scientific Coordinator of the emergenCITY Research Center established in the Hessian State Excellence Initiative LOEWE in January 2020. He further act as the Deputy Speaker of the DFG Doctoral School on Privacy and Trust for Mobile Users and as the Co-Deputy Speaker of the DFG Collaborative Research Center 1053 MAKI on Multi-mechanisms Adaptation in the Future Internet.

Publications

Type

Year

Show awards only

No results match your search criteria.

2022 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks Conference

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Alexander Heinrich Niklas Bittner Matthias Hollick

BibTeX DOI: 10.1145/3507657.3528546

Abstract

Finder networks in general, and Apple’s Find My network in particular, can pose a grave threat to users’ privacy and even health if these networks are abused for stalking. Apple’s release of the AirTag-a very affordable tracker covered by the nearly ubiquitous Find My network-amplified this issue. While Apple provides a stalking detection feature within its ecosystem, billions of Android users are still left in the dark. Apple recently released the Android app “Tracker Detect,” which does not deliver a convincing feature set for stalking protection. We reverse engineer Apple’s tracking protection in iOS and discuss its features regarding stalking detection. We design “AirGuard” and release it as an Android app to protect against abuse by Apple tracking devices. We compare the performance of our solution with the Apple-provided one in iOS and study the use of AirGuard in the wild over multiple weeks using data contributed by tens of thousands of active users.

2022 ACM Transactions on Internet of Things Article

Next2You: Robust Copresence Detection Based on Channel State Information

Mikhail Fomichev Luis F. Abanto-Leon Max Stiegler Alejandro Molina Ramirez Jakob Link Matthias Hollick

PDF BibTeX DOI: 10.1145/3491244

Abstract

Context-based copresence detection schemes are a necessary prerequisite to building secure and usable authentication systems in the Internet of Things (IoT). Such schemes allow one device to verify proximity of another device without user assistance utilizing their physical context (e.g., audio). The state-of-the-art copresence detection schemes suffer from two major limitations: (1) they cannot accurately detect copresence in low-entropy context (e.g., empty room with few events occurring) and insufficiently separated environments (e.g., adjacent rooms), (2) they require devices to have common sensors (e.g., microphones) to capture context, making them impractical on devices with heterogeneous sensors. We address these limitations, proposing Next2You, a novel copresence detection scheme utilizing channel state information (CSI). In particular, we leverage magnitude and phase values from a range of subcarriers specifying a Wi-Fi channel to capture a robust wireless context created when devices communicate. We implement Next2You on off-the-shelf smartphones relying only on ubiquitous Wi-Fi chipsets and evaluate it based on over 95 hours of CSI measurements that we collect in five real-world scenarios. Next2You achieves error rates below 4%, maintaining accurate copresence detection both in low-entropy context and insufficiently separated environments. We also demonstrate the capability of Next2You to work reliably in real-time and its robustness to various attacks.

2022 Other

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

Patrick Leu Giovanni Camurati Alexander Heinrich Marc Roeschlin Claudio Anliker Matthias Hollick Capkun Srdjan Jiska Classen

PDF BibTeX DOI: 10.48550/arXiv.2111.05313

2022 ARES 2021: The 16th International Conference on Availability, Reliability and Security Conference Postprint

Best Practices for Notification Studies for Security and Privacy Issues on the Internet

Max Maass Henning Pridöhl Dominik Herrmann Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00021773

Abstract

Researchers help operators of vulnerable and non-compliant internet services by individually notifying them about security and privacy issues uncovered in their research. To improve efficiency and effectiveness of such efforts, dedicated notification studies are imperative. As of today, there is no comprehensive documentation of pitfalls and best practices for conducting such notification studies, which limits validity of results and impedes reproducibility. Drawing on our experience with such studies and guidance from related work, we present a set of guidelines and practical recommendations, including initial data collection, sending of notifications, interacting with the recipients, and publishing the results. We note that future studies can especially benefit from extensive planning and automation of crucial processes, i. e., activities that take place well before the first notifications are sent.

2022 Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies Article Postprint

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Matthias Gazzari Annemarie Mattmann Max Maass Matthias Hollick

PDF BibTeX DOI: 10.26083/tuprints-00020660

Abstract

Wearables that constantly collect various sensor data of their users increase the chances for inferences of unintentional and sensitive information such as passwords typed on a physical keyboard. We take a thorough look at the potential of using electromyographic (EMG) data, a sensor modality which is new to the market but has lately gained attention in the context of wearables for augmented reality (AR), for a keylogging side-channel attack. Our approach is based on neural networks for a between-subject attack in a realistic scenario using the Myo Armband to collect the sensor data. In our approach, the EMG data has proven to be the most prominent source of information compared to the accelerometer and gyroscope, increasing the keystroke detection performance. For our end-to-end approach on raw data, we report a mean balanced accuracy of about 76 % for the keystroke detection and a mean top-3 key accuracy of about 32 % on 52 classes for the key identification on passwords of varying strengths. We have created an extensive dataset including more than 310 000 keystrokes recorded from 37 volunteers, which is available as open access along with the source code used to create the given results.

2022 43rd IEEE Symposium on Security and Privacy Conference

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Jiska Classen Francesco Gringoli Michael Hermann Matthias Hollick

Prof. Dr.-Ing. Matthias Hollick

Contact Information

Biography

Publications

AirGuard - Protecting Android Users from Stalking Attacks by Apple Find My Devices

Next2You: Robust Copresence Detection Based on Channel State Information

Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging

Best Practices for Notification Studies for Security and Privacy Issues on the Internet

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Attacks on Wireless Coexistence: Exploiting Cross-Technology Performance Features for Inter-Chip Privilege Escalation

Snail Mail Beats Email Any Day: On Effective Operator Security Notifications in the Internet

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Effective Notification Campaigns on the Web: A Matter of Trust, Framing, and Support

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack

Desynchronization and MitM Attacks Against Neighbor Awareness Networking Using OpenNAN

Leveraging Cross-Technology Broadcast Communication to build Gateway-Free Smart Homes

Connected Self-Organized Citizens in Crises: An Interdisciplinary Resilience Concept for Neighborhoods

Future-Proof Web Authentication: Bring Your Own FIDO2 Extensions

Very Pwnable Network: Cisco AnyConnect Security Analysis

ARIstoteles - Dissecting Apple’s Baseband Interface

PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop

Happy MitM: Fun and Toys in Every Bluetooth Device

AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop

OpenHaystack: A Framework for Tracking Personal Bluetooth Devices via Apple’s Massive Find My Network

FastZIP: faster and more secure zero-interaction pairing

Dinosaur Resurrection: PowerPC Binary Patching for Base Station Analysis

Polypyus - The Firmware Historian

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Zero-Interaction Security-Towards Sound Experimental Validation

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi

Stay Connected, Leave no Trace: Enhancing Security and Privacy in WiFi via Obfuscating Radiometric Fingerprints

RESCUE: A Resilient and Secure Device-to-Device Communication Framework for Emergencies

Joint Relaying and Spatial Sharing Multicast Scheduling for mmWave Networks

Towards an Automated Monitoring of RF Activity in Low-Power Wireless Testbeds

Hardware-Accelerated Real-Time Stream Data Processing on Android with GNU Radio

Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets

ToothPicker: Apple Picking in the iOS Bluetooth Stack

Firmware Insider: Bluetooth Randomness is Mostly Random

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

DEMO: BTLEmap: Nmap for Bluetooth Low Energy

Concurrent Wireless Cut-Through Forwarding: Ultra Low-Latency Multi-Hop Communication for the IoT

NEAT-TCP: Generation of TCP Congestion Control Through Neuroevolution of Augmenting Topologies

Improving the Reliability of Bluetooth Low Energy Connections

Cross-Technology Broadcast Communication between Off-The-Shelf Wi-Fi, BLE, and IEEE 802.15.4 Devices

Analyzing Bluetooth Low Energy Connections on Off-the-Shelf Devices

LIDOR: A Lightweight DoS-Resilient Communication Protocol for Safety-Critical IoT Systems

Empirical insights for designing Information and Communication Technology for International Disaster Response

SCAROS: A Scalable and Robust Self-backhauling Solution for Highly Dynamic Millimeter-Wave Networks

Riding the Waves: Decoding Asynchronous Multi-User MISO via Time-Variant Zero-Forcing

Hybrid Precoding for Multi-Group Multicasting in mmWave Systems

Zero-Interaction Security - Towards Sound Experimental Validation

Free Your CSI: A Channel State Information Extraction Platform For Modern Wi-Fi Chipsets

Benchmarking and Profiling the GNURadio Scheduler

The Emergency Responsive Digital City

Vacuums in the Cloud: Analyzing Security in a Hardened IoT Ecosystem

CBMoS: Combinatorial Bandit Learning for Mode Selection and Resource Allocation in D2D Systems

A Billion Open Interfaces for Eve and Mallory : MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

Reverse Engineering and Evaluating the Apple Wireless Direct Link Protocol

InternalBlue - Bluetooth Binary Patching and Experimentation Framework

Towards Transparency in Email Tracking

Inside Job: Diagnosing Bluetooth Lower Layers Using Off-the-Shelf Devices

Perils of Zero-Interaction Security in the Internet of Things

Practical VLC to WiFi Handover Mechanisms

Transitions: A Protocol-Independent View of the Future Internet

On the Difficulties of Incentivizing Online Privacy through Transparency: A Qualitative Survey of the German Health Insurance Market

Sea of Lights: Practical Device-to-Device Security Bootstrapping in the Dark

The King is Dead Long Live the King! Towards Systematic Performance Evaluation of Heterogeneous Bluetooth Mesh Networks in Real World Environments

Bluemergency: Mediating Post-disaster Communication Systems using the Internet of Things and Bluetooth Mesh

A Billion Open Interfaces for Eve and Mallory: MitM, DoS, and Tracking Attacks on iOS and macOS Through Apple Wireless Direct Link

Toxic Friends in Your Network: Breaking the Bluetooth Mesh Friendship Concept

TPy: A Lightweight Framework for Agile Distributed Network Experiments

Demo: Linux Goes Apple Picking: Cross-Platform Ad hoc Communication with Apple Wireless Direct Link

One Billion Apples’ Secret Sauce: Recipe for the Apple Wireless Direct Link Ad hoc Protocol

Conducting a Large-scale Field Test of a Smartphone-based Communication Network for Emergency Response

An Online Context-Aware Machine Learning Algorithm for 5G mmWave Vehicular Communications

Adaptive Codebook Optimization for Beam-Training on Off-The-Shelf IEEE 802.11ad Devices