TY - CHAP A1 - Schuba, Marko A1 - Höfken, Hans-Wilhelm A1 - Linzbach, Sophie T1 - An ICS Honeynet for Detecting and Analyzing Cyberattacks in Industrial Plants T2 - 2021 International Conference on Electrical, Computer and Energy Technologies (ICECET) N2 - Cybersecurity of Industrial Control Systems (ICS) is an important issue, as ICS incidents may have a direct impact on safety of people or the environment. At the same time the awareness and knowledge about cybersecurity, particularly in the context of ICS, is alarmingly low. Industrial honeypots offer a cheap and easy to implement way to raise cybersecurity awareness and to educate ICS staff about typical attack patterns. When integrated in a productive network, industrial honeypots may not only reveal attackers early but may also distract them from the actual important systems of the network. Implementing multiple honeypots as a honeynet, the systems can be used to emulate or simulate a whole Industrial Control System. This paper describes a network of honeypots emulating HTTP, SNMP, S7communication and the Modbus protocol using Conpot, IMUNES and SNAP7. The nodes mimic SIMATIC S7 programmable logic controllers (PLCs) which are widely used across the globe. The deployed honeypots' features will be compared with the features of real SIMATIC S7 PLCs. Furthermore, the honeynet has been made publicly available for ten days and occurring cyberattacks have been analyzed KW - Conpot KW - honeypot KW - honeynet KW - ICS KW - cybersecurity Y1 - 2022 SN - 978-1-6654-4231-2 SN - 978-1-6654-4232-9 U6 - http://dx.doi.org/10.1109/ICECET52533.2021.9698746 N1 - 2021 International Conference on Electrical, Computer and Energy Technologies (ICECET). 09-10 December 2021. Cape Town, South Africa. PB - IEEE ER - TY - CHAP A1 - Stöbe, Rolf A1 - Höfken, Hans-Wilhelm A1 - Schuba, Marko A1 - Breuer, Michael T1 - Artificial ageing of mobile devices using a simulated GSM/GPRS network T2 - Eighth International Conference on Availability, Reliability and Security (ARES) : 2-6 Sept. 2013, Regensburg Y1 - 2013 SP - 493 EP - 497 PB - IEEE ER - TY - CHAP A1 - Lindenlauf, Simon A1 - Höfken, Hans-Wilhelm A1 - Schuba, Marko T1 - Cold Boot Attacks on DDR2 and DDR3 SDRAM T2 - 10th International Conference on Availability, Reliability and Security (ARES) 2015 Y1 - 2015 U6 - http://dx.doi.org/10.1109/ARES.2015.28 SP - 287 EP - 292 ER - TY - CHAP A1 - Neth, Jannik A1 - Schuba, Marko A1 - Brodkorb, Karsten A1 - Neugebauer, Georg A1 - Höner, Tim A1 - Hack, Sacha T1 - Digital forensics triage app for android T2 - ARES '23: Proceedings of the 18th International Conference on Availability, Reliability and Security N2 - Digital forensics of smartphones is of utmost importance in many criminal cases. As modern smartphones store chats, photos, videos etc. that can be relevant for investigations and as they can have storage capacities of hundreds of gigabytes, they are a primary target for forensic investigators. However, it is exactly this large amount of data that is causing problems: extracting and examining the data from multiple phones seized in the context of a case is taking more and more time. This bears the risk of wasting a lot of time with irrelevant phones while there is not enough time left to analyze a phone which is worth examination. Forensic triage can help in this case: Such a triage is a preselection step based on a subset of data and is performed before fully extracting all the data from the smartphone. Triage can accelerate subsequent investigations and is especially useful in cases where time is essential. The aim of this paper is to determine which and how much data from an Android smartphone can be made directly accessible to the forensic investigator – without tedious investigations. For this purpose, an app has been developed that can be used with extremely limited storage of data in the handset and which outputs the extracted data immediately to the forensic workstation in a human- and machine-readable format. KW - Android KW - Digital triage KW - Triage-app Y1 - 2023 SN - 9798400707728 U6 - http://dx.doi.org/10.1145/3600160.3605017 N1 - ARES 2023: The 18th International Conference on Availability, Reliability and Security. August 29 - September 1, 2023. Benevento, Italy. PB - ACM ER - TY - CHAP A1 - Braun, Sebastian A1 - Höfken, Hans-Wilhelm A1 - Schuba, Marko A1 - Breuer, Michael T1 - Forensische Sicherung von DSLRoutern T2 - Proceedings of D-A-CH Security 2015. St. Augustin 8. und 9. September 2015 Y1 - 2015 ER - TY - CHAP A1 - Christian, Esser A1 - Montag, Tim A1 - Schuba, Marko A1 - Allhof, Manuel T1 - Future critical infrastructure and security - cyberattacks on charging stations T2 - 31st International Electric Vehicle Symposium & Exhibition and International Electric Vehicle Technology Conference (EVS31 & EVTeC 2018) Y1 - 2018 SN - 978-1-5108-9157-9 SP - 665 EP - 671 PB - Society of Automotive Engineers of Japan (JSAE) CY - Tokyo ER - TY - CHAP A1 - Bonney, Gregor A1 - Höfken, Hans-Wilhelm A1 - Paffen, Benedikt A1 - Schuba, Marko T1 - ICS/SCADA Security - Analysis of a Beckhoff CX5020 PLC T2 - 1st International Conference on Information Systems Security and Privacy : ICISSP 2015 Y1 - 2015 SP - 1 EP - 6 ER - TY - CHAP A1 - Granat, Andreas A1 - Höfken, Hans-Wilhelm A1 - Schuba, Marko T1 - Intrusion Detection of the ICS Protocol EtherCAT N2 - Control mechanisms like Industrial Controls Systems (ICS) and its subgroup SCADA (Supervisory Control and Data Acquisition) are a prerequisite to automate industrial processes. While protection of ICS on process management level is relatively straightforward – well known office IT security mechanisms can be used – protection on field bus level is harder to achieve as there are real-time and production requirements like 24x7 to consider. One option to improve security on field bus level is to introduce controls that help to detect and to react on attacks. This paper introduces an initial set of intrusion detection mechanisms for the field bus protocol EtherCAT. To this end existing Ethernet attack vectors including packet injection and man-in-the-middle attacks are tested in an EtherCAT environment, where they could interrupt the EtherCAT network and may even cause physical damage. Based on the signatures of such attacks, a preprocessor and new rule options are defined for the open source intrusion detection system Snort demonstrating the general feasibility of intrusion detection on field bus level. Y1 - 2017 N1 - International Conference on Computer, Network Security and Communication Engineering (CNSCE 2017), March 26-27, 2017, Bangkok, Thailand SP - 1 EP - 5 ER - TY - CHAP A1 - Becker, Sebastian A1 - Höfken, Hans-Wilhelm A1 - Schütz, Philip A1 - Schuba, Marko ED - Schartner, P. T1 - IT-forensische Erkennung modifizierter Android-Apps T2 - Proceedings of DACH Security 2016, Klagenfurt, Austria, September 2016 N2 - Malware auf Smartphones ist ein Problem, dem auch Strafverfolgungsbehörden immer häufiger gegenüberstehen. Insbesondere Telefone, bei denen potentiell schadhafte Apps zu einem finanziellen Schaden geführt haben, finden sich auf den Schreibtischen der Polizei wieder. Dabei müssen die Ermittler möglichst schnell und gezielt erkennen können, ob eine App tatsächlich schadhaft manipuliert wurde, was manipuliert wurde und mit wem die App kommuniziert. Klassische Malware-Erkennungsverfahren helfen zwar bei der generellen Erkennung schadhafter Software, sind aber für die polizeiliche Praxis nicht geeignet. Dieses Paper stellt ein Programm vor, welches gerade die forensischen Fragestellungen berücksichtigt und so für den Einsatz in der Strafverfolgung in Frage kommt. Y1 - 2016 SP - 120 EP - 125 ER - TY - CHAP A1 - Hartung, Frank A1 - Hillgärtner, Michael A1 - Schmitz, Günter A1 - Schuba, Marko A1 - Adolphs, Fabian A1 - Hoffend, Jens A1 - Theis, Jochen T1 - IT-Sicherheit im Automobil T2 - AmE 2014 : Automotive meets Electronics, Beiträge der 5. GMM-Fachtagung vom 18. bis 19. Februar 2014 in Dortmund. (GMM-Fachbericht ; 78) Y1 - 2014 SN - 978-3-8007-3580-8 SP - CD-ROM PB - VDE-Verl. CY - Berlin ER -