@inproceedings{BeckerHoefkenSchuetzetal.2016, author = {Becker, Sebastian and H{\"o}fken, Hans-Wilhelm and Sch{\"u}tz, Philip and Schuba, Marko}, title = {IT-forensische Erkennung modifizierter Android-Apps}, series = {Proceedings of DACH Security 2016, Klagenfurt, Austria, September 2016}, booktitle = {Proceedings of DACH Security 2016, Klagenfurt, Austria, September 2016}, editor = {Schartner, P.}, pages = {120 -- 125}, year = {2016}, abstract = {Malware auf Smartphones ist ein Problem, dem auch Strafverfolgungsbeh{\"o}rden immer h{\"a}ufiger gegen{\"u}berstehen. Insbesondere Telefone, bei denen potentiell schadhafte Apps zu einem finanziellen Schaden gef{\"u}hrt haben, finden sich auf den Schreibtischen der Polizei wieder. Dabei m{\"u}ssen die Ermittler m{\"o}glichst schnell und gezielt erkennen k{\"o}nnen, ob eine App tats{\"a}chlich schadhaft manipuliert wurde, was manipuliert wurde und mit wem die App kommuniziert. Klassische Malware-Erkennungsverfahren helfen zwar bei der generellen Erkennung schadhafter Software, sind aber f{\"u}r die polizeiliche Praxis nicht geeignet. Dieses Paper stellt ein Programm vor, welches gerade die forensischen Fragestellungen ber{\"u}cksichtigt und so f{\"u}r den Einsatz in der Strafverfolgung in Frage kommt.}, language = {de} } @inproceedings{BonneyHoefkenPaffenetal.2015, author = {Bonney, Gregor and H{\"o}fken, Hans-Wilhelm and Paffen, Benedikt and Schuba, Marko}, title = {ICS/SCADA Security - Analysis of a Beckhoff CX5020 PLC}, series = {1st International Conference on Information Systems Security and Privacy : ICISSP 2015}, booktitle = {1st International Conference on Information Systems Security and Privacy : ICISSP 2015}, organization = {International Conference on Information Systems Security and Privacy <1, 2015, Angers>}, pages = {1 -- 6}, year = {2015}, language = {en} } @inproceedings{BraunHoefkenSchubaetal.2015, author = {Braun, Sebastian and H{\"o}fken, Hans-Wilhelm and Schuba, Marko and Breuer, Michael}, title = {Forensische Sicherung von DSLRoutern}, series = {Proceedings of D-A-CH Security 2015. St. Augustin 8. und 9. September 2015}, booktitle = {Proceedings of D-A-CH Security 2015. St. Augustin 8. und 9. September 2015}, pages = {11 S.}, year = {2015}, language = {de} } @inproceedings{BroennerHoefkenSchuba2016, author = {Broenner, Simon and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Streamlining extraction and analysis of android RAM images}, series = {Proceedings of the 2nd international conference on information systems security and privacy}, booktitle = {Proceedings of the 2nd international conference on information systems security and privacy}, organization = {ICISSP International Conference on Information Systems Security and Privacy <2, 2016, Rome, Italy>}, isbn = {978-989-758-167-0}, doi = {10.5220/0005652802550264}, pages = {255 -- 264}, year = {2016}, language = {en} } @book{GalleyMinoggioSchubaetal.2016, author = {Galley, Birgit and Minoggio, Ingo and Schuba, Marko and Bischoff, Barbara and H{\"o}fken, Hans-Wilhelm}, title = {Unternehmenseigene Ermittlungen : Recht - Kriminalistik - IT}, publisher = {Erich Schmidt Verlag}, address = {Berlin}, isbn = {978-3-503-16531-5}, pages = {XIII, 372 S.}, year = {2016}, language = {de} } @inproceedings{GranatHoefkenSchuba2017, author = {Granat, Andreas and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Intrusion Detection of the ICS Protocol EtherCAT}, pages = {1 -- 5}, year = {2017}, abstract = {Control mechanisms like Industrial Controls Systems (ICS) and its subgroup SCADA (Supervisory Control and Data Acquisition) are a prerequisite to automate industrial processes. While protection of ICS on process management level is relatively straightforward - well known office IT security mechanisms can be used - protection on field bus level is harder to achieve as there are real-time and production requirements like 24x7 to consider. One option to improve security on field bus level is to introduce controls that help to detect and to react on attacks. This paper introduces an initial set of intrusion detection mechanisms for the field bus protocol EtherCAT. To this end existing Ethernet attack vectors including packet injection and man-in-the-middle attacks are tested in an EtherCAT environment, where they could interrupt the EtherCAT network and may even cause physical damage. Based on the signatures of such attacks, a preprocessor and new rule options are defined for the open source intrusion detection system Snort demonstrating the general feasibility of intrusion detection on field bus level.}, language = {en} } @inproceedings{LindenlaufHoefkenSchuba2015, author = {Lindenlauf, Simon and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Cold Boot Attacks on DDR2 and DDR3 SDRAM}, series = {10th International Conference on Availability, Reliability and Security (ARES) 2015}, booktitle = {10th International Conference on Availability, Reliability and Security (ARES) 2015}, doi = {10.1109/ARES.2015.28}, pages = {287 -- 292}, year = {2015}, language = {en} } @article{MausHoefkenSchuba2011, author = {Maus, Stefan and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Forensic Analysis of Geodata in Android Smartphones}, pages = {1 -- 11}, year = {2011}, language = {en} } @article{SchaeferHoefkenSchuba2011, author = {Schaefer, Thomas and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Windows Phone 7 from a Digital Forensics' Perspective}, publisher = {Springer}, address = {Berlin}, year = {2011}, language = {en} } @incollection{SchubaHoefken2022, author = {Schuba, Marko and H{\"o}fken, Hans-Wilhelm}, title = {Cybersicherheit in Produktion, Automotive und intelligenten Geb{\"a}uden}, series = {IT-Sicherheit - Technologien und Best Practices f{\"u}r die Umsetzung im Unternehmen}, booktitle = {IT-Sicherheit - Technologien und Best Practices f{\"u}r die Umsetzung im Unternehmen}, publisher = {Carl Hanser Verlag}, address = {M{\"u}nchen}, isbn = {978-3-446-47223-5}, doi = {10.3139/9783446473478.012}, pages = {193 -- 218}, year = {2022}, language = {de} }