@inproceedings{BonneyNagelSchuba2016, author = {Bonney, Gregor and Nagel, Stefan and Schuba, Marko}, title = {Risiko Smart Home - Angriff auf ein Babymonitorsystem}, series = {Proceedings of DACH Security 2016, Klagenfurt, Austria, September 2016}, booktitle = {Proceedings of DACH Security 2016, Klagenfurt, Austria, September 2016}, editor = {Schartner, P.}, pages = {371 -- 378}, year = {2016}, abstract = {Unser Zuhause wird zunehmend intelligenter. Smart Homes bieten uns die Steuerung von Haus- oder Unterhaltungstechnik bequem vom Smartphone aus. Junge Familien nutzen die Technologie, um mittels vernetzten Babymonitorsystemen ihren Nachwuchs von {\"u}berall aus im Blick zu haben. Davon auszugehen, dass solche Systeme mit einem Fokus auf Sicherheit entwickelt wurden, um die sehr pers{\"o}nlichen Daten zu sch{\"u}tzen, ist jedoch ein Trugschluss. Die Untersuchung eines handels{\"u}blichen und keineswegs billigen Systems zeigt, dass die Ger{\"a}te sehr einfach kompromittiert und missbraucht werden k{\"o}nnen.}, language = {de} } @article{KoenigVoelkerWolfetal.2016, author = {K{\"o}nig, Johannes Alexander and V{\"o}lker, Veronika and Wolf, Martin and Schuba, Marko}, title = {Gamified Hacking Offence Simulation-based Training (GHOST)}, series = {Crisis Prevention}, volume = {2016}, journal = {Crisis Prevention}, number = {3}, publisher = {Beta}, address = {Bonn}, pages = {44 -- 46}, year = {2016}, language = {de} } @inproceedings{BroennerHoefkenSchuba2016, author = {Broenner, Simon and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Streamlining extraction and analysis of android RAM images}, series = {Proceedings of the 2nd international conference on information systems security and privacy}, booktitle = {Proceedings of the 2nd international conference on information systems security and privacy}, organization = {ICISSP International Conference on Information Systems Security and Privacy <2, 2016, Rome, Italy>}, isbn = {978-989-758-167-0}, doi = {10.5220/0005652802550264}, pages = {255 -- 264}, year = {2016}, language = {en} } @inproceedings{GranatHoefkenSchuba2017, author = {Granat, Andreas and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Intrusion Detection of the ICS Protocol EtherCAT}, pages = {1 -- 5}, year = {2017}, abstract = {Control mechanisms like Industrial Controls Systems (ICS) and its subgroup SCADA (Supervisory Control and Data Acquisition) are a prerequisite to automate industrial processes. While protection of ICS on process management level is relatively straightforward - well known office IT security mechanisms can be used - protection on field bus level is harder to achieve as there are real-time and production requirements like 24x7 to consider. One option to improve security on field bus level is to introduce controls that help to detect and to react on attacks. This paper introduces an initial set of intrusion detection mechanisms for the field bus protocol EtherCAT. To this end existing Ethernet attack vectors including packet injection and man-in-the-middle attacks are tested in an EtherCAT environment, where they could interrupt the EtherCAT network and may even cause physical damage. Based on the signatures of such attacks, a preprocessor and new rule options are defined for the open source intrusion detection system Snort demonstrating the general feasibility of intrusion detection on field bus level.}, language = {en} } @inproceedings{SchwankeHoefkenSchuba2017, author = {Schwanke, Peter and H{\"o}fken, Hans-Wilhelm and Schuba, Marko}, title = {Security Analysis of the ADS Protocol of a Beckhoff CX2020 PLC}, pages = {1 -- 5}, year = {2017}, abstract = {ICSs (Industrial Control Systems) and its subset SCADA systems (Supervisory Control and Data Acquisition) are getting exposed to a constant stream of new threats. The increasing importance of IT security in ICS requires viable methods to assess the security of ICS, its individual components, and its protocols. This paper presents a security analysis with focus on the communication protocols of a single PLC (Programmable Logic Controller). The PLC, a Beckhoff CX2020, is examined and new vulnerabilities of the system are revealed. Based on these findings recommendations are made to improve security of the Beckhoff system and its protocols.}, language = {en} } @inproceedings{SerrorHenzeHacketal.2018, author = {Serror, Martin and Henze, Martin and Hack, Sacha and Schuba, Marko and Wehrle, Klaus}, title = {Towards in-network security for smart homes}, series = {13th International Conference on Availability, Reliability and Security, ARES 2018; Hamburg; Germany; 27 August 2018 through 30 August 2018}, booktitle = {13th International Conference on Availability, Reliability and Security, ARES 2018; Hamburg; Germany; 27 August 2018 through 30 August 2018}, isbn = {978-145036448-5}, doi = {10.1145/3230833.3232802}, pages = {Article numer 3232802}, year = {2018}, language = {en} } @article{SerrorHackHenzeetal.2021, author = {Serror, Martin and Hack, Sacha and Henze, Martin and Schuba, Marko and Wehrle, Klaus}, title = {Challenges and Opportunities in Securing the Industrial Internet of Things}, series = {IEEE Transactions on Industrial Informatics}, volume = {17}, journal = {IEEE Transactions on Industrial Informatics}, number = {5}, publisher = {IEEE}, address = {New York}, issn = {1941-0050}, doi = {10.1109/TII.2020.3023507}, pages = {2985 -- 2996}, year = {2021}, language = {en} } @incollection{SchubaHoefken2022, author = {Schuba, Marko and H{\"o}fken, Hans-Wilhelm}, title = {Cybersicherheit in Produktion, Automotive und intelligenten Geb{\"a}uden}, series = {IT-Sicherheit - Technologien und Best Practices f{\"u}r die Umsetzung im Unternehmen}, booktitle = {IT-Sicherheit - Technologien und Best Practices f{\"u}r die Umsetzung im Unternehmen}, publisher = {Carl Hanser Verlag}, address = {M{\"u}nchen}, isbn = {978-3-446-47223-5}, doi = {10.3139/9783446473478.012}, pages = {193 -- 218}, year = {2022}, language = {de} } @incollection{EnglaenderKaminskiSchuba2022, author = {Engl{\"a}nder, Jacques and Kaminski, Lars and Schuba, Marko}, title = {Informationssicherheitsmanagement}, series = {Digitalisierungs- und Informationsmanagement}, booktitle = {Digitalisierungs- und Informationsmanagement}, publisher = {Springer Vieweg}, address = {Berlin}, isbn = {978-3-662-63757-9}, doi = {10.1007/978-3-662-63758-6_15}, pages = {373 -- 398}, year = {2022}, abstract = {Daten und Informationen sind die wichtigsten Ressourcen vieler Unternehmen und m{\"u}ssen daher entsprechend gesch{\"u}tzt werden. Getrieben durch die erh{\"o}hte Vernetzung von Informationstechnologie, die h{\"o}here Offenheit infolge datengetriebener Dienstleistungen und eine starke Zunahme an Datenquellen, r{\"u}cken die Gefahren von Informationsdiebstahl, -manipulation und -verlust in den Fokus von produzierenden Unternehmen. Auf dem Weg zum lern- und wandlungsf{\"a}higen Unternehmen kann dies zu einem großen Hindernis werden, da einerseits zu hohe Sicherheitsanforderungen neue Entwicklungen beschr{\"a}nken, andererseits wegen des Mangels an ausreichenden Informationssicherheitskonzepten Unternehmen weniger Innovationen wagen. Deshalb bedarf es individuell angepasster Konzepte f{\"u}r die Bereiche IT-Security, IT-Safety und Datenschutz f{\"u}r vernetzte Produkte, Produktion und Arbeitspl{\"a}tze. Bei der Entwicklung und Durchsetzung dieser Konzepte steht der Faktor Mensch im Zentrum aller {\"U}berlegungen. In diesem Kapitel wird dargestellt, wie der Faktor Mensch bei der Erstellung von Informationssicherheitskonzepten in verschiedenen Phasen zu beachten ist. Beginnend mit der Integration von Informationssystemen und damit verbundenen Sicherheitsmaßnahmen, {\"u}ber die Administration, bis hin zur Anwendung durch den Endnutzer, werden Methoden beschrieben, die den Menschen, verbunden mit seinem Mehrwert wie auch den Risiken, einschließen. Dabei werden sowohl Grundlagen aufgezeigt als auch Konzepte vorgestellt, mit denen Entscheider in der Unternehmens-IT Leitlinien f{\"u}r die Informationssicherheit festlegen k{\"o}nnen.}, language = {de} } @inproceedings{SchubaHoefkenLinzbach2022, author = {Schuba, Marko and H{\"o}fken, Hans-Wilhelm and Linzbach, Sophie}, title = {An ICS Honeynet for Detecting and Analyzing Cyberattacks in Industrial Plants}, series = {2021 International Conference on Electrical, Computer and Energy Technologies (ICECET)}, booktitle = {2021 International Conference on Electrical, Computer and Energy Technologies (ICECET)}, publisher = {IEEE}, isbn = {978-1-6654-4231-2}, doi = {10.1109/ICECET52533.2021.9698746}, pages = {6 Seiten}, year = {2022}, abstract = {Cybersecurity of Industrial Control Systems (ICS) is an important issue, as ICS incidents may have a direct impact on safety of people or the environment. At the same time the awareness and knowledge about cybersecurity, particularly in the context of ICS, is alarmingly low. Industrial honeypots offer a cheap and easy to implement way to raise cybersecurity awareness and to educate ICS staff about typical attack patterns. When integrated in a productive network, industrial honeypots may not only reveal attackers early but may also distract them from the actual important systems of the network. Implementing multiple honeypots as a honeynet, the systems can be used to emulate or simulate a whole Industrial Control System. This paper describes a network of honeypots emulating HTTP, SNMP, S7communication and the Modbus protocol using Conpot, IMUNES and SNAP7. The nodes mimic SIMATIC S7 programmable logic controllers (PLCs) which are widely used across the globe. The deployed honeypots' features will be compared with the features of real SIMATIC S7 PLCs. Furthermore, the honeynet has been made publicly available for ten days and occurring cyberattacks have been analyzed}, language = {en} }