RuhrSec is the annual English speaking non-profit IT security conference with cutting-edge security talks by renowned experts. RuhrSec is organized by Hackmanit.
🔽 More information ...

Due to the coronavirus, we decided to cancel RuhrSec 2020. Thanks to our amazing speakers, we present you with a selection of talks in our RuhrSec 2020 #StayAtHome Edition.

If you enjoy the talk we encourage you to make a donation to the non-profit organization
DLRG Hattingen ([ Ссылка ]) (PayPal available).
The donation will be used to support the local youth department of the DLRG, which is the largest voluntary lifesaving organization worldwide.

———

Episode 4: Analysis of DTLS Implementations Using Protocol State Fuzzing, Robert Merget

Abstract. Recent years have witnessed an increasing number of protocols relying on UDP. Due to UDP's simplicity and performance advantages over TCP, it is being adopted in Voice over IP, tunneling technologies, IoT, and novel Web protocols. To protect sensitive data exchange in these scenarios, the DTLS protocol has been developed as a cryptographic variation of TLS. DTLS's main challenge is to support the stateless and unreliable transport of UDP. This has forced the protocol designers to make choices that affect the complexity of DTLS, and to incorporate features that need not be addressed in the numerous TLS analyses. We present the first comprehensive analysis of DTLS implementations using protocol state fuzzing. To that end, we extend TLS-Attacker, an open-source framework for analyzing TLS implementations, with support for DTLS tailored to the stateless and unreliable nature of the underlying UDP layer. We build a framework for applying protocol state fuzzing on DTLS servers and use it to learn state machine models for thirteen DTLS implementations. Analysis of the learned state models reveals 4 serious security vulnerabilities, including a full client authentication bypass in the latest JSSE version, as well as several functional bugs and non-conformance issues. It also uncovers considerable differences between the models, confirming the complexity of DTLS state machines.

Biography. Robert Merget is a PhD Student at the Chair for Network and Data security at Ruhr University Bochum. The focus of his research is practical TLS implementations and their analysis. He is the main developer of TLS-Attacker and TLS-Scanner.

Speaker:
Robert Merget
[ Ссылка ]

———

👉 Subscribe to our channel:
[ Ссылка ]

👉 Read more about interesting IT Security topics on our blog:
[ Ссылка ]

✍️ Want a deeper dive?
Training courses in Single Sign-On (SAML, OAuth and OpenID Connect), Secure Web Development, TLS and Web Services are available here:
[ Ссылка ]

———

🌍 RuhrSec conference website: [ Ссылка ]
🌍 Visit our website: [ Ссылка ]

✔ Follow RuhrSec on Twitter: [ Ссылка ]
✔ Follow Hackmanit on Twitter: [ Ссылка ]

Linkedin: [ Ссылка ]
XING: [ Ссылка ]

———

Thanks for your attention and support. Stay secure.


#cybersecurity #DTLS #ruhrsec #cyber #DTLSimplementations #fuzzing
#itsecurity #itsicherheit #conference #talk #StayAtHome #ProtocolStateFuzzing

свернуть