July 30, 2018

Bluetooth Keyboard Security and Trust Relations

Together with my college Matthias Deeg I’ve done some research on several Bluetooth keyboards. This was a follow-up project to our research on wireless desktop sets. In general, Bluetooth-based keyboards seem to be more secure as the wireless keyboards with proprietary protocols. However, when it comes to Bluetooth security, there are some things which need to be taken into account. For me, the most interesting realization was about the trust relationship between paired devices. In some Bluetooth stacks (e.g. Android or iOS) a device can change complete without any waring to the user. For example a Bluetooth headset can turn into a full functional keyboard. Read more

May 15, 2018

RFID/NFC Basics - A Pentesters Perspective

I’ve did a presentation on the basics of RFID/NFC from my (a pentester) perspective. Since several parties were interested, I gave the presentation twice, once at the “Gulaschprogrammiernacht” in Karlsruhe and once at the “IT-Sicherheitskonferenz“ in Stralsund. The main goal was to explain how some of the RFID/NFC technologies work and what security issues there are. Read more

October 12, 2017

Pentesting Cars

I’ve been invited to the Vector Cyber Security Symposium to talk about pentesting cars. Since the audience does not only consists of techies, this presentation I gave was rather basic. It aims at providing a better understanding of why pentesting is important and souled be done for cars. The general theme of the talk is “improving security by breaking it”. Read more

November 23, 2016

Alarm System Security

Together with my college Matthias Deeg I’ve done some research on several (cheap) wireless alarm systems. We found that it is possible to disarm all systems by a simple replay attack. Such an attack can be easily carried out using a Software Defined Radio (SDR). The results of our research have been documented by “Plusminus”, a German TV show. Read more

November 20, 2016

Of Mice and Keyboards: On the Security of Modern Wireless Desktop Sets

Together with my college Matthias Deeg I’ve done some research on several modern wireless desktop sets. All of the manufacturers claim they are secure because they encrypt data using AES 128. All keyboards and mice use a proprietary communication protocol (not Bluetooth), therefore we were interested in if they are really secure. The result of the analysis was presented at several IT security conferences including Ruxcon in Melbourne, Hacktivity in Budapest, ZERONIGHTS in Moscow, DeepSec in Vienna and hack.lu in Luxembourg. Read more

February 21, 2016

433MHz OOK Remote

After playing around with my SDR and wireless sockets I had a look at other devices, which also use ASK/OOK modulated signals. I found a different wireless socket system, an alarm system and a sex toy. After analyzing the signals, I wanted do build a remote to control them all. I used an Adafruit Trinket (ATtiny85) as micro controller and a cheap OOK transmitter module at 433MHz. The code on the controller just sends the same signal as the original remote replay attack). Read more

November 8, 2015

Wireless Socket Remote

In order to improve my understanding of Software Defined Radios (SDRs) and wireless communication in general, I tinkered with cheap wireless sockets. The results are two pieces of software. Sniffer: This script can eavesdrop on the signals the remote control sends to the sockets. It displays the address, the socket identifier (A, B, C, D or E) and the state (on/off). Remote control: This script allows you to change the state of any socket by supplying the address and the socket identifier. Alternatively you can use the brute-force mode to turn on/off every socket within range. Read more

October 21, 2014

USB Security

I wrote my bachelor thesis about finding and exploiting USB security issues in USB host implementations. The first chapter imparts some basic knowledge about the USB technology. The second part is about USB security. This includes theoretical approaches as well as practical attack vectors. In the last chapter of the thesis you will find my work of trying to exploit some USB vulnerabilities and building a malicious USB device. Read more

September 24, 2013

RFID Security - Theory and Practice

This is a paper about RFID security. It was part of my university studies (sixth semester). The main focus is on the theory and feasibility of different attack vectors and their counter measures. Especially logical issues and physical attack vectors have been taken into account. Read more

July 18, 2013

Digital Forensics

This is a paper about the basics of digital forensics. It was part of my university studies (sixth semester). It is an introduction to the topic and aims to answer questions like “what is digital forensics?”, “what is it for?” and “how is it done?”. There also is a practical part about some basic tools and how to use them. Read more

June 2, 2013

Security Analysis of the Student Card

The “Gulaschprogrammiernacht” (GPN) is a congress organized by Entropia e.V. (CCC Karlsruhe). I presented my research about the security of the student card at this congress. The similar student card system is present at most German universities. At this point in time the system was very broken, mostly because of the usage of the insecure MIFARE Classic RFID tags. Read more

February 15, 2013

MifareClassicTool (MCT)

MifareClassicTool (MCT) is a Android NFC app for reading, writing, analyzing, etc. MIFARE Classic RFID tags. It provides several features to interact with (and only with) MIFARE Classic RFID tags. It is designed for users who have at least basic familiarity with the MIFARE Classic technology. You also need an understanding of the hexadecimal number system, because all data input and output is in hexadecimal. A list of features can be taken from the readme. Read more

May 31, 2012

GSM Security

As part of my studies, some fellow students and I held a lecture about GSM security. The purpose was to give other students a theoretical and practical background. We put together a script, a handout and some exercises. To make this as palatial as possible we used some Motorola C123 phones running OsmocomBB software. Read more

January 27, 2012

Security of Smartphone Operating Systems

This is a paper about the basic security concepts of the smart phone operating systems Android and iOS. It was part of my university studies (fourth semester). Please note: The information in the paper are very outdated. Much has changed since then. You will find better and more recent information on the internet. This paper is just here for “completeness”. Read more

October 10, 2011

RFID Security

This is a paper about basic RFID security issues but with focus on the MIFARE Classic technology. It was part of my university studies (fourth semester). As part of this research, I had a closer look at the MIFARE Classic-based system of my university. Because of the multiple use cases (payment, access control, amount of free copies at the printers, etc.) there are plenty of attack vectors. Furthermore, I build an RFID zapper. This device can destroy RFID chips without leaving a trace (visible from the outside). Read more

October 1, 2010

WiFi Security

This is a paper about basic and common security issues with wireless LANs. It was part of my university studies (first semester). After cracking the WiFi security, basic attack vectors like ARP spoofing and SSL/TLS man-in-the-middle have been taken into account as well. The last part is about my practical experience with wardriving. Read more

© 2018 - Gerhard Klostermeier - Some rights reserved - Legal Notice