15 citations · 60 across the 18 of their papers we have counts for
21 papers
The Fault in Our Drafts: Vulnerabilities in RPKI Specification and Software
Oliver Jacobsen, Tobias Kirsch, Haya Schulmann +2
The Resource Public Key Infrastructure (RPKI) secures the Internet's routing system by defining a complex trust and validation framework for certificates, Route Origin Authorizatio…
Batch Me If You Can: Coverage-guided RPKI Fuzzing at Scale
Haya Schulmann, Niklas Vogel
The Resource Public Key Infrastructure (RPKI) has become essential to secure inter-domain routing. Despite its critical role, RPKI software remains largely untested beyond shallow…
Pruning the Tree: Rethinking RPKI Architecture From The Ground Up
Haya Schulmann, Niklas Vogel
Resource Public Key Infrastructure (RPKI) is a critical security mechanism for BGP, but the complexity of its architecture is a growing concern as its adoption scales. Current RPKI…
Learning to Identify Conflicts in RPKI
Haya Schulmann, Shujie Zhao
The long history of misconfigurations and errors in RPKI indicates that they cannot be easily avoided and will most probably persist also in the future. These errors create conflic…
Poster: From Fort to Foe: The Threat of RCE in RPKI
Oliver Jacobsen, Haya Schulmann, Niklas Vogel +1
In this work, we present a novel severe buffer-overflow vulnerability in the RPKI validator Fort, that allows an attacker to achieve Remote Code Execution (RCE) on the machine runn…
RPKI: Not Perfect But Good Enough
Haya Schulmann, Niklas Vogel, Michael Waidner
The Resource Public Key Infrastructure (RPKI) protocol was standardized to add cryptographic security to Internet routing. With over 50% of Internet resources protected with RPKI t…
SoK: An Introspective Analysis of RPKI Security
Donika Mirdita, Haya Schulmann, Michael Waidner
The Resource Public Key Infrastructure (RPKI) is the main mechanism to protect inter-domain routing with BGP from prefix hijacks. It has already been widely deployed by large provi…
The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
Elias Heftrig, Haya Schulmann, Niklas Vogel +1
Availability is a major concern in the design of DNSSEC. To ensure availability, DNSSEC follows Postel's Law [RFC1123]: "Be liberal in what you accept, and conservative in what you…
Byzantine-Secure Relying Party for Resilient RPKI
Jens Friess, Donika Mirdita, Haya Schulmann +1
To protect against prefix hijacks, Resource Public Key Infrastructure (RPKI) has been standardized. To enjoy the security guarantees of RPKI validation, networks need to install a…
Cloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
Jens Frieß, Tobias Gattermayer, Nethanel Gelernter +2
Recent works showed that it is feasible to hijack resources on cloud platforms. In such hijacks, attackers can take over released resources that belong to legitimate organizations.…
Attacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS Resolver CPU
Olivia Gruza, Elias Heftrig, Oliver Jacobsen +3
NSEC3 is a proof of non-existence in DNSSEC, which provides an authenticated assertion that a queried resource does not exist in the target domain. NSEC3 consists of alphabetically…
The CURE To Vulnerabilities in RPKI Validation
Donika Mirdita, Haya Schulmann, Niklas Vogel +1
Over recent years, the Resource Public Key Infrastructure (RPKI) has seen increasing adoption, with now 37.8% of the major networks filtering bogus BGP routes. Systems interact wit…
Keep Your Friends Close, but Your Routeservers Closer: Insights into RPKI Validation in the Internet
Tomas Hlavacek, Haya Shulman, Niklas Vogel +1
IP prefix hijacks allow adversaries to redirect and intercept traffic, posing a threat to the stability and security of the Internet. To prevent prefix hijacks, networks should dep…
XDRI Attacks - and - How to Enhance Resilience of Residential Routers
Philipp Jeitner, Haya Shulman, Lucas Teichmann +1
We explore the security of residential routers and find a range of critical vulnerabilities. Our evaluations show that 10 out of 36 popular routers are vulnerable to injections of…
Stalloris: RPKI Downgrade Attack
Tomas Hlavacek, Philipp Jeitner, Donika Mirdita +2
We demonstrate the first downgrade attacks against RPKI. The key design property in RPKI that allows our attacks is the tradeoff between connectivity and security: when networks ca…
Injection Attacks Reloaded: Tunnelling Malicious Payloads over DNS
Philipp Jeitner, Haya Shulman
The traditional design principle for Internet protocols indicates: "Be strict when sending and tolerant when receiving" [RFC1958], and DNS is no exception to this. The transparency…
The Master and Parasite Attack
Lukas Baumann, Elias Heftrig, Haya Shulman +1
We explore a new type of malicious script attacks: the persistent parasite attack. Persistent parasites are stealthy scripts, which persist for a long time in the browser's cache.…
Privacy Preserving and Resilient RPKI
Kris Shrishak, Haya Shulman
Resource Public Key Infrastructure (RPKI) is vital to the security of inter-domain routing. However, RPKI enables Regional Internet Registries (RIRs) to unilaterally takedown IP pr…
The Impact of DNS Insecurity on Time
Philipp Jeitner, Haya Shulman, Michael Waidner
We demonstrate the first practical off-path time shifting attacks against NTP as well as against Man-in-the-Middle (MitM) secure Chronos-enhanced NTP. Our attacks exploit the insec…
Off-Path Hacking: The Illusion of Challenge-Response Authentication
Yossi Gilad, Amir Herzberg, Haya Shulman
Everyone is concerned about the Internet security, yet most traffic is not cryptographically protected. The usual justification is that most attackers are only off-path and cannot…
Security of Patched DNS
Amir Herzberg, Haya Shulman
In spite of the availability of DNSSEC, which protects against cache poisoning even by MitM attackers, many caching DNS resolvers still rely for their security against poisoning on…