7 citations · 14 across the 10 of their papers we have counts for
10 papers
The Fault in Our Drafts: Vulnerabilities in RPKI Specification and Software
Oliver Jacobsen, Tobias Kirsch, Haya Schulmann +2
The Resource Public Key Infrastructure (RPKI) secures the Internet's routing system by defining a complex trust and validation framework for certificates, Route Origin Authorizatio…
Poster: From Fort to Foe: The Threat of RCE in RPKI
Oliver Jacobsen, Haya Schulmann, Niklas Vogel +1
In this work, we present a novel severe buffer-overflow vulnerability in the RPKI validator Fort, that allows an attacker to achieve Remote Code Execution (RCE) on the machine runn…
RPKI: Not Perfect But Good Enough
Haya Schulmann, Niklas Vogel, Michael Waidner
The Resource Public Key Infrastructure (RPKI) protocol was standardized to add cryptographic security to Internet routing. With over 50% of Internet resources protected with RPKI t…
SoK: An Introspective Analysis of RPKI Security
Donika Mirdita, Haya Schulmann, Michael Waidner
The Resource Public Key Infrastructure (RPKI) is the main mechanism to protect inter-domain routing with BGP from prefix hijacks. It has already been widely deployed by large provi…
The Harder You Try, The Harder You Fail: The KeyTrap Denial-of-Service Algorithmic Complexity Attacks on DNSSEC
Elias Heftrig, Haya Schulmann, Niklas Vogel +1
Availability is a major concern in the design of DNSSEC. To ensure availability, DNSSEC follows Postel's Law [RFC1123]: "Be liberal in what you accept, and conservative in what you…
Byzantine-Secure Relying Party for Resilient RPKI
Jens Friess, Donika Mirdita, Haya Schulmann +1
To protect against prefix hijacks, Resource Public Key Infrastructure (RPKI) has been standardized. To enjoy the security guarantees of RPKI validation, networks need to install a…
Cloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
Jens Frieß, Tobias Gattermayer, Nethanel Gelernter +2
Recent works showed that it is feasible to hijack resources on cloud platforms. In such hijacks, attackers can take over released resources that belong to legitimate organizations.…
Attacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS Resolver CPU
Olivia Gruza, Elias Heftrig, Oliver Jacobsen +3
NSEC3 is a proof of non-existence in DNSSEC, which provides an authenticated assertion that a queried resource does not exist in the target domain. NSEC3 consists of alphabetically…
The CURE To Vulnerabilities in RPKI Validation
Donika Mirdita, Haya Schulmann, Niklas Vogel +1
Over recent years, the Resource Public Key Infrastructure (RPKI) has seen increasing adoption, with now 37.8% of the major networks filtering bogus BGP routes. Systems interact wit…
Stalloris: RPKI Downgrade Attack
Tomas Hlavacek, Philipp Jeitner, Donika Mirdita +2
We demonstrate the first downgrade attacks against RPKI. The key design property in RPKI that allows our attacks is the tradeoff between connectivity and security: when networks ca…