Monday
16. September
Tuesday
17. September
Wednesday
18. September
Thursday
19. September
Friday
20. September
8:40 Welcome        
9:00 – 10:30 Mathias Payer
 

From Crashes to Attacks: Synthesizing Exploits

Katharina Krombholz 

A User-Centric Approach to Securing the HTTPS Ecosystem

Thomas Eisenbarth 

Microarchitectural Side-Channel Attacks

Bart Preneel 

The Impact of Quantum Computers on Cybersecurity

Maria Eichlseder 

Effective Attacks from Ineffective Faults

10:30 – 11:00 Coffee Coffee Coffee Coffee Coffee
11:00 – 12:30 Michael Schwarz
Runtime Security Lab I
Peter Schwabe 

Implementing Post-quantum Cryptography on Embedded Microcontrollers

Elisabeth Oswald 

Deep Learning of Side-channel Leakage

Andrei Sabelfeld 

Securing IoT Apps

Peter Pessl, Robert Primas, Michael Schwarz
Side-Channel Lab II
12:30 – 14:00 Lunch Lunch Lunch Lunch Lunch
14:00 – 15:30 Byron Cook

Reasoning about the security of AWS

PhD Forum Peter Pessl, Robert Primas, Michael Schwarz
Side-Channel Lab I
Matteo Maffei  
15:30 – 16:00 Coffee   Coffee Coffee  
16:00 – 17:00 PhD Forum Social Event Bart Preneel 

Keynote – Is Blockchain Dead?

Michael Schwarz
Runtime Security Lab II
 
  Welcome Dinner   Dinner Lab Night + Dinner  

PhD Forum

A central goal of the school is to enable communication between presenters and the participants. Therefore we will have a so-called PhD forum on Monday and Tuesday. The basic idea of the forum is that PhD students and researchers can present their current research in a 5-minute talk. This will help them to get connected with other participants working on a similar topic. Furthermore, presenting at the PhD forum is a prerequisite for earning optional 2 ECTS.

We strongly encourage you to use this opportunity and would like to ask you to send us a title of your presentation to securityweek@iaik.tugraz.at no later than September 13th. We will then arrange the presentation slots accordingly.

Runtime Security Lab

In this tutorial, you will learn about runtime security and what can go wrong if memory is accessed out of bounds, integers do overflow, etc.
Do you manage to read or modify protected memory? Can you manipulate the control flow to jump to a protected function? During a Capture-the-Flag competition, you will learn to attack vulnerable applications. If your attack is successful, the application will reveal a secret flag to you, for which you get points. Rumor has it that the best teams will be rewarded. Please bring your own laptop.

Side-Channel Lab

During the side-channel labs, we offer two parallel sessions to choose from. First, physical side channels and faults, and second, microarchitectural side channels. Please bring your own laptop.

Physical Side-Channels

In this tutorial, you will learn how the physical properties of embedded devices can be used to break their security. First, we will measure the power consumption of a microcontroller performing encryptions and use that to extract the used secret key. Second, we will inject voltage spikes and clock glitches into the microcontroller and thus disturb its computations. The resulting faults can then be used to bypass security checks or extract secrets. All your experiments will be performed on a real device: you will receive a ChipWhisperer-Lite board, which lets you easily measure the power consumption and inject faults on an included target microcontroller.

Microarchitectural Side-Channels

In contrast to runtime attacks, the CPU microarchitecture itself gives much more subtle ways to attack an application via side-channels. These side channels range from measuring execution time and detecting memory access patterns, over cache attacks (e.g., Flush+Reload) to Meltdown and Spectre attacks, leaking information across different processes and privilege boundaries. In this lab, you will experiment with various microarchitectural side channels.