Full Program

Monday June 22

18:00 - 19:30

RFIDsec Reception

Tuesday June 23

8:15 - 8:45

Continental Breakfast

8:45 - 10:15

RFIDsec Tutorial 1: Contactless Payments

Speaker: Joeri de Ruiter (University of Birmingham)


This tutorial will explain the EMV contactless protocols, both the Visa and MasterCard variants, and the original EMV protocols on which these are based, and discuss various weaknesses that have been discovered over the years. Here we also discuss and demo the possibilities with relay attacks, and discuss the options for payments with NFC phones. During the tutorial there will be the opportunity to experiment with your own bank cards, if you have a laptop with a working contactless reader. Participants are encouraged to bring all their bank and credit cards.

About the speaker:

Joeri de Ruiter is a research fellow in the Security and Privacy group of the University of Birmingham in the United Kingdom. Before that, he worked on his PhD in the Digital Security group of the Radboud University Nijmegen in the Netherlands. His research interests include formal and practical analysis of real-world security protocols. His research resulted in a formal analysis of the EMV protocol (used in bank cards) and the discovery of vulnerabilities in a card reader used for online banking and several widely used TLS implementations.

10:15 - 10:45

Coffee Break

10:45 - 12:00

RFIDsec Tutorial 2: ABCs in Theory and Practice

Speaker: Gergely Alpar (Radboud University)


Attribute-based credentials (ABCs) were already been designed 10-15 years ago. Yet it is just now that devices — and smart cards, in particular — are strong enough to make them practical. Not only technical possibilities, but also infrastructural and societal demands are arising. Electronic identity systems provide increasingly more functions, and simultaneously, privacy is demanded more and more in such nation-wide ecosystems (see e.g. German eID). ABCs are capable of supporting authentic personal data management in a user-centric and privacy-friendly way. Also, the Internet of Things is a new realm in which ABC implementations can play an important role. This tutorial gives an accessible introduction to the mathematics and cryptography of ABCs (many nice ideas!), and also to demonstrate the IRMA approach, that is, our view about how ABCs can be put in practice. We also present some on-going and future research directions. The topics include: Zero-knowledge, Signatures and commitments, Attribute-based credentials, U-Prove and/or Idemix, IRMA technology, Future of ABCs.

About the speaker:

Gergely Alpar is a postdoctoral researcher and teacher at the Radboud University (Nijmegen, The Netherlands) with a research focus on privacy, cryptography, identity management and education. He received his Ph.D. in computer science from the Radboud University's Digital Security group in 2015. He holds two Masters degrees, one from Eötvös Loránd University, Hungary, and one from Eindhoven University of Technology, The Netherlands. He plays a leading role in the IRMA project (www.irmacard.org) that puts attribute-based identity management in practice. Gergely also takes active part in the Privacy and Identity Lab, an interdisciplinary research institute in the Netherlands. More information can be obtained from his personal web site (www.cs.ru.nl/~gergely).

12:00 - 13:15


13:15 - 14:15

RFIDsec Keynote: Hardware Trojans for ASICs and FPGAs

Speaker: Christof Paar (Ruhr University Bochum & University of Massachusetts Amherst)


Countless systems ranging from consumer electronics to military equipment are dependent on integrated circuits (ICs). A surprisingly large number of such systems are already security critical, e.g., medical devices, automotive electronics, or SCADA systems. If the underlying ICs in such applications are maliciously manipulated through hardware Trojans, the security of the entire system can be compromised. In recent years, hardware Trojans have drawn the attention of governments and the scientific community. Initially, the primary attacker model was a malicious foundry that could alter the design, i.e., introduce hardware Trojans which could interfere with the (security-sensitive) functionality of a chip. Many other attacker models exist too. For instance, a legitimate IC manufacturer, e.g., a consumer electronics company abroad, might be in cohort with a foreign intelligence agency to alter its products in a way that compromises their security. Even though hardware Trojans have been considerably studied, little is known about how they might look, especially those that are particularly designed to avoid detection. In this talk we introduce two recent research projects which deal with the Trojan insertion in two different types of hardware platforms, ASICs and FPGAs. This is joint work with Georg Becker, Wayne Burleson, Marc Fyrbiak, Philipp Koppe, Franceso Regazzoni and Pawel Swierczynski.

About the speaker:

Christof Paar has the Chair for Embedded Security at the University of Bochum, Germany, and is research professor at the University of Massachusetts at Amherst. He co-founded, with Cetin Koc, the CHES conference. Christof’s research interests include highly efficient software and hardware realizations of cryptography, physical security, penetration of realworld systems, trusted systems and cryptanalytical hardware. He also works on real-world applications of embedded security, e.g., in cars, consumer devices, smart cards and RFID. Christof has over 150 peer-reviewed publications and is co-author of the textbook Understanding Cryptography (Springer, 2009). He has given invited talks at MIT, Yale, Stanford University, IBM Labs and Intel. He has taught cryptography extensively in industry, including courses at NASA, Motorola Research, and Philips Research. Christof is Fellow of the IEEE and recipient of the German IT Security Award 2010. He co-founded ESCRYPT Inc. – Embedded Security, a leading system provider in industrial security which is now part of Bosch.

14:45 - 16:15

RFIDsec Session 1: PUFs and Applications (Chair: Thomas Plos)

Security Evaluation and Enhancement of Bistable Ring PUFs

Xiaolin Xu, Ulrich Rührmair, Daniel Holcomb and Wayne Burleson

On the Scaling of Machine Learning Attacks on PUFs with Application to Noise Bifurcation

Johannes Tobisch and Georg T. Becker

ReSC: RFID-enabled Supply Chain Management and Traceability for Network Devices

Kun Yang, Domenic Forte and Mark Tehranipoor

16:15 - 16:45

Coffee Break

16:45 - 17:45

RFIDsec Session 2: Side-Channels and Countermeasures (Chair: Matt Robshaw)

Side Channel Assisted Modeling Attacks on Feed-Forward Arbiter PUFs using Silicon Data

Raghavan Kumar and Wayne Burleson

Sharing is Caring – On the protection of Arithmetic Logic Units against Passive Physical Attacks

Hannes Gross

Wednesday June 24

8:15 - 8:45

Continental Breakfast

8:45 - 8:55

Welcome from the General Chairs

8:55 - 9:05

Welcome from the Program Chairs

9:00 - 10:00

WiSec and RFIDsec Keynote: Why we should build a Secure Positioning Infrastructure

Speaker: Srdjan Capkun (ETH Zurich)


In this talk I will argue for the development of a new positioning infrastructures that offers security and privacy by design. Such an infrastructure should provide resilience to location and time spoofing, location verification as well as support, to the full feasible extent, identity and location privacy. This infrastructure should also be terrestrial, to enable better protection against DoS attacks and should be distributed and controlled by local operators, which will make it more resilient to global failures. I will review the main challenges in designing and building such an infrastructure as well as research opportunities that will arise as a part of this effort.

About the speaker:

Srdjan Čapkun is a Full Professor in the Department of Computer Science, ETH Zurich and Director of the Zurich Information Security and Privacy Center (ZISC). He was born in Split, Croatia where he received his Dipl.Ing. Degree in Electrical Engineering / Computer Science from the University of Split in 1998. He received his Ph.D. degree in Communication Systems from EPFL in 2004. Prior to joining ETH Zurich in 2006 he was a postdoctoral researcher in the Networked & Embedded Systems Laboratory (NESL), University of California Los Angeles and an Assistant Professor in the Informatics and Mathematical Modelling Department, Technical University of Denmark (DTU). His research interests are in system and network security. He is a co-founder of 3db Access, a spin-off focusing on secure proximity-based access control.

10:00 - 10:20

Coffee Break

10:20 - 11:50

RFIDsec Session 3: RFID System Attacks (Chair: Georg Becker)

Practical Experiences on NFC Relay Attacks with Android: Virtual Pickpocketing Revisited

Ricardo J. Rodríguez and José Vila

Algebraic Cryptanalysis and ISO/IEC 29167-15

Carlos Cid, Loic Ferreira, Gordon Procter and Matt Robshaw

An RFID Skimming Gate Using Higher Harmonics

Rene Habraken, Peter Dolron, Erik Poll and Joeri de Ruiter

11:50 - 12:50


12:50 - 14:20

WiSec Session 1: PHY Security (Chair: Vincent Lenders)

Lockpicking Physical Layer Key Exchange: Weak Adversary Models Invite the Thief

Daniel Steinmetzer, Matthias Schulz and Matthias Hollick

UWB Rapid-Bit-Exchange System for Distance Bounding

Nils Ole Tippenhauer, Heinrich Luecken, Marc Kuhn and Srdjan Capkun

Short: HB+DB: Mitigating Man-in-the-Middle Attacks Against HB+ with Distance Bounding

Elena Pagnin, Anjia Yang, Gerhard Hancke and Aikaterini Mitrokotsa

Short: Freedom of Speech: Thwarting Jammers via a Probabilistic Approach

Roberto Di Pietro and Gabriele Oligeri

14:20 - 14:45

Coffee Break

14:45 - 16:00

WiSec Session 2: Smartphone Security I (Chair: William Enck)

DroidJust: Automated Functionality-Aware Privacy Leakage Analysis for Android Applications

Xin Chen and Sencun Zhu

Short: CICC: A Fine-Grained, Semantic-Aware, and Transparent Approach to Preventing Permission Leaks for Android Permission Managers

Daibin Wang, Haixia Yao, Yingjiu Li, Hai Jin, Deqing Zou and Robert H. Deng

Short: A Measurement Study on Tracking in Paid Mobile Applications

Suranga Seneviratne, Harini Kolamunna and Aruna Seneviratne

Short: How Talkative is your Mobile Device? An Experimental Study of Wi-Fi Probe Requests

Julien Freudiger

16:00 - 17:00

RFIDsec Session 4: Efficient Implementations (Chair: Joeri de Ruiter)

Efficient Full-Size E-Case on MULTOS SmartCards

Gesine Hinterwalder, Felix Riek and Christof Paar

Efficient and Secure Delegation of Group Exponentiation to a Single Server

Bren Cavallo, Giovanni Di Crescenzo, Delaram Kahrobaei and Vladimir Shpilrain

17:30 -

Joint Social Event RFIDsec & WiSec

Thursday June 25

8:00 - 8:45

Continental Breakfast

8:45 - 10:30

WiSec Session 3: Smartphone Security II (Chair: N. Asokan)

DroidEagle: Seamless Detection of Visually Similar Android Apps

Mingshen Sun, Mengmeng Li and John C.S. Lui

AppWatcher: Unveiling the Underground Market of Trading Mobile App Reviews

Zhen Xie and Sencun Zhu

Securacy: An Empirical Investigation of Android Applications’ Network Usage, Privacy and Security

Denzil Ferreira, Vassilis Kostakos, Alastair R. Beresford, Janne Lindqvist and Anind K. Dey

Short: Security and System Architecture: Comparison of Android Customizations

Roberto Gallo, Ricardo Dahab, Henrique Kawakami, Patricia Hongo, Kaio Karam, Luiz Navarro, Luander Ribeiro and Glauco Junqueira

10:30 - 11:00

Coffee Break

11:00 - 12:00

WiSec and RFIDsec Keynote: Security for Low-End IoT Devices: When Energy is Not Enough, What is One to Do?

Speaker: Wade Trappe (Rutgers University)


There is a push to extend the boundary of the Internet to include a wide array of nontraditional computing devices, ranging from programmable thermostats to wearable systems to devices that monitor and track people/objects. Many of these new networkable devices, which constitute the Internet of Things (IoT), are low-end, lowenergy and lightweight computing devices. This talk will present the viewpoint that securing the low-end of the IoT cannot be addressed using the cryptographic tools as the operating energy and computational regime for this portion of the IoT will not be conducive for traditional security approaches. The low-end, low-energy, and lightweight computing that will characterize the edge of the Internet of Things will come with considerable restrictions on how one designs their various functions. What is needed is a change of perspective, where at the outset one takes into account the resource sparsity and the limitations that might result in terms of security. In this talk, we examine the challenge of securing devices that are characterized as having significant limitations in functionality, and energy resources. We outline the various security objectives that one might desire in the Internet of Things. Next, we argue that there is no simple solution that will provide enough energy to allow these low-end IoT devices to operate on their own and allow one to support additional functionality beyond the basic (non-security) functions of these devices. Further, we also examine conventional cryptographic methods and make the case that it is unlikely that strong cipher suites will ever be suitably designed and implemented to operate in such an energy-sparse setting. We thus arrive at the main thesis of this talk, which suggests alternative approaches for providing security for low-end IoT devices. We identify a few directions at the device itself, as well as suggest that one powerful avenue for supporting security involves are typically communicating with higher-end, more resource-rich devices that can perform more computation (and, in particular, signal analysis) to ensure the sanctity of their low-end counterpart's communication. The talk concludes by highlighting future directions in supporting security for light-weight devices.

About the speaker:

Wade Trappe received his B.A. in Mathematics from The University of Texas at Austin in 1994 and his Ph.D. in Applied Mathematics and Scientific Computing from the University of Maryland in 2002. He is currently a Professor in the Electrical and Computer Engineering Department at Rutgers University, and Associate Director of the Wireless Information Network Laboratory (WINLAB), where he directs WINLAB’s research in wireless security. He has led several federally funded in the area of cybersecurity and communication systems, projects involving security and privacy for sensor networks, physical layer security for wireless systems, a security framework for cognitive radios, the development of wireless testbed resources (the ORBIT testbed, www.orbit-lab.org), and new RFID technologies. Prof. Trappe led a DARPA initiative into validating and prototyping physical layer security mechanisms, an Army Research Office project on the theory of physical layer security, and is currently leading an Army project on cognitive radio networks and MIMO communications. He has developed several cross-layer security mechanisms for wireless networks, jamming detection and jamming defense mechanisms for wireless networks, and has investigated privacy-enhancing routing methods. He has published over 150 papers, including six best papers awards. His experience in network security and wireless spans over 15 years, and he has coauthored a popular textbook in security, Introduction to Cryptography with Coding Theory, as well as several notable monographs on wireless security, including Securing Wireless Communications at the Physical Layer and Securing Emerging Wireless Systems: Lower-layer Approaches. Professor Trappe has served as an editor for IEEE Transactions on Information Forensics and Security (TIFS), IEEE Signal Processing Magazine (SPM), and IEEE Transactions on Mobile Computing (TMC). He is currently the US Regional Director for the IEEE Signal Processing Society.

12:00 - 12:45


12:45 - 13:30

WiSec Poster/Demo Session

13:30 - 14:45

WiSec Session 4: Authentication and Integrity in Mobile Systems (Chair: Matthias Hollick)

Injection Attacks on 802.11n MAC Frame Aggregation

Pieter Robyns, Peter Quax and Wim Lamotte

A Practical Investigation of Identity Theft Vulnerabilities in Eduroam

Sebastian Brenza, Andre Pawlowski and Christina Pöpper

Short: Danger is my middle name: Experimenting with SSL Vulnerabilities in Android Apps

Lucky Onwuzurike and Emiliano De Cristofaro

14:45 - 15:00

Short Break

15:00 - 16:15


16:15 - 16:45

Coffee Break

16:45 - 18:15

WiSec Session 5: Mobile (A)Social Network Security (Chair: Panagiotis Papadimitratos)

SHIELD: A Data Verification Framework for Participatory Sensing Systems

Stylianos Gisdakis, Thanassis Giannetsos and Panos Papadimitratos

Liveness Verifications for Citizen Journalism Videos

Mahmudur Rahman, Mozhgan Azimpourkivi, Umut Topkara and Bogdan Carbunar

How Far Removed Are You? Scalable Privacy- Preserving Estimation of Social Path Length with Social PaL

Marcin Nagy, Thanh Bui, Emiliano De Cristofaro, N Asokan, Jorg Ott and Ahmad-Reza Sadeghi

Friday June 26

8:15 - 9:00

Continental Breakfast

9:00 - 10:30

WiSec Session 6: Vehicular Systems Security (Chair: Christina Pöpper)

Short: A Framework for Evaluating Pseudonym Strategies in Vehicular Ad-Hoc Networks

David Förster, Frank Kargl and Hans Löhr

Short: Device-to-Identity Linking Attack Using Targeted Wi-Fi Geolocation Spoofing

Célestin Matte, Jagdish Prasad Achara and Mathieu Cunche

CAPS: Context- Aware Privacy Scheme for VANET Safety Applications

Karim Emara, Wolfgang Wörndl and Johann Schlichter

Is Your Commute Driving you Crazy? A Study of Misbehavior in Vehicular Platoons

Bruce Debruhl, Sean Weerakkody, Bruno Sinopoli and Patrick Tague

10:30 - 11:00

Coffee Break

11:00 - 12:30

WiSec Session 7: Side Channels (Chair: Yossi Oren)

Harvesting Developer Credentials in Android Apps

Yajin Zhou, Lei Wu, Zhi Wang and Xuxian Jiang

TextLogger: inferring longer inputs on touch screen using motion sensors

Dan Ping, Xin Sun and Bing Mao

WeChecker: Efficient and Precise Detection of Privilege Escalation Vulnerabilities in Android Apps

Xingmin Cui, Jingxuan Wang, Lucas C.K. Hui, Zhongwei Xie, Tian Zeng and S.M. Yiu

12:30 - 12:45

Concluding Remarks

12:45 - 14:00

Lunch (on your own)

14:00 - 17:00

WiSec Tutorial: Millimeter Wave Cellular Wireless Networks for 5G

Speaker: Sundeep Rangan (University of Michigan, Ann Arbor & Bell Labs)


With the severe spectrum shortage in conventional cellular bands millimeter wave (mmWave) frequencies, roughly between 30 and 300 GHz, have attracted growing attention for next-generation micro- and pico-cellular wireless networks. The mmWave bands offer vastly greater spectrum than current cellular allocations and enable very high-dimension antenna arrays for further gains via beamforming and spatial multiplexing. However, the propagation of mmWave signals in outdoor non line-of-sight (NLOS) links remains challenging. In this tutorial, I will provide an overview of the recent measurements, trials and capacity projections that suggest that these systems may offers orders of magnitude greater capacity than current cellular allocations. However, reaching the full potential of the mmWave bands will require significant changes in the way networks are designed today and I will discuss various research efforts and preliminary results in the PHY, MAC and networking layers. The tutorial should be of interest to engineers and researchers in any area of wireless networks or related field.

About the speaker:

Sundeep Rangan received the B.A.Sc. at the University of Waterloo, Canada and the M.Sc. and PhD at the University of California, Berkeley, all in Electrical Engineering. He has held postdoctoral appointments at the University of Michigan, Ann Arbor and Bell Laboratories, Murray Hill, NJ. In 2000, he co-founded (with four others) Flarion Technologies, a spin off of Bell Labs, that developed Flash OFDM, one of the first cellular OFDM data systems and precursor to modern 4G system such as LTE. In 2006, Flarion was acquired by Qualcomm Technologies where Dr. Rangan was a Director of Engineering involved in OFDM infrastructure products. He joined the ECE department at NYU-Poly in 2010 as an Associate Professor. He is also the Associate Director of NYU WIRELESS -- an industry-academic partnership program for shaping 5G cellular. His research interests are in wireless communications, signal processing, information theory and control theory.