SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.
Rewatch our latest Security Meetup video starring Michael Koppmann, information security consultant at SBA Research. Title Type-Driven Domain Design – Security in the Fabric of Your Code Speaker Michael Koppmann Abstract Types in programming languages protect us from doing mistakes. It depends on the… Read More
Shibboleth Identity Provider OIDC OP plugin 3.0.3 or below is prone to a server-side request forgery (SSRF) vulnerability due to an insufficient restriction of the request_uri parameter. This allows unauthenticated attackers to interact with arbitrary third-party HTTP services. We recommend to update Shibboleth Identity Provider OIDC OP plugin to version 3.0.4 or later. For further details, see the full security advisory. Read More
On December 15, 2021 Mathias Tausig held an online talk for 189 participants at the WeAreDevelopers Security Day, powered by Bosch. The online event presented 4 talks in the field of Secure Software Development Lifecycle. Title Maturity assessment for technicians or how I learned to love OWASP SAMM Presenter… Read More
Title Verifying compliance in process choreographies: Foundations, algorithms, and implementation Authors Walid Fdhila, David Knuplesch, Stefanie Rinderle-Ma, Manfred Reichert Journal Information Systems (Link to article) Abstract The current push towards interoperability drives companies to collaborate through process choreographies. At the same time, they face a jungle of continuously… Read More
On December 1, 2021 Tanja Šarčević held a talk at the joint UNECE/Eurostat Expert Meeting on Statistical Data Confidentiality hosted by Statistics Poland in Poznań. Title Fingerprinting Relational Data Speaker Tanja Šarčević is researcher at SBA Research. Event UNECE/Eurostat Expert Meeting on Statistical Data The focus of… Read More
Tomasz Miksa published an article for the ACM Transactions on Management Information Systems Journal. Title Automating Research Data Management Using Machine-Actionable Data Management Plans Authors Tomasz Miksa, Simon Oblasser , Andreas Rauber Journal ACM Transactions on Management Information Systems, Vol. 13, No. 2 Abstract Many research funders… Read More
The collaboration of COMET partners in research projects is an important factor in boosting knowledge exchange and achieving best results.Condignum has been a FFG COMET partner for nearly two years now, we summarized our first joint results here: “The COMET program allows us to access an enormous… Read More
Two research articles by Kevin Mallinger, business developer at SBA Research, discussing novel advancements and applications of Digital Twins and Complexity Metrics supporting sustainability efforts got accepted for the special edition “AI Open Issue 2023: Environmental Sustainability Science, Artificial Intelligence and Digitization” of the international top Journal “Current… Read More
Our third newsletter was sent out last week. Check it out here! Highlights We introduce you to MLDM, our Machine Learning and Data Management Group (MLDM), including a video about their research activities. Launch of our new Professional Services website 15 years of… Read More
Philipp Reisinger, information security consultant at SBA Research, wrote a blog post (in German) for the WIFI about Cyber Security. He there explains how to deal with security and risks in the real and virtual world. Link to blog post… Read More
Together with sipgate and ISMK Stralsund, Gabriel Gegenhuber, researcher at SBA Research and University of Vienna, and Michael Pucher, researcher at SBA research, discovered and investigated a vulnerability in the Voice of LTE (VoLTE) stack that is broadly used within MediaTek-based smartphones. ∞
In the Mediatek modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. ∞