CeBIT 2007

On Saturday I took my annual trip to Hannover to visit the CeBIT trade fair. I just want to give my impressions what I have found to be interesting there.

Plasma TVs can have lower power consumption than LCD TVs

This is quite interesting since people still believe Plasma TVs have a high power consumption. However, in contrast to LCD TVs, which always have a constant power consumption (about 160-240 W, depending on the model), Plasma TVs can very in their consumption depending on the current image to display. If the image is very bright, e.g., a white screen or a snow landscape, Plasma TVs have a high power consumption (let’s say 200 W, depending on the model of course). But if the image is dark, e.g. black screen or a night scene in a movie, Plasma TVs consume very less than their maximum consumption (e.g., 60 W only). So, depending on your TV watching habits, a Plasma TV might even save energy compared to a LCD TV!

Mobile phones for older people become more usable and cheaper

I discovered a mobile phone which was especially designed for older people. The “emporiaLife” phone has larger buttons than usual phones, a large display that shows the dialed numbers much bigger, and a special emergency button, which you only have to press to get connected to a number you have previously defined (there can be up to five different emergency numbers). The device is dual-band, can send and receive SMS, and has included a flashlight. At the booth they told me the price will be about 200 Euros.

Car navigation devices get more functionality

There seems to be the trend to integrate a variety of functionality into car (or mobile) navigation devices. I have seen the integration of DVB-T TV or Bluetooth connection to mobile phones at several vendors. One example is Naviflash. Some interesting detail I have also discovered: Naviflash has a flexible bracket with some kind of “ground support” to stabilize the device when attached at the windshield.

Digital picture frames

A lot of vendors now offer digital picture frames, for instance Samsung and its SPF-07N. A digital picture frame displays a digital photo, similar as a normal “hard-cover” picture frame. But a digital picture frame can store several pictures and display them alternately, e.g., changing them periodically or at command. This might become a new big trend; at least if prices are acceptable.

“I’ll call you by trousers”

In the Future Parc, they showed (amongst others) smart textiles. These are clothes which integrate some digital functionality, usually control panels for electronic devices. Funny example: leather trousers with a control panel for a mobile phone. :-)

Phishing Attacks Predicted among Top Security Threats for 2007

On TechNewsWorld, there is an article about the prediction of the top security threats for the year 2007. Most of the predicted attacks mentioned are related to phishing attacks and identity theft. The prediction is given by the companies McAcfee and MessageLabs. Besides faked Web sites that try to steal passwords, more and more phishing attacks will use malware to achieve their goals, e.g., malicious code distributed through video files, spoofing of IM (instant messaging) identities. Interestingly, they also predict phishing attacks through VoIP (voice over IP) using spoofed phone calls.

Security by Configuration

There is an interesting article on Linux.com about configuration-centered security, “Configuration: The Forgotten Side of Security” (by Bruce Byfield). Whereas most security products on the market follow the approach of reactive security (e.g., anti-virus scanners, patches), a proactive approach includes security aspects in the design and installation of a computer system. Intuitively, taking security into account right from the start should be the better approach because design flaws in a software architecture are harder to fix later. The article gives some hints why the computer industry has not followed this approach. One reason mentioned is the tradeoff between security and convenience. But counter-examples are given (for instance, Mac OS X *g*), and an IT professional is cited that “usability and security are not mutually exclusive”. And I think that is absolutely right.

The article lists the basic goals of system configuration, which are derived from basic security principles (e.g., least privilege, containment, etc.):

• Build for a specific purpose and only include the bare minimum needed to accomplish the task.


• Protect the availability and integrity of data at rest.


• Protect the confidentiality and integrity of data in motion.


• Disable all unnecessary resources.


• Limit and record access to necessary resources.

I think these goals should be applied especially for online banking applications in the context of phishing attacks. Having full-featured, complex web browser applications seems not to be the right basis for such tasks, does it? Well, maybe the idea of browser compartments is a good starting point…

Towards Multicolored Computing - Compartmented Security to Prevent Phishing Attacks

This is a paper that I have written together with Sebastian Gajek, Ahmad-Reza Sadeghi, and Christian Stüble. I have presented the paper at the 1st Benelux Workshop on Information and System Security (WISSec 2006) in Antwerpen, Belgium, last month. The paper aims at making the first steps towards the design and implementation of an open source and interoperable security architecture that prevents both classical phishing (e.g., e-mails luring unaware users to faked web sites) and the new emerging malware phishing, i.e., malicious software specifically tailored to certain services.

Our approach is based on the ideas of multicolored computing (e.g., red for the risky and green for the trusted domain), and a trusted wallet for storing credentials and authenticating sensitive services. Our solution requires no special care from users for identifying the right web sites while the disclosure of credentials is strictly controlled. In the paper we present the main idea of how to integrate countermeasures against phishing and malware into one sound security architecture. We also briefly sketch how to implement this architecture based on the PERSEUS security framework, which utilizes Trusted Computing functionality and virtualization. The former is used to preserve system integrity, and the latter provides compartment isolation and software re-use.

To establish a trusted path to the trusted wallet we make use of the Secure GUI subsystem that is developed by the EMSCB project for the PERSEUS system. the Secure GUI subsystem provides to each compartment an isolated graphics framebuffer, which are then multiplexed or switched to on the screen. To enable the user to authenticate the currently displayed compartment, the Secure GUI has a reserved area on the screen to which no compartment has access. The Secure GUI displays the compartment identifier and the color indicating a trusted (green) or untrusted (red) compartment there.

You can download the paper as PDF.

TCG Inside? - A Note on TPM Specification Compliance

This is a paper that I have written together with Ahmad-Reza Sadeghi, Marcel Selhorst, Christian Stüble and Christian Wachsmann, and I am going to present it at the First ACM Workshop on Scalable Trusted Computing (STC’06) in Fairfax, Virginia, USA, next month. The paper describes the first steps towards having an independent means for testing the compliance of Trusted Platform Module (TPM) chips according the TCG specifications. Besides presenting a test strategy, we have also developed a prototype test suite. Although the currently implemented tests do not cover the complete TCG specification, our test results show that many TPM implementations do not meet the TCG specification and have bugs. We also discuss that non-compliance may have crucial impact on security. For instance, non-compliant error return codes may be useful for profiling TPM chip models. These profiles may then be used in further attacks, e.g., password dictionary attacks.

We have already published first results of our tests in a technical report, which was also mentioned in the c’t magazine (“Sicherheits-Chips auf den Zahn gefühlt”, in German). For more information, see our project website on TPM Compliance Tests.