Peter Quax

Short paper: exploiting WPA2-enterprise vendor implementation weaknesses through challenge response oracles

Many of todays enterprise-scale wireless networks are protected by the WPA2-Enterprise Protected Extensible Authentication Protocol (PEAP). In this paper it is demonstrated how an attacker can steal a users credentials and gain unauthorized access to such networks, by utilizing a class of vulnerable devices as MSCHAPv2 challenge response oracles. More specifically this paper explains how on these devices, Lightweight EAP (LEAP) MSCHAPv1 credentials can be captured and converted to PEAP MSCHAPv2 credentials by using a rogue Access Point. This man-in-the-middle vulnerability was found to be present in all current versions of Apples iOS and OS X operating systems, and may impact other devices as well. A proof-of-concept implementation is available that shows how Authentication Server certificate validation and certificate pinning mechanisms may be bypassed. Mitigation strategies for the attack and protective actions which can be undertaken by end-users are also described in this paper.

Remote rendering solutions using web technologies

Remote rendering is a well-known solution to the issue of running high-performance applications requiring complex visualizations on less capable hardware/software platforms or when client access to the data source for visualization is undesired or prohibitive in terms of required bandwidth. Visualizing the output of these remote rendering applications is typically achieved through native applications or, when considering a browser environment, through plug-ins. In this paper, several solutions are presented that enable deployment of these applications on standard web browsers, even those from the pre-HTML5 era. The focus in this paper is on two specific use case scenarios, taking into account that the proposed solutions are generic enough to be applied to a range of similar applications. The technologies presented cover the entire range of sub-processes contained in a complete remote rendering solution, such as the establishment of interaction feedback channels and delivery of images as part of the rendering pipeline. Depending on factors such as application requirements, developer preferences, feature availability in the web browser or raw performance figures, a custom solution can be composed from the options discussed in this paper. This is illustrated by applying them to the two aforementioned use cases, each with specific requirements and challenges, and benchmarking these example setups in terms of performance. A comparison of advantages and disadvantages is presented to guide developers in applying the technologies under real-life conditions.

An optimized adaptive streaming framework for interactive immersive video experiences

This paper describes how optimized streaming strategies, based on MPEG-DASH, can be employed to power a new generation of interactive applications based on immersive video. The latter encompasses ultra-high-resolution, omnidirectional and panoramic video. The goal is to deliver experiences that are made up of multiple videos of short duration, which can be joined at run-time in an order defined through user interactions. Applications of the technology are widespread, ranging from virtual walkthroughs to interactive storytelling, the former of which will be featured in detail. The main technological challenges tackled in this paper are to deliver these experiences in a seamless fashion, at the highest quality level allowed by network conditions and on a wide range of platforms, including the Web. Besides these, the paper focuses on the two-tier software architecture of the proposed framework, as well as a short evaluation to substantiate the validity of the proposed solutions.

Web Performance Characteristics of HTTP/2 and Comparison to HTTP/1.1

The HTTP/1.1 protocol has long been a staple on the web, for both pages and apps. However, it has started to show its age, especially with regard to page load performance and the overhead it entails due to its use of multiple underlying connections. Its successor, the newly standardized HTTP/2, aims to improve the protocol’s performance and reduce its overhead by (1) multiplexing multiple resources over a single TCP connection, (2) by using advanced prioritization strategies and by introducing new features such as (3) Server Push and (4) HPACK header compression.

POSTER: Assessing the Impact of 802.11 Vulnerabilities using Wicability

Wicability is an open platform created for researchers, that aims to provide insights into the spatial and temporal impact of both novel and past 802.11 security vulnerabilities. This is achieved through the automated collection and analysis of large datasets containing 802.11 Information Elements (IEs) transmitted by access points and stations. The results of this analysis are anonymized and provided free of charge to researchers through a web interface.