Abstract-Band - Fakultät für Informatik, TU Wien - Technische ...

y providing the ability to interface with existing directory services and
authentication mechanisms. The reporting component provides the end users
with personalized reports of their resource consumption. For the use by
managers, administrators and other parties in charge of IT, the data can be
summarized by users and departments or the whole organization. The
component can be extended by additional modules and configured by an
administration website.
Adrian Marek Dabrowski
Security Analysis of Metropolitan Locking Systems Using the Example of the
City of Vienna
Studium: Masterstudium Software Engineering & Internet Computing
BetreuerIn: Ao.Univ.Prof. Dr. Wolfgang Kastner
In this work, we carried out a black-box analysis of the electronic contact-less
BEGEH system that has been steadily replacing the conventional mechanical BG
key on multi-party houses in Vienna. The BG key has been introduced originally
to allow mail delivery services to access multi-party houses but has since then
aggregated additional users. We have found several vulnerabilities in the new
system caused by the design, technology used, organization, and its implementation.
We have further shown that the new system is circumventable with
little costs.This effectively nullifies many security advantages promised by the
manufacturer. We found a configuration issue, enabling access to 43% of all
installations with a reprogrammed transponders worth approximately 2, such as
an old ski pass. We have also shown that it is not necessary to break the
encryption of the data, as it can be replayed together with its UID-derived key.
Therefore, we built a card simulator for less than 20. We also conclude that the
way blacklist updates are organized, raises the black market value of physically
stolen keys. On two more examples (an electronic purse and an UID based
access system) we demonstrated that similar issues are found in other systems
as well. We show that UID based solutions offer a lower level of security than
could be expected, especially when not enough attention is payed to the
entropy of the UID space.
Duc Hoa Do
Möglichkeiten des Nachweises der funktionalen Sicherheit von technischen
Systemen
Studium: Masterstudium Wirtschaftsingenieurwesen Informatik
BetreuerIn: Em.O.Univ.Prof. Dr. Gerhard Helge Schildt
12
Die Einhaltung grundlegender sicherheitstechnische Prinzipien erhöht nicht nur
die Zuverlässigkeit von technischen Systemen, sondern wird häufig auch vom
Gesetz gefordert. Diese Diplomarbeit beschäftigt sich zuerst mit den zwei
Normen EN 61508 und ISO 26262. Während die EN 61508 generisch ist und
sich hauptsächlich mit der Risikobewertung von sicherheitsbezogenen tech-