Security Research Labs

Security Research Labs
Name	Security Research Labs
Type	Research organization
Founded	2009
Headquarters	Berlin
Key people	Karsten Nohl, Ralf-Philipp Weinmann
Fields	Computer security, privacy, cryptography

Security Research Labs

Security Research Labs is a research collective focused on applied computer security and privacy engineering, known for public disclosures, tool development, and protocol analysis. The group interacts with academic institutions such as Technische Universität Berlin, University of Oxford, Massachusetts Institute of Technology, and Stanford University, collaborates with industry partners like Google, Microsoft, Apple Inc., and Facebook, and participates in standards processes at organizations including Internet Engineering Task Force, European Union Agency for Cybersecurity, and International Organization for Standardization.

History

Founded in 2009 by security researchers with backgrounds linked to Chaos Computer Club, Fraunhofer Society, and Darmstadt University of Technology, the organization gained attention for work on mobile network vulnerabilities, cryptographic protocol analysis, and hardware reverse engineering. Early publications drew on incidents involving Stuxnet, Duqu, Flame (computer worm), and influenced responses from entities such as European Commission, Bundesamt für Sicherheit in der Informationstechnik, and US Department of Homeland Security. Over time the lab published results alongside researchers from Karlsruhe Institute of Technology, ETH Zurich, University of Cambridge, and Royal Holloway, University of London and presented at conferences including Black Hat USA, DEF CON, RSA Conference, Usenix Security Symposium, and ACM CCS.

Research Areas

The lab’s work spans vulnerabilities in mobile telephony systems like GSM, UMTS, and LTE, analysis of cryptographic protocols such as RSA (cryptosystem), Elliptic-curve cryptography, and Diffie–Hellman key exchange, and assessments of hardware security for devices using Trusted Platform Module and Intel SGX. Research also covers side-channel attacks demonstrated against platforms referenced in publications from NIST, IETF, and IEEE Security and Privacy. Collaboration with groups at University of California, Berkeley, Carnegie Mellon University, Princeton University, and Imperial College London expanded work into supply-chain threats exemplified by incidents like SolarWinds hack and firmware compromises documented by Kaspersky Lab and Symantec (Broadcom).

Methods and Tools

Techniques include protocol fuzzing using frameworks inspired by tools from AFL (American Fuzzy Lop), Peach Fuzzer, and custom implementations used at SANS Institute trainings. Hardware analysis leverages equipment from Rohde & Schwarz, Keysight Technologies, and techniques from chip-off forensics and JTAG debugging. Cryptanalysis employs libraries such as OpenSSL, libsodium, and testing suites from Cryptrec. Measurements incorporate passive monitoring with systems similar to those used in studies by CAIDA, RIPE NCC, and APNIC, while active probing uses methods discussed in papers at SIGCOMM, IMC (Internet Measurement Conference), and NDSS Symposium.

Notable Labs and Institutions

Collaborative partners and peer institutions include Max Planck Institute for Informatics, Graz University of Technology, University of Waterloo, École Polytechnique Fédérale de Lausanne, and Tsinghua University. Industry labs with intersecting research agendas are Google Project Zero, Microsoft Research, Apple Security],] Facebook AI Research, IBM Research, and Cisco Talos. Governmental and intergovernmental bodies engaged in joint initiatives include ENISA, European Parliament, US Cyber Command, National Institute of Standards and Technology, and German Federal Intelligence Service.

Ethics, Regulation, and Legal Issues

The group navigates disclosure policies comparable to frameworks established by CERT Coordination Center, Coordinated Vulnerability Disclosure, and standards from ISO/IEC. Legal tensions arise in contexts similar to cases involving WannaCry, Equation Group, and export-control debates tied to Wassenaar Arrangement. Ethical debates reference positions from ACM and IEEE, and litigation or regulatory scrutiny has parallels with high-profile actions involving Apple Inc. and FBI, as well as compliance regimes like the General Data Protection Regulation and rulings by the European Court of Human Rights.

Impact and Applications

Findings influenced telecom operators such as Deutsche Telekom, Vodafone Group, T-Mobile, and AT&T, prompted firmware patches from vendors like Huawei, Ericsson, Nokia, and Samsung Electronics, and shaped protocol revisions adopted by 3GPP and recommendations by IETF. Tools and techniques have been employed in security audits by PwC, Deloitte, KPMG, and EY, and informed government cybersecurity strategies at Bundesministerium des Innern, UK National Cyber Security Centre, and US Cybersecurity and Infrastructure Security Agency. Academic impact is evident in citations across journals such as IEEE Transactions on Information Forensics and Security, Journal of Cryptology, and conferences like Eurocrypt and Usenix Annual Technical Conference.

Category:Computer security