1194 research outputs found
Sort by
Open Source Intelligence Training in Hacking-Lab (SA)
Get PDFIn cyber security the topic of Open-source intelligence (OSINT) plays a major role. With OSINT security defender and researcher may find valuable information about cyber crime and attackers. OSINT helps to understand the effects of sharing public information. OSINT is not yet part of the curriculum at OST. An e-learning platform called Hacking-Lab already exists and is used at OST. In Hacking-Lab, students can apply what they have learned in the lecture in a controlled environment in the form of practical hands-on exercises.
The goal of this thesis was to create ten OSINT challenges in the Hacking-Lab for students to solve and practice. In every OSINT challenge, students are given a set of tasks and summative assessment questions. The students are guided through the proposed steps in order to answer the posed questions in form of a write-up.
Each OSINT challenge is framed by a story to make them more engaging. These stories were chosen in a way that many different OSINT techniques are applicable and can be practiced by the students. In OSINT there is not only one way to find the correct answer hence the students are also encouraged to find their own way to reach the expected solution. To guarantee a high quality of the challenges, multiple quality assurance tests were conducted with students and colleagues working in IT. The results of these quality tests are an indicator whether the goal was reached.
As a result of this work, the goal of creating ten OSINT challenges in Hacking-Lab was achieved. These challenges provide some insight into the topic of OSINT without getting lost in details and technicalities.
This project provides a foundation which a lecturer can build upon by creating a lecture on OSINT. This lecture could be integrated in a course on cyber security. Social media was purposely neglected in this project because social media is difficult to maintain and make future-proof, which makes it incompatible with the project's requirements. Therefore, it could also be a future project to expand upon these challenges with a focus on social media as it is an indispensable part of OSINT
Showroom fur den zukunft.bahnhof Lichtensteig
Get PDFDas Ziel dieser Arbeit ist es, in einem Showroom das Projekt zukunft.bahnhof in digitaler Form erlebbar zu machen.
Dazu gehört sowohl die Entwicklung eines Konzepts für ein interaktives Besuchserlebnis, wie auch die prototypische Implementierung in Form einer Applikation.
Zudem soll der gewählte Lösungsansatz kritisch reflektiert werden, um Möglichkeiten zur Weiterentwicklung und iterativen Verbesserung aufzuzeigen.
Mithilfe einer Literaturrecherche wurden mögliche Realisierungsansätze sowie Technologien erfasst.
Eine Nutzwertanalyse sowie ein Workshop mit einer Fokusgruppe diente dem Vergleich der Ansätze sowie der Wahl eines zu realisierenden Produkts.
Als Teil eines Gesamtkonzepts für den Showroom, wurde eine Virtual Reality Applikation in Form einer WebApp realisiert.
Die Applikation besteht dabei aus einem NGINX Reverse Proxy, welcher sowohl das React Frontend, wie auch das ASP.Net Core Backend bereitstellt.
Das Areal von Lichtensteig ist in einem Unity Projekt modelliert. Die Daten werden in einer PostgreSQL Datenbank via Entity Framework Core persistiert.
Alle Komponenten werden mittels Continuous Delivery getestet, gebuildet und in Docker Containern ausgeliefert.
Der Prototyp dieser VR Applikation für den Showroom ermöglicht es den Besuchenden auf eindrucksvolle und spielerische Art Informationen zum Projekt zukunft.bahnhof zu vermitteln.
Benutzende können dabei das Projektareal in Lichtensteig virtuell betrachten und sich spezifisch zu den einzelnen Teilen des Projekts erkunden.
Durch die Möglichkeit der eigenen Arealgestaltung, sowie Kommentar- und Feedback-Funktionen können sich Besuchende des Showrooms partizipativ im Projekt einbringen.
Da der Prototyp als WebApp realisiert wurde, kann die Applikation auch auf mobilen Geräten genutzt werden.
Somit kann das Nutzererlebnis auch nach einem Besuch im Showroom noch fortgeführt werden
Pantry - Price And NuTRition analYsis of cooking recipes
Get PDFWenn man in einem Kochbuch oder im Internet ein Rezept betrachtet, hätte man oft gerne weiterführende Informationen darüber, was der Einkauf der Produkte für das Rezept kostet und welche Nährwerte das Rezept enthält.
Genau bei diesem Problem setzt die entwickelte Web-App «Pantry» (Price And NuTRition analYsis of cooking recipes) an. «Pantry» ermöglicht es dem Benutzer auf einfache Weise ein Rezept mit mehreren Zutaten zu erfassen. Darauf schlägt die Web-App dem Benutzer ein Produkt je Zutat vor. Des Weiteren werden dem Benutzer der Gesamtpreis für den Kauf aller Produkte, der spezifische Preis für sein Rezept, als auch die totalen Nährwerte, welche sein Rezept enthalten, ausgewiesen. Auf Grundlage dieser von «Pantry» gelieferten Informationen kann der Benutzer dann leichter entscheiden, ob er ein Rezept zubereiten möchte.
Durch eine zusätzlich aufgebaute Produktdatenbank ist «Pantry» in der Lage Produktvorschläge zu machen. Um diese Datenbank zu befüllen, wurde ein Web-Scraper in Python mit Hilfe der Libraries Scrapy und Playwright entwickelt, welcher die Produkte von der öffentlichen Coop-Webseite sammelt, aufbereitet und in die Datenbank einfügt.
Die Web-App wurde dabei mit React realisiert, welche im Hintergrund eine REST-API verwendet. Die auf Spring Boot basierende REST API greift dann auf die Produktdatenbank zurück, um dem Benutzer Produktvorschläge für seine gewünschten Zutaten machen zu können.
Die entwickelte Web-App «Pantry» erfüllt die gesetzten Ziele, hat aber noch Weiterentwicklungspotenzial. So wäre es in Zukunft sicher sinnvoll den Web-Scraper auf weitere Verkäufer (z.B. Migros) auszuweiten, damit «Pantry» Produkte von verschiedenen Anbietern vorschlagen kann
Response Recommendations to Cyber Security Threats
No full textCyber security threats continue to pose a major challenge to organizations. While there is an abundance of technologies and products assisting the detection and investigation of threats, supporting security operation teams in responding to threats has received limited attention. Modern Endpoint Detection and Response (EDR) systems provide the possibility to react in real time to cyber threats, but still lack the ability to predict the impact of the responses on the system environment.
This student research project realizes a proof-of-concept application for impact calculation of cyber incident responses. The focus is on supporting the cyber security analyst in making a decision on the best suited response by providing additional information about the environment. The application receives security alerts from an EDR system and calculates the impact of possible responses which are then presented to the analyst. Consequently, the analyst can decide on the most suited response, considering its impact on the environment. The application itself is a three-tier architecture which consists of a frontend, a backend, and a persistency tier. The frontend presents the relevant information to the analyst and allows the inspection of alerts and their responses. The backend provides the calculation and alert data handling functionalities. To model and calculate the implications, the environment is abstracted in a graph data model implemented in a persistent graph database. This data model is pre-configured, based on the real environment, and serves as starting point for further elaboration by the analyst.
The application implements different subject areas such as data modelling, matching security responses to given incidents, as well as impact calculation of an incident response under consideration of an environment model. It can retrieve security alerts from an EDR system which are then processed by the backend. This data, together with additional information about the environment, is then visually presented to the analyst.
The combination of security events, possible responses and the impact calculation supports a cyber security analyst making more efficient decisions to mitigate a threat. This builds the basis for further development such as an extended data model or more extensive impact calculations
Analyse und Optimierung des Aktionsprozesses des Warenwirtschaftssystems eines Schweizer Grossverteilers
Get PDFIn einem Einzelhandelsunternehmen ist die Warenwirtschaft eine komplexe Tätigkeit. Für jedes Produkt muss die richtige Menge immer verfügbar sein. Tausende von Produkten müssen gleichzeitig verwaltet werden, weshalb es selbstverständlich ist, dass die Warenwirtschaft effizient und automatisiert sein muss.
Im Jahr 2013 hat die Firma Ergon Informatik AG in Zusammenarbeit mit Coop eine erste Version der Web-App für die Warenbewirtschaftung mit dem Namen ERGO veröffentlicht. Schnelligkeit und Benutzerfreundlichkeit, kombiniert mit einer modernen Architektur, waren die wichtigsten Anforderungen für Coop.
ERGO unterstützt die Coop-Mitarbeiterinnen und -Mitarbeiter bei ihrer täglichen Arbeit und sorgt dafür, dass die Bestandsinformationen in allen Filialen immer aktuell sind. Gute Umsätze hängen von der optimalen Funktionsweise von ERGO ab und viele Prozesse bei Coop sind darauf abgestimmt. Mitarbeitende werden jährlich geschult und ein internes Innovations- und Entwicklungsteam am Coop-Hauptsitz in Basel kümmert sich um die Pflege der Software und veröffentlicht regelmässig Releases.
Mehrere Jahre nach seiner Veröffentlichung entstand bei Coop jedoch der Wunsch, innovative Lösungen zu entwickeln und auf die neuen Bedürfnisse der Mitarbeiter und Mitarbeiterinnen zu reagieren. Es ist schwierig und zeitaufwändig, regelmässig Feedback von Mitarbeitern und Mitarbeiterinnen von Coop einzuholen. Heute besteht die Herausforderung darin, die User von ERGO zu beobachten, zu verstehen und Verständnis für ihre Schwierigkeiten aufzubringen, um eine Lösung zu entwickeln, die es ihnen ermöglicht, die ERGO Web-App optimal zu nutzen.
Genau hier setzt das Projekt «Analyse und Optimierung des Aktionsprozesses des Warenwirtschaftssystems eines Schweizer Grossverteilers» an.
Die Untersuchungen konzentrieren sich auf einen der am häufigsten verwendeten Prozesse in der ERGO Web-App: den Aktionsprozess. Die entwickelten Lösungen ermöglichen es Coop, die Arbeit der Mitarbeiter bzw. Mitarbeiterinnen in Verkaufsstellen besser zu unterstützen
Embedded Programming with Embedded Domain-Specific Languages (EDSLs) in Haskell
Get PDFEmbedded domain-specific languages (EDSLs) make it possible to program embedded systems with Haskell. Programming in Haskell has many advantages such as the reduction of runtime errors and writing code more elegantly. The Haskell library Haskino provides two EDSLbased variants for programming Arduinos. In the first variant, commands are sent interactively to an Arduino that is connected to the computer. The second variant turns the Haskell code into an abstract syntax tree (AST) representing actions and computations. This structure can be used to generate C code that can be executed directly on the Arduino. The advantage of Haskell becomes apparent when using paradigms such as functional reactive programming (FRP). In the first variant offered by Haskino, FRP can be used without any problems because it is executed in the Haskell environment. In the second, it would be necessary to integrate the FRP functionality into the AST and to define the translation into C. The ability to run FRP code directly on Arduino is demonstrated by the frp-arduino library. This paper introduces EDSLs in Haskell, their application in the Haskino library, and shows an Arduino programming example using Haskell and FRP
FlatFeeStack Go-Live
Get PDFThe FlatFeeStack platform offers a convenient and transparent way for individuals and companies to show their support for open-source projects. It operates on a simple model where users pay a fixed fee of $125 annually. Through FlatFeeStack, contributors to open-source projects receive funds based on their contribution level, measured by analyzing Git commits. Payments can be made using credit cards, and the platform supports payouts using cryptocurrencies.
The platform has been in development for several years now. The platform is primarily feature-complete, so it should be opened to the public. A platform-as-a-provider was evaluated as part of the thesis, and a continuous deployment strategy leveraging GitHub Actions was implemented. The platform uses Prometheus and Grafana for monitoring, which allows to observe both infrastructure and application-relevant metrics. The existing decentralized autonomous organization (DAO) is now accompanied by a forum where members can discuss proposals before they are written onto the blockchain. A complete overview of all the functionality was created, and bugs were fixed that were discovered during the creation of this overview.
On June 2nd, the platform was silently launched, and initial contributions to open-source projects were distributed on the same day
Test Result Viewer
Get PDFSonova AG is a company based in Stäfa, Switzerland, and is known for the development of high quality hearing aids and other audio-related products. Their development division currently uses several custom made tools for the visualization of automated test results. They suffer from various deficiencies and should be replaced by one single platform.
In existing off-the-shelf solutions it is often the assumption that detailed information about test results is only relevant if there were any errors during execution. In case of a successful run, no details are presented to a developer except the final result "all passed".
Therefore, it has been decided that a new and custom platform should be built to replace the existing tools.
This platform receives test result files in different XML-based formats along with separate JSON metadata, which will be provided by the current infrastructure at Sonova.
The Data Consumer component parses and transformes these files into a unified schema. To create such a schema required the definition of what information is relevant for the visualizations. The results are then saved to a central data store and displayed by a frontend application. Elaborate requirements of what visualizations the platform should support have been provided by Sonova in advance.
We have evaluated different tools for the components and according to our own research, some recommendations and experience present at Sonova, we chose Python to implement the Data Consumer, Elasticsearch to store the data and Angular to implement the frontend.
The resulting product of this project serves as a prototype kind of implementation to be extended by Sonova in the future. The platform we have created contains two main visualizations as well as additional pages that display important metadata. It focuses on extensibility so that it supports implementing new requirements in existing as well as additional views
Design of a mobile-based user interface for eye workouts
Get PDFObjective
The objective of this thesis is to develop a mobile application that aims to make eye workouts more accessible to a wider audience, specifically targeting individuals suffering from headaches or migraines. The study focuses on investigating the research questions surrounding the development of the user interface and employs a user-centered approach to effectively address the challenge. By developing a mobile app that guides users through the process of specific eye exercises, the objective is to provide a convenient and accessible solution that can be practiced independently.
Approach
The study follows a user centered design process that includes a literature study, competitor analysis, requirement identification, user-centered interface design, technology evaluation, prototype implementation, and final evaluation. Research questions addressed in this study are:
1) Target Group: Identify the target audience to tailor the app experience to their preferences and needs.
2) Feedback Mechanisms: Explore reliable feedback methods to ensure correct execution of workouts.
3) User Retention: Develop strategies to encourage regular app usage for long-term benefits.
Conclusion
A functional prototype in the form of an angular web app was created based on the extensive conceptualization developed within the thesis. The implementation focused on addressing the research questions and provided valuable insights. The findings highlighted the importance of customization options to optimize the execution of eye workouts for different individuals. By enhancing personalization and ensuring usability according to recognized principles, the application can better cater to user needs. The recommendations and evaluation findings serve as a foundation for future iterations and improvements of the application, with a focus on customization and adherence to recognized usability principles
Ethereum Custody@PostFinance PoC
No full textIn collaboration with PostFinance AG and under the guidance of Dr. Thomas Bocek at the Department of Computer Science, OST, this semester assignment explores and enhances the custody solution of PostFinance’s digital assets offering. Given the increasing demand for secure storage of assets such as Ethereum, this work focuses on developing a robust self-managed custody solution that ensures the availability, confidentiality, and integrity of private keys.
The Proof of Concept (PoC) conducted as part of this project demonstrates a Custodian backend application, offering a RESTful HTTP API. This API enables the creation of secure single- and multisig wallets, facilitates buy and sell orders, and executing Ethereum transactions with these wallets. The private key material is securely stored in a Hardware Security Module (HSM) using the Securosys CloudHSM, specifically chosen for this project. Communication with the Ethereum network occurs through a self-operated full node setup, utilizing Besu as the execution client and Teku as the consensus client.
In addition, the project includes an analysis and elaboration of a secure method for signing transactions, employing multisig smart contracts in conjunction with a combination of hot and cold wallets.
While the project demonstrates feasibility, it is crucial to continue addressing privacy concerns and ensuring a privacy-compliant solution, especially within the context of a financial institution. Furthermore, it is important to evaluate which components should be developed and operated in-house versus outsourced, especially considering the addition of various other blockchains, as the development and maintenance burden could become substantial.
Overall, the established foundation, including the Custodian application, the chosen HSM, full node setup, and signing strategy using multisig smart contracts, lay the groundwork for a secure self-managed custody solution.
Keywords: Digital Asset Custody, Ethereum, Hardware Security Module (HSM