ESSE, the security team of RISE GmbH, discovered a new critical vulnerability in the ageing TLS (Transport Layer Security) protocol. The vulnerability has been presented at an international IT Security conference. TLS, which is better known as HTTPS (when paired with HTTP), and also known as SSL (Secure Socket Layer), is one of the most important and most used security protocols on the Internet. For example, TLS is widely and worldwide employed by e-banking systems.

The newly discovered weakness allows to open supposedly securely encrypted TLS communication to full-blown Man-in-the-Middle (MitM) attacks: The attack allows hackers to eavesdrop on private communication data and even modify sensitive data arbitrarily while in transit. The work of the security researchers of RISE GmbH closed a crucial security vulnerability. By making the technical details of the attack public, RISE GmbH helps to ensure that the weakness will not resurface in new systems. Among others, Apple’s own TLS library was affected. This allowed an attacker to compromise connections from Apple’s MAC OS X devices to sites such as Facebook. This backdoor has been closed! Facebook has appreciated our efforts with a bug bounty -- a global award.

More information and technical details https://kcitls.org/.

From March 6 – 8, 2015 the preliminary rounds of the VW codeFEST8 were held concurrently at eight universities in Germany, Austria and Switzerland. Within the theme "Mobility of the Future", a team of enthusiasts, all of them also employees of RISE, took up the challenge. After a sleep-deficient weekend and within just 28 hours, the team was able to implement a connected car data transmission protocol for external service providers. The idea included a “blind” data hub, that should collect all data without being able to “see” it in order to create an advanced data security. The highest level of compliance with data protection and privacy requirements convinced the jury for them and their idea.

At the grand finale of codeFEST8 taking place at the CeBIT in Hannover on March 18, 2015 four team members, current PhD students, presented their idea and implementation about privacy and self-determination to a jury within just 60 seconds. The team was very excited about the opportunity to take part in this event and evidently to raise awareness about the issue across all departments. RISE is very proud to have such ambitious employees, who made it in the finals at CeBIT 2015.

codeFEST8

Austrian Post AG and RISE GmbH developed a mobile application offering manifold mail services to the customer. The application has been implemented natively – running on Android and iOS – and is integrated with the backend system of the Austrian Post AG in order to serve the customer at its best.

A highlight is the virtualization of traditional mail notification for parcels: customers will be always kept up to date on the most current status within the deliver process of their package. In case the customer is not at home for delivery, the package can be picked up with the e-notification at the next post office.

In the future, customers are able to redirect parcels to other locations in real time, such as an office address, a dedicated post office, or just to their neighbor.

Additional features are a post office and post box finder as well as a fee calculator for sendings.