»File systems are deeply rooted in operating systems and, despite years of development and daily endurance tests by users, they can be exploited by a wide variety of vulnerabilities,« says awardee Krah, explaining the motivation behind his master's thesis, which takes an exhaustive look at this topic in BSD operating systems. For users, these vulnerabilities play out in a variety of scenarios: the computer might immediately crash if prompted to process a deliberately manipulated file system or there could be more serious consequences, such as an information leak or the overwriting of sensitive data. This would not normally be immediately apparent to a normal user, but it could cause significant damage. These vulnerabilities can be found in the most common file systems, like those found on USB sticks. »This, along with a high risk of infection from disguised malware, is one of the reasons why you should never use third-party or unchecked USB sticks,« says Krah.

With his analysis, the 27-year-old not only showed whether vulnerabilities can be detected in file systems, a core component of operating systems, but also which ones exist and where they are located. While working on his master's thesis, Krah revealed more than 50 different vulnerabilities - some 40 percent of which were fixed on the basis of Krah's analysis.

His master's thesis was supervised by Professor Peter Martini, head of the Institute for Computer Science 4 at Bonn University and also director of Fraunhofer FKIE. His career is just beginning but the talented young computer scientist already has a very strong connection to the research institute. His bachelor's thesis was supervised by a Fraunhofer FKIE scientist, who also brought him directly to the institute as a student assistant. Following his master's thesis, he was employed as a research assistant in the Cyber Analysis and Defense Department (CA&D). That is why Professor Martini and department head Dr. Elmar Padilla did not miss the opportunity to participate in the award ceremony at the IT conference in Koblenz.

The AFCEA Academic Award has been awarded annually since 2008: a total of 20,000 euros is shared amongst the winners. The association thus promotes the academic qualification of young scientists who have distinguished themselves through outstanding theses in the fields of applied computer science, communications engineering or automation technology. In addition to the academic quality of the work, the award recognizes novelty and practical applicability in solving the underlying problem.

His in-depth work with file system vulnerabilities has definitely paid off for Krah. And not only because of the AFCEA academic award, which he was visibly proud to receive. »Up to now there has not been very extensive research on vulnerability analysis in file systems, particularly not in the context of BSD-based operating systems,« says Krah. Moreover, he will continue to reap the benefits of the experience and his findings. »In the course of analysis we became aware of very specific problem sets. The knowledge acquired in the course of the master's thesis and the dynamic analysis techniques devised for that purpose can easily be refined in the future and adapted to similar problems.«