Dr. Stefan Tatschner

IT-Sicherheitsforscher · Fraunhofer AISEC

Garching bei München

Über mich

Ich forsche seit 2015 am Fraunhofer AISEC  zur Sicherheit von Netzwerkprotokollen und Open-Source-Software und teste Fahrzeuge und eingebettete Systeme auf Schwachstellen. An der University of Limerick in Irland habe ich zur Nachhaltigkeit und Sicherheit freier und quelloffener Software promoviert (Dissertation ). Ich betreue das Pentest-Framework gallia  und imkere in meiner Freizeit: bienensteff.de .

Schwerpunkte

  • IT-Sicherheit der Software-Lieferkette und Nachhaltigkeit des Open-Source-Ökosystems
  • Beratung zur Cyberresilienzverordnung (CRA) und zu Sicherheitskonzepten für Neuentwicklungen
  • Sicherheit von Netzwerkprotokollen: QUIC, TLS, X.509 und Public-Key-Infrastrukturen
  • Penetrationstests von Fahrzeugen und eingebetteten Systemen

Ausbildung

  • Promotion (PhD), Department of Electronic and Computer Engineering (ECE), Faculty of Science and Engineering, University of Limerick, Irland, 2019–2025
  • Master of Science (M.Sc.), Elektro- und Informationstechnik (Schwerpunkt: Nachrichtentechnik), Technische Hochschule Deggendorf, Bayern, 2015

Zertifizierungen

Publikationen

  1. A QUIC(k) Security Evaluation: A Server-Testbed for RFC Security Considerations
    Sebastian N. Peters , Lukas Lautenschlager, Stefan Tatschner, Kacper Darowski, Nguyen Truong An To, Moritz Buhl
    Computer Security – ESORICS 2026 (Lecture Notes in Computer Science), S. 448–469, Springer, 2026 Konferenzbeitrag
    DOIArtefakt
    BibTeX 
    @inproceedings{peters2026quic,
  author = {Sebastian N. Peters and Lukas Lautenschlager and Stefan Tatschner and Kacper Darowski and Nguyen Truong An To and Moritz Buhl},
  title = {A QUIC(k) Security Evaluation: A Server-Testbed for RFC Security Considerations},
  booktitle = {Computer Security – ESORICS 2026},
  series = {Lecture Notes in Computer Science},
  publisher = {Springer},
  pages = {448--469},
  year = {2026},
  doi = {10.1007/978-3-032-38692-2_23}
}
  2. Towards a More Sustainable and Secure Software Tooling in Free/Libre Open Source Software Environments
    Stefan Tatschner
    University of Limerick, 2025 Dissertation
    DOI
    BibTeX 
    @phdthesis{tatschner2025thesis,
  author = {Stefan Tatschner},
  title = {Towards a More Sustainable and Secure Software Tooling in Free/Libre Open Source Software Environments},
  school = {University of Limerick},
  year = {2025},
  doi = {10.34961/18737}
}
  3. Tracking Down Software Cluster Bombs: A Current State Analysis of the Free/Libre and Open Source Software (FLOSS) Ecosystem
    Stefan Tatschner, Michael P. Heinl, Nicole Pappler, Tobias Specht, Sven Plaga, Thomas Newe
    arXiv:2502.08219, 2025 Preprint
    DOIPDFDaten
    BibTeX 
    @misc{tatschner2025clusterbombs,
  author = {Stefan Tatschner and Michael P. Heinl and Nicole Pappler and Tobias Specht and Sven Plaga and Thomas Newe},
  title = {Tracking Down Software Cluster Bombs: A Current State Analysis of the Free/Libre and Open Source Software (FLOSS) Ecosystem},
  eprint = {2502.08219},
  archivePrefix = {arXiv},
  year = {2025},
  doi = {10.48550/arXiv.2502.08219}
}
  4. ParsEval: Evaluation of Parsing Behavior using Real-world Out-in-the-wild X.509 Certificates
    Stefan Tatschner, Sebastian N. Peters , Michael P. Heinl, Tobias Specht, Thomas Newe
    Proceedings of the 19th International Conference on Availability, Reliability and Security (ARES 2024), S. 1–9, ACM, 2024 Konferenzbeitrag
    DOIArtefakt
    BibTeX 
    @inproceedings{tatschner2024parseval,
  author = {Stefan Tatschner and Sebastian N. Peters and Michael P. Heinl and Tobias Specht and Thomas Newe},
  title = {ParsEval: Evaluation of Parsing Behavior using Real-world Out-in-the-wild X.509 Certificates},
  booktitle = {Proceedings of the 19th International Conference on Availability, Reliability and Security (ARES 2024)},
  publisher = {ACM},
  pages = {1--9},
  year = {2024},
  doi = {10.1145/3664476.3669935}
}
  5. Cybersecurity as a Service
    John Morris*, Stefan Tatschner*, Michael P. Heinl, Patrizia Heinl, Thomas Newe, Sven Plaga (* geteilte Erstautorschaft)
    Cybersecurity Vigilance and Security Engineering of Internet of Everything (Internet of Things), S. 141–161, Springer, 2023 Buchkapitel
    DOI
    BibTeX 
    @incollection{morris2023caas,
  author = {John Morris and Stefan Tatschner and Michael P. Heinl and Patrizia Heinl and Thomas Newe and Sven Plaga},
  title = {Cybersecurity as a Service},
  booktitle = {Cybersecurity Vigilance and Security Engineering of Internet of Everything},
  series = {Internet of Things},
  publisher = {Springer},
  pages = {141--161},
  year = {2023},
  doi = {10.1007/978-3-031-45162-1_9}
}
  6. A Quic(k) Security Overview: A Literature Research on Implemented Security Recommendations
    Stefan Tatschner, Sebastian N. Peters , David Emeis, John Morris, Thomas Newe
    Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2023), S. 1–8, ACM, 2023 Konferenzbeitrag
    DOIArtefakt
    BibTeX 
    @inproceedings{tatschner2023quic,
  author = {Stefan Tatschner and Sebastian N. Peters and David Emeis and John Morris and Thomas Newe},
  title = {A Quic(k) Security Overview: A Literature Research on Implemented Security Recommendations},
  booktitle = {Proceedings of the 18th International Conference on Availability, Reliability and Security (ARES 2023)},
  publisher = {ACM},
  pages = {1--8},
  year = {2023},
  doi = {10.1145/3600160.3605164}
}
  7. The Stream Exchange Protocol: A Secure and Lightweight Tool for Decentralized Connection Establishment
    Stefan Tatschner, Ferdinand Jarisch, Alexander Giehl, Sven Plaga, Thomas Newe
    Sensors, 21(15), 4969, MDPI, 2021 Zeitschriftenartikel
    DOIArtefakt
    BibTeX 
    @article{tatschner2021sep,
  author = {Stefan Tatschner and Ferdinand Jarisch and Alexander Giehl and Sven Plaga and Thomas Newe},
  title = {The Stream Exchange Protocol: A Secure and Lightweight Tool for Decentralized Connection Establishment},
  journal = {Sensors},
  volume = {21},
  number = {15},
  publisher = {MDPI},
  pages = {4969},
  year = {2021},
  doi = {10.3390/s21154969}
}
  8. Securing future decentralised industrial IoT infrastructures: Challenges and free open source solutions
    Sven Plaga, Norbert Wiedermann, Simon Duque Anton, Stefan Tatschner, Hans Schotten, Thomas Newe
    Future Generation Computer Systems, 93, S. 596–608, Elsevier, 2019 Zeitschriftenartikel
    DOI
    BibTeX 
    @article{plaga2019iiot,
  author = {Sven Plaga and Norbert Wiedermann and Simon Duque Anton and Stefan Tatschner and Hans Schotten and Thomas Newe},
  title = {Securing future decentralised industrial IoT infrastructures: Challenges and free open source solutions},
  journal = {Future Generation Computer Systems},
  volume = {93},
  publisher = {Elsevier},
  pages = {596--608},
  year = {2019},
  doi = {10.1016/j.future.2018.11.008}
}
  9. Shedding too much Light on a Microcontroller’s Firmware Protection
    Johannes Obermaier, Stefan Tatschner
    11th USENIX Workshop on Offensive Technologies (WOOT 17), USENIX Association, 2017 Konferenzbeitrag
    Paper
    BibTeX 
    @inproceedings{obermaier2017shedding,
  author = {Johannes Obermaier and Stefan Tatschner},
  title = {Shedding too much Light on a Microcontroller’s Firmware Protection},
  booktitle = {11th USENIX Workshop on Offensive Technologies (WOOT 17)},
  publisher = {USENIX Association},
  year = {2017},
  url = {https://www.usenix.org/conference/woot17/workshop-program/presentation/obermaier}
}
  10. Logboat — A simulation framework enabling CAN security assessments
    Sven Plaga, Stefan Tatschner, Thomas Newe
    2016 International Conference on Applied Electronics (AE), S. 215–218, IEEE, 2016 Konferenzbeitrag
    DOI
    BibTeX 
    @inproceedings{plaga2016logboat,
  author = {Sven Plaga and Stefan Tatschner and Thomas Newe},
  title = {Logboat — A simulation framework enabling CAN security assessments},
  booktitle = {2016 International Conference on Applied Electronics (AE)},
  publisher = {IEEE},
  pages = {215--218},
  year = {2016},
  doi = {10.1109/AE.2016.7577276}
}
  11. Investigations in intercepting the physical layer of GSM: Enabling advanced impact-assessments in terms of security and reliability
    Stefan Tatschner, Sven Plaga, Matthias Wuschek
    2013 International Conference on Applied Electronics (AE), S. 1–4, IEEE, 2013 Konferenzbeitrag
    IEEE Xplore
    BibTeX 
    @inproceedings{tatschner2013gsm,
  author = {Stefan Tatschner and Sven Plaga and Matthias Wuschek},
  title = {Investigations in intercepting the physical layer of GSM: Enabling advanced impact-assessments in terms of security and reliability},
  booktitle = {2013 International Conference on Applied Electronics (AE)},
  publisher = {IEEE},
  pages = {1--4},
  year = {2013},
  url = {https://ieeexplore.ieee.org/document/6636535}
}

Technische Berichte

  1. Partnerspezifischer Schlussbericht des Fraunhofer AISEC zum Projekt „Automatisierter Transport zwischen Logistikzentren auf Schnellstraßen im Level 4 (ATLAS-L4)“, Teilvorhaben „Security-Umfänge“
    Patrick Wagner, Magdalena Bertram, Alexander Giehl, Fabian Kügler, Lukas Lautenschlager, Nikolai Lenski, Veronique Momeu, Sebastian N. Peters , Nikolai Puch, Tudor Soroceanu, Stefan Tatschner, Benjamin Zengin
    Technische Informationsbibliothek (TIB), Hannover, 2025 Technischer Bericht
    DOI
    BibTeX 
    @techreport{wagner2025atlasl4,
  author = {Patrick Wagner and Magdalena Bertram and Alexander Giehl and Fabian Kügler and Lukas Lautenschlager and Nikolai Lenski and Veronique Momeu and Sebastian N. Peters and Nikolai Puch and Tudor Soroceanu and Stefan Tatschner and Benjamin Zengin},
  title = {Partnerspezifischer Schlussbericht des Fraunhofer AISEC zum Projekt „Automatisierter Transport zwischen Logistikzentren auf Schnellstraßen im Level 4 (ATLAS-L4)“, Teilvorhaben „Security-Umfänge“},
  institution = {Technische Informationsbibliothek (TIB), Hannover},
  year = {2025},
  doi = {10.34657/28745}
}

Schwachstellen

Veröffentlichte Schwachstellen, an deren Entdeckung ich beteiligt war:

Software

Mehr auf Codeberg  und GitHub .

Vorträge

Blogbeiträge

Lehre

Seminare

Betreute studentische Arbeiten

Gastvorlesungen

  • A Quic(k) Time Travel
    Das Protokoll QUIC und meine aktuelle Forschung dazu, für den Studiengang Informatik.
    Technische Hochschule Ingolstadt · April 2024

Forschungsprojekte

Öffentlich geförderte Projekte, an denen ich mitgearbeitet habe: