Rapid digital transformation, accelerated by covid-19 and a younger, more digital workforce, has changed the B2B sales environment affecting customer behavior, business practices and technologies. To adapt to this change B2B companies need to create new endeavors that connect marketing and sales activities, and identify how these can be efficiently enhanced by technology and digital tools. There is a need to identify effective tactics in different phases of the marketing and sales process. Consequently, more academic research is needed to investigate critical issues that technology may have in the B2B buying process. This paper thereby aims to establish a framework for B2B companies on how to optimize the customer journey by supporting the sales process with digital inbound marketing. This is examined by looking at how B2B companies can optimize the sales process by targeting customers’ needs with relevant actions throughout the customer journey with the help of technology and digital means. The results of this exploratory single case study demonstrates that the customer journey is complex with several touchpoints, and to create optimized processes, the customer journey must be adapted to each specific customer segment. Further, the study also contributes to the literature by demonstrating the importance of the marketing and sales departments being integrated and working together to create efficient processes. The presented framework for a customer journey can be used by managers to visualize the sales process, and identify at what stages the process can be made more efficient by digital means.

A system is only as secure as the weakest link in the chain. Humans are the binding link between IT (information technology) security and physical secu-rity. In general, the human is often considered as the weakest link in the chain, so social engineering attacks are used to manipulate or trick people to accom-plish the goal of bypassing security systems. Within this master thesis, we answer several research questions related to social engineering. Most im-portant is to find out why humans are considered as the weakest link and why existing guidelines are failing, as well as to achieve the goal of raising aware-ness and starting education at a young age. For this, we examine existing lit-erature on the subject and create experiments, an interview, a campaign eval-uation, and a survey. Our systematic work begins with an introduction, the methodology, a definition of social engineering and explanations of state-of-the-art social engineering methods. The theoretical part of this thesis also in-cludes ethical and psychological aspects and an evaluation of existing guide-lines with a review of why they are not successful.Furthermore, we continue with the practical part. An interview with a profes-sional security consultant focusing on social engineering from our collabora-tion company TÜV TRUST IT GmbH (TÜV AUSTRIA Group)1 is con-ducted. A significant part here deals with awareness-raising overall, espe-cially at a younger age. Additionally, the countermeasures against each dif-ferent social engineering method are analysed. Another practical part is the evaluation of existing social engineering campaigns2 from TÜV TRUST IT GmbH TÜV AUSTRIA Group to see how dangerous and effective social en-gineering has been in the past. From experience gained in this thesis, guide-lines on dealing with social engineering are discussed before the thesis is fi-nalized with results, the conclusion and possible future work.

Unmanned Aerial Vehicles, often called drones or abbreviated as UAVs, have been popularised and used by civilians for recreational use since the early 2000s. A majority of the entry- level commercial drones on the market are based on a WiFi connection with a controller, usually a smart phone. This makes them vulnerable to various WiFi attacks, which are evaluated and tested in this thesis, specifically on the Ryze Tello drone. Several threats were identified through threat modelling, in which a set of them was selected for penetration testing. This is done in order to answer the research question: How vulnerable is the Ryze Tello drone against WiFi based attacks? The answer to the research question is that the Ryze Tello drone is relatively safe, with the exception of it not having a default password for the network. A password was set for the network, however it was still exploited through a dictionary attack. This enabled attacks such as injecting flight instructions as well as the ability to gain access to the video feed of the drone while simultaneously controlling it through commands in terminal. / Drönare, eller UAV från engelskans Unmanned Aerial Vehicle, har ökat i popularitet bland privatpersoner sedan tidigt 2000tal. En majoritet av drönare för nybörjare är baserade på WiFi och styrs med en kontroll som vanligtvis är en smart phone. Detta innebär att dessa drönare kan vara sårbara för olika typer av attacker på nätverket, vilket utvärderas och testas i denna rapport på drönaren Ryze Tello. Flera hot identifierades med hotmodellering och ett flertal valdes ut för penetrationtest. Detta genomförs med syftet att svara på forskningsfrågan: Hur sårbar är Ryze Tello mot WiFi baserade attacker? Svaret på forskningsfrågan är att drönaren Ryze Tello är relativt säker, med undantaget att den inte har ett standardlösenord. Ett lösenord sattes på nätverket, men lösenordet knäcktes ändå med en ordboksattack. Detta möjliggjorde attacker så som instruktionsinjicering och förmågan att se videoströmmen från drönaren samtidigt som den kan kontrolleras via kommandon i terminalen.

Current practices in study design and data analysis have led to low reproducibility and replicability of findings in fields such as psychology, medicine, biology, and economics. Because gifted education research relies on the same underlying statistical and sociological paradigms, it is likely that it too suffers from these problems. This article discusses the origin of the poor replicability and introduces a set of open science practices that can increase the rigor and trustworthiness of gifted education’s scientific findings: preregistration, open data and open materials, registered reports, and preprints. Readers are directed to Internet resources for facilitating open science. To model these practices, a pre peer-review preprint of this article is available at https://psyarxiv.com/nhuv3/.

IoT devices can be found in almost any type of situation as the availability and viability of them has surged in the last decade with technological advancements. The purpose of this project is to investigate how secure these types of devices, in particular a robot vacuum cleaner, actually are if an ill intended actor tries to interfere with the device. Different methods used in the sphere of threat modeling and penetration testing were applied and tested with the result coming back positive. The robot vacuum cleaner was successfully compromised and the privacy of the owner could be violated applying the attacks used. The current way of thinking about privacy and security of IoT devices could therefore need to be reviewed.

Cyber attacks are an increasing problem in the society today. They increase dramatically, especially on IoT products, such as smart locks. This project aims to evaluate the security of the Verisure smartlock system in hopes of contributing to a safer development of IoT products and highlighting theexisting flaws of today’s society. This is achieved by identifying and attempting to exploit potential vulnerabilities with threat modeling and penetration testing. The results showed that the system is relatively secure. No major vulnerabilities were found, only a few weaknesses, including the possibility of a successful DoS attack, inconsistent password policy, the possibility of gaining sensitive information of a user and cloning the key tag used for locking/unlocking the smart lock. / Cyberattacker är ett ökande problem i samhället idag. De ökar markant, särskilt mot IoT-produkter, såsom smarta lås. Detta projekt syftar till att utvärdera säkerheten i Verisures smarta låssystem i hopp om att bidra till en säkrare utveckling av IoT-produkter och belysa de befintliga bristerna i dagens samhälle. Detta uppnås genom att identifiera och försöka utnyttja potentiella sårbarheter med hotmodellering och penetrationstestning. Resultaten visade att systemet är relativt säkert. Inga större sårbarheter hittades, bara några svagheter, inklusive möjligheten till en lyckad DoS-attack, inkonsekvent lösenordspolicy, möjligheten att få känslig information från en användare och kloning av nyckelbrickan som används för att låsa/låsa upp smarta låset.

Internet of Things (IoT) devices have entered the home, offices, and other parts of everyday life at an alarming rate in recent years. A large company in the IoT space is Ring. They mostly make smart home security devices, with the mission of making neighborhoods safer, and their flagship product is the Ring doorbell. However, an important question is: Does connecting such a device to your home network introduce new threats? In this thesis, the security of the Ring doorbell and applications in its ecosystem are evaluated and presented. A structured approach is taken for the evaluation by constructing a threat model, evaluating threats, and further pursuing selected threats by penetration testing. One minor vulnerability was discovered but the overall conclusion was that this product followed best practices when it comes to securing IoT devices, reducing attack surfaces, and enforcing user security policies. The conclusion of this thesis is that adding a Ring doorbell to your home network does not introduce a new threat. / Sakernas internet (IoT) enheter har kommit in i hemmet, kontoret och andra delar av vardagen i en alarmerande takt under de senaste åren. Ett stort företag inom IoT området är Ring. De tillverkar mestadels smarta hem säkerhetsenheter, med uppdraget att göra stadsdelar säkrare, och deras flaggskeppsprodukt är Ring-dörrklockan. Men införs nya hot om du ansluter en sådan enhet till ditt hemnätverk? I detta examensarbete utvärderas och presenteras säkerheten för Ring dörrklockan och applikationer i dess ekosystem. Ett strukturerat tillvägagångssätt används för utvärderingen genom att konstruera en hotmodell, utvärdera hot och fortsätta vidare utvalda hot genom penetrationstester. En mindre sårbarhet men den övergripande slutsatesen var att den här produkten följde bästa praxis när det gäller att säkra IoT enheter, minska attackytor och upprätthålla användarsäkerhetspolicyer. Slutsatsen av denna avhandling är att om du lägger till en Ring-dörrklocka i ditt hemnätverk inte introducerar ett nytt säkerhetshot.

The proliferation of IoT devices has brought our world closer than ever. However, because these devices can connect to the internet, they are also vulnerable to cyberattacks. IoT devices collect our personal information, so we must take IoT security seriously to protect our privacy. In this master thesis, an assessment of the security of Sennheiser smart headphones Momentum 3 wireless was conducted to demonstrate whether the smart headphones are secure or not. This pair of headphones were chosen because Sennheiser is a well-known brand and the headphones are one of its high-end headphones, they should be expected to be more secure. Previous academic papers related to the security of Bluetooth headphones were not found, because the security of headphones is generally considered to be less important. For the above reasons, this paper conducts security assessment on this pair of smart headphones. The thesis begins with gathering information of the smart headphones from a black-box perspective. Then threat modeling is used to list and select the attacks to be performed during penetration testing. Finally, the penetration testing is conducted. The result of the penetration testing shows that the headphones are secure enough with no serious vulnerabilities found but a few minor flaws. As this thesis is not in cooperation with Sennheiser, some tests were not performed due to Swedish law. Meanwhile, due to time constraints, some of the identified threats were not attempted in the penetration testing phase and require further investigation. / Spridningen av IoT-enheter har fört vår värld närmare än någonsin. Men eftersom dessa enheter kan ansluta till internet är de också sårbara för cyberattacker. IoT-enheter samlar in vår personliga information, så vi måste ta IoT-säkerhet på allvar för att skydda vår integritet. I denna masteruppsats genomfördes en bedömning av säkerheten hos Sennheiser smarta hörlurar Momentum 3 wireless för att visa om de smarta hörlurarna är säkra eller inte. Detta par hörlurar valdes för att Sennheiser är ett välkänt varumärke och hörlurarna är en av dess avancerade hörlurar, de bör förväntas vara säkrare. Tidigare akademiska artiklar relaterade till säkerheten för Bluetooth-hörlurar hittades inte, eftersom säkerheten för hörlurar generellt anses vara mindre viktig. Av ovanstående skäl genomför detta dokument en säkerhetsbedömning av detta par smarta hörlurar. Examensarbetet börjar med att samla information om de smarta hörlurarna ur ett black-box-perspektiv. Sedan används hotmodellering för att lista och välja de attacker som ska utföras under penetrationstestning. Slutligen genomförs penetrationsprovningen. Resultatet av penetrationstestet visar att hörlurarna är tillräckligt säkra utan några allvarliga sårbarheter men några mindre brister. Eftersom detta examensarbete inte är i samarbete med Sennheiser har vissa tester inte utförts på grund av svensk lag. Under tiden, på grund av tidsbrist, försökte inte några av de identifierade hoten under penetrationstestfasen och kräver ytterligare undersökning.

Ethical hacking and penetration testing are two methods often used when organizations and companies want to measure their level of information security, and find out if there are additional steps that can be taken in order to increase the security. This report describes a security test of the card terminal iZettle Reader 2, with the intention to examine its level of security based on the device’s frequent appearance in the society. The implementation is divided into three phases: prestudy and threat modelling, penetration testing and evaluation and conclusion of the security. The threat model was created using the two established models STRIDE & DREAD, which purpose is to identify the device’s various threats and attack vectors. From the threat model, a couple of attack vectors were selected to be penetration tested. By using conventional models and obtaining knowledge of common attacks such as Man-in-the-middle, Spoofing and Replay, the device and the payment solution could be tested with a systematical and reliable approach. A selection was made of the most prominent attack vectors, of which these were later tested; Man-in-the-middle of Bluetooth and HTTPS, and Reverse Engineering of the associated mobile application "iZettle Go". The result of the penetration tests indicated that the security around the device and surrounding systems is strong, but that it can be further supplemented with a couple of actions like certificate pinning and mutual authentication when communicating with TLS, as well as a more tamperproof software regarding the mobile application. / Etisk hackning och penetrationstestning är två metoder som ofta tillämpas i sammanhang när organisationer och företag vill mäta sin nivå av informationssäkerhet, samt även ta reda på om eventuella åtgärder kan tas för att stärka säkerheten. Denna rapport beskriver ett säkerhetstest av kortterminalen iZettle Reader 2, med syftet att undersöka dess nivå av säkerhet grundat på enhetens frekventa uppträdande i samhället. Genomförandet är uppdelat i tre faser: förstudie och hotmodellering, penetrationstestning samt utvärdering och avgörande av säkerheten. Hotmodellen skapades med hjälp av de två vedertagna modellerna STRIDE & DREAD, vars syfte är att identifiera enhetens olika hot och attackvektorer. Utifrån hotmodellen valdes några attackvektorer som sedan penetrationstestades. Genom att använda etablerade modeller samt erhålla kännedom om konventionella attacker såsom Man-in-the-middle, Spoofing och Replay, kunde man testa enheten och betallösningen med ett systematiskt och pålitligt tillvägagångssätt. Ett urval gjordes av de mest lovande attackvektorerna, varav dessa senare testades; Man-in-the-middle av Bluetooth och Wi-Fi samt Reverse Engineering av den tillhörande mobilapplikationen "iZettle Go". Resultatet av testerna påvisade en stark säkerhet gällande enheten och dess omgivande system, men att säkerheten kan kompletteras ytterligare med ett par olika åtgärder som certificate pinning och mutual authentication vid kommunikation med TLS, samt manipuleringssäker mjukvara med avseende på mobilapplikationen.

Smart speakers are becoming increasingly ubiquitous. Previous research has studied the security of these devices; however, only some studies have employed a penetration testing methodology. Moreover, most studies have only investigated models by well-known brands such as the Amazon or Google. Therefore, there is a research gap of penetration tests on less popular smart speaker models. This study aims to address this gap by conducting a penetration test on the less popular JBL Link Music with firmware version 23063250. The results show that the speaker is subject to several security threats and is vulnerable to some attacks. The Bluetooth Low Energy implementation is vulnerable to passive eavesdropping. Additionally, the speaker is vulnerable to an 802.11 denial of service attack, and a boot log containing sensitive information can be accessed through a serial communication interface. It is concluded that the speaker is, in some aspects, insecure. / Smarta högtalare blir alltmer närvarande. Tidigare forskning har undersökt säkerheten kring dessa, dock har endast några använt en penetrerings testnings metolologi. Därutover har de flesta studier endast studerat modeller av välkända varumärken som Google eller Amazon. Därmed finns en vetenskaplig kunskapslucka kring penetrationstester av mindre populära modeller. Denna studie syftar till att bemöta denna lucka genom att utföra ett penetrationstest av den mindre populära JBL Link Music med mjukvaruversion 23063250. Resultaten visar att högtalaren är utsatt för flera säkerhetshot och är sårbar för några attacket. Bluetooth Low Energy implementationen är sårbar för passiv avlyssning. Därutöver är högtalaren sårbar för en 802.11 denial of service attack och en boot logg innehållande känslig information kan nås genom ett seriellt kommunikations gränssnitt. Slutsatsen dras att högtalaren, i vissa aspekter, är osäker.