Computer Sciences Commons^™

Security Assessment Of Iot Devices: The Case Of Two Smart Tvs, Maxim Chernyshev, Peter Hannay

Australian Digital Forensics Conference

Being increasingly complex devices, smart TVs are becoming more capable and have the potential to receive, store, process and transmit considerable amounts of personal data. These capabilities also represent several diverse attack surfaces potentially rendering these devices highly vulnerable. The emergence and high adoption rate of smart TVs have been drawing notable interest from security researchers and industry. We utilise an attack surface area-based approach to assess the security of two modern smart TVs from different vendors and describe some of the possible multi-surface attacks that can be carried out against these devices.

Comparison Of Live Response, Linux Memory Extractor (Lime) And Mem Tool For Acquiring Android’S Volatile Memory In The Malware Incident, Andri Heriyanto, Craig Valli, Peter Hannay

Australian Digital Forensics Conference

The increasing use of encryption and obfuscation within the malware development arena has necessitated the use of volatile memory acquisition on smartphone platforms. Current smartphone forensics research lacks a well-formulated process for the acquisition of volatile memory. This research evaluates and contrasts three differing tools for acquisition of volatile memory from the Android platform: Live Response, Linux Memory Extractor (LiME) and Mem Tool. Evaluation is conducted through practical examination during the analysis of an infected device. The results demonstrate a combination of LiME and the Volatility Framework provides the most robust findings. Complexities due to the nature of LiME prevent …

Mining Social Networking Sites For Digital Evidence, Brian Cusack, Saud Alshaifi

Australian Digital Forensics Conference

OnLine Social Networking sites (SNS) hold a vast amount of information that individuals and organisations post about themselves. Investigations include SNS as sources of evidence and the challenge is to have effective tools to extract the evidence. In this exploratory research we apply the latest version of a proprietary tool to identify potential evidence from five SNS using three different browsers. We found that each web browser influenced the scope of the evidence extracted. In previous research we have shown that different open source and proprietary tools influence the scope of evidence obtained. In this research we asked, What variation …

Steganography As A Threat – Fairytale Or Fact?, Tom Cleary

Australian Digital Forensics Conference

Almost since the birth of the Internet, there has been a fear that steganographically-encoded threats would be used to bring harm. Serious consideration has been given to the idea that merely downloading an image could introduce malware. Yet, for decades, evidence of this malware channel has been missing in action. There is still an unwritten assumption that images are harmless. Many vendors have implicitly avoided producing defences against steganographic threats. Is it truly impossible to make a widely harmful exploit this way or have malicious actors accepted general wisdom? Three recent papers suggest that there may be a new chapter …

Evaluating Small Drone Surveillance Capabilities To Enhance Traffic Conformance Intelligence, Brian Cusack, Reza Khaleghparast

Australian Security and Intelligence Conference

The availability of cheap small physical drones that fly around and have a variety of visual and sensor networks attached invites investigation for work applications. In this research we assess the capability of a set of commercially available drones (VTOL) that cost less than $1000 (Cheap is a relative term and we consider anything less than $5000 relatively cheap). The assessment reviews the capability to provide secure and safe motor vehicle surveillance for conformance intelligence. The evaluation was conducted by initially estimating a set of requirements that would satisfy an ideal surveillance situation and then by comparing a sample of …

File System Modelling For Digital Triage: An Inductive Profiling Approach, Benjamin Rice, Benjamin Turnbull

Australian Digital Forensics Conference

Digital Triage is the initial, rapid screening of electronic devices as a precursor to full forensic analysis. Triage has numerous benefits including resource prioritisation, greater involvement of criminal investigators and the rapid provision of initial outcomes. In traditional scientific forensics and criminology, certain behavioural attributes and character traits can be identified and used to construct a case profile to focus an investigation and narrow down a list of suspects. This research introduces the Triage Modelling Tool (TMT), that uses a profiling approach to identify how offenders utilise and structure files through the creation of file system models. Results from the …

Mobile Device Damage And The Challenges To The Modern Investigator, Dan Blackman

Australian Digital Forensics Conference

Mobile Forensics has developed into an area of significant concern to law enforcement agencies and their counterparts, specifically as a result of individuals moving away from using traditional computers and focusing attention on their mobile device. Due to the smart phone being almost permanently attached to the person or in near proximity, it has become a significant source of information for investigators and can mean the difference between proving guilt or innocence. Tools have long been established, which provide agencies the ability to encapsulate expertise, which allows the easy download and production of reports for the mobile device and how …

Behavior-Based Anomaly Detection On Big Data, Hyunjoo Kim, Jonghyun Kim, Ikkyun Kim, Tai-Myung Chung

Australian Information Security Management Conference

Recently, cyber-targeted attacks such as APT (Advanced Persistent Threat) are rapidly growing as a social and national threat. It is an intelligent cyber-attack that infiltrates the target organization and enterprise clandestinely using various methods and causes considerable damage by making a final attack after long-term and through preparations. These attacks are threatening cyber worlds such as Internet by infecting and attacking the devices on this environment with the malicious code, and by destroying them or gaining their authorities. Detecting these attacks requires collecting and analysing data from various sources (network, host, security equipment, and devices) over the long haul. Therefore, …

The Challenges Of Seizing And Searching The Contents Of Wi-Fi Devices For The Modern Investigator, Dan Blackman, Patryk Szewczyk

Australian Digital Forensics Conference

To the modern law enforcement investigator, the potential for an offender to have a mobile device on his or her person, who connects to a Wi-Fi network, may afford evidence to place them at a scene, at a particular time. Whilst tools to interrogate mobile devices and Wi-Fi networks, have undergone significant development, little research has been conducted with regards to interrogating Wi-Fi routers and the evidence they may contain. This paper demonstrates that multiple inhibiting factors exist for forensic investigators when attempting to extract data from Wi-Fi routers at the scene. Data volatility means the Wi-Fi router cannot be …

Efficacy Of Property Marking As A Situational Crime Prevention Strategy, David J. Brooks, Michael Coole, Chauncey Johnson, Jeff Corkill, Malcolm Jenkinson

Australian Security and Intelligence Conference

Burglary and stealing are crimes that have a significant impact and cost on its victims and society. To mitigate such crimes, property marking is a situational crime prevention strategy that attempts to prevent through dissuasion. There are many forms of property marking, yet there is limited research of its efficacy. Where there have been such studies, there has been some indications of success. Therefore, the study assessed the efficacy of property marking to reduce burglary and stealing crimes. The study undertook a quantitate approach using non-equivalent control groups to assess the geo-spatial impact of property marking when applied at a …

Mapping The Laws Which Apply To Intercepting Wireless Communications In A Western Australian Legal Context, Tim Thomas, Craig Valli

Australian Digital Forensics Conference

The rapid evolution and deployment of WiFi technology creates a new environment where offenders can intercept and obtain sensitive information for use in the commissioning of further criminal activity. This paper explores how the law applies to an protects the wireless communications environment, with specific focus on the interception of WiFi data communications.

An Overview Of Bluetooth Device Discovery And Fingerprinting Techniques – Assessing The Local Context, Maxim Chernyshev

Australian Digital Forensics Conference

The ubiquitous nature of portable communication devices presents a number of opportunities for automated device discovery, tracking and possible owner identification. Consumer devices such as smartphones, tablets, wearables, laptops and vehicle entertainment systems commonly support the 802.15.1 (Bluetooth) wireless communication protocol that enables a variety device discovery and fingerprinting techniques. We provide an overview of these techniques encompassing those native to the protocol as well as those that are possibly protocol-agnostic due to their inherently generic nature. We then introduce an opportunity for a comparison study that sets out to examine and quantify the effectiveness of selected techniques in the …

The Spy In Your Pocket: Smartphones And Geo-Location Data, Krishnun Sansurooah, Bradley Keane

Australian Digital Forensics Conference

The integration of Global Positioning Systems and Smartphones has seen the significance of location based services rise. Geo-location data could prove to be an invaluable source of evidence in a forensic investigation. An attempt to extract geo-location data from an iPhone4s and Huawei Ascend G526 in a forensically sound manner revealed significant geo-location data embedded within geo-tags within photos taken on the devices. Other limited evidence was located on the devices.

Image Similarity Using Dynamic Time Warping Of Fractal Features, Ahmed Ibrahim, Craig Valli

Australian Digital Forensics Conference

Hashing algorithms such as MD/SHA variants have been used for years by forensic investigators to look for known artefacts of interest such as malicious files. However, such hashing algorithms are not effective when their hashes change with the slightest alteration in the file. Fuzzy hashing overcame this limitation to a certain extent by providing a close enough measure for slight modifications. As such, image forensics is an essential part of any digital crime investigation, especially in cases involving child pornography. Unfortunately such hashing algorithms can be thwarted easily by operations as simple as saving the original file in a different …

Cyber Blackbox For Collecting Network Evidence, Jooyoung Lee, Sunoh Choi, Yangseo Choi, Jonghyun Kim, Ikkyun Kim, Youngseok Lee

Australian Digital Forensics Conference

In recent years, the hottest topics in the security field are related to the advanced and persistent attacks. As an approach to solve this problem, we propose a cyber blackbox which collects and preserves network traffic on a virtual volume based WORM device, called EvidenceLock to ensure data integrity for security and forensic analysis. As a strategy to retain traffic for long enough periods, we introduce a deduplication method. Also this paper includes a study on the network evidence which is collected and preserved for analyzing the cause of cyber incident. Then, a method is proposed to suggest a starting …

Security Risks Of Medical Devices In Wireless Environments, Krishnun Sansurooah

Australian eHealth Informatics and Security Conference

The advancement of wireless medical devices technology, that has developed in hospitals and migrated into the home environment, has created unsustainability in in terms of the management of security for such devices. Through this paper, we shall attempt to explain how medical devices have completely changed the way security needs to be approached in the medical field. We shall also explore the history of medical devices and the organizational problems faced for the development of these devices, the different stakeholders strengths and weaknesses, especially if the device is implanted inside the body of a patient. Once the risk is understood …

Creating An Operational Security Management Structure For Inimical Environments: Papua New Guinea As A Case Study, William J. Bailey

Australian Security and Intelligence Conference

Security is a necessary cost for businesses wishing to operate in the developing economy of Papua New Guinea. The country continues to face levels of crime and violence out of proportion to other East Asian countries; which deters many would be investors. However, the potential in PNG is vast and eagerly sought after despite the high costs required to operate without harm, therefore, it is necessary manage the security situation. Experience from similar countries has shown by using optimal security management systems and structures it is possible to work safely, securely and effectively, but this requires a comprehensive security, threat …

Cctv Surveillance: The Differing Aims And Functions Of Cctv Within The Corporate Stratum, Johan Malmenbratt, David J. Brooks

Australian Security and Intelligence Conference

Closed Circuit Television (CCTV) systems are found in a variety of environments and used for a multitude of purposes, leading to differing views of CCTV within an organisation. In accordance to management theory, organisations contain a stratum of work where each level requires specific skills set. In accordance with this work stratum, the study’s methodology used semi-structured interviews with different levels of security personnel in a Casino complex to extract and undertake a thematic analysis. The study extracted 10 CCTV surveillance features across two themes, being its aims and functions. CCTV features included creating a safe environment, protection, legal compliance …

Attributes Of An Analyst: What We Can Learn From The Intelligence Analysts Job Description, Jeffrey D. Corkill, Teresa Kasprzyk Cunow, Elisabeth Ashton, Amanda East

Australian Security and Intelligence Conference

No abstract provided.

Intensity Based Interrogation Of Optical Fibre Sensors For Industrial Automation And Intrusion Detection Systems, Gary Andrew Allwood

Theses: Doctorates and Masters

In this study, the use of optical fibre sensors for intrusion detection and industrial automation systems has been demonstrated, with a particular focus on low cost, intensity-based, interrogation techniques. The use of optical fibre sensors for intrusion detection systems to secure residential, commercial, and industrial premises against potential security breaches has been extensively reviewed in this thesis. Fibre Bragg grating (FBG) sensing is one form of optical fibre sensing that has been underutilised in applications such as in-ground, in-fence, and window and door monitoring, and addressing that opportunity has been a major goal of this thesis. Both security and industrial …

Intelligent Network Intrusion Detection Using An Evolutionary Computation Approach, Samaneh Rastegari

Theses: Doctorates and Masters

With the enormous growth of users' reliance on the Internet, the need for secure and reliable computer networks also increases. Availability of effective automatic tools for carrying out different types of network attacks raises the need for effective intrusion detection systems.

Generally, a comprehensive defence mechanism consists of three phases, namely, preparation, detection and reaction. In the preparation phase, network administrators aim to find and fix security vulnerabilities (e.g., insecure protocol and vulnerable computer systems or firewalls), that can be exploited to launch attacks. Although the preparation phase increases the level of security in a network, this will never completely …

A Survey And Method For Analysing Soho Router Firmware Currency, Nikolai Hampton, Patryk Szewczyk

Australian Information Security Management Conference

Network routers are a core component of contemporary SoHo networks. The firmware within these devices provides routing, control and monitoring functionality coupled with mechanisms to ensure a secure and reliable network. End-users are typically reliant on manufacturers to provide timely firmware updates to mitigate known vulnerabilities. An investigation was undertaken to identify the underlying software components used in the firmware of currently available, SoHo network devices used in Australia. Firmware from 37 devices was deconstructed to identify potential security issues; in each instance, the firmware images were found to include vulnerabilities, obsolete software and out-of-date operating system components. 95% of …

Evaluating Single Sign On Security Failure In Cloud Services, Brian Cusack, Eghbal Zadeh

Australian Information Security Management Conference

The business use of cloud computing services is motivated by the ease of use and the potential financial cost reductions. Service failure may occur when the service provider does not protect information or when the use of the services becomes overly complex and difficult. The benefits also bring optimisation challenges for the information owners who must assess the service security risk and the degree to which new human behaviours are required. In this research we look at the risk of identity theft when ease of service access is provided through a Single Sign On (SSO) authorisation and ask: What are …

Ransomware: Emergence Of The Cyber-Extortion Menace, Nikolai Hampton, Zubair A. Baig

Australian Information Security Management Conference

Ransomware is increasingly posing a threat to the security of information resources. Millions of dollars of monetary loss have been afflicted on end-users and corporations alike through unlawful deployment of ransomware. Through malware injection into end-user devices and subsequent extortion of their system or data, ransomware has emerged as a threat requiring immediate attention and containment by the cyber-security community. We conduct a detailed analysis of the steps of execution involved in ransomware deployment to facilitate readiness of the cyber-security community in containing the rapid proliferation of ransomware. This paper examines the evolution of malware over a period of 26 …

Innovating Additional Layer 2 Security Requirements For A Protected Stack, Brian Cusack, Raymond Lutui

Australian Information Security Management Conference

Security is only as good as the weakest link and if the weakness is at a low level in the communication stack then every other Layer has potential to inherit the problem. The OSI Layer model has defined the theoretical architecture for network communications (ISO/IEC 7498-1). Standardisation assures that each element of an internetwork uses the same model and hence a message can be moved intelligibly and correctly between participants. The OSI model divides communications into seven hierarchical Layers that provide the necessary services from the application Layer through to the physical Layer of electricity (ISO/IEC 7498-2). Each Layer is …

Using Passive And Active Enumeration Methods To Improve Ipv6 Host Enumeration Search Algorithms, Clinton Carpene

Australian Information Security Management Conference

IPv6 off-link host enumeration, when compared to IPv4 host enumeration, is a difficult and expensive exercise. The expense arises from the difference in address space sizes between the two protocols, with IPv6 having a 296 larger address space than that of IPv4. This paper presents an algorithm for performing contextual IPv6 host enumeration against a target. The algorithm uses passive and active enumeration in order to focus the search upon areas of the address space where it is more probable that targets will exist. Experiments were conducted to test the proposed adaptive heuristic search algorithm involving applying the algorithm to …

The Challeges In Implementing Security In Spontaneous Ad Hoc Networks, Alastair Nisbet

Australian Information Security Management Conference

Mobile Ad Hoc Networks (MANETS) promise much in the ability to rapidly deploy a wireless network in a fashion where no prior planning is needed and the network can be running efficiently and with high security within minutes. Natural disaster response, military, education and business provide areas where MANETS can offer significant advantages in communication where infrastructure networks may take days to set up or may be impossible to implement. This research reviews a selection of MANET protocols to show the progression of the research and the issues that are yet to be addressed. It discusses the challenges to researchers …

Does A Weak Security Discourse Provide Opportunity For Security Deviance To Flourish?, Michael P. Coole, Jeff Corkill

Australian Security and Intelligence Conference

In the years since the tragedy of 9/11 the term "security" has become a much used and abused term. As the war on terrorism has evolved, politicians of all persuasions played the security card to change law and legislation ostensibly to protect the community. Those whom provide the security assume that freedoms lost by the wider community in the name of security are in fact a fair price to pay for that security. In this environment the security discourse is diminished and this provides an opportunity for security deviance to emerge. This research used a selection of publically reported examples …

Improving The Detection And Validation Of Inland Revenue Numbers, Henry Gee, Thomas Laurenson, Hank Wolfe

Australian Digital Forensics Conference

Forensic analysis commonly involves searching an investigation target for personal identifiable information. An Inland Revenue Department (IRD) number is used for taxation purposes in New Zealand and can provide evidence of perpetrator identity, transaction information or electronic fraud. This research has designed and implemented a bulk_extractor feature scanner to detect and validate IRD numbers (features). The IRD scanner has been tested on a known data set to ensure tool functionality. A large real world data set was then used to determine scanner effectiveness in a realistic investigation scenario. Real world data set testing highlighted a high number of unrelated features …

Analysis Into Developing Accurate And Efficient Intrusion Detection Approaches, Priya Rabadia, Craig Valli

Australian Digital Forensics Conference

Cyber-security has become more prevalent as more organisations are relying on cyber-enabled infrastructures to conduct their daily actives. Subsequently cybercrime and cyber-attacks are increasing. An Intrusion Detection System (IDS) is a cyber-security tool that is used to mitigate cyber-attacks. An IDS is a system deployed to monitor network traffic and trigger an alert when unauthorised activity has been detected. It is important for IDSs to accurately identify cyber-attacks against assets on cyber-enabled infrastructures, while also being efficient at processing current and predicted network traffic flows. The purpose of the paper is to outline the importance of developing an accurate and …