Information Security Commons^™

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

A Forensic Enabled Data Provenance Model For Public Cloud, Shariful Haque, Travis Atkison

Journal of Digital Forensics, Security and Law

Cloud computing is a newly emerging technology where storage, computation and services are extensively shared among a large number of users through virtualization and distributed computing. This technology makes the process of detecting the physical location or ownership of a particular piece of data even more complicated. As a result, improvements in data provenance techniques became necessary. Provenance refers to the record describing the origin and other historical information about a piece of data. An advanced data provenance system will give forensic investigators a transparent idea about the data's lineage, and help to resolve disputes over controversial pieces of data …

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

A Nonlinear Systems Framework For Cyberattack Prevention For Chemical Process Control Systems, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

Recent cyberattacks against industrial control systems highlight the criticality of preventing future attacks from disrupting plants economically or, more critically, from impacting plant safety. This work develops a nonlinear systems framework for understanding cyberattack-resilience of process and control designs and indicates through an analysis of three control designs how control laws can be inspected for this property. A chemical process example illustrates that control approaches intended for cyberattack prevention which seem intuitive are not cyberattack-resilient unless they meet the requirements of a nonlinear systems description of this property.

Rationality And Efficient Verifiable Computation, Matteo Campanelli

Dissertations, Theses, and Capstone Projects

In this thesis, we study protocols for delegating computation in a model where one of the parties is rational. In our model, a delegator outsources the computation of a function f on input x to a worker, who receives a (possibly monetary) reward. Our goal is to design very efficient delegation schemes where a worker is economically incentivized to provide the correct result f(x). In this work we strive for not relying on cryptographic assumptions, in particular our results do not require the existence of one-way functions.

We provide several results within the framework of rational proofs introduced by Azar …

Resonance Attacks On Load Frequency Control Of Smart Grids, Yongdong Wu, Zhuo Wei, Jian Weng, Xin Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Load frequency control (LFC) is widely employed to regulate power plants in modern power generation systems of smart grids. This paper presents a simple and yet powerful type of attacks, referred to as resonance attacks, on LFC power generation systems. Specifically, in a resonance attack, an adversary craftily modifies the input of a power plant according to a resonance source (e.g., rate of change of frequency) to produce a feedback on LFC power generation system, such that the state of the power plant quickly becomes instable. Extensive computer simulations on popular LFC power generation system models which consist of linear, …

Dsh: Deniable Secret Handshake Framework, Yangguang Tian, Yingjiu Li, Yinghui Zhang, Nan Li, Guomin Yang, Yong Yu

Research Collection School Of Computing and Information Systems

Secret handshake is a useful primitive that allows a group of authorized users to establish a shared secret key and authenticate each other anonymously. It naturally provides a certain degree of user privacy and deniability which are also desirable for some private conversations that require secure key establishment. The inherent user privacy enables a private conversation between authorized users without revealing their real identities. While deniability allows authorized users to later deny their participating in conversations. However, deniability of secret handshakes lacks a comprehensive treatment in the literature. In this paper, we investigate the deniability of existing secret handshakes. We …

Efficient Traceable Oblivious Transfer And Its Applications, Weiwei Liu, Yinghui Zhang, Yi Mu, Guomin Yang, Yangguang Tian

Research Collection School Of Computing and Information Systems

Oblivious transfer (OT) has been applied widely in privacy-sensitive systems such as on-line transactions and electronic commerce to protect users’ private information. Traceability is an interesting feature of such systems that the privacy of the dishonest users could be traced by the service provider or a trusted third party (TTP). However, previous research on OT mainly focused on designing protocols with unconditional receiver’s privacy. Thus, traditional OT schemes cannot fulfill the traceability requirements in the aforementioned applications. In this paper, we address this problem by presenting a novel traceable oblivious transfer (TOT) without involvement of any TTP. In the new …

Blockchain Based Efficient And Robust Fair Payment For Outsourcing Services In Cloud Computing, Yinghui Zhang, Robert H. Deng, Ximeng Liu, Dong Zheng

Research Collection School Of Computing and Information Systems

As an attractive business model of cloud computing, outsourcing services usually involve online payment and security issues. The mutual distrust between users and outsourcing service providers may severely impede the wide adoption of cloud computing. Nevertheless, most existing payment solutions only consider a specific type of outsourcing service and rely on a trusted third-party to realize fairness. In this paper, in order to realize secure and fair payment of outsourcing services in general without relying on any third-party, trusted or not, we introduce BCPay, a blockchain based fair payment framework for outsourcing services in cloud computing. We first present the …

Concessive Online/Offline Attribute Based Encryption With Cryptographic Reverse Firewalls: Secure And Efficient Fine-Grained Access Control On Corrupted Machines, Hui Ma, Rui Zhang, Guomin Yang, Zishuai Song, Shuzhou Sun, Yuting Xiao

Research Collection School Of Computing and Information Systems

Attribute based encryption (ABE) has potential to be applied in various cloud computing applications. However, the Snowden revelations show that powerful adversaries can corrupt users’ machines to compromise the security, and many implementations of provably secure encryption schemes may present undetectable vulnerabilities that can expose secret, e.g., the scheme still works properly even some backdoors have been stealthily engineered on users’ machines. Undoubtedly, ABE is also facing the above security threats. Recently, Mironov and Stephens-Davidowitz proposed cryptographic reverse firewall (CRF) to solve the problem. Unfortunately, no CRF-based protection for ABE has been proposed so far due to the complex system …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Cover

Journal of Digital Forensics, Security and Law

No abstract provided.

Publication Information

Journal of Digital Forensics, Security and Law

No abstract provided.

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Digital Forensics In The Next Five Years, Laoise Luciano, Ibrahim Baggili, Mateusz Topor, Peter Casey, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Cyber forensics has encountered major obstacles over the last decade and is at a crossroads. This paper presents data that was obtained during the National Workshop on Redefining Cyber Forensics (NWRCF) on May 23-24, 2017 supported by the National Science Foundation and organized by the University of New Haven. Qualitative and quantitative data were analyzed from twenty-four cyber forensics expert panel members. This work identified important themes that need to be addressed by the community, focusing on (1) where the domain currently is; (2) where it needs to go and; (3) steps needed to improve it. Furthermore, based on the …

I Know What You Did Last Summer: Your Smart Home Internet Of Things And Your Iphone Forensically Ratting You Out, Gokila Dorai, Shiva Houshmand, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The adoption of smart home Internet of Things (IoT) devices continues to grow. What if your devices can snitch on you and let us know where you are at any given point in time? In this work we examined the forensic artifacts produced by Nest devices, and in specific, we examined the logical backup structure of an iPhone used to control a Nest thermostat, Nest Indoor Camera and a Nest Outdoor Camera. We also integrated the Google Home Mini as another method of controlling the studied Smart Home devices. Our work is the primary account for the examination of Nest …

Suas: Cybersecurity Threats, Vulnerabilities, And Exploits, Philip Craiger, Gary Kessler, William Rose

National Training Aircraft Symposium (NTAS)

The FAA predicts that purchases of hobbyist small unmanned aerial systems (sUAS) will grow from 1.9 million in 2016 to 4.3 million by 2020, and commercial sUAS to increase from 600,000 in 2016 to 2.7 million by 2020. sUAS, often referred to as 'drones,' are comprised of aeronautical hardware, a CPU, RAM, onboard storage, radio frequency communications, sensors, a camera, and a controller used by the pilot-in-command (PIC). Some have argued that a sUAS is essentially a flying computer. As such, sUAS are sometimes susceptible to many of the types of attacks that are often used on PC-based computers attached …

Semantic-Aware Stealthy Control Logic Infection Attack, Sushma Kalle

LSU New Orleans Theses and Dissertations

In this thesis work we present CLIK, a new, automated, remote attack on the control logic of a programmable logic controller (PLC) in industrial control systems. The CLIK attack modifies the control logic running in a remote target PLC automatically to disrupt a physical process. We implement the CLIK attack on a real PLC. The attack is initiated by subverting the security measures that protect the control logic in a PLC. We found a critical (zero-day) vulnerability, which allows the attacker to overwrite password hash in the PLC during the authentication process. Next, CLIK retrieves and decompiles the original logic …

Manana: A Generalized Heuristic Scoring Approach For Concept Map Analysis As Applied To Cybersecurity Education, Sharon Elizabeth Blake Gatto

LSU New Orleans Theses and Dissertations

Concept Maps (CMs) are considered a well-known pedagogy technique in creating curriculum, educating, teaching, and learning. Determining comprehension of concepts result from comparisons of candidate CMs against a master CM, and evaluate "goodness". Past techniques for comparing CMs have revolved around the creation of a subjective rubric. We propose a novel CM scoring scheme called MAnanA based on a Fuzzy Similarity Scaling (FSS) score to vastly remove the subjectivity of the rubrics in the process of grading a CM. We evaluate our framework against a predefined rubric and test it with CM data collected from the Introduction to …

Forensic Analysis Of Immersive Virtual Reality Social Applications: A Primary Account, Ananya Yarramreddy, Peter Gromkowski, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Our work presents the primary account for exploring the forensics of immersive Virtual Reality (VR) systems and their social applications. The Social VR applications studied in this work include Bigscreen, Altspace VR, Rec Room and Facebook Spaces. We explored the two most widely adopted consumer VR systems: the HTC Vive and the Oculus Rift. Our tests examined the efficacy of reconstructing evidence from network traffic as well as the systems themselves. The results showed that a significant amount of forensically relevant data such as user names, user profile pictures, events, and system details may be recovered. We anticipate that this …

Exploring Confidentiality Issues In Hyperledger Fabric Business Applications, Shivam Bajpayi, Pedro Moreno-Sanchez, Donghang Lu, Sihao Yin

The Summer Undergraduate Research Fellowship (SURF) Symposium

The rise of Bitcoin and cryptocurrencies over the last decade have made its underlying technology (blockchain) come into the spotlight. Blockchain is a secure ledger of linked records called blocks. These records are cryptographically immutable and any tampering with the block is evident through a change in the cryptographic signature of the block. Among the blockchains deployed in practice today, Hyperledger Fabric is a platform that allows businesses to make use of blockchains in their applications. However, confidentiality issues arise with respects to the blocks in this blockchain network due to the fact that blocks might contain sensitive information accessible …

State Measurement Spoofing Prevention Through Model Predictive Control Design, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

Security of chemical process control systems against cyberattacks is critical due to the potential for injuries and loss of life when chemical process systems fail. A potential means by which process control systems may be attacked is through the manipulation of the measurements received by the controller. One approach for addressing this is to design controllers that make manipulating the measurements received by the controller in any meaningful fashion very difficult, making the controllers a less attractive target for a cyberattack of this type. In this work, we develop a model predictive control (MPC) implementation strategy that incorporates Lyapunov-based stability …

Formal Verification Of A Modern Boot Loader, Scott D. Constable, Rob Sutton, Arash Sahebolamri, Steve Chapin

Electrical Engineering and Computer Science - Technical Reports

We introduce the Syracuse Assured Boot Loader Executive (SABLE), a trustworthy secure loader. A trusted boot loader performs a cryptographic measurement (hash) of program code and executes it unconditionally, allowing later-stage software to verify the integrity of the system through local or remote attestation. A secure loader differs from a trusted loader in that it executes subsequent code only if measurements of that code match known-good values. We have applied a rigorous formal verification technique recently demonstrated in practice by NICTA in their verification of the seL4 microkernel. We summarize our design philosophy from a high level and present our …

Privacy-Preserving Photo Taking And Accessing For Mobile Phones, Ang Li

Graduate Theses and Dissertations

Today, we are living in environments that are full of cameras embedded in devices such as smart phones and wearables. These mobile devices and as well as apps installed on them are designed to be extremely convenient for users to take, store and share photos. In spite of the convenience brought by ubiquitous cameras, users' privacy may be breached through photos that are taken and stored with mobile devices. For example, when users take a photo of a scenery, a building or a target person, a stranger may also be unintentionally captured in the photo. Such photos expose the location …

Welcoming Remarks From The Ijcic Honorary Editor, Peter Grabosky

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

The Present And Future Of Cybercrime, Cyberterrorism, And Cybersecurity, Kyung-Shick Choi, Claire Seungeun Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Cybercriminology combines knowledge from criminology, psychology, sociology, computer science, and cybersecurity to provide an in-depth understanding of cybercrime. Cybercrime and cybersecurity are interconnected across many places, platforms, and actors. Cybercrime issues are continuously and expeditiously changing and developing, especially with the advent of new technologies. The International Journal of Cybersecurity Intelligence and Cybercrime (IJCIC) aims to contribute to the growing field of cybercriminology and cybersecurity. The IJCIC is eager to work with scholars, policy analysts, practitioners, and others to enhance theory, methods, and practice within cybercrime and cybersecurity at the regional, national, and international levels.

Juvenile Hackers: An Empirical Test Of Self-Control Theory And Social Bonding Theory, Sinchul Back, Sadhika Soor, Jennifer Laprade

International Journal of Cybersecurity Intelligence & Cybercrime

In accordance with a similar growth in information technology, computer hacking has become a pervasive issue as a form of crime worldwide in recent years. Self-control theory and social bonding theory have frequently been employed to explain various types of crimes, but rarely to explore computer hacking. Drawing from Gottfredson and Hirschi’s (1990) self-control theory and Hirschi’s (1969) social bonding theory, the purpose of this study is to empirically examine the suitability of these two theories in explaining juvenile computer hacking offenses. The self-report survey data utilized for the present study was derived from middle school and high school students …

Architecture Of Aggression In Cyberspace. Testing Cyber Aggression In Young Adults In Hungary, Katalin Parti, Tibor Kiss, Gergely Koplányi

International Journal of Cybersecurity Intelligence & Cybercrime

In order to test whether and how violence is exacerbated in online social networking sites, we utilized the BryantSmith Aggression Scale (Bryant & Smith, 2001), and included examples in the questionnaire offering solutions for 7 different hypothetical cases occurring online (Kiss, 2017). The questionnaire was sent to social work and law school students in Hungary. Prevalence and levels of aggression and its manifestation as violence online proved to be not more severe than in offline social relations. Law students were more aware than students of social work that online hostile acts are discrediting. Students of social work were significantly more …

An Argument For Interdisciplinary Programs In Cybersecurity, Dennis Giever

International Journal of Cybersecurity Intelligence & Cybercrime

In this commentary Dr. Giever presents a compelling argument for interdisciplinary programs in cybersecurity at the university level. He argues that we no longer have the luxury of allowing barriers to exist between those tasked with IT security and those who provide physical security. He recommends that any security program take an “all possible paths” or “balanced approach” to the protection of assets within an organization. Students in computer science, criminal justice, business, human resources, and others should work collaboratively within education programs learning these necessary skills. A team effort is needed to accomplish the myriad of tasks necessary to …