Information Security Commons^™

A Lattice-Based Linkable Ring Signature Supporting Stealth Addresses, Zhen Liu, Khoa Nguyen, Guomin Yang, Huaxiong Wang, Duncan S. Wong

Research Collection School Of Computing and Information Systems

First proposed in CryptoNote, a collection of popular privacy-centric cryptocurrencies have employed Linkable Ring Signature and a corresponding Key Derivation Mechanism (KeyDerM) for keeping the payer and payee of a transaction anonymous and unlinkable. The KeyDerM is used for generating a fresh signing key and the corresponding public key, referred to as a stealth address, for the transaction payee. The stealth address will then be used in the linkable ring signature next time when the payee spends the coin. However, in all existing works, including Monero, the privacy model only considers the two cryptographic primitives separately. In addition, to be …

Predictors Of Ransomware From Binary Analysis, Aaron M. Otis

Master's Theses

Ransomware, a type of malware that extorts payment from a victim by encrypting her data, is a growing threat that is becoming more sophisticated with each generation. Attackers have shifted from targeting individuals to entire organizations, raising extortions from hundreds of dollars to hundreds of thousands of dollars. In this work, we analyze a variety of ransomware and benign software binaries in order to identify indicators that may be used to detect ransomware. We find that several combinations of strings, cryptographic constants, and a large number loops are key indicators useful for detecting ransomware.

Longitudinal Analysis With Modes Of Operation For Aes, Dana Geislinger, Cory Thigpen, Daniel W. Engels

SMU Data Science Review

In this paper, we present an empirical evaluation of the randomness of the ciphertext blocks generated by the Advanced Encryption Standard (AES) cipher in Counter (CTR) mode and in Cipher Block Chaining (CBC) mode. Vulnerabilities have been found in the AES cipher that may lead to a reduction in the randomness of the generated ciphertext blocks that can result in a practical attack on the cipher. We evaluate the randomness of the AES ciphertext using the standard key length and NIST randomness tests. We evaluate the randomness through a longitudinal analysis on 200 billion ciphertext blocks using logistic regression and …

Map My Murder: A Digital Forensic Study Of Mobile Health And Fitness Applications, Courtney Hassenfeldt, Shabana Baig, Ibrahim Baggili, Xiaolu Zhang

Electrical & Computer Engineering and Computer Science Faculty Publications

The ongoing popularity of health and fitness applications catalyzes

the need for exploring forensic artifacts produced by them. Sensitive

Personal Identifiable Information (PII) is requested by the applications

during account creation. Augmenting that with ongoing

user activities, such as the user’s walking paths, could potentially

create exculpatory or inculpatory digital evidence. We conducted

extensive manual analysis and explored forensic artifacts produced

by (n = 13) popular Android mobile health and fitness applications.

We also developed and implemented a tool that aided in the timely

acquisition and identification of artifacts from the examined applications.

Additionally, our work explored the type of …

Latent Error Prediction And Fault Localization For Microservice Applications By Learning From System Trace Logs, Xiang Zhou, Xin Peng, Tao Xie, Jun Sun, Chao Ji, Dewei Liu, Qilin Xiang, Chuan He

Research Collection School Of Computing and Information Systems

In the production environment, a large part of microservice failures are related to the complex and dynamic interactions and runtime environments, such as those related to multiple instances, environmental configurations, and asynchronous interactions of microservices. Due to the complexity and dynamism of these failures, it is often hard to reproduce and diagnose them in testing environments. It is desirable yet still challenging that these failures can be detected and the faults can be located at runtime of the production environment to allow developers to resolve them efficiently. To address this challenge, in this paper, we propose MEPFL, an approach of …

Blocks' Network: Redesign Architecture Based On Blockchain Technology, Moataz Hanif

Doctoral Dissertations and Master's Theses

The Internet is a global network that uses communication protocols. It is considered the most important system reached by humanity, which no one can abandon. However, this technology has become a weapon that threatens the privacy of users, especially in the client-server model, where data is stored and managed privately. Additionally, users have no power over their data that store in a private server, which means users’ data may interrupt by government or might be sold via service provider for-profit purposes. Furthermore, blockchain is a technology that we can rely on to solve issues related to client-server model if appropriately …

Formally Designing And Implementing Cyber Security Mechanisms In Industrial Control Networks., Mehdi Sabraoui

Electronic Theses and Dissertations

This dissertation describes progress in the state-of-the-art for developing and deploying formally verified cyber security devices in industrial control networks. It begins by detailing the unique struggles that are faced in industrial control networks and why concepts and technologies developed for securing traditional networks might not be appropriate. It uses these unique struggles and examples of contemporary cyber-attacks targeting control systems to argue that progress in securing control systems is best met with formal verification of systems, their specifications, and their security properties. This dissertation then presents a development process and identifies two technologies, TLA+ and seL4, that can be …

Cybersecurity Education In Utah High Schools: An Analysis And Strategy For Teacher Adoption, Cariana June Cornel

Theses and Dissertations

The IT Education Specialist for the USBE, Brandon Jacobson, stated:I feel there is a deficiency of and therefore a need to teach Cybersecurity.Cybersecurity is the “activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation” (NICE, 2018). Practicing cybersecurity can increase awareness of cybersecurity issues, such as theft of sensitive information. Current efforts, including but not limited to, cybersecurity camps, competitions, college courses, and conferences, have been created to better prepare cyber citizens nationwide for such cybersecurity occurrences. In …

Constructing Strong Designated Verifier Signatures From Key Encapsulation Mechanisms, Borui Gong, Ho Man Au, Haiyang Xue

Research Collection School Of Computing and Information Systems

A designated verifier signature (DVS) allows a signer to convince a verifier that a message has been endorsed in a way that the conviction cannot be transferred to any third party. This is achieved by the property that the signature can be generated by one of them. Since DVS is publicly verifiable, a valid DVS implies that the signature must be created by either the signer or the verifier. To enhance privacy of signers' identity, a strong DVS (SDVS) disallows public verification. In this paper, we investigate various aspects of SDVS with making two contributions. Firstly, we consider SDVS in …

Iot Ignorance Is Digital Forensics Research Bliss: A Survey To Understand Iot Forensics Definitions, Challenges And Future Research Directions, Tina Wu, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Interactions with IoT devices generates vast amounts of personal data that can be used as a source of evidence in digital investigations. Currently, there are many challenges in IoT forensics such as the difficulty in acquiring and analysing IoT data/devices and the lack IoT forensic tools. Besides technical challenges, there are many concepts in IoT forensics that have yet to be explored such as definitions, experience and capability in the analysis of IoT data/devices and current/future challenges. A deeper understanding of these various concepts will help progress the field. To achieve this goal, we conducted a survey which received 70 …

A Secure Iot Cloud Storage System With Fine-Grained Access Control And Decryption Key Exposure Resistance, Shengmin Xu, Guomin Yang, Yi Mu, Ximeng Liu

Research Collection School Of Computing and Information Systems

Internet of Things (IoT) cloud provides a practical and scalable solution to accommodate the data management in large-scale IoT systems by migrating the data storage and management tasks to cloud service providers (CSPs). However, there also exist many data security and privacy issues that must be well addressed in order to allow the wide adoption of the approach. To protect data confidentiality, attribute-based cryptosystems have been proposed to provide fine-grained access control over encrypted data in loT cloud. Unfortunately, the existing attributed-based solutions are still insufficient in addressing some challenging security problems, especially when dealing with compromised or leaked user …

Cybersecurity Education: The Quest To Building Bridge Skills, Andy Igonor, Raymond L. Forbes, Jonathan Mccombs

All Faculty and Staff Scholarship

Today's employers differ in what skills and abilities they believe make for a competent cybersecurity professional; however, they concur on the importance of technical and soft skills, which we collectively refer to as "bridge skills" - in other words, skills needed to bridge employer needs and what higher education teaches. Higher education, on the other hand favors producing a holistic and rounded graduate, with soft skills incorporated into the first one or two years of study. Somewhere between these two dichotomies is a missing link which currently manifests as higher education not meeting the needs of industry relative to cybersecurity …

Who Should Pay The Cost: A Game-Theoretic Model For Government Subsidized Investments To Improve National Cybersecurity, Xinrun Wang, Bo An, Hau Chan

Research Collection School Of Computing and Information Systems

Due to the recent cyber attacks, cybersecurity is becoming more critical in modern society. A single attack (e.g., WannaCry ransomware attack) can cause as much as $4 billion in damage. However, the cybersecurity investment by companies is far from satisfactory. Therefore, governments (e.g., in the UK) launch grants and subsidies to help companies to boost their cybersecurity to create a safer national cyber environment. The allocation problem is hard due to limited subsidies and the interdependence between self-interested companies and the presence of a strategic cyber attacker. To tackle the government's allocation problem, we introduce a Stackelberg game-theoretic model where …

Suitability Of Finite State Automata To Model String Constraints In Probablistic Symbolic Execution, Andrew Harris

Boise State University Theses and Dissertations

Probabilistic Symbolic Execution (PSE) extends Symbolic Execution (SE), a path-sensitive static program analysis technique, by calculating the probabilities with which program paths are executed. PSE relies on the ability of the underlying symbolic models to accurately represent the execution paths of the program as the collection of input values following these paths. While researchers established PSE for numerical data types, PSE for complex data types such as strings is a novel area of research.

For string data types SE tools commonly utilize finite state automata to represent a symbolic string model. Thus, PSE inherits from SE automata-based symbolic string models …

Process/Equipment Design Implications For Control System Cybersecurity, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

An emerging challenge for process safety is process control system cybersecurity. An attacker could gain control of the process actuators through the control system or communication policies within control loops and potentially drive the process state to unsafe conditions. Cybersecurity has traditionally been handled as an information technology (IT) problem in the process industries. In the literature for cybersecurity specifically of control systems, there has been work aimed at developing control designs that seek to fight cyberattacks by either giving the system appropriate response mechanisms once attacks are detected or seeking to make the attacks difficult to perform. In this …

Design Of Personnel Big Data Management System Based On Blockchain, Houbing Song, Jian Chen, Zhihan Lv

Publications

With the continuous development of information technology, enterprises, universities and governments are constantly stepping up the construction of electronic personnel information management system. The information of hundreds of thousands or even millions of people’s information are collected and stored into the system. So much information provides the cornerstone for the development of big data, if such data is tampered with or leaked, it will cause irreparable serious damage. However, in recent years, electronic archives have exposed a series of problems such as information leakage, information tampering, and information loss, which has made the reform of personnel information management more and …

Control-Flow Carrying Code, Yan Lin, Debin Gao

Research Collection School Of Computing and Information Systems

Control-Flow Integrity (CFI) is an effective approach in mitigating control-flow hijacking attacks including code-reuse attacks. Most conventional CFI techniques use memory page protection mechanism, Data Execution Prevention (DEP), as an underlying basis. For instance, CFI defenses use read-only address tables to avoid metadata corruption. However, this assumption has shown to be invalid with advanced attacking techniques, such as Data-Oriented Programming, data race, and Rowhammer attacks. In addition, there are scenarios in which DEP is unavailable, e.g., bare-metal systems and applications with dynamically generated code. We present the design and implementation of Control-Flow Carrying Code (C3), a new CFI enforcement without …

An Architecture For Blockchain-Based Collaborative Signature-Based Intrusion Detection System, Daniel Laufenberg

Master of Science in Information Technology Theses

Collaborative intrusion detection system (CIDS), where IDS hosts work with each other and share resources, have been proposed to cope with the increasingly sophisticated cyberattacks. Despite the promising benefits such as expanded signature databases and alert data from multiple sites, trust management and consensus building remain as challenges for a CIDS to work effectively. The blockchain technology with built-in immutability and consensus building capability provides a viable solution to the issues of CIDS. In this paper, we introduce an architecture for a blockchain-enabled signature-based collaborative IDS, discuss the implementation strategy of the proposed architecture and developed a prototype using Hyperledger …

Dynopvm: Vm-Based Software Obfuscation With Dynamic Opcode Mapping, Xiaoyang Cheng, Yan Lin, Debin Gao

Research Collection School Of Computing and Information Systems

VM-based software obfuscation has emerged as an effective technique for program obfuscation. Despite various attempts in improving its effectiveness and security, existing VM-based software obfuscators use potentially multiple but static secret mappings between virtual and native opcodes to hide the underlying instructions. In this paper, we present an attack using frequency analysis to effectively recover the secret mapping to compromise the protection, and then propose a novel VM-based obfuscator in which each basic block uses a dynamic and control-flow-aware mapping between the virtual and native instructions. We show that our proposed VM-based obfuscator not only renders the frequency analysis attack …

Ethical Hacking For Effective Defense (Modules, Labs, And Lectures), Hossain Shahriar

Computer Science and Information Technology Ancillary Materials

Summer 2019 Update: Through a Round Twelve ALG Mini-Grant for Ancillary Materials Creation and Revision, five new modules have been added to this collection:

• Enumeration with Sparta
• Enumeration with Inguma
• Hacking Web Servers with Dirbuster
• Hacking Web Servers with Skipfish
• Hacking Wireless and IoT with Bluehydra

The following set of materials is used in the Textbook Transformation Grants implementation of Ethical Hacking for Effective Defense:

https://oer.galileo.usg.edu/compsci-collections/8/

Topics include:

• TCP/IP Level Attacks
• Port Scanning
• DDoS
• Footprinting and Social Engineering
• Enumeration
• Programming for Security Professionals
• Operating System Vulnerabilities
• Embedded System Security
• Hacking Web Servers
• Hacking Wireless Networks
• Cryptography
• Protecting Networks with …

Towards Understanding Android System Vulnerabilities: Techniques And Insights, Daoyuan Wu, Debin Gao, Eric K. T. Cheng, Yichen Cao, Jintao Jiang, Robert H. Deng

Research Collection School Of Computing and Information Systems

As a common platform for pervasive devices, Android has been targeted by numerous attacks that exploit vulnerabilities in its apps and the operating system. Compared to app vulnerabilities, systemlevel vulnerabilities in Android, however, were much less explored in the literature. In this paper, we perform the first systematic study of Android system vulnerabilities by comprehensively analyzing all 2,179 vulnerabilities on the Android Security Bulletin program over about three years since its initiation in August 2015. To this end, we propose an automatic analysis framework, upon a hierarchical database structure, to crawl, parse, clean, and analyze vulnerability reports and their publicly …

A Closer Look Tells More: A Facial Distortion Based Liveness Detection For Face Authentication, Yan Li, Zilong Wang, Yingjiu Li, Robert H. Deng, Binbin Chen, Weizhi Meng, Hui Li

Research Collection School Of Computing and Information Systems

Face authentication is vulnerable to media-based virtual face forgery (MVFF) where adversaries display photos/videos or 3D virtual face models of victims to spoof face authentication systems. In this paper, we propose a liveness detection mechanism, called FaceCloseup, to protect the face authentication on mobile devices. FaceCloseup detects MVFF-based attacks by analyzing the distortion of face regions in a user's closeup facial videos captured by built-in camera on mobile device. It can detect MVFF-based attacks with an accuracy of 99.48%.

Splitsecond: Flexible Privilege Separation Of Android Apps, Jehyun Lee, Akshaya Venkateswara Venkateswara Raja, Debin Gao

Research Collection School Of Computing and Information Systems

Android applications have been attractive targets to attackers due to the large number of users and the sensitive information they possess. After the success of the first step of an attack exploiting a software vulnerability, the consequential damage is primarily determined by the criticality and the amount of Android permissions that a victim application has. As a countermeasure, process separation techniques that isolate potentially vulnerable components — usually native libraries — from the critical data and permissions, have been proposed. However, existing techniques offer little flexibility in the separation, e.g., with all native code being placed into one process without …

Securing Messaging Services Through Efficient Signcryption With Designated Equality Test, Yujue Wang, Hwee Hwa Pang, Robert H. Deng, Yong Ding, Qianhong Wu, Bo Qin

Research Collection School Of Computing and Information Systems

To address security and privacy issues in messaging services, we present a public key signcryption scheme with designated equality test on ciphertexts (PKS-DET) in this paper. The scheme enables a sender to simultaneously encrypt and sign (signcrypt) messages, and to designate a tester to perform equality test on ciphertexts, i.e., to determine whether two ciphertexts signcrypt the same underlying plaintext message. We introduce the PKS-DET framework, present a concrete construction and formally prove its security against three types of adversaries, representing two security requirements on message confidentiality against outsiders and the designated tester, respectively, and a requirement on message unforgeability …

Oblidc: An Sgx-Based Oblivious Distributed Computing Framework With Formal Proof, Pengfei Wu, Qingni Shen, Robert H. Deng, Ximeng Liu, Yinghui Zhang, Zhonghai Wu

Research Collection School Of Computing and Information Systems

Data privacy is becoming one of the most critical concerns in cloud computing. Several proposals based on Intel SGX such as VC3 and M2R have been introduced in the literature to protect data privacy during job execution in the cloud. However, a comprehensive formal proof of their security guarantees is still lacking. In this paper, we propose ObliDC, a general UC-secure SGX-based oblivious distributed computing framework. First, we model the life-cycle of a distributed computing job as data-flow graphs. Under the assumption of malicious, adaptive adversaries in the cloud, we then formally define data privacy of a distributed computing job …

Pruneable Sharding-Based Blockchain Protocol, Xiaoqin Feng, Jianfeng Ma, Yinbin Miao, Qian Meng, Ximeng Liu, Qi Jiang, Hui Li

Research Collection School Of Computing and Information Systems

As a distributed ledger technology, the block-chain has gained much attention from both the industrical and academical fields, but most of the existing blockchain protocols still have the cubical dilatation problem. Although the latest Rollerchain has mitigated this issue by changing the blockheader's contents, the low efficiency, severe capacity expansion and non-scalability problems still hinder the adoption of Rollerchain in practice. To this end, we present the pruneable sharding-based blockchain protocol by utilizing the sharding technique and PBFT(Practical Byzantine Fault Tolerance) algorithm in the improved Rollerchain, which has high efficiency, slow cubical dilatation, small capacity expansion and high scalability. Moreover, …

The Wiener Attack On Rsa Revisited: A Quest For The Exact Bound, Willy Susilo, Joseph Tonien, Guomin Yang

Research Collection School Of Computing and Information Systems

Since Wiener pointed out that the RSA can be broken if the private exponent d is relatively small compared to the modulus N (using the continued fraction technique), it has been a general belief that the Wiener attack works for. On the contrary, in this work, we give an example where the Wiener attack fails with, thus, showing that the bound is not accurate as it has been thought of. By using the classical Legendre Theorem on continued fractions, in 1999 Boneh provided the first rigorous proof which showed that the Wiener attack works for. However, the question remains whether …

The Chilling Effect Of Enforcement Of Computer Misuse: Evidences From Online Hacker Forums, Qiu-Hong Wang, Rui-Bin Geng, Seung Hyun Kim

Research Collection School Of Computing and Information Systems

To reduce the availability of hacking tools for violators in committing cybersecurity offences, many countries have enacted the legislation to criminalize the production, distribution and possession of computer misuse tools with offensive intent. However, the dual-use nature of cybersecurity technology increases the difficulty in the legal process to recognize computer misuse tools and predict their harmful outcome, which leads to unintended impacts of the enforcement on the provision of techniques valuable for information security defence. Leveraging an external shock in online hacker forums, this study examines the potential impacts of the enforcement of computer misuse on users' contribution to information …

A Scalable Approach To Joint Cyber Insurance And Security-As-A-Service Provisioning In Cloud Computing, Jonathan David Chase, Dusit Niyato, Ping Wang, Sivadon Chaisiri, Ryan K. L. Ko

Research Collection School Of Computing and Information Systems

As computing services are increasingly cloud-based, corporations are investing in cloud-based security measures. The Security-as-a-Service (SECaaS) paradigm allows customers to outsource security to the cloud, through the payment of a subscription fee. However, no security system is bulletproof, and even one successful attack can result in the loss of data and revenue worth millions of dollars. To guard against this eventuality, customers may also purchase cyber insurance to receive recompense in the case of loss. To achieve cost effectiveness, it is necessary to balance provisioning of security and insurance, even when future costs and risks are uncertain. To this end, …

Location Based Encryption, Tran Viet Xuan Phuong, Willy Susilo, Guomin Yang, Jun Yan, Dongxi Liu

Research Collection School Of Computing and Information Systems

We first propose a 2D Location Based Encryption (LBE) scheme, where the setting includes a geography center system and the 2D triangle area including the set of locations. A user joining in the system is provided with a pre-arranged key, which belongs to her/his location. If the user’s location is belonging to this area, he/she can decrypt the message. Our proposed scheme achieves a constant ciphertext size in encryption algorithm and decryption cost. Beyond the 2D-LBE scheme, we explore the 3D-LBE scheme; whereby the location is set up in the 3D dimensions. This proposed scheme is an extension of 2D-LBE …