Information Security Commons^™

Forensicast: A Non-Intrusive Approach & Tool For Logical Forensic Acquisition & Analysis Of The Google Chromecast Tv, Alex Sitterer, Nicholas Dubois, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The era of traditional cable Television (TV) is swiftly coming to an end. People today subscribe to a multitude of streaming services. Smart TVs have enabled a new generation of entertainment, not only limited to constant on-demand streaming as they now offer other features such as web browsing, communication, gaming etc. These functions have recently been embedded into a small IoT device that can connect to any TV with High Definition Multimedia Interface (HDMI) input known as Google Chromecast TV. Its wide adoption makes it a treasure trove for potential digital evidence. Our work is the primary source on forensically …

An Adaptive Cryptosystem On A Finite Field, Awnon Bhowmik, Unnikrishnan Menon

Publications and Research

Owing to mathematical theory and computational power evolution, modern cryptosystems demand ingenious trapdoor functions as their foundation to extend the gap between an enthusiastic interceptor and sensitive information. This paper introduces an adaptive block encryption scheme. This system is based on product, exponent, and modulo operation on a finite field. At the heart of this algorithm lies an innovative and robust trapdoor function that operates in the Galois Field and is responsible for the superior speed and security offered by it. Prime number theorem plays a fundamental role in this system, to keep unwelcome adversaries at bay. This is a …

Duck Hunt: Memory Forensics Of Usb Attack Platforms, Tyler Thomas, Mathew Piscitelli, Bhavik Ashok Nahar, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

To explore the memory forensic artifacts generated by USB-based attack platforms, we analyzed two of the most popular commercially available devices, Hak5's USB Rubber Ducky and Bash Bunny. We present two open source Volatility plugins, usbhunt and dhcphunt, which extract artifacts generated by these USB attacks from Windows 10 system memory images. Such artifacts include driver-related diagnostic events, unique device identifiers, and DHCP client logs. Our tools are capable of extracting metadata-rich Windows diagnostic events generated by any USB device. The device identifiers presented in this work may also be used to definitively detect device usage. Likewise, the DHCP logs …

Another Brick In The Wall: An Exploratory Analysis Of Digital Forensics Programs In The United States, Syria Mccullough, Stella Abudu, Ebere Onwubuariri, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present a comprehensive review of digital forensics programs offered by universities across the United States (U.S.). While numerous studies on digital forensics standards and curriculum exist, few, if any, have examined digital forensics courses offered across the nation. Since digital forensics courses vary from university to university, online course catalogs for academic institutions were evaluated to curate a dataset. Universities were selected based on online searches, similar to those that would be made by prospective students. Ninety-seven (n = 97) degree programs in the U.S. were evaluated. Overall, results showed that advanced technical courses are missing from curricula. We …

Browser Fingerprinting And The Importance Of Digital Privacy, Aaron M. Corpstein

Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal

Browser fingerprinting is a type of internet tracking where the attributes of a user’s computer and browser accessing a web page are remotely recorded and then used for profiling, tracking, and advertising purposes. This paper focuses on defining browser fingerprinting and enumerating ways in which the user can combat fingerprinting. Browser fingerprinting can be thwarted by changing attributes within the user’s browser or machine, using a browser designed to combat fingerprinting, or with security and anti-fingerprinting focused browser extensions. All of these methods are capable of increasing the security of the user.

Information Security Maturity Model For Healthcare Organizations In The United States, Bridget Joan Barnes Page

Dissertations and Theses

This research provides a maturity model for information security for healthcare organizations in the United States. Healthcare organizations are faced with increasing threats to the security of their information systems. The maturity model identifies specific performance metrics, with relative importance measures, that can be used to enhance information security at healthcare organizations allowing them to focus scarce resources on mitigating the most important information security threat vectors. This generalizable, hierarchical decision model uses both qualitative and quantitative metrics based on objective goals. This model may be used as a baseline by which to measure individual organizational performance, to measure performance …

Secure Self-Checkout Kiosks Using Alma Api With Two-Factor Authentication, Ron Bulaon

Research Collection Library

Self-checkout kiosks have become a staple feature of many modern and digitized libraries. These devices are used by library patrons for self-service item loans. Most implementations are not new, in fact many of these systems are simple, straight forward and work as intended. But behind this useful technology, there is a security concern on authentication that has to be addressed.

In my proposed presentation, I will discuss the risk factors of self-checkout kiosks and propose a solution using Alma APIs. I will address the technical shortcomings of the current implementations, compared to the proposed solution, and where the weakest link …

The Affect Of Globalization On Terrorism, Philip R. Passante

Master's Theses

This thesis proposal will dive into the concept of terrorism and how it is an act of force and has proven to be detrimental to the modern world. In addition, this thesis will analyze the concept of terrorism as well as the rationale behind it. It is important to understand and study this as terrorism is a complex entity made up of different themes. The concentration of this thesis will highlight how globalization has affected the phenomena of terrorism in the past, present, and ultimately the future. Globalization and terrorism have a relationship that many scholars and researchers have noticed. …

Mining Bitcoin To Avoid Sanctions, Tyler C. Lubin

Master's Theses

Though the world’s first cryptocurrency, Bitcoin, was introduced over a decade ago, it was not until recently that it became a mainstream subject. While cryptocurrencies offer many advantages, a potential downside for governments, is that no central bank controls the monetary policy and new coins can be mined by anyone anywhere in the world. Governments have always been deeply involved with how a their countries’ currency is ran and the policies they create are meant to keep a currencies’ value stable and make sure other factors like inflation is under control. Even though as of 2021, there were well over …

Lightweight Mutual Authentication And Privacy Preservation Schemes For Iot Systems., Samah Mansour

Electronic Theses and Dissertations

Internet of Things (IoT) presents a holistic and transformative approach for providing services in different domains. IoT creates an atmosphere of interaction between humans and the surrounding physical world through various technologies such as sensors, actuators, and the cloud. Theoretically, when everything is connected, everything is at risk. The rapid growth of IoT with the heterogeneous devices that are connected to the Internet generates new challenges in protecting and preserving user’s privacy and ensuring the security of our lives. IoT systems face considerable challenges in deploying robust authentication protocols because some of the IoT devices are resource-constrained with limited computation …

Outsourcing Service Fair Payment Based On Blockchain And Its Applications In Cloud Computing, Yinghui Zhang, Robert H. Deng, Ximeng Liu, Dong Zheng

Research Collection School Of Computing and Information Systems

As a milestone in the development of outsourcing services, cloud computing enables an increasing number of individuals and enterprises to enjoy the most advanced services from outsourcing service providers. Because online payment and data security issues are involved in outsourcing services, the mutual distrust between users and service providers may severely impede the wide adoption of cloud computing. Nevertheless, most existing solutions only consider a specific type of services and rely on a trusted third-party to realize fair payment. In this paper, to realize secure and fair payment of outsourcing services in general without relying on any third-party, trusted or …

Cybersecurity: Creating A Cybersecurity Culture, Steven Edward Ogden

Electronic Theses, Projects, and Dissertations

Human error has been identified as one of the highest contributing factors to successful cyber-attacks and security incidents that result in data leaks and theft of sensitive information. Human error has been caused by employees not behaving securely when interacting with information systems. This culminating experience project investigated how a cybersecurity culture can be developed to address the human error problem. The research was based on several key questions that focus on influencing factors of human behavior and best practices that have been used to develop a cybersecurity culture so that employees engage in secure behaviors. Social Cognitive Theory was …

A Lightweight And Privacy-Preserving Answer Collection Scheme For Mobile Crowdsourcing, Yingling Dai, Jian Weng, Anjia Yang, Shui Yu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Mobile Crowdsourcing (MCS) has become an emerging paradigm evolved from crowdsourcing by employing advanced features of mobile devices such as smartphones to perform more complicated, especially spatial tasks. One of the key procedures in MCS is to collect answers from mobile users (workers), which may face several security issues. First, authentication is required to ensure that answers are from authorized workers. In addition, MCS tasks are usually location-dependent, so the collected answers could disclose workers' location privacy, which may discourage workers to participate in the tasks. Finally, the overhead occurred by authentication and privacy protection should be minimized since mobile …

Towards Generative Aspect-Based Sentiment Analysis, Wenxuan Zhang, Xin Li, Yang Deng, Lidong Bing, Wai Lam

Research Collection School Of Computing and Information Systems

Aspect-based sentiment analysis (ABSA) has received increasing attention recently. Most existing work tackles ABSA in a discriminative manner, designing various task-specific classification networks for the prediction. Despite their effectiveness, these methods ignore the rich label semantics in ABSA problems and require extensive task-specific designs. In this paper, we propose to tackle various ABSA tasks in a unified generative framework. Two types of paradigms, namely annotation-style and extraction-style modeling, are designed to enable the training process by formulating each ABSA task as a text generation problem. We conduct experiments on four ABSA tasks across multiple benchmark datasets where our proposed generative …

Receiver-Anonymity In Rerandomizable Rcca-Secure Cryptosystems Resolved, Yi Wang, Rongmao Chen, Guomin Yang, Xinyi Huang, Baosheng Wang, Moti Yung

Research Collection School Of Computing and Information Systems

In this work we resolve the open problem raised by Prabhakaran and Rosulek at CRYPTO 2007, and present the first anonymous, rerandomizable, Replayable-CCA (RCCA) secure public-key encryption scheme. This solution opens the door to numerous privacy-oriented applications with a highly desired RCCA security level. At the core of our construction is a non-trivial extension of smooth projective hash functions (Cramer and Shoup, EUROCRYPT 2002), and a modular generic framework developed for constructing rerandomizable RCCA-secure encryption schemes with receiver-anonymity. The framework gives an enhanced abstraction of the original Prabhakaran and Rosulek’s scheme (which was the first construction of rerandomizable RCCA-secure encryption …

Editorial Introduction To The Special Issue: Supporting Future Scholarship On Cybercrime, Jaeyong Choi, Brandon Dulisse, Richard L. Wentling, Nathan Kruis

International Journal of Cybersecurity Intelligence & Cybercrime

This editorial introduction will present an overview of the three papers published in this special issue of the International Journal of Cybersecurity Intelligence and Cybercrime. The winners of the student paper competition during the 2021 Whitehat Conference have prepared their papers for this special issue. Their research directs our attention to key issues regarding cybercrime that have often been overlooked in the literature ranging from North Korean cyberterrorism to the relationship between COVID-19 and cybercrime and to fear of online victimization.

North Korean Cyber Attacks And Policy Responses: An Interdisciplinary Theoretical Framework, Jeeseon Hwang, Kyung-Shick Choi

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Malware Infections In The U.S. During The Covid-19 Pandemic: An Empirical Study, Sydney Gero, Sinchul Back, Jennifer Laprade, Joonggon Kim

International Journal of Cybersecurity Intelligence & Cybercrime

The COVID-19 pandemic has changed the world in many ways, especially in the landscape of cyber threats. The pandemic has pro-vided cybercriminals with more opportunities to commit crimes due to more people engaging in online activities, along with the increased use of computers for school, work, and social events. The current study seeks to explore cybercrime trends, in particular malware infections, during the COVID-19 pandemic. Thus, this study examines the relationship between the number of malware in-fections, COVID-19 positive cases, closed non-essential businesses, and closed K-12 public schools in the United States. Data utilized in this study derives from (1) …

Level Of Engagement With Social Networking Services And Fear Of Online Victimization: The Role Of Online Victimization Experiences, Yeonjae Park, Lynne M. Vieraitis

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Unlinkable And Revocable Secret Handshake, Yangguang Tian, Yingliu Li, Guomin Yang, Guomin Yang

Research Collection School Of Computing and Information Systems

In this paper, we introduce a new construction for unlinkable secret handshake that allows a group of users to perform handshakes anonymously. We define formal security models for the proposed construction and prove that it can achieve session key security, anonymity and affiliation hiding. In particular, the proposed construction ensures that (i) anonymity against protocol participants (including group authority) is achieved since a hierarchical identity-based signature is used in generating group user's pseudonym-credential pairs and (ii) revocation is achieved using a secret sharing-based revocation mechanism.

On The Vulnerability Of Openthread To Agile Denial Of Service Attacks, Casey Cronin, Sarah Diesburg Ph.D., Dheryta Jaisinghani Ph.D.

Summer Undergraduate Research Program (SURP) Symposium

The Internet of Things (IoT) includes physical devices such as sensors, connected home appliances, video monitoring systems, and smart classroom or smart warehouse applications. These devices can capture large amounts of data while using low amount of power to do it, as well as keep track of things going on around it and turn it into usable data for the user depending on what task it is performing.

IoT devices are not immune from security concerns, such as Denial of Service (DoS) attacks. These attacks are important to investigate because they can play a dangerous role in shutting down applications, …

Probability Distributions For Elliptic Curves In The Cgl Hash Function, Dhruv Bhatia, Kara Fagerstrom, Max Watson

Mathematical Sciences Technical Reports (MSTR)

Hash functions map data of arbitrary length to data of predetermined length. Good hash functions are hard to predict, making them useful in cryptography. We are interested in the elliptic curve CGL hash function, which maps a bitstring to an elliptic curve by traversing an inputdetermined path through an isogeny graph. The nodes of an isogeny graph are elliptic curves, and the edges are special maps betwixt elliptic curves called isogenies. Knowing which hash values are most likely informs us of potential security weaknesses in the hash function. We use stochastic matrices to compute the expected probability distributions of the …

A Wireguard Exploration, Alexander Master, Christina Garman

CERIAS Technical Reports

Internet users require secure means of communication. Virtual Private Networks (VPNs) often serve this purpose, for consumers and businesses. The research aims of this paper were an analysis and implementation of the new VPN protocol WireGuard. The authors explain the cryptographic primitives used, build server and client code implementations of WireGuard peers, and present the benefits and drawbacks of this new technology. The outcome was a functional WireGuard client and server implementation, capable of tunneling all Internet traffic through a cloud-based virtual private server (VPS), with minimal manual configuration necessary from the end user. The code is publicly available.

Secure Coding In Five Steps, Mini Zeng, Feng Zhu

Journal of Cybersecurity Education, Research and Practice

Software vulnerabilities have become a severe cybersecurity issue. There are numerous resources of industry best practices available, but it is still challenging to effectively teach secure coding practices. The resources are not designed for classroom usage because the amount of information is overwhelming for students. There are efforts in academia to introduce secure coding components into computer science curriculum, but a big gap between industry best practices and workforce skills still exists. Unlike many existing efforts, we focus on both the big picture of secure coding and hands-on projects. To achieve these two goals, we present five learning steps that …

Observations, Evaluations, And Recommendations For Deterlab From An Educational Perspective, Ahmed Ibrahim, Vitaly Ford

Journal of Cybersecurity Education, Research and Practice

DETERLab is a cluster environment that provides a set of virtual machines that can be used by researchers and teachers to run cybersecurity experiments and competitions, and where it is possible to deploy different network configurations to research attack and defense mechanisms in the cyber world. While we were working to develop a pathway for producing more usable and effective cybersecurity educational resources by investigating and examining several projects, we examined DETERLab as a prospective platform to use in the classroom. Throughout our experimentation, we faced challenges that we decided to document in order to help other educators use the …

An Exploratory Study Of Mode Efficacy In Cybersecurity Training, Michael D. Workman

Journal of Cybersecurity Education, Research and Practice

Cybersecurity capabilities in organizations and governmental agencies continue to lag behind the threats. Given the current environment, these entities have placed renewed emphasis on cybersecurity education. However, education appears to lack its full potential in most settings. Few empirical studies have systematically tested the efficacy of various training methods and modes, and those that have been conducted have yielded inconsistent findings. Recent literature on the use of gamified simulations have suggested that they may improve cybersecurity behaviors. Similarly, live activities such as hackathons and capture the flag events have been surmised to augment learning and capabilities. We conducted an exploratory …

An Economical Method For Securely Disintegrating Solid-State Drives Using Blenders, Brandon J. Hopkins Phd, Kevin A. Riggle

Journal of Digital Forensics, Security and Law

Pulverizing solid-state drives (SSDs) down to particles no larger than 2 mm is required by the United States National Security Agency (NSA) to ensure the highest level of data security, but commercial disintegrators that achieve this standard are large, heavy, costly, and often difficult to access globally. Here, we present a portable, inexpensive, and accessible method of pulverizing SSDs using a household blender and other readily available materials. We verify this approach by pulverizing SSDs with a variety of household blenders for fixed periods of time and sieve the resulting powder to ensure appropriate particle size. Among the 6 household …

Certis: Digital Transformation Of A Physical Security Company, Singapore Management University

Perspectives@SMU

How a company synonymous with auxiliary police injected sensors and artificial intelligence into its 21st century operations

A Mean-Field Markov Decision Process Model For Spatial-Temporal Subsidies In Ride-Sourcing Markets, Zheng Zhu, Jintao Ke, Hai Wang

Research Collection School Of Computing and Information Systems

Ride-sourcing services are increasingly popular because of their ability to accommodate on-demand travel needs. A critical issue faced by ride-sourcing platforms is the supply-demand imbalance, as a result of which drivers may spend substantial time on idle cruising and picking up remote passengers. Some platforms attempt to mitigate the imbalance by providing relocation guidance for idle drivers who may have their own self-relocation strategies and decline to follow the suggestions. Platforms then seek to induce drivers to system-desirable locations by offering them subsidies. This paper proposes a mean-field Markov decision process (MF-MDP) model to depict the dynamics in ride-sourcing markets …

Effect Of Team Cohesion Nn Flow: An Empirical Study Of Team-Based Gamification For Enterprise Resource Planning Systems In Online Classes, Yu Zhao, Mark Srite, Sumin Kim, Jinwoong Lee

Business and Information Technology Faculty Research & Creative Works

Pedagogy using gamification has recently received much attention as a way of enhancing student learning and retention. Additionally, academic institutions are making extensive use of online resources to expand teaching beyond the traditional classroom setting. Both academic institutions and companies utilize virtual teams to accomplish remote teamwork, particularly in a post-COVID environment. Despite the growing interest in incorporating gamification into teaching for business school courses, prior researchers have paid little attention to team-based gamification in the online learning environment. The purpose of this study is to examine if team members' perceived team cohesion influences their perceptions of flow. Also, we …