Semantic-Aware Stealthy Control Logic Infection Attack,
2018
University of New Orleans, New Orleans
Semantic-Aware Stealthy Control Logic Infection Attack, Sushma Kalle
LSU New Orleans Theses and Dissertations
In this thesis work we present CLIK, a new, automated, remote attack on the control logic of a programmable logic controller (PLC) in industrial control systems. The CLIK attack modifies the control logic running in a remote target PLC automatically to disrupt a physical process. We implement the CLIK attack on a real PLC. The attack is initiated by subverting the security measures that protect the control logic in a PLC. We found a critical (zero-day) vulnerability, which allows the attacker to overwrite password hash in the PLC during the authentication process. Next, CLIK retrieves and decompiles the original logic …
Manana: A Generalized Heuristic Scoring Approach For Concept Map Analysis As Applied To Cybersecurity Education,
2018
LSU New Orleans
Manana: A Generalized Heuristic Scoring Approach For Concept Map Analysis As Applied To Cybersecurity Education, Sharon Elizabeth Blake Gatto
LSU New Orleans Theses and Dissertations
Concept Maps (CMs) are considered a well-known pedagogy technique in creating curriculum, educating, teaching, and learning. Determining comprehension of concepts result from comparisons of candidate CMs against a master CM, and evaluate "goodness". Past techniques for comparing CMs have revolved around the creation of a subjective rubric. We propose a novel CM scoring scheme called MAnanA based on a Fuzzy Similarity Scaling (FSS) score to vastly remove the subjectivity of the rubrics in the process of grading a CM. We evaluate our framework against a predefined rubric and test it with CM data collected from the Introduction to …
Forensic Analysis Of Immersive Virtual Reality Social Applications: A Primary Account,
2018
University of New Haven
Forensic Analysis Of Immersive Virtual Reality Social Applications: A Primary Account, Ananya Yarramreddy, Peter Gromkowski, Ibrahim Baggili
Electrical & Computer Engineering and Computer Science Faculty Publications
Our work presents the primary account for exploring the forensics of immersive Virtual Reality (VR) systems and their social applications. The Social VR applications studied in this work include Bigscreen, Altspace VR, Rec Room and Facebook Spaces. We explored the two most widely adopted consumer VR systems: the HTC Vive and the Oculus Rift. Our tests examined the efficacy of reconstructing evidence from network traffic as well as the systems themselves. The results showed that a significant amount of forensically relevant data such as user names, user profile pictures, events, and system details may be recovered. We anticipate that this …
Exploring Confidentiality Issues In Hyperledger Fabric Business Applications,
2018
Purdue University
Exploring Confidentiality Issues In Hyperledger Fabric Business Applications, Shivam Bajpayi, Pedro Moreno-Sanchez, Donghang Lu, Sihao Yin
The Summer Undergraduate Research Fellowship (SURF) Symposium
The rise of Bitcoin and cryptocurrencies over the last decade have made its underlying technology (blockchain) come into the spotlight. Blockchain is a secure ledger of linked records called blocks. These records are cryptographically immutable and any tampering with the block is evident through a change in the cryptographic signature of the block. Among the blockchains deployed in practice today, Hyperledger Fabric is a platform that allows businesses to make use of blockchains in their applications. However, confidentiality issues arise with respects to the blocks in this blockchain network due to the fact that blocks might contain sensitive information accessible …
State Measurement Spoofing Prevention Through Model Predictive Control Design,
2018
Wayne State University
State Measurement Spoofing Prevention Through Model Predictive Control Design, Helen Durand
Chemical Engineering and Materials Science Faculty Research Publications
Security of chemical process control systems against cyberattacks is critical due to the potential for injuries and loss of life when chemical process systems fail. A potential means by which process control systems may be attacked is through the manipulation of the measurements received by the controller. One approach for addressing this is to design controllers that make manipulating the measurements received by the controller in any meaningful fashion very difficult, making the controllers a less attractive target for a cyberattack of this type. In this work, we develop a model predictive control (MPC) implementation strategy that incorporates Lyapunov-based stability …
Formal Verification Of A Modern Boot Loader,
2018
Syracuse University
Formal Verification Of A Modern Boot Loader, Scott D. Constable, Rob Sutton, Arash Sahebolamri, Steve Chapin
Electrical Engineering and Computer Science - Technical Reports
We introduce the Syracuse Assured Boot Loader Executive (SABLE), a trustworthy secure loader. A trusted boot loader performs a cryptographic measurement (hash) of program code and executes it unconditionally, allowing later-stage software to verify the integrity of the system through local or remote attestation. A secure loader differs from a trusted loader in that it executes subsequent code only if measurements of that code match known-good values. We have applied a rigorous formal verification technique recently demonstrated in practice by NICTA in their verification of the seL4 microkernel. We summarize our design philosophy from a high level and present our …
Privacy-Preserving Photo Taking And Accessing For Mobile Phones,
2018
University of Arkansas, Fayetteville
Privacy-Preserving Photo Taking And Accessing For Mobile Phones, Ang Li
Graduate Theses and Dissertations
Today, we are living in environments that are full of cameras embedded in devices such as smart phones and wearables. These mobile devices and as well as apps installed on them are designed to be extremely convenient for users to take, store and share photos. In spite of the convenience brought by ubiquitous cameras, users' privacy may be breached through photos that are taken and stored with mobile devices. For example, when users take a photo of a scenery, a building or a target person, a stranger may also be unintentionally captured in the photo. Such photos expose the location …
Welcoming Remarks From The Ijcic Honorary Editor,
2018
Australian National University
Welcoming Remarks From The Ijcic Honorary Editor, Peter Grabosky
International Journal of Cybersecurity Intelligence & Cybercrime
No abstract provided.
The Present And Future Of Cybercrime, Cyberterrorism, And Cybersecurity,
2018
Bridgewater State University
The Present And Future Of Cybercrime, Cyberterrorism, And Cybersecurity, Kyung-Shick Choi, Claire Seungeun Lee
International Journal of Cybersecurity Intelligence & Cybercrime
Cybercriminology combines knowledge from criminology, psychology, sociology, computer science, and cybersecurity to provide an in-depth understanding of cybercrime. Cybercrime and cybersecurity are interconnected across many places, platforms, and actors. Cybercrime issues are continuously and expeditiously changing and developing, especially with the advent of new technologies. The International Journal of Cybersecurity Intelligence and Cybercrime (IJCIC) aims to contribute to the growing field of cybercriminology and cybersecurity. The IJCIC is eager to work with scholars, policy analysts, practitioners, and others to enhance theory, methods, and practice within cybercrime and cybersecurity at the regional, national, and international levels.
Juvenile Hackers: An Empirical Test Of Self-Control Theory And Social Bonding Theory,
2018
Florida International University
Juvenile Hackers: An Empirical Test Of Self-Control Theory And Social Bonding Theory, Sinchul Back, Sadhika Soor, Jennifer Laprade
International Journal of Cybersecurity Intelligence & Cybercrime
In accordance with a similar growth in information technology, computer hacking has become a pervasive issue as a form of crime worldwide in recent years. Self-control theory and social bonding theory have frequently been employed to explain various types of crimes, but rarely to explore computer hacking. Drawing from Gottfredson and Hirschi’s (1990) self-control theory and Hirschi’s (1969) social bonding theory, the purpose of this study is to empirically examine the suitability of these two theories in explaining juvenile computer hacking offenses. The self-report survey data utilized for the present study was derived from middle school and high school students …
Architecture Of Aggression In Cyberspace. Testing Cyber Aggression In Young Adults In Hungary,
2018
National Institute of Criminology Hungary
Architecture Of Aggression In Cyberspace. Testing Cyber Aggression In Young Adults In Hungary, Katalin Parti, Tibor Kiss, Gergely Koplányi
International Journal of Cybersecurity Intelligence & Cybercrime
In order to test whether and how violence is exacerbated in online social networking sites, we utilized the BryantSmith Aggression Scale (Bryant & Smith, 2001), and included examples in the questionnaire offering solutions for 7 different hypothetical cases occurring online (Kiss, 2017). The questionnaire was sent to social work and law school students in Hungary. Prevalence and levels of aggression and its manifestation as violence online proved to be not more severe than in offline social relations. Law students were more aware than students of social work that online hostile acts are discrediting. Students of social work were significantly more …
An Argument For Interdisciplinary Programs In Cybersecurity,
2018
New Mexico State University
An Argument For Interdisciplinary Programs In Cybersecurity, Dennis Giever
International Journal of Cybersecurity Intelligence & Cybercrime
In this commentary Dr. Giever presents a compelling argument for interdisciplinary programs in cybersecurity at the university level. He argues that we no longer have the luxury of allowing barriers to exist between those tasked with IT security and those who provide physical security. He recommends that any security program take an “all possible paths” or “balanced approach” to the protection of assets within an organization. Students in computer science, criminal justice, business, human resources, and others should work collaboratively within education programs learning these necessary skills. A team effort is needed to accomplish the myriad of tasks necessary to …
Anonymous Privacy-Preserving Task Matching In Crowdsourcing,
2018
City University of Hong Kong
Anonymous Privacy-Preserving Task Matching In Crowdsourcing, Jiangang Shu, Ximeng Liu, Xiaohua Jia, Kan Yang, Robert H. Deng
Research Collection School Of Computing and Information Systems
With the development of sharing economy, crowdsourcing as a distributed computing paradigm has become increasingly pervasive. As one of indispensable services for most crowdsourcing applications, task matching has also been extensively explored. However, privacy issues are usually ignored during the task matching and few existing privacy-preserving crowdsourcing mechanisms can simultaneously protect both task privacy and worker privacy. This paper systematically analyzes the privacy leaks and potential threats in the task matching and proposes a single-keyword task matching scheme for the multirequester/multiworker crowdsourcing with efficient worker revocation. The proposed scheme not only protects data confidentiality and identity anonymity against the crowd-server, …
Lightweight Break-Glass Access Control System For Healthcare Internet-Of-Things,
2018
Fuzhou University
Lightweight Break-Glass Access Control System For Healthcare Internet-Of-Things, Yang Yang, Ximeng Liu, Robert H. Deng
Research Collection School Of Computing and Information Systems
Healthcare Internet-of-things (IoT) has been proposed as a promising means to greatly improve the efficiency and quality of patient care. Medical devices in healthcare IoT measure patients' vital signs and aggregate these data into medical files which are uploaded to the cloud for storage and accessed by healthcare workers. To protect patients' privacy, encryption is normally used to enforce access control of medical files by authorized parties while preventing unauthorized access. In healthcare, it is crucial to enable timely access of patient files in emergency situations. In this paper, we propose a lightweight break-glass access control (LiBAC) system that supports …
Spreading Propaganda In Cyberspace: Comparing Cyber-Resource Usage Of Al Qaeda And Isis,
2018
Bridgewater State University
Spreading Propaganda In Cyberspace: Comparing Cyber-Resource Usage Of Al Qaeda And Isis, Kyung-Shick Choi, Claire Seungeun Lee, Robert Cadigan
International Journal of Cybersecurity Intelligence & Cybercrime
Terrorists in cyberspace are increasingly utilizing social media to promote their ideologies, recruit new members, and justify terrorist attacks and actions. This study explores the ways in which types of social media, message contents, and motives for spreading propaganda take shape in cyberspace. In order to empirically test these relations, we created a dataset with annual terrorism reports from 2011 to 2016. In our global cyberterrorism dataset, we used and connected cyber-resources (Facebook, online forum, Twitter mentions, websites, and YouTube videos) and legal documents of individual cases that were mentioned in the reports. The results show that YouTube videos were …
Practical Attribute-Based Multi-Keyword Search Scheme In Mobile Crowdsourcing,
2018
Singapore Management University
Practical Attribute-Based Multi-Keyword Search Scheme In Mobile Crowdsourcing, Yinbin Miao, Jianfeng Ma, Ximeng Liu, Xinghua Li, Zhiquan Liu, Hui Li
Research Collection School Of Computing and Information Systems
Cloud-based mobile crowd-sourcing has been an attractive solution to provide data storage and share services for resource-limited mobile devices in a privacy-preserving manner, but how to enable mobile users to issue search queries and achieve fine-grained access control over ciphertexts simultaneously is still a big challenge for various circumstances. Although the ciphertext-policy attribute-based keyword search technology combining attribute-based encryption with searchable encryption has become a hot research topic, it just deals with equivalent attributes rather than more practical attribute comparisons, like “greater than” or “less than.” In this paper, we devise a practical cryptographic primitive called attribute-based multi-keyword search scheme …
Server-Aided Attribute-Based Signature With Revocation For Resource-Constrained Industrial-Internet-Of-Things Devices,
2018
Royal Melbourne Institute of Technology
Server-Aided Attribute-Based Signature With Revocation For Resource-Constrained Industrial-Internet-Of-Things Devices, Hui Cui, Robert H. Deng, Joseph K. Liu, Xun Yi, Yingjiu Li
Research Collection School Of Computing and Information Systems
The industrial Internet-of-things (IIoT) can be seen as the usage of Internet-of-things technologies in industries, which provides a way to improve the operational efficiency. An attribute-based signature (ABS) has been a very useful technique for services requiring anonymous authentication in practice, where a signer can sign a message over a set of attributes without disclosing any information about his/her identity, and a signature only attests to the fact that it is created by a signer with several attributes satisfying some claim predicate. However, an ABS scheme requires exponentiation and/or pairing operations in the signature generation and verification algorithms, and hence, …
Building Test Anonymity Networks In A Cybersecurity Lab Environment,
2018
CUNY Queensborough Community College
Building Test Anonymity Networks In A Cybersecurity Lab Environment, John Schriner
Student Theses
This paper explores current methods for creating test anonymity networks in a laboratory environment for the purpose of improving these networks while protecting user privacy. We first consider how each of these networks is research-driven and interested in helping researchers to conduct their research ethically. We then look to the software currently available for researchers to set up in their labs. Lastly we explore ways in which digital forensics and cybersecurity students could get involved with these projects and look at several class exercises that help students to understand particular attacks on these networks and ways they can help to …
Pusc: Privacy-Preserving User-Centric Skyline Computation Over Multiple Encrypted Domains,
2018
Singapore Management University
Pusc: Privacy-Preserving User-Centric Skyline Computation Over Multiple Encrypted Domains, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng, Yang Yang
Research Collection School Of Computing and Information Systems
In this paper, we present a new privacy-preserving user-centric skyline computation framework over different encrypted domains, which we referred to as PUSC. With PUSC, a user can flexibly obtain the skyline set from different service providers without disclosing user preferences to third parties in the system. Specifically, we introduce a secure user-defined vector dominance protocol to compare the vector dominance relationship between two encrypted vectors, according to user's preference. This serves as the core protocol in PUSC. Detailed security analysis shows that the proposed PUSC achieves the goal of selecting skyline set according to authorized users' preferences without leaking their …
Privacy-Preserving Biometric-Based Remote User Authentication With Leakage Resilience,
2018
Singapore Management University
Privacy-Preserving Biometric-Based Remote User Authentication With Leakage Resilience, Yangguang Tian, Yingjiu Li, Rongmao Chen, Ximeng Liu, Bing Chang, Xingjie Yu
Research Collection School Of Computing and Information Systems
Biometric-based remote user authentication is a useful primitive that allows an authorized user to authenticate to a remote server using his biometrics. Leakage attacks, such as side-channel attacks, allow an attacker to learn partial knowledge of secrets (e.g., biometrics) stored on any physical medium. Leakage attacks can be potentially launched to any existing biometric-based remote user authentication systems. Furthermore, applying plain biometrics is an efficient and straightforward approach when designing remote user authentication schemes. However, this approach jeopardises user’s biometrics privacy. To address these issues, we propose a novel leakage-resilient and privacy-preserving biometric-based remote user authentication framework, such that registered …
