Information Security Commons^™

Splitsecond: Flexible Privilege Separation Of Android Apps, Jehyun Lee, Akshaya Venkateswara Venkateswara Raja, Debin Gao

Research Collection School Of Computing and Information Systems

Android applications have been attractive targets to attackers due to the large number of users and the sensitive information they possess. After the success of the first step of an attack exploiting a software vulnerability, the consequential damage is primarily determined by the criticality and the amount of Android permissions that a victim application has. As a countermeasure, process separation techniques that isolate potentially vulnerable components — usually native libraries — from the critical data and permissions, have been proposed. However, existing techniques offer little flexibility in the separation, e.g., with all native code being placed into one process without …

Location Based Encryption, Tran Viet Xuan Phuong, Willy Susilo, Guomin Yang, Jun Yan, Dongxi Liu

Research Collection School Of Computing and Information Systems

We first propose a 2D Location Based Encryption (LBE) scheme, where the setting includes a geography center system and the 2D triangle area including the set of locations. A user joining in the system is provided with a pre-arranged key, which belongs to her/his location. If the user’s location is belonging to this area, he/she can decrypt the message. Our proposed scheme achieves a constant ciphertext size in encryption algorithm and decryption cost. Beyond the 2D-LBE scheme, we explore the 3D-LBE scheme; whereby the location is set up in the 3D dimensions. This proposed scheme is an extension of 2D-LBE …

Towards Understanding Android System Vulnerabilities: Techniques And Insights, Daoyuan Wu, Debin Gao, Eric K. T. Cheng, Yichen Cao, Jintao Jiang, Robert H. Deng

Research Collection School Of Computing and Information Systems

As a common platform for pervasive devices, Android has been targeted by numerous attacks that exploit vulnerabilities in its apps and the operating system. Compared to app vulnerabilities, systemlevel vulnerabilities in Android, however, were much less explored in the literature. In this paper, we perform the first systematic study of Android system vulnerabilities by comprehensively analyzing all 2,179 vulnerabilities on the Android Security Bulletin program over about three years since its initiation in August 2015. To this end, we propose an automatic analysis framework, upon a hierarchical database structure, to crawl, parse, clean, and analyze vulnerability reports and their publicly …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Examining The Correlates Of Failed Drdos Attacks, Thomas Hyslip, Thomas Holt

Journal of Digital Forensics, Security and Law

Over the last decade, there has been a rise in cybercrime services offered on a feefor- service basis, enabling individuals to direct attacks against various targets. One of the recent services offered involves stresser or booter operators, who offer distributed reflected denial of service (DRDoS) attacks on an hourly or subscription basis. These attacks involve the use of malicious traffic reflected off of webservers to increase the volume of traffic, which is directed toward websites and servers rendering them unusable. Researchers have examined DRDoS attacks using realtime data, though few have considered the experience of their customers and the factors …

Enhancing Forensic-Tool Security With Rust: Development Of A String Extraction Utility, Jens Getreu, Olaf Maennel

Journal of Digital Forensics, Security and Law

The paper evaluates the suitability of the Rust ecosystem for forensic tool development. As a case study, a forensic tool named Stringsext is developed. Starting from analyzing the specefic requirements of forensic software in general and those of the present case study, all stages of the software development life-cycle are executed and evaluated. Stringsext is a re-implementation and enhancement of the GNU-strings tool, a widely used program in forensic investigations. Stringsext recognizes Cyrillic, CJKV East Asian characters and other scripts in all supported multi-byte-encodings while GNU-strings fails in finding these in UTF-16 and other encodings. During the case study it …

Forensic Cell Site Analysis: Mobile Network Operator Evidence Integrity Maintenance Research, John B. Minor

Journal of Digital Forensics, Security and Law

Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and …

Df 2.0: An Automated, Privacy Preserving, And Efficient Digital Forensic Framework That Leverages Machine Learning For Evidence Prediction And Privacy Evaluation, Robin Verma, Jayaprakash Govindaraj Dr, Saheb Chhabra, Gaurav Gupta

Journal of Digital Forensics, Security and Law

The current state of digital forensic investigation is continuously challenged by the rapid technological changes, the increase in the use of digital devices (both the heterogeneity and the count), and the sheer volume of data that these devices could contain. Although data privacy protection is not a performance measure, however, preventing privacy violations during the digital forensic investigation, is also a big challenge. With a perception that the completeness of investigation and the data privacy preservation are incompatible with each other, the researchers have provided solutions to address the above-stated challenges that either focus on the effectiveness of the investigation …

Cyberbullying And Cybervictimization In Tanzanian Secondary Schools: Prevalence And Predictors, Hezron Zacharia Onditi, Jennifer Shapka

Journal of Humanities and Social Sciences

This study explored cyberbullying and cybervictimization, and the role of socio demographic and access to technology variables for Tanzanian adolescents. A self-report questionnaire was completed by secondary school students aged 14 to 18 (Form 1 to Form IV). Results provide evidence that online violence is increasingly becoming a problem of concern for Tanzanian adolescents. In particular, whereas 42% of the students reported to have cyberbullied others using electronic communication devices, 58% admitted having experienced cybervictimization. Also, results showed that students who spend more time online, share cellphones with others, and who access digital devices in a private location are more …

The Trust-Based Interactive Partially Observable Markov Decision Process, Richard S. Seymour

Theses and Dissertations

Cooperative agent and robot systems are designed so that each is working toward the same common good. The problem is that the software systems are extremely complex and can be subverted by an adversary to either break the system or potentially worse, create sneaky agents who are willing to cooperate when the stakes are low and take selfish, greedy actions when the rewards rise. This research focuses on the ability of a group of agents to reason about the trustworthiness of each other and make decisions about whether to cooperate. A trust-based interactive partially observable Markov decision process (TI-POMDP) is …

Weaving The Dark Web: Legitimacy On Freenet, Tor, And I2p, John Schriner

Publications and Research

This is a book review of Robert W. Gehl's Weaving the Dark Web: Legitimacy on Freenet, Tor, and I2P (2018). The book explores these anonymity networks and the concept of legitimacy throughout. Using a multidisciplinary approach and interviews with network-builders and users, Gehl helps to demystify the dark web and critically examine these networks and technologies.

Decentralise Me, Paul Robert Griffin

MITB Thought Leadership Series

If you are in need of a reminder of the levels of hype surrounding blockchain, then look no further than Japan’s J-Pop sensation Kasotsuka Shojo, otherwise known as the Virtual Currency Girls who, with their debut track “The Moon and Cryptocurrencies and Me”, aim to educate fans about cryptocurrencies in an entertaining way.

”Cyberworld” As A Theme For A University-Wide First-Year Common Course, Kristen Przyborski, Frank Breitinger, Lauren Beck, Ronald S. Harichandran

Engineering and Applied Science Education Faculty Publications

Nowadays we all live in a cyber world and use the internet for emailing, banking, streaming video, shopping, reading news, or other activities. Given all the time people spend online, it is important that all students (regardless of their major) learn some basics about living in a cyber world, e.g., strategies for online safety, impact of artificial intelligence, digital forensics or ancestry.com. To facilitate students from many majors to learn about important issues related to the internet, eight faculty from a variety of disciplines at the University of New Haven integrated the theme of Cyber World into our team-taught, first-year …

Lightweight Privacy-Preserving Ensemble Classification For Face Recognition, Zhuo Ma, Yang Liu, Ximeng Liu, Jianfeng Ma, Kui Ren

Research Collection School Of Computing and Information Systems

The development of machine learning technology and visual sensors is promoting the wider applications of face recognition into our daily life. However, if the face features in the servers are abused by the adversary, our privacy and wealth can be faced with great threat. Many security experts have pointed out that, by 3-D-printing technology, the adversary can utilize the leaked face feature data to masquerade others and break the E-bank accounts. Therefore, in this paper, we propose a lightweight privacy-preserving adaptive boosting (AdaBoost) classification framework for face recognition (POR) based on the additive secret sharing and edge computing. First, we …

Adopting The Cybersecurity Curriculum Guidelines To Develop A Secondary And Primary Academic Discipline In Cybersecurity Postsecondary Education, Wasim A. Alhamdani

Journal of Cybersecurity Education, Research and Practice

A suggested curriculum for secondary and primarily academic discipline in Cybersecurity Postsecondary Education is presented. This curriculum is developed based on the Association for Computing Machinery guidelines and the National Centers of Academic Excellence Cyber Operations program.

From The Editors, Michael E. Whitman, Herbert J. Mattord, Carole L. Hollingsworth

Journal of Cybersecurity Education, Research and Practice

No abstract provided.

Car Hacking: Accessing And Exploiting The Can Bus Protocol, Bryson R. Payne

Journal of Cybersecurity Education, Research and Practice

With the rapid adoption of internet-connected and driver-assist technologies, and the spread of semi-autonomous to self-driving cars on roads worldwide, cybersecurity for smart cars is a timely concern and one worth exploring both in the classroom and in the real world. Highly publicized hacks against production cars, and a relatively small number of crashes involving autonomous vehicles, have brought the issue of securing smart cars to the forefront as a matter of public and individual safety, and the cybersecurity of these “data centers on wheels” is of greater concern than ever.

However, up to this point there has been a …

A Design Case: Assessing The Functional Needs For A Multi-Faceted Cybersecurity Learning Space, Charles J. Lesko Jr.

Journal of Cybersecurity Education, Research and Practice

Following a multi-year effort that developed not only a detailed list of functional requirements but also the preliminary physical and logical design layouts, the concept for a multi-faceted cybersecurity center was approved and the physical, as well as, additional infrastructure space was subsequently allocated. This effort briefly describes the structure and scope of the current cybersecurity program being supported and then draws out the functional requirements that were identified for the center based on the needs of the institution’s cybersecurity program. It also highlights the physical and logical design specifications of the center, as well as, the many external program …

Key-Insulated And Privacy-Preserving Signature Scheme With Publicly Derived Public Key, Zhen Liu, Guomin Yang, Duncan S. Wong, Khoa Nguyen, Huaxiong Wang

Research Collection School Of Computing and Information Systems

Since the introduction of Bitcoin in 2008, cryptocurrency has been undergoing a quick and explosive development. At the same time, privacy protection, one of the key merits of cryptocurrency, has attracted much attention by the community. A deterministic wallet algorithm and a stealth address algorithm have been widely adopted in the community, due to their virtues on functionality and privacy protection, which come from a key derivation mechanism that an arbitrary number of derived keys can be generated from a master key. However, these algorithms suffer a vulnerability. In particular, when a minor fault happens (say, one derived key is …

The Performance Cost Of Security, Lucy R. Bowen

Master's Theses

Historically, performance has been the most important feature when optimizing computer hardware. Modern processors are so highly optimized that every cycle of computation time matters. However, this practice of optimizing for performance at all costs has been called into question by new microarchitectural attacks, e.g. Meltdown and Spectre. Microarchitectural attacks exploit the effects of microarchitectural components or optimizations in order to leak data to an attacker. These attacks have caused processor manufacturers to introduce performance impacting mitigations in both software and silicon.

To investigate the performance impact of the various mitigations, a test suite of forty-seven different tests was created. …