Accepted Papers
Analog Physical-Layer Relay Attacks with Application to Bluetooth and Phase-Based Ranging
1 Max Planck Institute for Security and Privacy
2 PHYSEC GmbH
3 Technische Hochschule Köln
Today, we use smartphones as multi-purpose devices that communicate with their environment to implement context-aware services, including asset tracking, indoor localization, contact tracing, or access control. As a de-facto standard, Bluetooth is available in virtually every smartphone to provide short-range wireless communication. Importantly, many Bluetooth-driven applications such as Phone as a Key (PaaK) for vehicles and buildings require proximity of legitimate devices, which must be protected against unauthorized access. In earlier access control systems, attackers were able to violate proximity-verification through relay station attacks. However, the vulnerability of Bluetooth against such attacks was yet unclear as existing relay attack strategies are not applicable or can be defeated through wireless distance measurement.
In this paper, we design and implement an analog physical-layer relay attack based on low-cost off-the-shelf radio hardware to simultaneously increase the wireless communication range and manipulate distance measurements. Using our setup, we successfully demonstrate relay attacks against Bluetooth-based access control of a car (Tesla Model 3) and a smart lock (Nuki Smart Lock 2.0). Further, we show that our attack can arbitrarily manipulate Multi-Carrier Phase-based Ranging (MCPR) while relaying signals over 90 m.
Automating the Quantitative Analysis of Reproducibility for Build Artifacts derived from the Android Open Source Project
1 Johannes Kepler University Linz
This work proposes a modular automation toolchain to analyze current state and over-time changes of reproducibility of build artifacts derived from the Android Open Source Project (AOSP). While perfect bit-by-bit equality of binary artifacts would be a desirable goal to permit independent verification if binary build artifacts really are the result of building a specific state of source code, this form of reproducibility is often not (yet) achievable in practice. Certain complexities in the Android ecosystem make assessment of production firmware images particularly difficult. To overcome this, we introduce “accountable builds” as a form of reproducibility that allows for legitimate deviations from 100 percent bit-by-bit equality. Using our framework that builds AOSP in its native build system, automatically compares artifacts, and computes difference scores, we perform a detailed analysis of differences, identify typical accountable changes, and analyze current major issues leading to non-reproducibility and non-accountability. We find that pure AOSP itself builds mostly reproducible and that Project Treble helped through its separation of concerns. However, we also discover that Google’s published firmware images deviate from the claimed codebase (partially due to side-effects of Project Mainline).
Sybil-Based Attacks on Google Maps or How to Forge the Image of City Life
1 KTH Royal Institute of Technology
Location-based services (LBS) increasingly rely on participatory or crowd-sensed data: users voluntarily contribute data about their whereabouts and points of interest (POIs) and allow the LBS to capture the dynamically changing environment, e.g., how crowded specific places, streets, or public transportation are. Popular LBS applications do not offer strong security, less so for their participatory sensing (PS) and data contribution part. Openness favors participation and increases data, but it also makes attacks easier. Sporadic misbehavior incidents and the presumed user honesty should not be reassuring: an attacker could exploit the PS components and submit a large volume of forged data to dominate the PS-collected LBS data, locally or at a large scale. Individuals, organizations, or entire areas could be targeted, e.g., having customers diverted or causing public transportation routes or roads to appear congested. The lingering open question is whether such attacks can be perpetrated against well-established popular LBS with PS components. This paper affirms this: we investigate Google Maps, the single most popular application in this domain, and show a range of effective and scalable attacks based on very modest adversarial assumptions. We reverse-engineer the data submission process and automate attacks that craft and submit false data in volume and a targeted fashion. We collect evidence that our attacks work on POI crowdedness, traffic congestion levels, and public transportation crowdedness with extreme caution. We responsibly disclosed the attacks to Google, acknowledged them and awarded recognition. The attack methodology carries over to other LBS applications but, most importantly, raises awareness and motivates countermeasures, which we also outline here, for stronger LBS and PS security overall.
Take a Bite of the Reality Sandwich: Revisiting the Security of Progressive Message Authentication Codes
1 Fraunhofer FKIE
2 RWTH Aachen University
Message authentication guarantees the integrity of messages exchanged over untrusted channels. However, to achieve this goal, message authentication considerably expands packet sizes, which is especially problematic in constrained wireless environments. To address this issue, progressive message authentication provides initially reduced integrity protection that is often sufficient to process messages upon reception. This reduced security is then successively improved with subsequent messages to uphold the strong guarantees of traditional integrity protection. However, contrary to previous claims, we show in this paper that existing progressive message authentication schemes are highly susceptible to packet loss induced by poor channel conditions or jamming attacks. Thus, we consider it imperative to rethink how authentication tags depend on the successful reception of surrounding packets. To this end, we propose R2-D2, which uses randomized dependencies with parameterized security guarantees to increase the resilience of progressive authentication against packet loss. To deploy our approach to resource-constrained devices, we introduce SP-MAC, which implements R2-D2 using efficient XOR operations. Our evaluation shows that SP-MAC is resilient to sophisticated network-level attacks and operates as resources-conscious and fast as existing, yet insecure, progressive message authentication schemes.
5G saw the introduction of an encrypted user identifier, the Subscriber Concealed Identifier (SUCI), to provide confidentiality of the subscriber’s whereabouts and identities. The SUCI protects the new generation of cellular networks against tracking devices, so-called IMSI-catchers, which have undermined users' confidentiality ever since the inception of cellular networks. However, the potential advent of large-scale quantum computers in the near future threatens to compromise the confidentiality provided by the SUCI yet again. The security of the public-key cryptography that underpins the SUCI relies on the hardness of the discrete logarithm problem. Using Shor’s algorithm, a quantum adversary could break the SUCI’s cryptography and once more gain the capability to track and identify users. Advancements in quantum computing are unpredictable, and a breakthrough might be only a decade away. Given the slow nature of standards and their implementation, it is thus necessary to already integrate now quantum-resistant cryptography into the current and also next-generation (6G) cellular networks. To contribute to this development, we propose a post-quantum secure scheme for the SUCI calculation, KEMSUCI. To this end, we first analyze the weak points in the current SUCI calculation scheme when considering quantum attacks. We then describe an alternative SUCI calculation scheme based on post-quantum secure key-encapsulation mechanisms (KEMs). Our proposed scheme can use any of the KEMs submitted to the NIST call for standardization of post-quantum secure cryptography (PQC) schemes. For the usage in KEMSUCI, the KEM should provide efficient execution on a SIM card and induce little network communication overhead. We evaluate all of the NIST PQC finalists under these aspects and identify Kyber and Saber as the best fit. Instantiated with these KEMs, KEMSUCI can be integrated into 5G and 6G. Compared to the existing SUPI protection schemes, KEMSUCI exhibits faster execution speed and only little communication overhead.
SoK: Your Mind Tells a Lot About You: On the Privacy Leakage via Brainwave Devices
1 University of Alabama at Birmingham
2 Texas A&M University, College Station
Head-worn wearables, such as consumer-grade EEG headsets deployed in Brain Computer Interfaces (BCI), are getting popularity in the gaming and entertainment industry, and for people with certain disabilities. However, the increasing popularity of these wearables creates a significant privacy risk. For instance, tech companies are intending to use brainwave devices to detect workers' emotional state and mental condition. There are AI techniques that can learn what people are looking at in real-time. Silently conversing with the computing system is now possible using neuromuscular signals, for instance, untold digit recognition with higher accuracy is possible, which can retrieve untold PIN or password. These applications can reveal more private information than designated benign purpose, such as, while detecting performance of worker, sensitive information like Parkinson’s disease, substance abuse disorder, heart disease, can be revealed from brainwave. The consequences of these privacy leakages may be potentially devastating, such as tracking users for targeted advertisements and launching targeted attacks against users. In this paper, we analyze current devices, explore previously studied attacks, research efforts to extract information from brainwave and analyze and synthesize potential future attacks from the current deployment. This systematization will provide right direction towards ensuring privacy risk of BCI devices, which is a pre-requisite to building future defense mechanisms against the attacks.
RRF: A Robust Radiometric Fingerprint Authentication System that Embraces Wireless Channel Diversity
1 Uppsala University
2 RISE
Radiometric fingerprint schemes have been shown effective in identifying wireless devices based on imperfections in their hardware electronics. The robustness of fingerprint systems under complex channel conditions, however, is a critical challenge that makes their application in real-world scenarios difficult. We systematically evaluate the wireless channel’s impact on radiometric fingerprints and find that the channel impacts fingerprint features in a very particular way that depends on the channel’s properties. Based on the insights, we present RRF, a system that provides a robust identification/authentication service even under complex channel fading disturbance. Our design deploys a hybrid architecture that combines wireless channel simulation, signal processing and machine learning. In this pipeline, RRF first utilizes a series of structured channel simulations to strategically improve system tolerance towards multipath channel interference. On top of that, in the identification phase, RRF relies on noise compensation and a feature denoising filter to augment the system’s stability in noisy conditions with weak signals. Our experimental results show that RRF achieves an average accuracy consistently above 99% in empirical scenarios with complex channels, where the baseline approach from previous work rarely exceeds 50%.
PAcT: Detecting and Classifying Privacy Behavior of Android Applications
1 University of Maine
2 Google Inc.
3 University of Notre Dame
Interpreting and describing mobile applications' privacy behaviors to ensure creating consistent and accurate privacy notices is a challenging task for developers. Traditional approaches to creating privacy notices are based on predefined templates or questionnaires and do not rely on any traceable behaviors in code which may result in inconsistent and inaccurate notices. In this paper, we present an automated approach to detect privacy behaviors in code of Android applications. We develop Privacy Action Taxonomy (PAcT), which includes labels for Practice (i.e. how applications use personal information) and Purpose (i.e. why). We annotate ~5,200 code segments based on the labels and create a multi-label multi-class dataset with ~14,000 labels. We develop and train deep learning models to classify code segments. We achieve the highest F-1 scores across all label types of 79.62% and 79.02% for Practice and Purpose.
On the Security of Thread Networks: Experimentation with OpenThread-Enabled Devices
1 Carnegie Mellon University
The Thread networking protocol is expected to be utilized by a plethora of smart home devices as one of the IP-based networking technologies that will be supported by the Matter standard that is being developed by members of the Connectivity Standards Alliance. Thread has been developed by the Thread Group as an application-agnostic protocol that builds on top of the IEEE 802.15.4 standard to enable IPv6-based low-power wireless mesh networking. However, unlike other IEEE 802.15.4-based protocols like Zigbee, the security of Thread networks has been relatively less analyzed in the literature. Given that commercial Thread devices are expected to interact with the physical world, vulnerabilities in their communication protocols could impact the physical security of end users. In this work we analyze the security of Thread networks by repurposing hardware and software tools that have been used for the security analysis of Zigbee networks. We used development boards that were flashed with OpenThread binaries to gain insight into the nature of Thread traffic and to study their susceptibility to a set of energy depletion attacks and online password guessing attacks. Lastly, we are publicly releasing our software enhancements as well as our dataset of captured Thread packets.
Breathe-to-Pair (B2P): Respiration-Based Pairing Protocol for Wearable Devices
1 Cleveland State University
2 Texas A&M University
We propose Breathe-to-Pair (B2P), a protocol for pairing and shared-key generation for wearable devices that leverages the wearer’s respiration activity to ensure that the devices are part of the same body-area network. We assume that the devices exploit different types of sensors to extract and process the respiration signal. We illustrate B2P for the case of two devices that use respiratory inductance plethysmography (RIP) and accelerometer sensors, respectively. Allowing for different types of sensors in pairing allows us to include wearable devices that use a variety of different sensors. In practice, this form of sensor variety creates a number of challenges that limit the ability of the shared-key establishment algorithm to generate matching keys. The two main obstacles are the lack of synchronization across the devices and the need for correct noise-induced mismatches between the generated key bit-strings.
B2P addresses the synchronization challenge by utilizing Change Point Detection (CPD) to detect abrupt changes in the respiration signal and consider their occurrences as synchronizing points. Any potential mismatches are handled by optimal quantization and encoding of the respiration signal in order to maximize the mismatch correction rate and minimize the message overheads. Extensive evaluation on a dataset collected from 30 volunteers demonstrates that our protocol can generate a secure 256-bit key every 2.85 seconds (around one breathing cycle). Particular attention is given to secure B2P against device impersonation attacks.
AirGuard - Protecting Android Users From Stalking Attacks By Apple Find My Devices
1 TU Darmstadt, Germany
Finder networks in general, and Apple’s Find My network in particular, can pose a grave threat to users' privacy and even health if these networks are abused for stalking. Apple’s release of the AirTag-a very affordable tracker covered by the nearly ubiquitous Find My network-amplified this issue. While Apple provides a stalking detection feature within its ecosystem, billions of Android users are still left in the dark. Apple recently released the Android app “Tracker Detect,” which does not deliver a convincing feature set for stalking protection. We reverse engineer Apple’s tracking protection in iOS and discuss its features regarding stalking detection. We design “AirGuard” and release it as an Android app to protect against abuse by Apple tracking devices. We compare the performance of our solution with the Apple-provided one in iOS and study the use of AirGuard in the wild over multiple weeks using data contributed by tens of thousands of active users.
When an iPhone is turned off, most wireless chips stay on. For instance, upon user-initiated shutdown, the iPhone remains locatable via the Find My network. If the battery runs low, the iPhone shuts down automatically and enters a power reserve mode. Yet, users can still access credit cards, student passes, and other items in their Wallet. We analyze how Apple implements these standalone wireless features, working while iOS is not running, and determine their security boundaries. On recent iPhones, Bluetooth, Near Field Communication (NFC), and Ultra-wideband (UWB) keep running after power off, and all three wireless chips have direct access to the secure element. As a practical example what this means to security, we demonstrate the possibility to load malware onto a Bluetooth chip that is executed while the iPhone is off.
With the introduction of WPA3 and Wi-Fi 6, an increased usage of Wi-Fi Management Frame Protection (MFP) is expected. Wi-Fi MFP, defined in IEEE 802.11w, protects robust management frames by providing data confidentiality, integrity, origin authenticity, and replay protection. One of its key goals is to prevent deauthentication attacks in which an adversary forcibly disconnects a client from the network. In this paper, we inspect the standard and its implementations for their robustness and protection against deauthentication attacks. In our standard analysis, we inspect the rules for processing robust management frames on their completeness, consistency, and security, leading to the discovery of unspecified cases, contradictory rules, and revealed insecure rules that lead to new denial-of-service vulnerabilities. We then inspect implementations and identify vulnerabilities in clients and access points running on the latest versions of the Linux kernel, hostap, IWD, Apple (i.e., macOS, iOS, iPadOS), Windows, and Android. Altogether, these vulnerabilities allow an adversary to disconnect any client from personal and enterprise networks despite the usage of MFP. Our work highlights that management frame protection is insufficient to prevent deauthentication attacks, and therefore more care is needed to mitigate attacks of this kind. In order to address the identified shortcomings, we worked with industry partners to propose updates to the IEEE 802.11 standard.
Metasurfaces enable controllable manipulation of electromagnetic waves and have been shown to improve wireless communications in many diverse ways. In this paper, we define and experimentally demonstrate for the first time a “MetaSurface-in-the-Middle'' (MSITM) attack. In this attack, the adversary Eve places a metasurface in the path of a directive transmission between Alice and Bob and targets to re-direct a portion of the signal towards herself, without being detected. In particular, we show how Eve can design a metasurface that induces abrupt phase changes at the interface of the metasurface to controllably diffract directional links and establish furtive eavesdropping links. We explore the theoretical foundations of the MSITM attack and demonstrate that an effective metasurface can be prototyped in under 5 min at the cost of several cents. We experimentally demonstrate the attack in a THz time-domain system and perform a set of over-the-air experiments. Our results indicate that the MSITM attack yields an acute vulnerability that can significantly reduce empirical secrecy capacity while leaving a minimal energy footprint, making the attack challenging to detect.
DyWCP: Dynamic and Lightweight Data-Channel Coupling towards Confidentiality in IoT Security
1 New Mexico State University
2 University of South Florida
3 Xidian University
As Internet of Things (IoT) is more and more pervasive and deployed in critical applications, it’s becoming increasingly important to preserve the confidentiality of sensitive data when IoT devices communicate with each other. However, traditional cryptography is usually time and energy consuming. It may not be applicable to IoT devices with limited computational capability or limited power. In this paper, we propose a lightweight encryption scheme named Dynamic Wireless Channel P ad (DyWCP) inspired by one-time pad encryption. One-time pad encryption achieves perfect secrecy but has been rarely used in practice due to the inconvenience of key negotiation. Our research discovers that in the wireless context it is possible to design a one-time pad encryption scheme without key negotiation. Towards the realization of DyWCP, we create techniques to utilize the additive feature of wireless channel to encrypt messages, to integrate modular operations at wireless physical layer, and to defend against multiple eavesdroppers. We implement a prototype of the proposed scheme using Universal Software Defined Radio Peripherals (USRP), and conduct a suite of experiments to evaluate the performance of the proposed scheme.
An Investigative Study on the Privacy Implications of Mobile E-scooter Rental Apps
1 University of Texas at San Antonio
2 University of Oklahoma
E-scooter rental services have significantly expanded the micromobility paradigm of short-distance urban and suburban transportation since their inception in 2017. Service providers around the world have followed a common rental model wherein customers (i.e., riders or users) download and install a mobile application for locating (finding) and renting e-scooters. Unlike many other app categories, e-scooter rental apps require a set of privacy-sensitive user data as a functional requirement. Unfortunately, privacy-related questions such as how much user data is being collected by these apps, is user data being safely handled once acquired, and with whom the collected user data is being shared are not readily known to customers. Answering such questions can be critical for users in determining which e-scooter rental services are sufficiently trustworthy per their personal privacy preferences. In this paper, we conduct a comprehensive analysis of e-scooter rental apps to answer these and other research questions related to user data collection, third-party involvement, usefulness of privacy policies, and evolution of user data management by different e-scooter apps/services over time. Our findings will create awareness among consumers vis-à-vis the data they share with service providers in return for the received e-scooter rental service, and it can also evoke more accountability and transparency from service providers towards their efforts and processes on protecting consumer privacy.
Cooperative Adaptive Cruise Control, a promising Vehicular Ad-hoc Network application, automates transportation and improves efficiency. Vehicles form a platoon, following a leader, with their controllers automatically adjusting velocity, based on messages by other vehicles, to keep appropriate distances for safety. Towards deploying secure Cooperative Adaptive Cruise Control, several proposals in academia and standardization leave significant questions unanswered. Thwarting adversaries is hard: cryptographic protection ensures access control (authentication and authorization) but falsified kinematic information by faulty insiders (platoon members with credentials, even the platoon leader) can cause platoon instability or vehicle crashes. Filtering out such adversarial data is challenging (computational cost and high false positive rates) but, most important, state-of-the-art misbehavior detection algorithms completely fail during platoon maneuvering. In this paper, we systematically investigate how and to what extent controllers for existing platooning applications are vulnerable, mounting a gamut of attacks, ranging from falsification attacks to jamming and collusion; including two novel attacks during maneuvering. We show how the existing middle-join and leave processes are vulnerable to falsification or ‘privilege escalation’ attacks. We mitigate such vulnerabilities and enable vehicles joining and exiting from any position (middle-join and middle-exit). We propose a misbehavior detection system that achieves an F1 score of 87% on identifying attacks throughout the lifetime of the platoon formation, including maneuvers. Our cyberphysical simulation framework can be extended to assess any other driving automation functionality in the presence of attackers.
Short papers
Angularly Dispersive Terahertz Links with Secure Coding: from Theoretical Foundations to Experiments
1 Rice University
2 Technion
3 MIT
4 Brown University
With the large bandwidths available in the terahertz regime, directional transmissions can exhibit angular dispersion, i.e., frequency-dependent radiation direction. Unfortunately, angular dispersion introduces new security threats as increased bandwidth necessarily yields a larger signal footprint in the spatial domain and potentially benefits an eavesdropper. This paper is the first study of secure transmission strategies on angularly dispersive links. Based on information theoretic foundations, we propose to channelize the wideband transmission in frequency, and perform secure coding across frequency channels. With over-the-air experiments, we show that the proposed method exploits the properties of angular dispersion to realize secure wideband transmissions, despite the increased signal footprint and even for practical irregular beams with side lobes and asymmetry. In contrast, without the proposed cross-channel coding strategy, angularly dispersive links can suffer from significant security degradation when bandwidth increases.
Resource-constrained devices increasingly rely on wireless communication for the reliable and low-latency transmission of short messages. However, especially the implementation of adequate integrity protection of time-critical messages places a significant burden on these devices. We address this issue by proposing BP-MAC, a fast and memory-efficient approach for computing message authentication codes based on the well-established Carter-Wegman construction. Our key idea is to offload resource-intensive computations to idle phases and thus save valuable time in latency-critical phases, i.e., when new data awaits processing. Therefore, BP-MAC leverages a universal hash function designed for the bitwise preprocessing of integrity protection to later only require a few XOR operations during the latency-critical phase. Our evaluation on embedded hardware shows that BP-MAC outperforms the state-of-the-art in terms of latency and memory overhead, notably for small messages, as required to adequately protect resource-constrained devices with stringent security and latency requirements.
PITracker: Detecting Android PendingIntent Vulnerabilities through Intent Flow Analysis
1 Shandong University
Intent is an essential inter-component communication mechanism of Android OS, which can be used to request an action from another app component. The security of its design and implementation attracts lots of attention. However, the security of PendingIntent, a kind of delayed-triggered Intent, was neglected by most previous research, and the related analysis techniques are still imperfect. In this paper, we design a novel automated tool, PITracker, to detect the PendingIntent vulnerabilities in Android apps. It achieves the Intent flow tracking technique proposed by us, figuring out how an Intent is created and where it goes. In the real-world evaluations, PITracker discovered 2,939 potential threats in 10,000 third-party apps and 214 in 1,412 pre-installed apps. Among them, 11 exploitable vulnerabilities have been confirmed and acknowledged by the corresponding vendors.
Device Re-identification in LoRaWAN through Messages Linkage
1 Univ. Lyon
2 INSA Lyon
3 Inria
4 CITI
5 Univ. Grenoble Alpes
6 LIG
In LoRaWAN networks, devices are identified by two identifiers: a globally unique and stable one called DevEUI, and an ephemeral and randomly assigned pseudonym called DevAddr. The association between those identifiers is only known by the network and join servers, and is not available to a passive eavesdropper.
In this work, we consider the problem of linking the DevAddr with the corresponding DevAddr based on passive observation of the LoRa traffic transmitted over the air. Leveraging metadata exposed in LoRa frames, we devise a technique to link two messages containing respectively the DevEUI and the DevAddr, thus identifying the link between those identifiers. The approach is based on machine learning algorithms using various pieces of information including timing, signal strength, and fields of the frames. Based on an evaluation using a real-world dataset of 11 million messages, with ground truth available, we show that multiple machine learning models are able to reliably link those identifiers. The best of them achieves an impressive true positive rate of over 0.8 and a false positive rate of 0.001.
Automatic Dependent Surveillance Broadcast (ADS-B) sensors deployed on the ground are central to observing aerial movements of aircraft. Their unsystematic placement, however, results in over-densification of sensor coverage in some areas and insufficient sensor coverage in other areas. ADS-B sensor coverage has so far been recognized and analyzed as an availability problem; it was tackled by sensor placement optimization techniques that aim for covering large enough areas. In this paper, we demonstrate that the unsystematic placement of ADS-B sensors leads to a security problem, since the realization and possible deployment of protective mechanisms is closely linked to aspects of redundancy in ADS-B sensor coverage. In particular, we model ADS-B sensor coverage as a multi-dimensional security problem. We then use multi-objective optimization techniques to tackle this problem and derive security-optimized near-optimal placement solutions. Our results show how the location of sensors play a significant role in reducing the success rate of attackers by providing a sufficient number of sensors within a specific geographical area to verify location claims and reducing the exposure to jamming attacks.
BiasHacker: Voice Command Disruption by Exploiting Speaker Biases in Automatic Speech Recognition
1 Texas A&M University, College Station
Modern speech recognition systems that are widely deployed today still suffer from known gender and racial biases. In this work, we demonstrate the potential to exploit the existing biases in these systems to achieve a new attack goal. We consider the potential for command disruption by an attacker that can be conducted in a manner that allows for access and control of a victim’s voice assistant device. We present a novel attack, BiasHacker, which crafts specialized chatter noise to exploit racial and gender biases in speech recognition systems for the purposes of command disruption. Our experimental results confirm both racial and gender bias that is still present in the speech recognition systems of two modern smart speaker devices. We also evaluated the effectiveness of three types of chatter noise (American English (AE)-Male, Nigerian-Female, Korean-Female) for disruption and demonstrate that the AE-Male chatter is consistently more successful. Comparing the average success rate of each chatter type, in scenarios where disruption was achieved, we find that when targeting the Google Home mini smart speaker, the AE-Male chatter noise increases average disruption success compared to the Nigerian-Female and Korean-Female chatter noises by 112% and 121%, respectively. Also, when targeting the Amazon Echo Dot 2 the AE-Male chatter noise increases average disruption success compared to the Nigerian-Female and Korean-Female chatter noises by 42% and 69%, respectively.
Measuring the Deployment of 5G Security Enhancement
1 Tsinghua University
2 CableLabs
3 Carleton University
4 Qi-ANXIN Technology Research Institute
5 Institute for Network Science and Cyberspace
The fifth-generation(5G) cellular network is entering an era of rapid development. Not only is 5G supposed to be fast, it also offers enhanced security based on 5G security specifications developed by the 3rd Generation Partnership Project (3GPP). However, little is known about 5G security in real world deployment. This paper analyzes 5G security features and measures their implementation in commercial 5G networks. By collecting and analyzing signaling messages between a cell phone and several commercial 5G networks, we measured multiple aspects of 5G security in real world deployment including, crypto algorithms used in the control plane, user plane (UP) security activation, subscriber identifier protection, and initial None-Access Stratum(NAS) message protection. We evaluated the compliance of commercial 5G networks with 5G security specifications. The results show that major discrepancy exists between 5G security standards and real world deployment, especially in the areas of UP protection and subscriber identifier protection. Therefore, well-known security risks, such as user data leakage, location exposure and Denial-of-Service(DoS) attacks, still apply to 5G commercial networks.
WebAssembly (Wasm) has seen a lot of attention lately as it spreads through the mobile computing domain and becomes the new standard for performance-oriented web development. It has diversified its uses far beyond just web applications by acting as an execution environment for mobile agents, containers for IoT devices, and enabling new serverless approaches for edge computing. Within the numerous uses of Wasm, not all of them are benign. With the rise of Wasm-based cryptojacking malware, analyzing Wasm applications has been a hot topic in the literature, resulting in numerous Wasm-based cryptojacking detection systems. Many of these methods rely on static analysis, which traditionally can be circumvented through obfuscation. However, the feasibility of the obfuscation techniques for Wasm programs has never been investigated thoroughly. In this paper, we address this gap and perform the first look at code obfuscation for Wasm. We apply numerous obfuscation techniques to Wasm programs, and test their effectiveness in producing a fully obfuscated Wasm program. Particularly, we obfuscate both benign Wasm-based web applications and cryptojacking malware instances and feed them into a state-of-the-art Wasm cryptojacking detector to see if current Wasm analysis methods can be subverted with obfuscation. Our analysis shows that obfuscation can be highly effective and can cause even a state-of-the-art detector to misclassify the obfuscated Wasm samples.
Demo & Posters
Metasurfaces enable controllable manipulation of electromagnetic waves and have been shown to improve wireless communications in many diverse ways. Investigating adversarial metasurfaces, we define and experimentally demonstrate for the first time a “MetaSurface-in-the-Middle'' (MSITM) attack in our paper [shaikhanov2022MSITM]. In the attack, the adversary Eve places a metasurface in the path of a directive transmission between Alice and Bob and targets to re-direct a portion of the signal towards herself, without being detected. Here, we demonstrate the rapid fabrication of the MSITM employing only standard office supplies such as a printer, paper, foil, and laminator. We show that an effective metasurface can be prototyped in under $5$ min at the cost of several cents. We also demo the attack implementation in the THz network, presenting a video of the MSITM attacker establishing a diffractive eavesdropping link while maintaining the legitimate Alice-Bob link. Our results indicate that the attack yields an acute eavesdropping vulnerability while leaving a minimal energy footprint, making the attack challenging to detect.
DEMO: OpenHaystack Mobile - Tracking custom Find My Accessories on Smartphones
1 Technical University of Darmstadt
In 2021 OpenHaystack on macOS was the first step into liberating Apple’s Find My technology to be integrated into any Bluetooth-capable device. By using custom firmware for microchips like the ESP32, it was possible to build custom trackable accessories similar to an Apple AirTag in size and functionality.
OpenHaystack Mobile is a cross-platform mobile application that runs on Android and iOS. It extends previous work, which was tied to macOS, to be available to more users. It provides BLE-based location tracking functionality based on Apple’s Find My network. Our app is built cross-platform capable by using the Flutter framework for the user interface and the cryptographic operations. The user experience is improved compared to a desktop-based app because it allows tracking lost valuables anywhere. Furthermore, the app allows to directly route users to lost devices with smartphone navigation apps like Google Maps.
POSTER: No Doppelgänger: Advancing Mobile Networks Against Impersonation in Adversarial Scenarios
1 Linköping University
2 University of Waikato
The expansion of mobile network capabilities throughout the decades has increased people’s exposure to the digital world, and the next generations of communication networks are expected to achieve ubiquitous connectivity and immersive use cases. Security and privacy concerns have arisen and are continuously taken into account in the design of mobile networks. However, a relevant limitation currently lies in the use of shared secrets for providing security and privacy to users. Ideally, we believe that users' identities should be immune to impersonation as long as their own devices remain secure, notwithstanding the network operators and other entities potentially being compromised. In this paper, we develop this idea with the objective of providing the non-repudiation property, which represents a mitigation to its dual, impersonation.
POSTER: Post-Quantum Cipher Power Analysis in Lightweight Devices
1 University of Colorado Colorado Springs
2 University of Washington Tacoma
Post-quantum ciphers (PQC) provide cryptographic algorithms for public-key ciphers which are computationally secure against the threats from quantum-computing adversaries. Because the devices in mobile computing are limited in hardware and power, we analyze the PQC power overheads. We implement the new NIST PQCs across a range of device platforms to simulate varying resource capabilities, including multiple Raspberry Pis with different memories, a laptop, and a desktop computer. We compare the power measurements with the idle cases as our baseline and show the PQCs consume considerable power. Our results show that PQC ciphers can be feasible in the resource-constrained devices (simulated with varying Raspberry Pis in our case); while PQCs consume greater power than the classical cipher of RSA for laptop and desktop, they consume comparable power for the Raspberry Pis.
POSTER: Lightweight Code Assurance Proof for Wireless Software
1 University of Colorado Colorado Springs
2 Texas A&M University
3 Electronics and Telecommunications Research Institute, South Korea
Software-defined radio (SDR) and the softwarization of the wireless and mobile systems enable intelligent processing and control in wireless networking. We design and build a lightweight code assurance proof scheme for wireless system software implementations. More specifically, our scheme assures that a wireless user/prover holds the correct software codes, e.g., the correct version, for its wireless networking implementations. In contrast to the previous research for code attestation in trusted computing, our scheme forgoes hardware-based security and real-time networking, thus substantially increasing the application feasibility. We further design our scheme to be efficient in computing by using a Merkle tree for the efficiency of the verification of the assurance proof. We implement our scheme for proof-of-concept on srsRAN (a popular open-source software for cellular technology) and conduct preliminary measurements to demonstrate the lightweight design. We envision our scheme to be orthogonal and supplementary to the previous trustworthy code attestation because it provides different properties (assurance vs. attestation) and because the lightweight aspect yields greater applicability and lower overheads in hardware and networking. Our scheme will therefore be appropriate for the wireless/mobile environment which uses broadcasting (where receiving/verifications occur more frequently than transmitting/generations) and whose devices are resource-constrained.
Industrial Cyber-Physical Systems (ICPS) make significant use of Supervisory Control and Data Acquisition (SCADA) for control. Such SCADA systems are known to utilise insecure communication protocols such as Modbus, DNP3 and OPC DA. This leads to increased cyber risks faced in critical infrastructures, as these protocols allow threat actors to mount attacks like Denial of Service (DoS). We present a novel field flooding attack, compromising the structure of the ModbusTCP packet and disrupting a controller’s interpretation of the commands sent to it. This can disrupt the ability of an operator to control hazardous operations leading to potentially unsafe scenarios.
POSTER: MAG-PUF - Authenticating IoT devices via Magnetic Physical Unclonable Functions
1 Hamad Bin Khalifa University (HBKU)
2 Eindhoven University of Technology (TU/e)
Authenticating Internet of Things (IoT) devices is still a defiant task, despite the remarkable technological advancement achieved in the last few years. The issue is especially challenging in scenarios involving low-cost constrained nodes, hardly supporting dynamic re-keying algorithms. To provide a viable general-purpose solution, we propose MAG-PUF: a novel and lightweight authentication scheme using unintentional magnetic emissions produced by IoT devices to implement Physical Unclonable Functions (PUFs). Our extensive experimental campaign, involving 25 Arduino boards and four example reference functions, unveiled an outstanding authentication accuracy of over 99%, proving the feasibility of using code-driven magnetic emissions as a lightweight, efficient, and robust PUF for IoT deployments.
We introduce PQ 5G AKA, a prototype for possible extensions of the current 5G authentication and key agreement protocol to the post-quantum setting, we further analyse the computational and communication complexities of our prototype using potential post-quantum KEMs.
Drones raise significant privacy and security threats, by intruding into the airspace of private properties or unauthorized regions. Being able to detect and localize the encroaching drones is essential to build geofencing systems to prevent drone misuse. While most existing approaches focus on detecting and localizing active drones, passive drones that do not emit signals are particularly challenging to localize, without requiring advanced hardware. In this work, we propose a novel, low-cost passive drone localization approach, by leveraging opportunistic environmental RF signals (e.g., LTE or WiFi) that reflect off the target drone, with only a single wireless receiver. We implement a prototype system on a USRP-device based testbed, with standard LTE signals emitted by multiple distributed transmitters, and conduct experiments on top of a campus building to evaluate its performance. We also perform a drone detection range analysis to extrapolate the real-world applicability of our scheme.
Sponsors
Corporate Sponsors
Best Paper/Poster Sponsor
Conference Sponsors
Travel Grants Sponsor
Hosted by
