PapersCut A shortcut to recent security papers

Arxiv

An Empirical Analysis of Privacy in the Lightning Network

Authors: George Kappos, Haaroon Yousaf, Ania Piotrowska, Sanket Kanjalkar, Sergi Delgado-Segura, Andrew Miller, Sarah Meiklejohn

Abstract: Payment channel networks, and the Lightning Network in particular, seem to offer a solution to the lack of scalability and privacy offered by Bitcoin and other blockchain-based cryptocurrencies. Previous research has already focused on the scalability, availability, and crypto-economics of the Lightning Network, but relatively little attention has been paid to exploring the level of privacy it achieves in practice. This paper presents a thorough analysis of the privacy offered by the Lightning Network. We present three main attacks that exploit publicly available information about the network topology and its active nodes and channels in order to learn information that is designed to be kept secret, such as how many coins a node has available to spend or who the sender and recipient are in a payment routed through the network. We evaluate one of our attacks on the live network and, due to cost and ethical considerations, evaluate our other two attacks on a simulated Lightning network that faithfully mimics the real one.

Comment: 17 pages, 5 figures

Date: 27 Mar 2020

PDF »Main page »


Hardware Fingerprinting for the ARINC 429 Avionic Bus

Authors: Nimrod Gilboa Markevich, Avishai Wool

Abstract: ARINC 429 is the most common data bus in use today in civil avionics. However, the protocol lacks any form of source authentication. A technician with physical access to the bus is able to replace a transmitter by a rogue device, and the receivers will accept its malicious data as they have no method of verifying the authenticity of messages. Updating the protocol would close off security loopholes in new aircraft but would require thousands of airplanes to be modified. For the interim, until the protocol is replaced, we propose the first intrusion detection system that utilizes a hardware fingerprinting approach for sender identification for the ARINC 429 data bus. Our approach relies on the observation that changes in hardware, such as replacing a transmitter or a receiver with a rogue one, modify the electric signal of the transmission. Because we rely on the analog properties, and not on the digital content of the transmissions, we are able to detect a hardware switch as soon as it occurs, even if the data that is being transmitted is completely normal. Thus, we are able to preempt the attack before any damage is caused. In this paper we describe the design of our intrusion detection system and evaluate its performance against different adversary models. Our analysis includes both a theoretical Markov-chain model and an extensive empirical evaluation. For this purpose, we collected a data corpus of ARINC 429 data traces, which may be of independent interest since, to the best of our knowledge, no public corpus is available. We find that our intrusion detection system is quite realistic: e.g., it achieves near-zero false alarms per second, while detecting a rogue transmitter in under 50ms, and detecting a rogue receiver in under 3 seconds. In other words, technician attacks can be reliably detected during the pre-flight checks, well before the aircraft takes off.

Date: 27 Mar 2020

PDF »Main page »


Assessing the Security of OPC UA Deployments

Authors: Linus Roepert, Markus Dahlmanns, Ina Berenice Fink, Jan Pennekamp, Martin Henze

Abstract: To address the increasing security demands of industrial deployments, OPC UA is one of the first industrial protocols explicitly designed with security in mind. However, deploying it securely requires a thorough configuration of a wide range of options. Thus, assessing the security of OPC UA deployments and their configuration is necessary to ensure secure operation, most importantly confidentiality and integrity of industrial processes. In this work, we present extensions to the popular Metasploit Framework to ease network-based security assessments of OPC UA deployments. To this end, we discuss methods to discover OPC UA servers, test their authentication, obtain their configuration, and check for vulnerabilities. Ultimately, our work enables operators to verify the (security) configuration of their systems and identify potential attack vectors.

Comment: 2 pages, 1 figure, to be published in Proceedings of the 1st ITG Workshop on IT Security (ITSec)

Date: 27 Mar 2020

PDF »Main page »


SpectreRewind: A Framework for Leaking Secrets to Past Instructions

Authors: Jacob Fustos, Heechul Yun

Abstract: Transient execution attacks,such as Spectre and Meltdown, utilize micro-architectural covert channels to leak secrets that should not have been accessible during logical program execution. Commonly used micro-architectural covert channels in such attacks are those that leave lasting footprints in the micro-architectural state, for example, a cache state change. This lasting footprint has led attackers to utilize an attack framework where secrets are transmitted into covert channel during transient execution and later, after transient execution is complete, read secret from covert channel. This has led to the proposal of high performance hardware defenses that track potential secret data during transient execution and either discard or revert micro-architectural changes once transient execution has completed. In this work, we create a new framework for transient execution attacks that we call SpectreRewind. Our framework allows the attacker to both transmit and receive secret before transient execution has completed, bypassing defenses that try to revert changes caused by the attack. Unlike similar techniques utilizing hyper-threading, SpectreRewind is designed to be performed on a single hardware thread making it viable on systems where attacker cannot utilize SMT. We accomplish this by reading from covert channel with instructions that come logically before the transient execution in program order. Using our framework, we are even able to utilize simultaneous covert channels from a single hardware thread and show this by creating a channel that utilizes contention on the floating point divisional unit of modern commodity processors.

Date: 27 Mar 2020

PDF »Main page »


HERS: Homomorphically Encrypted Representation Search

Authors: Joshua J. Engelsma, Anil K. Jain, Vishnu Naresh Boddeti

Abstract: We present a method to search for a probe (or query) image representation against a large gallery in the encrypted domain. We require that the probe and gallery images be represented in terms of a fixed-length representation, which is typical for representations obtained from learned networks. Our encryption scheme is agnostic to how the fixed-length representation is obtained and can, therefore, be applied to any fixed-length representation in any application domain. Our method, dubbed HERS (Homomorphically Encrypted Representation Search), operates by (i) compressing the representation towards its estimated intrinsic dimensionality, (ii) encrypting the compressed representation using the proposed fully homomorphic encryption scheme, and (iii) searching against a gallery of encrypted representations directly in the encrypted domain, without decrypting them, and with minimal loss of accuracy. Numerical results on large galleries of face, fingerprint, and object datasets such as ImageNet show that, for the first time, accurate and fast image search within the encrypted domain is feasible at scale (296 seconds; 46x speedup over state-of-the-art for face search against a background of 1 million).

Comment: 25 pages

Date: 27 Mar 2020

PDF »Main page »


A Principled Approach to Learning Stochastic Representations for Privacy in Deep Neural Inference

Authors: Fatemehsadat Mireshghallah, Mohammadkazem Taram, Ali Jalali, Ahmed Taha Elthakeb, Dean Tullsen, Hadi Esmaeilzadeh

Abstract: INFerence-as-a-Service (INFaaS) in the cloud has enabled the prevalent use of Deep Neural Networks (DNNs) in home automation, targeted advertising, machine vision, etc. The cloud receives the inference request as a raw input, containing a rich set of private information, that can be misused or leaked, possibly inadvertently. This prevalent setting can compromise the privacy of users during the inference phase. This paper sets out to provide a principled approach, dubbed Cloak, that finds optimal stochastic perturbations to obfuscate the private data before it is sent to the cloud. To this end, Cloak reduces the information content of the transmitted data while conserving the essential pieces that enable the request to be serviced accurately. The key idea is formulating the discovery of this stochasticity as an offline gradient-based optimization problem that reformulates a pre-trained DNN (with optimized known weights) as an analytical function of the stochastic perturbations. Using Laplace distribution as a parametric model for the stochastic perturbations, Cloak learns the optimal parameters using gradient descent and Monte Carlo sampling. This set of optimized Laplace distributions further guarantee that the injected stochasticity satisfies the -differential privacy criterion. Experimental evaluations with real-world datasets show that, on average, the injected stochasticity can reduce the information content in the input data by 80.07%, while incurring 7.12% accuracy loss.

Date: 26 Mar 2020

PDF »Main page »


Concerning Quantum Identification Without Entanglement

Authors: González-Guillén, María Isabel González Vasco, Floyd Johnson, Ángel L. Pérez del Pozo

Abstract: Identification schemes are interactive protocols typically involving two parties, a prover, who wants to provide evidence of his or her identity and a verifier, who checks the provided evidence and decide whether it comes or not from the intended prover. In this paper, we comment on a recent proposal for quantum identity authentication from Zawadzki, and give a concrete attack upholding theoretical impossibility results from Lo and Buhrman et al. More precisely, we show that using a simple strategyan adversary may indeed obtain non-negligible information on the shared identification secret. While the security of a quantum identity authentication scheme is not formally defined in [1], it is clear that such a definition should somehow imply that an external entity may gain no information on the shared identification scheme (even if he actively participates injecting messages in a protocol execution, which is not assumed in our attack strategy).

Comment: 8 pages, 0 figures, 1 protocol review

Date: 26 Mar 2020

PDF »Main page »


To Tweet or Not to Tweet: Covertly Manipulating a Twitter Debate on Vaccines Using Malware-Induced Misperceptions

Authors: Filipo Sharevski, Peter Jachim, Kevin Florek

Abstract: Trolling and social bots have been proven as powerful tactics for manipulating the public opinion and sowing discord among Twitter users. This effort requires substantial content fabrication and account coordination to evade Twitter's detection of nefarious platform use. In this paper we explore an alternative tactic for covert social media interference by inducing misperceptions about genuine, non-trolling content from verified users. This tactic uses a malware that covertly manipulates targeted words, hashtags, and Twitter metrics before the genuine content is presented to a targeted user in a covert man-in-the-middle fashion. Early tests of the malware found that it is capable of achieving a similar goal as trolls and social bots, that is, silencing or provoking social media users to express their opinion in polarized debates on social media. Following this, we conducted experimental tests in controlled settings (N=315) where the malware covertly manipulated the perception in a Twitter debate on the risk of vaccines causing autism. The empirical results demonstrate that inducing misperception is an effective tactic to silence users on Twitter when debating polarizing issues like vaccines. We used the findings to propose a solution for countering the effect of the malware-induced misperception that could also be used against trolls and social bots on Twitter.

Date: 26 Mar 2020

PDF »Main page »


Corella: A Private Multi Server Learning Approach based on Correlated Queries

Authors: Hamidreza Ehteram, Mohammad Ali Maddah-Ali, Mahtab Mirmohseni

Abstract: The emerging applications of machine learning algorithms on mobile devices motivate us to offload the computation tasks of training a model or deploying a trained one to the cloud. One of the major challenges in this setup is to guarantee the privacy of the client's data. Various methods have been proposed to protect privacy in the literature. Those include (i) adding noise to the client data, which reduces the accuracy of the result, (ii) using secure multiparty computation, which requires significant communication among the computing nodes or with the client, (iii) relying on homomorphic encryption methods, which significantly increases computation load. In this paper, we propose an alternative approach to protect the privacy of user data. The proposed scheme relies on a cluster of servers where at most $T$ of them for some integer $T$, may collude, that each running a deep neural network. Each server is fed with the client data, added with a $\textit{strong}$ noise. This makes the information leakage to each server information-theoretically negligible. On the other hand, the added noises for different servers are $\textit{correlated}$. This correlation among queries allows the system to be $\textit{trained}$ such that the client can recover the final result with high accuracy, by combining the outputs of the servers, with minor computation efforts. Simulation results for various datasets demonstrate the accuracy of the proposed approach.

Comment: 10 pages, 5 figures, 3 tables

Date: 26 Mar 2020

PDF »Main page »


Man-in-the-Middle and Denial of Service Attacks in Wireless Secret Key Generation

Authors: Miroslav Mitev, Arsenia Chorti, E. Veronica Belmega, Martin Reed

Abstract: Wireless secret key generation (W-SKG) from shared randomness (e.g., from the wireless channel fading realizations), is a well established scheme that can be used for session key agreement. W-SKG approaches can be of particular interest in delay constrained wireless networks and notably in the context of ultra reliable low latency communications (URLLC) in beyond fifth generation (B5G) systems. However, W-SKG schemes are known to be malleable over the so called "advantage distillation" phase, during which observations of the shared randomness are obtained at the legitimate parties. As an example, an active attacker can act as a man-in-the-middle (MiM) by injecting pilot signals and/or can mount denial of service attacks (DoS) in the form of jamming. This paper investigates the impact of injection and reactive jamming attacks in W-SKG. First, it is demonstrated that injection attacks can be reduced to - potentially less harmful - jamming attacks by pilot randomization; a novel system design with randomized QPSK pilots is presented. Subsequently, the optimal jamming strategy is identified in a block fading additive white Gaussian noise (BF-AWGN) channel in the presence of a reactive jammer, using a game theoretic formulation. It is shown that the impact of a reactive jammer is far more severe than that of a simple proactive jammer

Date: 26 Mar 2020

PDF »Main page »


Loading ...