Categories
News

Khir Henderson featured in Diversity in Action Fall 2021 Magazine

Khir Henderson, doctoral student at Morgan State University whose work focuses on designing and developing sustainable and scalable architectures to help protect some of the major security vulnerabilities in our nation’s critical infrastructures, was recently featured in the Fall 2021 edition of Diversity in Action.

Khir’s work on the SPLICE team includes investigating hardware and software implementations of hardware-based security used to establish the ‘root of trust’ in IoT devices or systems. He has also lead the development of an IoT device testbed, housed at the CAP Center at Morgan State University, that uses an automated network-security architecture following the Manufacturer Usage Description (MUD) IETF model. Khir has collaborated with researchers at Johns Hopkins University on developing a smart home scanning apparatus that encompasses discovery, fingerprinting, and profiling.

You can find Khir’s feature in the Fall 2021 edition of Diversity in Action here. To stay up-to-date with SPLICE happenings, consider following the SPLICE blog by scrolling to the bottom of this page and entering your email address.

SPLICE Researcher and Doctoral Student, Khir Henderson
Categories
News

Webinar on Communications Metadata and User Privacy

Join us for a Zoom webinar, by our very own Dr. Susan Landau, on the topic of Communications Metadata and User Privacy. The link to register and add the event to your calendar can be found on the bottom right corner of the flyer below and is copied here: https://tinyurl.com/52my6sh4

Categories
News Publication

New SPLICE paper on Security and Privacy Attitudes

Many studies of mobile security and privacy are, for simplicity, limited to either only Android users or only iOS users. However, it is not clear whether there are systematic differences in the privacy and security knowledge or preferences of users who select these two platforms. Understanding these differences could provide important context about the generalizability of research results. This paper reports on a survey (n=493) with a demographically diverse sample of U.S. Android and iOS users. We compare users of these platforms using validated privacy and security scales (IUIPC-8 and SA-6) as well as previously deployed attitudinal and knowledge questions from the Pew Research Center. As a secondary analysis, we also investigate potential differences among users of different smart-speaker platforms, including Amazon Echo and Google Home. We find no significant differences in privacy attitudes of different platform users, but we do find that Android users have more technology knowledge than iOS users. In addition, we find evidence (via comparison with Pew data) that Prolific participants have more technology knowledge than the general U.S. population.

To read more, check out the full paper and presentation from the Symposium on Usable Privacy and Security (SOUPS) 2021 here. To see other SPLICE publications, check out our Zotero page here.

Desiree Abrokwa, Shruti Das, Omer Akgul, and Michelle L. Mazurek. Comparing Security and Privacy Attitudes Among U.S. Users of Different Smartphone and Smart-Speaker Platforms. USENIX Symposium on Usable Privacy and Security (SOUPS) 2021, pages 139-158. USENIX Association, August 2021.

Categories
News Publication

New SPLICE Paper on Recurring Device Verification

The most common forms of authentication are passwords, potentially used in combination with a second factor such as a hardware token or mobile app (i.e., two-factor authentication). These approaches emphasize a one-time, initial authentication. Recent work has explored how to provide passive, continuous authentication and/or automatic de-authentication by correlating user movements and inputs with actions observed in an application (e.g., a web browser). The issue with indefinite trust goes beyond user authentication; consider devices that pair via Bluetooth.

The increased adoption of IoT devices and reports of inadequacy of their security makes indefinite trust of devices problematic. The reality of ubiquitous connectivity and frequent mobility gives rise to a myriad of opportunities for devices to be compromised. Thus, we argue that one-time, single-factor, device-to-device authentication (i.e., an initial pairing) is not enough, and that there must exist some mechanism to frequently (re-)verify the authenticity of devices and their connections.

In this paper we propose a device-to-device recurring authentication scheme – Verification of Interaction Authenticity (VIA) – that is based on evaluating characteristics of the communications (interactions) between devices. We adapt techniques from wireless traffic analysis and intrusion detection systems to develop behavioral models that capture typical, authentic device interactions (behavior); these models enable recurring verification of device behavior. 

To read more, check out the paper here.

Travis Peters, Timothy J. Pierson, Sougata Sen, José Camacho, and David Kotz. Recurring Verification of Interaction Authenticity Within Bluetooth Networks. Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2021), pages 192–203. ACM, June 2021. doi:10.1145/3448300.3468287. ©

Categories
News

Finding and reporting a device vulnerability

*Posted on behalf of Adam Vandenbussche, Dartmouth ’22*

My name is Adam and I’m a Dartmouth undergraduate researcher on the SPLICE project. I first became involved with SPLICE as a student in Professor Kotz’s COSC 89.26 SPLICE seminar course last fall. After spending the term reading and discussing papers considering a variety of security and privacy concerns in IoT, our culminating project was to conduct either a security or privacy analysis of an IoT device or to explore a topic of our choosing in an open-ended research project.

I’ve been curious to learn more about medical IoT, considering the particularly sensitive nature of the data this ecosystem produces and manages. For my project, I decided to analyze a Bluetooth-enabled device that, when paired with an accompanying smartphone app,* helps users monitor their medication adherence. To perform thorough testing of the device and app’s main functionalities, I used PCAP Remote  and Android’s adb utility, two open-source packet sniffers, to capture network and Bluetooth packets, respectively. I then analyzed the intercepted data using Wireshark, a popular open-source packet analysis program. 

I discovered a handful of mostly minor security and privacy vulnerabilities while analyzing the collected data, but one vulnerability particularly troubled me. Although the app’s API served most of its endpoints over the encrypted HTTPS protocol, it served two of them—the image upload and download endpoints—over the unencrypted HTTP protocol. The images transmitted over these endpoints could include user’s faces, such as for their profile picture, or medical information, such as images of documents discussing their medication. This lack of encryption to protect the transmission of highly sensitive information gravely threatened user privacy.

As a novice ethical hacker, I felt it important to alert the vendor of this vulnerability to avoid any further compromises of users’ privacy. I first informed the company over email, but much to my chagrin, my initial message—as well as the follow ups I sent 45 and 75 days later—went unanswered. Unfortunately, 90 days after my initial outreach I still had yet to hear from the company. 

My next step was to inform the vendor in writing by mail. Despite sending a registered letter including a report detailing how to reproduce the issue and the post office confirming its delivery, I still received no response from the company.

My last resort was to report the vulnerability to the Cybersecurity and Infrastructure Security Agency (CISA), a branch of the Department of Homeland Security, and hope that they would have more luck getting through. Within a week of submitting my report to CISA, I heard back from the vendor who acknowledged the vulnerability and disabled the implicated features. A day later, I received confirmation from CISA that they had successfully contacted the vendor who patched the issue.

Overall, I was most impressed with CISA’s quick turnaround time and learned a lot about the responsible disclosure process through this experience. It feels good that my work through the SPLICE project has had a direct, positive impact—however small—on the security of a smart product.

* As the disclosure has not been publicized, I will refrain from identifying the vendor. 

Categories
News Video

David Kotz speaks on Smart Devices

Did you receive a smart device this holiday season, and leave it sitting in the box because you don’t know how to set it up? Or were you one of those savvy shoppers who bought a smart device on clearance after the holiday rush and already have the perfect place to put it in your home?

Either way, SPLICE PI David Kotz has some advice for keeping your information secure and private when using smart devices. Check it what he has to say in the video!

Categories
News Patents Publication

New SPLICE Patent

The SPLICE team is pleased to announce one new patent derived from research conducted by SPLICE Principal Investigator Kevin Kornegay and Professor Willie Thompson, both from Morgan State University. The patent describes a data traffic module supporting the attestation and secure boot operations of IoT devices and legacy computing devices, and providing tamper resistance to such devices. 

Kevin Kornegay and Willie Lee Thompson II. Decentralized Root-of-Trust Framework for Heterogeneous Networks, November 2020. Morgan State University; USPTO. Download from https://patents.google.com/patent/US20180196945A1/en