Bypass Attack Research Articles

The applicability of a hybrid framework for automated phishing detection

Phishing attacks are a critical and escalating cybersecurity threat in the modern digital landscape. As cybercriminals continually adapt their techniques, automated phishing detection systems have become essential for safeguarding Internet users. However, many current systems rely on single-analysis models, making them vulnerable to sophisticated bypass attempts by hackers. This research delves into the potential of hybrid approaches, which combine multiple models to enhance both the robustness and effectiveness of phishing detection. It highlights existing hybrid models' limitations that focus primarily on effectiveness while ignoring broader applicability. To address these gaps, we introduce a novel framework explicitly designed for applicability in the real world, which poses the foundation for practical and robust phishing detection architectures. We develop a proof of concept to evaluate its effectiveness, robustness, and detection speed. Additionally, we introduce an innovative methodology for simulating bypass attacks on single-analysis base models. Our experiments demonstrate that the proposed hybrid framework outperforms individual models, displaying higher effectiveness, robustness against bypassing attempts, and real-time detection capabilities. Our proof of concept achieves an accuracy of 97.44% thereby outperforming the current state-of-the-art approach while requiring less computational time. The results provide insights into the multifaceted factors of hybrid models, extending beyond mere effectiveness, and emphasize the importance of holistic applicability in hybrid approaches to address the critical need for robust defenses against phishing attacks.

Fiddling the Twiddle Constants - Fault Injection Analysis of the Number Theoretic Transform

In this work, we present the first fault injection analysis of the Number Theoretic Transform (NTT). The NTT is an integral computation unit, widely used for polynomial multiplication in several structured lattice-based key encapsulation mechanisms (KEMs) and digital signature schemes. We identify a critical single fault vulnerability in the NTT, which severely reduces the entropy of its output. This in turn enables us to perform a wide-range of attacks applicable to lattice-based KEMs as well as signature schemes. In particular, we demonstrate novel key recovery and message recovery attacks targeting the key generation and encryption procedure of Kyber KEM. We also propose novel existential forgery attacks targeting deterministic and probabilistic signing procedure of Dilithium, followed by a novel verification bypass attack targeting its verification procedure. All proposed exploits are demonstrated with high success rate using electromagnetic fault injection on optimized implementations of Kyber and Dilithium, from the open-source pqm4 library on the ARM Cortex-M4 microcontroller. We also demonstrate that our proposed attacks are capable of bypassing concrete countermeasures against existing fault attacks on lattice-based KEMs and signature schemes. We believe our work motivates the need for more research towards development of countermeasures for the NTT against fault injection attacks.

Analysis of shielding failure of transmission line based on pilot model

Since the main way of power transmission in China is overhead line transmission, some overhead lines are in a harsh outdoor environment. Among them, the bypass attack is more serious. Shielding Failure is a severe form of lightning damage. Based on the situation, this article studies the lightning shielding phenomenon of transmission lines. This article uses the pilot development model to simulate the lightning strike process, analyzes the different target objects of the lightning strike, and elaborates and calculates the lightning shielding trip rate. In addition, by changing the protection angle, the height of the tower, the ground inclination of the area where the line is located, and the number of lines, the impact of these four factors on the lightning shielding trip rate is discussed. According to the influencing factors, measures to strengthen the lightning protection performance of the line are proposed.

SPrivAD: A secure and privacy-preserving mutually dependent authentication and data access scheme for smart communities

Recent studies show that attackers evade authentication by exploiting valid credentials and crafting authentication request messages to compromise assets and illegitimately access data in smart communities such as smart campuses and smart cities. In addition, attackers can send large numbers of authentication and data access requests to spread malware across the smart communities’ network and cause Distributed Denial of Service (DDoS) attacks. This paper proposes SPrivAD, a secure and privacy-preserving mutually dependent authentication and data access solution by which smart communities’ assets such as users, devices, and apps can authenticate each other before allowing data access. SPrivAD uses an Inter-Attribute-based Zero Knowledge Proof of Knowledge (IA-ZKPK) protocol based on computational attributes of cryptographic operations, and cryptographic identities of the assets to perform Mutually Dependent Multi-Factor Authentication and Data Access (MDMFA). The computational attributes such as message size and number of executed steps of cryptographic operations are features derived from the knowledge of cryptographic operations between the assets. Our approach for deriving a unique, deactivatable, and revocable cryptographic identity is based on the secrets of an asset in a modified Elliptic Curve Pedersen Commitment Scheme (EC-PCS) with security and privacy guarantees. We implement a prototype of SPrivAD and evaluate it with respect to its security, privacy, and performance. The results show that it is secure, privacy-preserving, and efficient for mutually dependent authentication and data access in smart communities. Furthermore, we design and analyse a new attack, Smart Communities Authentication Bypass Attack (SCABA), on real-world authentication and secure access schemes such as Ruckus Cloudpath Enrollment System and Duo Multi-Factor Authentication (MFA). This type of attack exploits valid credentials of smart communities’ assets. We show that SPrivAD mitigates SCABA.

Cryptanalysis and improvement of a two-factor user authentication scheme for smart home

Smart home is a latest technology in the field of Internet of Things (IoT) through which one can manage the smart devices at home using internet. This communication takes place via insecure channel which makes it vulnerable to many attacks. Hence, a secure authentication protocol is required to transfer sensitive data within smart home. Recently Shuai et al. have designed two factor user authentication protocol for smart home environment. In this paper, it has been discussed that this protocol is vulnerable to offline password guessing attack, insider attack, replay attack, gateway bypass attack and insecure session key agreement problem. To overcome these attacks, a user authentication protocol has been proposed. Its formal security analysis and verification is given using random oracle model and ProVerif tool, respectively. In performance analysis, the proposed scheme is compared with other related scheme to show that it is more reliable and secure than them.

Iot Secured Disjunctive XOR Two Factor Mutual Authentication for Users

Aims: The paper has introduced an algorithmic modification of M.L.Das's previous work done of " IoT Mutual Authentication". Background: IoT has proven that if there exists a thing on the earth then it is bound to be connected to the internet to tell its feature on its own. IoT plays a remarkable role in all aspects of our daily lives it covers entertainment, sports, healthcare, education, security, automobiles, industrial as well as home appliances and many more real time applications. To ease our everyday activities, it reinforcing the way people interact with their surroundings. This holistic view brings some major concerns in terms of security and privacy. Objective: The objective of the work is to increase security and protect the algorithm from various attackers so to use with real time application. Methods: In this we have used XoR (Exclusive OR) operation and because of this we can protect the algorithm from DoS attacks, bypass attack, intruder attack and allow user to change password. Conclusion: The proposed work has secured all the connected IoT devices to work inde-pendently and secured because every device has to verify at each step in the IoT system before initiating its operation.

One enhanced secure access scheme for outsourced data

The popularity of apps makes smart phones rapidly become the most widespread form of communication. Due tothe impactof resource constraints in mobile phones, users prefer to outsource data from the local device to the cloud. Access control of outsourced data drives the researches for protecting sensitive data from all the possibly malicious software access or from cloud service provider misbehavior. The unexpected attacks from the local device or the cloud that are trying to breach the data access policy imposed by data owner has resulted in inadequate current access control solutions. Therefore, this paper proposes one access control scheme for Android devices to avoid authentication bypass attacks from both sides. Attribute-Based Encryption is used to design one app-level fine-grained data access for the purpose of data confidentiality in the local side. Moreover, Trusted Execution Environment is employed as a trusted computing environment which provides essential security services to protect encrypted data from unwanted access by cloud service providers or unauthorized apps from the local side. Finally, a prototype system is implemented and the performance is evaluated by the various operations used in the scheme. The experimental results show that the enhanced secure access model is flexible, efficient and secure for outsourcing data to the cloud.

Web intrusion detection system combined with feature analysis and SVM optimization

The current network traffic is large, and the network attacks have multiple types. Therefore, anomaly detection model combined with machine learning is developing rapidly. Frequent occurrences of Web Application Firewall (WAF) bypass attacks and the redundancy of the data characteristics in Hypertext Transfer Protocol (HTTP) protocol make it difficult to extract data characteristics. In this paper, an integrated web intrusion detection system combined with feature analysis and support vector machine (SVM) optimization is proposed. By using expert’s knowledge, the characteristics of the common Web attacks are analyzed. The related data characteristics are selected by the analysis of the HTTP protocol. In the classification learning, the mature and robust support vector machine algorithm is utilized and the grid search method is used for the parameter optimization. Consequently, a better detection capability on Web attacks can be obtained. By using the HTTP DATASET CSIC 2010 data set, experiments have been carried out to compare the detection capability of different kernel functions. The results show that the proposed system performs good in the detection capability and can detect the WAF bypass attacks effectively.

CAS-Lock: A Security-Corruptibility Trade-off Resilient Logic Locking Scheme

Logic locking has recently been proposed as a solution for protecting gatelevel semiconductor intellectual property (IP). However, numerous attacks have been mounted on this technique, which either compromise the locking key or restore the original circuit functionality. SAT attacks leverage golden IC information to rule out all incorrect key classes, while bypass and removal attacks exploit the limited output corruptibility and/or structural traces of SAT-resistant locking schemes. In this paper, we propose a new lightweight locking technique: CAS-Lock (cascaded locking) which nullifies both SAT and bypass attacks, while simultaneously maintaining nontrivial output corruptibility. This property of CAS-Lock is in stark contrast to the well-accepted notion that there is an inherent trade-off between output corruptibility and SAT resistance. We theoretically and experimentally validate the SAT resistance of CAS-Lock, and show that it reduces the attack to brute-force, regardless of its construction. Further, we evaluate its resistance to recently proposed approximate SAT attacks (i.e., AppSAT). We also propose a modified version of CAS-Lock (mirrored CAS-Lock or M-CAS) to protect against removal attacks. M-CAS allows a trade-off evaluation between removal attack and SAT attack resiliency, while incurring minimal area overhead. We also show how M-CAS parameters such as the implemented Boolean function and selected key can be tuned by the designer so that a desired level of protection against all known attacks can be achieved.

Increasing Trustworthiness of Face Authentication in Mobile Devices by Modeling Gesture Behavior and Location Using Neural Networks

Personal mobile devices currently have access to a significant portion of their user’s private sensitive data and are increasingly used for processing mobile payments. Consequently, securing access to these mobile devices is a requirement for securing access to the sensitive data and potentially costly services. Face authentication is one of the promising biometrics-based user authentication mechanisms that has been widely available in this era of mobile computing. With a built-in camera capability on smartphones, tablets, and laptops, face authentication provides an attractive alternative of legacy passwords for its memory-less authentication process, which is so sophisticated that it can unlock the device faster than a fingerprint. Nevertheless, face authentication in the context of smartphones has proven to be vulnerable to attacks. In most current implementations, a sufficiently high-resolution face image displayed on another mobile device will be enough to circumvent security measures and bypass the authentication process. In order to prevent such bypass attacks, gesture recognition together with location is proposed to be additionally modeled. Gestures provide a faster and more convenient method of authentication compared to a complex password. The focus of this paper is to build a secure authentication system with face, location and gesture recognition as components. User gestures and location data are a sequence of time series; therefore, in this paper we propose to use unsupervised learning in the long short-term memory recurrent neural network to actively learn to recognize, group and discriminate user gestures and location. Moreover, a clustering-based technique is also implemented for recognizing gestures and location.

Cryptanalysis of A Multi-use CCA-secure Proxy Re-encryption Scheme

Proxy re-encryption (PRE) can be classified as single-hop PRE and multi-use PRE according to the times which the ciphertext is transformed. Finding a unidirectional, multiuse, and chosen ciphertext attack (CCA) secure PRE is presented as an open problem by Canetti et al. Wang claimed to resolve this problem by proposing the first multi-use CCAsecure unidirectional PRE scheme. But Zhang et al. have shown their proposal is not CCAsecure by giving concrete attacks. In this paper, we propose an improvement for Wang-MultiUse-PRE to resist Zhang’s attack. But we also found that different with single-hop PRE, multi-use PRE without randomize encrypt key in its re-encryption algorithm could be vulnerable to attack. According to this principle we find a new type attack to multi-use CCAsecure PRE named proxy bypass attack. Then we give concrete attacks on Wang-Multi-UsePRE scheme. This attack is also effective for other multi-use scheme.