Cyber Vulnerabilities Research Articles

Moral Hazards in Cyber Vulnerability Markets

The cyber vulnerability market arose from bug bounty programs initiated in the 1980s. Originally created to provide programmers, end users, and security professionals with an opportunity to report code vulnerabilities, it has since become a cottage industry that serves many masters with very different motives.

Cyber Vulnerability Intelligence for Internet of Things Binary

Internet of Things (IoT) integrates a variety of software (e.g., autonomous vehicles and military systems) in order to enable the advanced and intelligent services. These software increase the potential of cyber-attacks because an adversary can launch an attack using system vulnerabilities. Existing software vulnerability analysis methods used to be relying on human experts crafted features, which usually miss many vulnerabilities. It is important to develop an automatic vulnerability analysis system to improve the countermeasures. However, source code is not always available (e.g., most IoT related industry software are closed source). Therefore, vulnerability detection on binary code is a demanding task. This article addresses the automatic binary-level software vulnerability detection problem by proposing a deep learning-based approach. The proposed approach consists of two phases: binary function extraction, and model building. First, we extract binary functions from the cleaned binary instructions obtained by using IDA Pro. Then, we employ the attention mechanism on top of a bidirectional long short-term memory for building the predictive model. To show the effectiveness of the proposed approach, we have collected datasets from several different sources. We have compared our proposed approach with a series of baselines including source code-based techniques and binary code-based techniques. We have also applied the proposed approach to real-world IoT related software such as VLC media player and LibTIFF project that used on Autonomous Vehicles. Experimental results show that our proposed approach betters the baselines and is able to detect more vulnerabilities.

Cyber vulnerability maintenance policies that address the incomplete nature of inspection

AbstractIn cybersecurity, incomplete inspection, resulting mainly from computers being turned off during the scan, leads to a challenge for scheduling maintenance actions. This article proposes the application of partially observable decision processes to derive cost‐effective cyber maintenance actions that minimize total costs. We consider several types of hosts having vulnerabilities at various levels of severity. The maintenance cost structure in our proposed model consists of the direct costs of maintenance actions in addition to potential incident costs associated with different security states. To assess the benefits of optimal policies obtained from partially observable Markov decision processes, we use real‐world data from a major university. Compared with alternative policies using simulations, the optimal control policies can significantly reduce expected maintenance expenditures per host and relatively quickly mitigate the most important vulnerabilities.

Can You Engage in Political Activity Without Internet Access? The Social Effects of Internet Deprivation

To what extent can you engage in political activity in the modern age without Internet access? The growing dependence on Internet access to fulfill basic civil functions is threatened by increasing personal and societal cyber vulnerability. In this article, we explore the extent to which citizens are able, or unable, to engage in specific political activities in the absence of Internet connectivity. To concretize the subject, we test how Internet deprivation affects the ability to realize three basic elements of political participation: political expression, civic association, and access to information. To measure this, we develop a new experimental methodology that tests people’s ability to complete tasks related to each function under simulated treatments of Internet access or deprivation. This empirical methodology offers a new framework through which to quantify the realization of social tasks under experimental conditions. Early results suggest that the absence of Internet access significantly reduces task completion for activities related to political expression and political association and conditionally reduces task completion for practices associated with freedom of information. Having substantiated this empirical framework, we encourage its application to additional forms of political activity.

An iterative learning and inference approach to managing dynamic cyber vulnerabilities of complex systems

As modern infrastructure systems become increasingly reliant on cyber technologies and continue to be integrated with physical systems, managing risks from deliberate and non-deliberate sources is a significant research challenge. Unlike strictly physical systems, cyber-enabled physical systems are influenced by dynamic and evolving technologies, environments, and attack mechanisms. As a result, vulnerabilities are rapidly changing and difficult to detect and manage. While there is recent interest in the dynamic properties of performance through resilience analysis, limited research addresses the dynamic nature of cyber-system vulnerability. This paper presents an iterative data-driven learning approach to evaluate and manage vulnerabilities for such complex systems. These time-varying system health characteristics may not be directly observable, but can be inferred using observable indicators. The approach recognizes that multiple types of vulnerabilities need to be included in a holistic system health assessment. The methods are applied to the Common Vulnerability Scoring System (CVSS) database containing thousands of documented cybersecurity vulnerabilities over nearly two decades. We acknowledge the dynamic properties of cyber vulnerability, while also inferring system health using observable data and hidden operational states. The results will be of interest to managers of large-scale cyber-enabled physical systems who are seeking to prioritize system health investments.

Designing online network intrusion detection using deep auto-encoder Q-learning

Because of the increasing application of reinforcement learning (RL), particularly deep Q-learning algorithm, research organizations utilize it with increasing frequency. The prediction of cyber vulnerability and development of efficient real-time online network intrusion detection (NID) systems are progressions toward becoming RL-powered. An open issues in NID is the model design and prediction of real-time online data composed of a series of time-related feature patterns. There have been concerns regarding the operation of the developed systems because cyber-attack scenarios vary continuously to circumvent NID. These issues have been related to the human interaction significance and the decrease in accuracy verification. Therefore, we employ an RL that permits a deep auto-encoder in the Q-network (DAEQ-N). The proposed DAEQ-N attempts to achieve the maximum prediction accuracy in online learning systems into which continuous behavior patterns are fed and which are trained with more significant weights by classifying it as either “normal” or “anomalous.”

Institutional Measures for Increasing the Cyber Security for Business in the European Union

Abstract Numerous research and analytical studies envisage a new wave of disruptive innovations that will completely change the economic landscape, organization and business models in the short term, as well as ways of managing companies. This wave of innovation, followed by the use of new digital technologies, such as Big Data, mobile applications, social networking, robotics, 3D printing, nanotechnology, quantum informatics, cloud computing, etc., through various forms and modes of cyber vulnerability, contribute to reducing the ability to achieve effective protection, not only for companies and public services, but also for other services available to citizens. The current research preoccupation is focused on finding adequate solutions, in terms of protecting the digital economy and digital business from all modern threats and risks that the modern disruptive technologies carry along with. The thematic focus is on strengthening the institutional and operational capacities of existing and newly-formed specialized agencies, such as: ENISA, EC3 and EUROPOL, in order to provide an integrated institutional response to a wide range of hybrid and cyber threats. The final section of the paper presents an overview of comprehensive strategic, regulatory and institutional approach of the EU to cyber incidents and crises in the digital space.

Cyberbiosecurity Implications for the Laboratory of the Future.

Technological innovation has become an integral and inescapable aspect of our daily existence as almost everything of significance in our world now has a cyber (i.e., relating to, or involving computers, computer networks, information technology, and virtual reality) component associated with it. Every facet of our lives is now touched by technology. As such, we're experiencing a digital transformation. Unfortunately, both as individuals and as a society, we're inadequately prepared to embrace the myriad of vulnerabilities presented by cybertechnologies. Unintended cyber vulnerabilities present significant risks to individuals, organizations, governments and economies. Here, we identify current cybersecurity vulnerabilities found in the life science enterprise and discuss the many ways in which these vulnerabilities present risk to laboratory workers in these facilities, the surrounding community and the environment. We also consider the cyberbiosecurity benefits associated with numerous innovations likely to be present in the laboratory of the future. The challenges associated with cyberbiosecurity vulnerabilities are not insurmountable; they simply require thoughtful consideration by equipment designers, software and control systems developers, and by end users. Organizations and the individuals that comprise them must respect, value, and protect their data. End users must train themselves to look at every piece of laboratory equipment and every process from a cyberbiosecurity perspective. With this approach, cyberbiosecurity vulnerabilities can be minimized or eliminated to the benefit of workers, life science organizations, and national security.

Flexible hardware‐in‐the‐loop testbed for cyber physical power system simulation

Nowadays, the power system is evolving into a complex cyber physical system with the closely merged physical system, information system, and communication network. It is critical to understand the connections between the power and cyber systems, and the potential impact of cyber vulnerability. In this study, a flexible hardware-in-the-loop (HIL) testbed is proposed for studying the cyber physical power system. By using the flexible interface, various co-simulation systems for different purposes are generated. Based on this testbed, three sample co-simulators are built as proofs. First, a HIL power and communication co-simulator with non-real-time synchronisation mechanism is introduced, and a case of false data injection attack on automation voltage control is studied. Then, a real-time power and communication HIL co-simulator is introduced, and a case considering the impact of communication bit error on the stability control system is simulated to demonstrate the performance of stability control equipment. Finally, another co-simulator for simulating the actual cyber-attack on the stability control system is introduced, and a case of a man-in-the-middle attack on the data link is simulated to demonstrate the impact of cyber-attack on the stability control system.

Cyber-Physical Attacks Targeting Communication-Assisted Protection Schemes

The dependence of modern societies on electric energy is ever increasing by the emergence of smart cities and electric vehicles. This is while unprecedented number of cyber-physical hazards are threatening the integrity and availability of the power grid on a daily basis. On one hand, physical integrity of power systems is under threat by more frequent natural disasters and intentional attacks. On the other hand, the cyber vulnerability of power grids is on the rise by the emergence of smart grid technologies. This underlines an imminent need for the modeling and examination of power grid vulnerabilities to cyber-physical attacks. This paper examines the vulnerability of the communication-assisted protection schemes like permissive overreaching transfer trip to cyberattacks using a co-simulation platform. The simulation results show that the transient angle stability of power systems can be jeopardized by cyberattacks on the communication-assisted protection schemes. To address this vulnerability, two physical solutions including the deployment of communication channel redundancy, and a more advanced communicated-assisted protection scheme, i.e., directional comparison unblocking scheme (DCUB), are considered and tested. The proposed solutions address the vulnerability of the communication-assisted protection schemes to distributed denial of service attack to some extent. Yet, the simulation results show the vulnerability of the proposed solutions to sophisticated cyberattacks like false data injection attacks. This highlights the need for the development of cyber-based solutions for communication channel monitoring.

Hacking 9-1-1: Infrastructure Vulnerabilities and Attack Vectors.

9-1-1 call centers are a critical component of prehospital care: they accept emergency calls, dispatch field responders such as emergency medical services, and provide callers with emergency medical instructions before their arrival. The aim of this study was to describe the technical structure of the 9-1-1 call-taking system and to describe its vulnerabilities that could lead to compromised patient care. 9-1-1 calls answered from mobile phones and landlines use a variety of technologies to provide information about caller location and other information. These interconnected technologies create potential cyber vulnerabilities. A variety of attacks could be carried out on 9-1-1 infrastructure to various ends. Attackers could target individuals, groups, or entire municipalities. These attacks could result in anything from a nuisance to increased loss of life in a physical attack to worse overall outcomes owing to delays in care for time-sensitive conditions. Evolving 9-1-1 systems are increasingly connected and dependent on network technology. As implications of cybersecurity vulnerabilities loom large, future research should examine methods of hardening the 9-1-1 system against attack.

A System Dynamics Model for Systems Security Engineering Analysis of Internet Service Provider Customer Modem Cyber Defense

AbstractInternet service providers seek to increase revenue by reducing costs and increasing subscriptions. We take a systems security engineering approach to evaluate ways of enhancing customer modem cybersecurity, using a system dynamics model to show the impact of different solutions for improving customer modem bandwidth. The model is extensible and modifiable to test other stakeholder goals. We demonstrate this by modelling customer goodwill and solution cost. When used as a tool for planning system changes, the model can be compared to the live system before and during incremental system changes. This helps improve model validity, control risk, evaluate return on investment, and provide a platform for testing proposed system changes. Businesses with similar cyber vulnerabilities can benefit from using this system engineering approach.

A Novel Distributed and Stealthy Attack on Active Distribution Networks and a Mitigation Strategy

Rapid advances in smart devices tremendously facilitate our day-to-day lives. However, these can be exploited remotely via existing cyber vulnerabilities to cause disruption at the physical infrastructure level. In this paper, we discover a novel distributed and stealthy attack that uses malicious actuation of a large number of small-scale loads residing within a distribution network (DN). This attack is capable of cumulatively violating the underlying operational system limits, leading to widespread and prolonged disruptions. A key element of this attack is the efficient use of attack resources, planned via Stackelberg games. To mitigate this type of an attack, we propose a countermeasure strategy which adaptively suppresses adverse effects of the attack when detected in a timely manner. The effectiveness of the proposed mitigation strategy is demonstrated via theoretical convergence studies, practical evaluations, and comparisons with the state-of-the-art strategies using realistic load flow and DN infrastructure models.

Virtualization Solutions Supporting Privacy and Data Protection in Online Activities

Abstract Nowadays, smart devices like computers, tablets, and smartphones allow transmitting the information everywhere, with high speed, over the World Wide Web. However, risks regarding data integrity, privacy and security when using the Internet, increased dramatically, as methods designed to exploit the system’s vulnerabilities are more and more sophisticated. Therefore the need for people working in professional environments to protect their private data when using unsecure connections, by employing advanced tools. There are multiple solutions, but we will focus on the use of virtualization software like VMware or Oracle Virtual Box, together with traditional privacy measures (use of proxies and VPN’s). Today’s smart devices store an important amount of data about their owners and, in most of the cases, people don’t even realize this. Installing and using protection means is often not enough. They have to be properly setup in order to ensure the desired level of security, or anonymity, when using the Internet, and require for the military personnel a good knowledge not only about cyber vulnerabilities and risks, but also technical capabilities and features of the employed security solutions. DISCLAIMER: This paper expresses the views, interpretations, and independent position of the authors. It should not be regarded as an official document, nor expressing formal opinions or policies, of NATO or the HUMINT Centre of Excellence (HCOE).

Optimization of Trust Node Assignment for Securing Routes in Smart Grid SCADA Networks

The move toward a smart power grid has widened the range of cyber vulnerabilities in supervisory control and data acquisition (SCADA) systems. Specialized security hardening devices, such as the trust systems, are being developed to protect energy SCADA networks from possible cyberattacks. The trust systems are network security resources that monitor and act on malicious packets. A node is said to be a trust node when it is equipped with a trust system. This paper investigates the optimal security deployment problem in resource-constrained SCADA networks. It proposes two deployment schemes for inline security devices: 1) link coverage maximization; and 2) minimal path tolerance (MPT). The first scheme focuses on the overall monitoring coverage. It is formulated as a quadratic assignment problem. The second scheme focuses on the hop distance between consecutive trust nodes. It uses a heuristic approach that deploys trust nodes in a distributive manner. The proposed schemes are evaluated considering the IEEE test case topologies under various scenarios. Numerical results demonstrate that the proposed schemes are capable of achieving their primary goals. They also reveal a performance tradeoff between the proposed schemes in the highly resource-constrained scenarios where MPT offers a better distributiveness.

Cybersafety Analysis of a Central Utilities Plant (CUP) Gas Turbine using STPA-SEC

As Industrial Control Systems (ICS) become increasingly software-intensive and more complex, the traditional approaches to cybersecurity that undertake a narrow, static technical view of the system are proving to be increasingly inept in the face of new threat vectors and vulnerabilities. To date, most attacks on Energy Systems have targeted either the IT infrastructure (e.g., the Aramco Shamoo attack) or Circuit breakers of Operational Technology (e.g., the Ukraine attack.). In such cases, recovery is usually rather fast – either by rebooting computers or resetting breakers. But, if the Operation Technology equipment, especially the important, large, customized equipment, is physically damaged, recovery can take weeks or even months. In this paper, we demonstrate the use of the Systems-Theoretic Process Analysis for Security (STPA-Sec) method to identify cyber vulnerabilities that have the potential to cause physical damage in industrial control systems using a Central Utilities Plant Gas Turbine as a use-case. This analysis does not attempt to perform a complete analysis of the Central Utilities Plant or the Gas Turbine; rather, it lays the foundation for the exercise in a rigorous, systematic fashion that could be emulated to perform a complete analysis. Several new requirements are identified to make the system more resilient which do not only span the technical aspects of the system but also the broader socio-organizational system.

A Preliminary Design-Phase Security Methodology for Cyber–Physical Systems

Despite “cyber” being in the name, cyber–physical systems possess unique characteristics that limit the applicability and suitability of traditional cybersecurity techniques and strategies. Furthermore, vulnerabilities to cyber–physical systems can have significant safety implications. The physical and cyber interactions inherent in these systems require that cyber vulnerabilities not only be defended against or prevented, but that the system also be resilient in the face of successful attacks. Given the complex nature of cyber–physical systems, the identification and evaluation of appropriate defense and resiliency strategies must be handled in a targeted and systematic manner. Specifically, what resiliency strategies are appropriate for a given system, where, and which should be implemented given time and/or budget constraints? This paper presents two methodologies: (1) the cyber security requirements methodology and (2) a systems-theoretic, model-based methodology for identifying and prioritizing appropriate resiliency strategies for implementation in a given system and mission. This methodology is demonstrated using a case study based on a hypothetical weapon system. An assessment and comparison of the results from the two methodologies suggest that the techniques presented in this paper can augment and enhance existing systems engineering approaches with model-based evidence.

Terveydenhuolto ja kyberuhkat

Kyberturvallisuusstrategian vision mukaan Suomen tulee kyetä suojaamaan elintärkeät toimintonsa kyberuhkaa vastaan kaikissa tilanteissa. Terveydenhuolto on yksi elintärkeistä toiminnoista. Terveystoimiala on kyberhyökkäysten top-5-listalla ensimmäisenä. Hyökkäysten keskeisin motivaatio on potilastietojen arvo pimeillä markkinoilla. Vuonna 2015 varastettiin yli satamiljoonaa potilastietoa, jotka sisältävät rikollisille arvokkaita tietoja, kuten luottokorttinumeroita, työnantajatietoja ja sairaushistoriatietoja. Tässä artikkelissa kuvataan terveydenhuoltoon liittyviä kyberuhkia, kyberhaavoittuvuuksia ja toteutuneita kyberhyökkäyksiä kybermaailman eri ulottuvuudet kattaen.
 Tarkastelussa käytetään kybermaailman viisikerroksista verkostomallia, joka sisältää fyysisen, syntaktisen, semanttisen, palvelu- ja kognitiivisen kerroksen. Malli kattaa laajasti koko kybermaailman fyysisen kerroksen laitteista ja verkoista kognitiivisen kerroksen inhimillisiin ongelmanratkaisu- ja tulkintaympäristöihin. Haavoittuvuuksia ja toteutuneita hyökkäyksiä voidaan mallin mukaan jaotella laitekohtaisista haavoittuvuuksista aina koulutuksen puutteista johtuviin haavoittuvuuksiin ja pelottelu- ja kalasteluohjelmilla tapahtuneisiin hyökkäyksiin. Paljon julkisuutta ovat saaneet myös terveydenhuoltoon kohdistuneet kiristyshaittaohjelmahyökkäykset.
 Kyberuhkia vastaan voidaan suojautua useilla eri tasoilla ja tavoilla. Lähtökohtana on se, että jokainen organisaatio huolehtii oman toimintansa kyberturvallisuudesta tehden yhteistyötä muiden toimijoiden kanssa uhkien tunnistamisessa ja torjumisessa. Terveydenhuollon kyberturvallisuuden rakentaminen on systeemin hallintaa, jossa tulee keskittyä järjestelmien kokonaisuuteen yksittäisten laitteiden sijaan. Yhteistoiminnan tavoitteena on, että kokonaisosaaminen tukee yksittäisen toimijan toimintaedellytyksiä yhteistä uhkaa vastaan. Terveydenhuollon kyberturvallisuuden jatkuva parantaminen ja tietoisuuden lisääminen ovat kaikkien kansalaisten etuja, jotka vaativat vahvaa ymmärrystä niin tietoturvasta kuin terveydenhuollon toimintatavoistakin. Tämän vuoksi tietoisuuden kohottamisen ja henkilökunnan kouluttamisen tuleekin olla keskeisellä sijalla organisaatioiden kyberturvallisuudessa.

Financially Motivated FDI on SCED in Real-Time Electricity Markets: Attacks and Mitigation

Given the strong cyber-physical coupling that exists in power systems today and of the future, false data injection (FDI) attacks have been shown to be feasible in tampering measurement devices by exploiting cyber vulnerabilities to mislead state estimation and related applications. For example, a corrupt generator owner, motivated by financial gain, may manipulate meter readings associated with short-term load forecasts and subsequently misguide the decisions of security constrained economic dispatch (SCED) in ex-ante real-time markets. In this paper, we analyze the feasibility of financially motivated FDI attacks in bi-level programming settings where multi-solution uncertainty of SCED is considered. To deter such attacks, a robust incentive-reduction strategy is proposed that can prevent financially motivated FDI attacks for all the possible load distributions and solutions of SCED requiring a minimal number of protected meters. Simulations for the IEEE 14-bus and IEEE 30-bus test systems demonstrate attack feasibility and performance of the proposed mitigation strategy for SCED in real-time markets.

A Reality of Vulnerability and Dependence: Internet Access as a Human Right

We are faced with a new reality where our reliance on internet access to fulfil basic civil tasks is threatened by increasing personal and societal cyber vulnerability. This dichotomy of dependence and vulnerability requires a new framework for understanding the legal and human rights status of this evolving technological reality. A number of theories have sought to explain how internet access could attain the status of a human right. These include reliance on the freedom of expression protection offered by the International Covenant on Civil and Political Rights and the Universal Declaration of Human Rights. More recent approaches have suggested that international customary law could apply, or that internet access could attain the status of an auxiliary human right. Despite repeated demands by international institutions to address modern cyber challenges through a human rights lens, this assortment of legal approaches has failed to garner a consensus view in the international community. The article reviews the merits of each of these arguments, and grounds the debate in the lens of this reality of dependence and vulnerability. Of the four options surveyed, we find that auxiliary righthood is the most promising approach, but that additional research is required to substantiate the claims.