Default Security Research Articles

Hardening Active Directory Graphs via Evolutionary Diversity Optimization based Policies

Active Directory (AD) is the default security management system for Windows domain networks. An AD environment can be described as a cyber-attack graph, with nodes representing computers, accounts, etc., and edges indicating existing accesses or known exploits that enable attackers to move from one node to another. This paper explores a Stackelberg game model between one attacker and one defender on an AD attack graph. The attacker’s goal is to maximize their chances of successfully reaching the destination before getting detected. The defender’s aim is to block a constant number of edges to minimize the attacker’s chance of success. The paper shows that the problem is #P-hard and, therefore, intractable to solve exactly. To defend the AD graph from cyber attackers, this paper proposes two defensive approaches. In the first approach, we convert the attacker’s problem to an exponential sized Dynamic Program that is approximated by a Neural Network (NN). Once trained, the NN serves as an efficient fitness function for defender’s Evolutionary Diversity Optimization based defensive policy. The diversity emphasis on the defender’s solution provides a diverse set of training samples, improving the training accuracy of our NN for modeling the attacker. In the second approach, we propose a RL based policy to solve the attacker’s problem and Critic network assisted Evolutionary Diversity Optimization based defensive policy to solve defender’s problem. Experimental results on synthetic AD graphs show that the proposed defensive policies are scalable, highly effective, approximate attacker’s problem accurately, and generate good defensive plans.

How “What you think you know about cybersecurity” can help users make more secure decisions

The increasing use of information technology artifacts in daily life makes security a shared responsibility of both users and companies. In recent years, increasing a user's objective (i.e., actual) security knowledge and providing applications with more secure default settings appear among the most ubiquitous tools companies use to broaden their efforts to help users make more secure decisions. Examining both solutions matters because they are widely used, cost effective, and understood by many security practitioners. Additionally, default settings and users’ objective knowledge provide anchors for decision-making. However, human errors and insecure default settings are increasing and raising further questions about the efficacy of such efforts. Using the theory of bounded rationality, we investigated the role of objective, subjective (i.e., self-assessed) security knowledge, and default settings security level on the overall decision security. We found that objective security knowledge can lead to secure decisions when paired with high subjective security knowledge. In the absence of the latter, objective security knowledge is unable to lead to better security decisions. Furthermore, subjective security knowledge reduces the extent to which users fully accept default security settings, thereby mitigating bias toward insecure default settings.

Scalable Edge Blocking Algorithms for Defending Active Directory Style Attack Graphs

Active Directory (AD) is the default security management system for Windows domain networks. An AD environment naturally describes an attack graph where nodes represent computers/accounts/security groups, and edges represent existing accesses/known exploits that allow the attacker to gain access from one node to another. Motivated by practical AD use cases, we study a Stackelberg game between one attacker and one defender. There are multiple entry nodes for the attacker to choose from and there is a single target (Domain Admin). Every edge has a failure rate. The attacker chooses the attack path with the maximum success rate. The defender can block a limited number of edges (i.e., revoke accesses) from a set of blockable edges, limited by budget. The defender's aim is to minimize the attacker's success rate. We exploit the tree-likeness of practical AD graphs to design scalable algorithms. We propose two novel methods that combine theoretical fixed parameter analysis and practical optimisation techniques. For graphs with small tree widths, we propose a tree decomposition based dynamic program. We then propose a general method for converting tree decomposition based dynamic programs to reinforcement learning environments, which leads to an anytime algorithm that scales better, but loses the optimality guarantee. For graphs with small numbers of non-splitting paths (a parameter we invent specifically for AD graphs), we propose a kernelization technique that significantly downsizes the model, which is then solved via mixed-integer programming. Experimentally, our algorithms scale to handle synthetic AD graphs with tens of thousands of nodes.

ENCIDER: Detecting Timing and Cache Side Channels in SGX Enclaves and Cryptographic APIs

Confidential computing aims to secure the code and data in use by providing a Trusted Execution Environment (TEE) for applications using hardware features such as Intel SGX. Timing and cache side-channel attacks, however, are often outside the scope of the threat model, although once exploited they are able to break all the default security guarantees enforced by hardware. Unfortunately, tools detecting potential side-channel vulnerabilities within applications are limited and usually ignore the strong attack model and the unique programming model imposed by Intel SGX. This article proposes a precise side-channel analysis tool, ENCIDER, detecting both timing and cache side-channel vulnerabilities within SGX applications via inferring potential timing observation points and incorporating the SGX programming model into analysis. ENCIDER uses dynamic symbolic execution to decompose the side-channel requirement based on the bounded non-interference property and implements byte-level information flow tracking via API modeling. We have applied ENCIDER to 4 real-world SGX applications, 2 SGX crypto libraries, and 3 widely-used crypto libraries, and found 29 timing side channels and 73 code and data cache side channels. We also compare ENCIDER with three state-of-the-art side channel analysis tools using their benchmarks. ENCIDER does not only report most of the bugs with 20%-50% run time improvement and 65%-92% memory usage improvement, but also detects 9 missing bugs from these tools. We have reported our findings to the corresponding parties, e.g., Intel and ARM, who have confirmed most of the vulnerabilities detected.

Robots Security Assessment and Analysis Using Open-Source Tools

The Internet of things (IoT) has revolutionized many aspects of the world, including industrial systems, automobiles, home automation, and surveillance, to name a few. IoT has offered a multitude of conveniences for our daily lives, such as being able to control our thermostats remotely, view our home surveillance cameras while away, or have a smart television that can surf the web. However, the widespread adoption of IoT devices combined with their vast device vulnerabilities results in significant security risks reinforcing the need for more robust default security controls and public awareness. As such, this paper aims to discover and document security vulnerabilities in the Asus Zenbo Junior IoT robot, along with providing a few best practices when securing smart home devices. This work presents an experiment using several security vulnerability assessment tools such as Nmap and OpenVAS scans to assess cybersecurity vulnerability currently present on Zenbo based on the 4P forensic investigative framework. The result of the experiment shows multiple open ports were discovered, along with miscellaneous information that an attacker could use to their advantage to attack the Zenbo robot. Based on the result, this work presents various security precautions that can help users protect against cyber-attack.

Practical Fixed-Parameter Algorithms for Defending Active Directory Style Attack Graphs

Active Directory is the default security management system for Windows domain networks. We study the shortest path edge interdiction problem for defending Active Directory style attack graphs. The problem is formulated as a Stackelberg game between one defender and one attacker. The attack graph contains one destination node and multiple entry nodes. The attacker's entry node is chosen by nature. The defender chooses to block a set of edges limited by his budget. The attacker then picks the shortest unblocked attack path. The defender aims to maximize the expected shortest path length for the attacker, where the expectation is taken over entry nodes. We observe that practical Active Directory attack graphs have small maximum attack path length and are structurally close to trees. We first show that even if the maximum attack path length is a constant, the problem is still w[1]-hard with respect to the defender's budget. Having a small maximum attack path length and a small budget is not enough to design fixed-parameter algorithms. If we further assume that the number of entry nodes is small, then we derive a fixed-parameter tractable algorithm. We then propose two other fixed-parameter algorithms by exploiting the tree-like features. One is based on tree decomposition and requires a small tree width. The other assumes a small number of splitting nodes (nodes with multiple out-going edges). Finally, the last algorithm is converted into a graph convolutional neural network based heuristic, which scales to larger graphs with more splitting nodes.

A Hybrid SDN Architecture for IDS Using Bio-Inspired Optimization Techniques

Software-defined networking (SDN) is a networking paradigm of subsequent generation where various network components are used by a centralized controller that allows reliability in network system configuration, execution of policy decisions, and management via a primary programmable network infrastructure unit. SDN is known to deny DDoS attacks despite the default security protocols. State-of-the-art researches have shown that SDN intrusion is possible in diverse layers of its generalized architecture. Addressing this problem, this work presents an optimized intrusion detection system for SDN to mitigate the effect of DDoS attacks. This article’s main contribution comprises the development of a voting strategy-based ensemble classifier, which is established based on bio-inspired particle swarm optimization and salp swarm optimization in the context of optimized classification of DDoS attack-prone traffic SDN. Experimental analysis of the proposed SDN-IDS depicts that the proposed strategy outperforms existing classifiers in terms of accuracy.

NDPsec: Neighbor Discovery Protocol Security Mechanism

Internet Protocol version 6 (IPv6) is envisioned as the cornerstone for future internet connectivity and information technology (IT) expansion. Due to its enormous address pool, extendable headers, high level of security, and mobility, IPv6 is positioned as the next-generation Internet Protocol. NDP is an integral component of IPv6 since it resolves addresses, locates routers, and finds duplicated addresses in a local-link network. Because NDP is based on the premise that all nodes in the network are trustworthy, it is subject to a variety of attacks, including Denial of Service (DoS) on Duplicate Address Detection (DAD) attacks (aka. DoS-on-DAD), Address Resolution-based attacks, Router Advertisement (RA) based attacks, and Redirect attacks. This paper proposes an NDP security (NDPsec) mechanism based on the Ed25519 digital signature to authenticate IPv6 hosts to prevent unauthorized devices from joining the network. The proposed NDPsec mechanism is evaluated and compared to Secure NDP (SeND), Match-Prevention, and Trust-ND mechanisms. The performance is measured in terms of processing time, traffic overhead, and resilience against network-based attacks. The results obtained from the experiments showed that NDPsec successfully prevented cyberattacks, with approximately 144% less processing time and over 50% less traffic overhead compared to SeND (the default security mechanism for NDP protocol). The proposed NDPsec mechanism has remarkable superiority in terms of resilience against attacks compared to Match-Prevention and Trust-ND mechanisms.

Re-Evaluating the Necessity of Third-Party Antivirus Software on Windows Operating System

There is a general assumption that one must purchase costly antivirus software products to defend one’s computer system. However, if one is using the Windows Operating System, the question that arises is whether one needs to purchase antivirus software or not. The Windows operating system has a market share of 31.15% behind Android with a market share of 41.56% worldwide amongst all the operating systems. This makes Windows a prime target for hacking due to its large user base. Windows 11 a recent upgrade to the Windows operating system has claimed to have taken its security to the next level. There is a need to evaluate the capability of the Windows 11 default security against antivirus evasion tools. This research investigated the capability of Windows 11 default security by evaluating it against 6 free and open-source antivirus evasion tools: TheFatRat, Venom, Paygen, Defeat Defender, Inflate and Defender Disabler. The criteria for the selection of the antivirus evasion tools were free and open source and recently updated. A research lab was set up using Oracle VirtualBox where two guest machines were installed: a Windows 11 victim machine and the Kali Linux attacking machine. The antivirus evasion tools were installed on the Kali Linux machine one at a time to generate a malware and pass it to the victim machine. Apache web server was used in holding the malicious sample for the Windows 11 victim machine to download. A score of 2 was awarded to an antivirus evasion tool that successfully evaded the Windows 11 security and created a reverse connection with the attacking machine. From the research results: TheFatRat had a 25% evasion score, Venom had 20% while the rest had a 0% evasion score. None of the payloads generated with the antivirus evasion tools was able to create a connection with the Kali Linux attacking machine. The research results imply that the default Windows 11 security is good enough to stand on its own. A third-party antivirus solution will only supplement the already good protection capability of Windows 11.

Lightweight Algorithm for MQTT Protocol to Enhance Power Consumption in Healthcare Environment

Internet of things (IoT) is used in various fields such as smart cities, smart home, manufacturing industries, and healthcare. Its application in healthcare has many advantages and disadvantages. One of its most common protocols is Message Queue Telemetry Transport (MQTT). MQTT protocol works as a publisher/subscriber which is suitable for IoT devices with limited power. One of the drawbacks of MQTT is that it is easy to manipulate. The default security provided by MQTT during user authentication, through username and password, does not provide any type of data encryption, to ensure confidentiality or integrity. This paper focuses on the security of IoT healthcare over the MQTT protocol, through the implementation of lightweight generating and key exchange algorithms. The research contribution of this paper is twofold. The first one is to implement a lightweight generating and key exchange algorithm for MQTT protocol, with the key length of 64 bits through OMNET++ simulation. The second one is to obtain lower power consumption from some existing algorithms. Moreover, the power consumption through using the proposed algorithm is 0.78%, 1.16%, and 1.93% of power for 256 bits, 512 bits, and 1024 respectively. On the other hand, the power consumption without using the encryption is 0.25%, 0.51%, and 1.03% for the same three payloads length.

Hardware Trojan Detection based on Testability Measures in Gate Level Netlists using Machine Learning

Modern integrated circuit design manufacturing involves outsourcing intellectual property to third-party vendors to cut down on overall cost. Since there is a partial surrender of control, these third-party vendors may introduce malicious circuit commonly known as Hardware Trojan into the system in such a way that it goes undetected by the end-users’ default security measures. Therefore, to mitigate the threat of functionality change caused by the Trojan, a technique is proposed based on the testability measures in gate level netlists using Machine Learning. The proposed technique detects the presence of Trojan from the gate-level description of nodes using controllability and observability values. Various Machine Learning models are implemented to classify the nodes as Trojan infected and non-infected. The efficiency of linear discriminant analysis obtains an accuracy of 92.85 %, precision of 99.9 %, recall of 80%, and F1 score of 88.8% with a latency of around 0.9 ms.

Towards Lightweight URL-Based Phishing Detection

Nowadays, the majority of everyday computing devices, irrespective of their size and operating system, allow access to information and online services through web browsers. However, the pervasiveness of web browsing in our daily life does not come without security risks. This widespread practice of web browsing in combination with web users’ low situational awareness against cyber attacks, exposes them to a variety of threats, such as phishing, malware and profiling. Phishing attacks can compromise a target, individual or enterprise, through social interaction alone. Moreover, in the current threat landscape phishing attacks typically serve as an attack vector or initial step in a more complex campaign. To make matters worse, past work has demonstrated the inability of denylists, which are the default phishing countermeasure, to protect users from the dynamic nature of phishing URLs. In this context, our work uses supervised machine learning to block phishing attacks, based on a novel combination of features that are extracted solely from the URL. We evaluate our performance over time with a dataset which consists of active phishing attacks and compare it with Google Safe Browsing (GSB), i.e., the default security control in most popular web browsers. We find that our work outperforms GSB in all of our experiments, as well as performs well even against phishing URLs which are active one year after our model’s training.

Cybersecurity Model Based on Hardening for Secure Internet of Things Implementation

The inclusion of Internet of Things (IoT) for building smart cities, smart health, smart grids, and other smart concepts has driven data-driven decision making by managers and automation in each domain. However, the hyper-connectivity generated by IoT networks coupled with limited default security in IoT devices increases security risks that can jeopardize the operations of cities, hospitals, and organizations. Strengthening the security aspects of IoT devices prior to their use in different systems can contribute to minimize the attack surface. This study aimed to model a sequence of seven steps to minimize the attack surface by executing hardening processes. Conducted a systematic literature review using Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) techniques. In this way, we were able to define a proposed methodology to evaluate the security level of an IoT solution by means of a checklist that considers the security aspects in the three layers of the IoT architecture. A risk matrix adapted to IoT is established to evaluate the attack surface. Finally, a process of hardening and vulnerability analysis is proposed to reduce the attack surface and improve the security level of the IoT solution.

Advancements in Cyber Attacks and Security

Succeeding the entrustment of the personal computer by Ed Roberts in 1975, the absolute first virus became known to exist in a trifling time span of six years. The adversary was called Elk Cloner. Not long before they established themselves as adverse. Forthwith, attacks become frequent by the clock at all levels possible. It is a direct indication to how important cyber security is considering the prolonging effect and enormous expansion caused by such events in recent years. Another major issue is the huge scale arrangement of gadgets with almost no security or a wide default security design susceptible to cyber-attack. Cyber security is swiftly transforming into an article of everyday usage. As attacks are becoming sophisticated, we expect gadgets like advanced mobile phones, PCs and significantly progressively computerized frameworks to be secure and the protection of the data to be fundamental. Our paper explores the variety of Cyber Attacks, their methodologies and core ideas with the motivations behind it, also the ways to circumvent the threats by putting lights on the ongoing and future technologies to tackle advanced threats.

Lightweight Security Mechanism over MQTT Protocol for IoT Devices

Security is one of the main concerns with regard to the Internet of Things (IoT) networks. Since most IoT devices are restricted in resource and power consumption, it is not easy to implement robust security mechanisms. There are different methods to secure network communications; however, they are not applicable to IoT devices. In addition, most authentication methods use certificates in which signing and verifying certificates need more computation and power. The main objective of this paper is to propose a lightweight authentication and encryption mechanism for IoT constrained devices. This mechanism uses ECDHE-PSK which is the Transport Layer Security (TLS) authentication algorithm over Message Queuing Telemetry Transport (MQTT) Protocol. This authentication algorithm provides a Perfect Forward Secrecy (PFS) feature that makes an improvement in security. It is the first time that this TLS authentication algorithm is implemented and evaluated over the MQTT protocol for IoT devices. To evaluate resource consumption of the proposed security mechanism, it was compared with the default security mechanism of the MQTT protocol and the ECDHE-ECDSA that is a certificate-based authentication algorithm. They were evaluated in terms of CPU utilization, execution time, bandwidth, and power consumption. The results show that the proposed security mechanism outperforms the ECDHE-ECDSA in all tests.

Why Not Diversify into Emerging Equity Markets via ADRs?

American depositary receipts (ADRs) are typically issued by a U.S. depository bank to represent shares in non-U.S. companies. This article seeks to identify whether investing in ADR market indexes provides greater diversification benefits for U.S. investors compared with those gained from investing in foreign stock market indexes. Using data from the world’s four largest emerging markets—Brazil, Russia, India, and China (BRIC), the authors find that diversification benefits tend to vary with time and investors diversifying into the ADR market can enjoy higher rewards for the level of risk. The incremental wealth may be attributed to the default security analysis, resulting in a nonmarket premium for investors.

Secure Graphical One Time Password (GOTPass): An Empirical Study

ABSTRACTThe traditional text-based password has been the default security medium for years; however, the difficulty of memorizing secure strong passwords often leads to insecure practices. A possible alternative solution is graphical authentication, which is motivated by the fact that the capability of humans’ memory for images is superior to text, which helps to improve password usability and security. Recently, some implementations of graphical authentication techniques have been deployed in practice. This paper introduces a new hybrid graphical authentication, “GOTPass,” that authenticates by means of a one-time numerical code that needs to be typed in based on a sequence of secret images and a prechosen input format. An important focus for this paper was the security aspects of the graphical password scheme. This paper reports an in-depth analysis of the security evaluation and shows a high resistance capability of GOTPass against common graphical password attacks. Three attacks were simulated (Guessing, Intersection, and Shoulder-surfing), and the results showed that nearly 98% of the 690 attempts failed to compromise the system.

Device-independent quantum cryptography for continuous variables

We present the first device-independent quantum cryptography protocol for continuous variables. Our scheme is based on the Gottesman-Kitaev-Preskill encoding scheme whereby a qubit is embedded in the infinite-dimensional space of a quantum harmonic oscillator. The novel application of discrete-variable device-independent quantum key distribution to this encoding enables a continuous-variable analogue. Since the security of this protocol is based on discrete-variables we inherit by default security against collective attacks and, under certain memoryless assumptions, coherent attacks. We find that our protocol is valid over the same distances as its discrete-variable counterpart, except that we are able to take advantage of high efficiency commercially available detectors where, for the most part, only homodyne detection is required. This offers the potential of removing the difficulty in closing the loopholes associated with Bell inequalities.

Security literacy: the missing link in today's online society?

With the successive revolutions in personal computing, Internet access, and mobility, the last few decades have seen an unprecedented period of technological growth and accompanying information access. While most of the consequences have been positive, and in many cases truly transformational, there are also some inevitable impacts that we, as technology's beneficiaries, can generally regard as less desirable. The more widespread need to understand IT security issues is a case in point. Despite an ever-increasing reliance on IT devices and services, users can still regularly suffer from a lack of security literacy. In spite of supporting information and guidance, behaviour frequently falls short of recommended good practice. Steven Furnell and Liam Moore of Plymouth University discuss a series of key security topics with which users should be familiar. They also suggest that a faster uptake of good practices could be achieved by strengthening the default security settings on systems and devices.

Three Models to Measure Information Security Compliance

This work introduces three models to measure information security compliance. These are the cardinality model, the second’s model, which is based on vector space, and the last model is based on the priority principle. Each of these models will be presented with definitions, basic operations, and examples. All three models are based on a new theory to understand information security called the Information Security Sets Theory (ISST). The ISST is based on four basic sets: external sets, local strategy sets, local standard sets, and local implementation sets. It should be noted that two sets are used to create local standard sets—local expansion and local creation. The major differences between the Zermelo Fraenkel set theory and the ISST are the elimination of using empty element and empty set. This assumption is based on “there is not empty security” measure and the is substituted to be and is defined as “minimum security (or system default security)”. The main objective of this article is to achieve new modeling system for information security compliance. The compliance measurement is defined in the first model as the cardinality between local strategy sets and the actual local implementation. The second model is looking at the security compliance as the angle between two sets, local implementation and local standard. The third model is based on the priority philosophy for local security standard.