Hardware Vulnerabilities Research Articles

Application of Artificial Intelligence to Network Forensics: Survey, Challenges and Future Directions

Network forensics focuses on the identification and investigation of internal and external network attacks, the reverse engineering of network protocols, and the uninstrumented investigation of networked devices. It lies at the intersection of digital forensics, incident response and network security. Network attacks exploit software and hardware vulnerabilities and communication protocols. The scope of a network forensic investigation can range from Internet-wide down to a single device’s network traffic. Network analysis tools (NATs) aid security professionals and law enforcement in the capturing, identification and analysis of network traffic. However, in most instances, the sheer volume of data to be analyzed is enormous and, despite some built-in NAT automation, the investigation of network traffic is often an arduous process. Furthermore, significant expert time remains wasted in the investigation of a high frequency of false positive alerting from automated systems. To address this globally impacting problem, artificial intelligence based approaches are becoming increasingly employed to automatically detect attacks and increase network traffic classification accuracy. This paper provides a comprehensive survey of the state-of-the-art in network forensics and the application of expert systems, machine learning, deep learning, and ensemble/hybrid approaches to a range of application areas in the field. These include network traffic analysis, intrusion detection systems, Internet-of-Things devices, cloud forensics, DNS tunneling, smart grid forensics, and vehicle forensics. In addition, the current challenges and future research directions for each of the aforementioned application areas is discussed.

Hardware-Assisted Security Monitoring Unit for Real-Time Ensuring Secure Instruction Execution and Data Processing in Embedded Systems.

The hardware security of embedded systems is raising more and more concerns in numerous safety-critical applications, such as in the automotive, aerospace, avionic, and railway systems. Embedded systems are gaining popularity in these safety-sensitive sectors with high performance, low power, and great reliability, which are ideal control platforms for executing instruction operation and data processing. However, modern embedded systems are still exposing many potential hardware vulnerabilities to malicious attacks, including software-level and hardware-level attacks; these can cause program execution failure and confidential data leakage. For this reason, this paper presents a novel embedded system by integrating a hardware-assisted security monitoring unit (SMU), for achieving a reinforced system-on-chip (SoC) on ensuring program execution and data processing security. This architecture design was implemented and evaluated on a Xilinx Virtex-5 FPGA development board. Based on the evaluation of the SMU hardware implementation in terms of performance overhead, security capability, and resource consumption, the experimental results indicate that the SMU does not lead to a significant speed degradation to processor while executing different benchmarks, and its average performance overhead reduces to 2.18% on typical 8-KB I/D-Caches. Security capability evaluation confirms the monitoring effectiveness of SMU against both instruction and data tampering attacks. Meanwhile, the SoC satisfies a good balance between high-security and resource overhead.

Meltdown-type attacks are still feasible in the wall of kernel page-Table isolation

Meltdown released in 2018 is a hardware vulnerability primarily affecting Intel modern processors. It allows a rogue process to read the kernel data in CPU L1D cache. To defend against the Meltdown attack in legacy processors, the most effective software-only mitigation approach is to unmap kernel memory from user processes, known as kernel page-table isolation (KPTI).In this paper, we present a novel Meltdown-type attack, named KPTImew, that can defeat KPTI in Linux and reliably dump all the target data in the kernel address space. We observe that there still exists kernel memory mapped in a user process, indicating that the mapped memory content can still be leaked through the Meltdown attack. However, the Meltdown attack is limited to leaking data that must be resident in CPU L1D cache. To lift the limitation, we propose a new technique, called reDump, as a part of our contribution. reDump exploits speculative execution to load data in the mapped memory into L1D cache and thus reliably dump the data using the Meltdown attack. To further leak data from the whole kernel including the above mapped memory, KPTImew first establishes data dependency between the mapped memory and any target kernel memory, and then exploits the data dependency to bring certain mapped kernel data into L1D cache that is dependent on targeted kernel data. When the mapped kernel data is leaked, the targeted kernel data can be leaked through the data-dependency.We modify an open-source tool, called smatch, to find such gadgets in recent kernels (i.e., 4.17.3 and 5.8.7) for loading the kernel mapped data into L1D cache and establishing the data-dependency, respectively. Specifically, dozens of potential gadgets are found in default kernel compile configuration while hundreds of gadget candidates are available for all-yes compile configuration. Our experiments show that reDump leaks 32 B of the mapped data within 6 seconds on average. With the assistance of reDump, KPTImew leaks any 32 B of kernel data within 12 seconds on average. In comparison, KPTImew can also work independently and requires 218 seconds on average to leak 32 B without reDump.

162 Regional Emergency Department Census Impacts During a Cyber Attack

Modern emergency department (ED) care is critically dependent on computerized systems such as medical devices, electronic health records, and imaging systems. Many clinical systems have software and hardware vulnerabilities that can be exploited by malicious computer hackers. Cyber-attacks including ransomware on healthcare delivery organizations (HDO) are increasing in severity and frequency, impacting both individual hospitals and the broader regional healthcare delivery ecosystem. The effects of healthcare cyber-attacks on neighboring HDOs has yet to be reported in the literature. The purpose of this study is to report the impact on fully functioning hospital EDs during an active cyber-attack on a neighboring HDO. We performed a retrospective analysis of the daily combined census of two large urban academic EDs in San Diego, CA for the first week of a ransomware cyber-attack on a nearby multi-hospital HDO (May 2nd - 8th 2021). We then compared the mean to the 5-year historical census (2016-2020), matched by week (ex. first full week in May 2020 etc.) A one-way analysis of variance (ANOVA) and Tukey test were used to compare census years. The matched mean combined daily ED census for years 2016 - 2020 (no cyber-attack) were: 2016 – 221 (SD 12), 2017 – 211 (SD 21), 2018 – 174 (SD 30), 2019 – 229 (SD 29), and 2020 – 179 (SD17). For 2021 (week of the cyber-attack) the mean was 281 (SD 37). There was a statistically significant higher census during the cyber attack when compared to the 5 years prior (Table 1). Cyber attacks on hospitals can have significantly detrimental effects on patient care due to the loss of critical digital systems. This study demonstrated an associated “spill over” effect of significantly higher ED census numbers at facilities in proximity to HDOs under active cyber-attack.

A Comprehensive Survey of Attacks without Physical Access Targeting Hardware Vulnerabilities in IoT/IIoT Devices, and Their Detection Mechanisms

With the advances in the field of the Internet of Things (IoT) and Industrial IoT (IIoT), these devices are increasingly used in daily life or industry. To reduce costs related to the time required to develop these devices, security features are usually not considered. This situation creates a major security concern. Many solutions have been proposed to protect IoT/IIoT against various attacks, most of which are based on attacks involving physical access. However, a new class of attacks has emerged targeting hardware vulnerabilities in the micro-architecture that do not require physical access. We present attacks based on micro-architectural hardware vulnerabilities and the side effects they produce in the system. In addition, we present security mechanisms that can be implemented to address some of these attacks. Most of the security mechanisms target a small set of attack vectors or a single specific attack vector. As many attack vectors exist, solutions must be found to protect against a wide variety of threats. This survey aims to inform designers about the side effects related to attacks and detection mechanisms that have been described in the literature. For this purpose, we present two tables listing and classifying the side effects and detection mechanisms based on the given criteria.

REVIEW ON IOT BASED THREATS, VULNERABILITIES & CHALLENGES OF INCIDENT RESPONSE USING EMBEDDED SYSTEM FOR SENSOR NODES

The Internet of Things (IoT) is the technology innovation of the century and will forever impact how future generations communicate, work, and handle personal day-to-day tasks. IoT devices streamline processes and often automate everyday household tasks. Despite all the hype and added benefits to their uses, they continue to be the spotlight of recent breaches, privacy concerns, and security vulnerabilities and incidents. The purpose of this study is to shed light on the current threat landscape as it relates to the Internet of Things (IoT) while addressing the reasons why IoT devices are prime targets for attack.Additionally, the study examines the challenges of network defenders, incident responders, and forensic examiners face when investigating incidents.The study found IoT devices are plagued by many software and hardware vulnerabilities, most of which are examined and researched heavily by the Open Web Application Security Project (OWASP). Solutions include providing education to consumers on the risks and mitigations associated some of the more common vulnerabilities. Device manufacturers have a role to play in securing devices before they are released to the general market. Solutions to the challenges faced by Incident Responders and Computer Forensics examiners includes preparation before the incident or crime occurs. Proposed solutions include creating investigative and analytical procedures applying specifically to the Internet of Things. Including understanding their internal makeup, where data is stored, and to whom data is transferred. Answering each of these questions provides potential sources of evidence used to paint an overall picture of the root cause of incidents and events.

Silicon Based Security for Protection Against Hardware Vulnerabilities

Silicon based embedded devices are susceptible to hardware attacks viz.: side channel attacks and fault injection attacks. Fault injection attack is an emerging field affecting security concerns related to semiconductor industry. An adversary by manipulating hardware vulnerabilities of silicon devices can easily get access to secret information not intended for it. Semiconductor industry needs a solution which is based on detection and mitigation of fault injection attacks since this category of hardware attack proves to be more dangerous due to its trait of easy conduction and less expertise needed for performing such attacks. Detection of attacks is one of the important factors to be considered for hardware engineer to mitigate a number of largest challenges and complexities associated with hardware attacks. Existing detection techniques are complex and require post si calibration which proves to be less efficient system. Also fewer techniques are available which detects both types of voltage fault injection attacks (positive /negative). To address these drawbacks this paper presents novel voltage fault injection detection technique which is based on op-amp circuits and designed using cadence 180nm technology node. Simulated results show detection of both types of voltage fault injection attack viz.: positive and negative. Further efficiency of detector circuit is tested by changing parameters like TW, TF and TP known as glitch width, glitch frequency and glitch period respectively.

Research on System Data Security Under Network Technology

Today’s society is a digital society, all data can be stored digitally, which leads to the explosion of data growth. However, the security storage of cloud data is the primary problem that restricts the development of cloud storage. Malicious hackers, software and hardware vulnerabilities and so on will pose a serious threat to users’ data stored in the cloud. This paper combines the typical big data system technical framework and builds the big data security technical framework around the security requirements of big data. Under this framework, the research status of key technologies of big data security is systematically summarized from multiple aspects, including the main security mechanisms involved in the technical framework of big data system. Finally, the core problems and development trends of big data security technology to be solved are summarized.

HYBRID DEEP NEURAL NETWORK ANOMALY DETECTION SYSTEM FOR SCADA NETWORKS

SCADA systems are more and more targeted by cyber-attacks because of many vulnerabilities inhardware, software, protocols and the communication stack. Those systems nowadays use standard hardware, software, operating systems and protocols. Furthermore, SCADA systems which used to be air-gaped are now interconnected to corporate networks and to the Internet, widening the attack surface.In this thesis, we are using a deep learning approach to propose an efficient hybrid deep neural network for anomaly detection in SCADA systems. The salient features of SCADA data are automatically and unsupervisingly learnt, and then fed to a supervised classifier in order to dertermine if those data are normal or abnormal, i.e if there is a cyber-attack or not. Afterwards, as a response to the challenge caused by high training time of deep learning models, we proposed a distributed approach of our anomaly detection system in order lo lessen the training time of our model.

An Overview of Hardware Security and Trust: Threats, Countermeasures, and Design Tools

Hardware security and trust have become a pressing issue during the last two decades due to the globalization of the semiconductor supply chain and ubiquitous network connection of computing devices. Computing hardware is now an attractive attack surface for launching powerful cross-layer security attacks, allowing attackers to infer secret information, hijack control flow, compromise system root-of-trust, steal intellectual property (IP), and fool machine learners. On the other hand, security practitioners have been making tremendous efforts in developing protection techniques and design tools to detect hardware vulnerabilities and fortify hardware design against various known hardware attacks. This article presents an overview of hardware security and trust from the perspectives of threats, countermeasures, and design tools. By introducing the most recent advances in hardware security research and developments, we aim to motivate hardware designers and electronic design automation tool developers to consider the new challenges and opportunities of incorporating an additional dimension of security into robust hardware design, testing, and verification.

Efficient Security Solutions for IoT Devices

The Internet of Things (IoT) is a technological innovation that has revolutionized society. The IoT will forever change the way we use simple things that do very little things to smart, fully capable things. IoT devices can process and automate everyday household and workplace tasks through simple sensors. Yet despite the benefits of these devices, they are vulnerable to violations such as privacy issues and security breaches. This paper aims to provide a clearer understanding of the IoT and current threats to it by explaining why IoT devices are susceptible to attack. Moreover, the technologies used in the IoT are examined, as well as the different communication layers of the IoT and their functioning. The findings reveal that IoT devices are prone to many software and hardware vulnerabilities, not to mention the challenges that come with IoT. Solutions to these challenges are proposed, notably through the use of anomaly-based intrusion detection systems, which are critical components of network security. Using machine learning (ML) to detect potential attacks is recommended. Many proposed anomaly-based detection systems use different ML algorithms and techniques. However, there is no standard benchmark to compare these in terms of power consumption. A benchmark that measures both accuracy and power consumption to calculate and evaluate each algorithm’s implementation is proposed.

On the design of secure primitives for real world applications

This editorial paper provides an overview of new advances on hardware security challenges and promising solutions for real world applications. It first presents the increasing hardware vulnerabilities with the emergence of diverse computing platforms. Then, it details the technical challenges, research opportunities, and potential solutions to cyber-attacks on -physical- devices.

Guest Editors' Introduction to the Special Issue on Hardware Security

The twelve papers in this special section focus on hardware security. This topic is becoming a significant challenge in modern computing systems. Recently discovered hardware vulnerabilities, such as Spectre and Meltdown, are striking evidence that today’s computing systems are untenable without deliberate consideration of the security aspects at the design time. The papers address various topics related to hardware security: secure-by-design architectures, secure speculative execution, secure system integration of untrusted chiplets, malware detection, program analysis using power side channels, architecture support for forensics, and efficient implementations of security modules.

An adaptive defense mechanism to prevent advanced persistent threats

The expansion of information technology infrastructure is encountered with Advanced Persistent Threats (APTs), which can launch data destruction, disclosure, modification, and/or Denial of Service attacks by drawing upon vulnerabilities of software and hardware. Moving Target Defense (MTD) is a promising risk mitigation technique that replies to APTs via implementing randomisation and dynamic strategies on compromised assets. However, some MTD techniques adopt the blind random mutation, which causes greater performance overhead and worse defense utility. In this paper, we formulate the cyber-attack and defense as a dynamic partially observable Markov process based on dynamic Bayesian inference. Then we develop an Inference-Based Adaptive Attack Tolerance (IBAAT) system , which includes two stages. In the first stage, a forward–backward algorithm with a time window is employed to perform a security risk assessment. To select the defense strategy, in the second stage, the attack and defense process is modelled as a two-player general-sum Markov game and the optimal defense strategy is acquired by quantitative analysis based on the first stage. The evaluation shows that the proposed algorithm has about 10% security utility improvement compared to the state-of-the-art.

Combined software and hardware fault injection vulnerability detection

Fault injection is a well-known method to test the robustness and security vulnerabilities of software. Software-based and hardware-based approaches have been used to detect fault injection vulnerabilities. Software-based approaches typically rely upon simulations that can provide broad and rapid coverage, but may not correlate with genuine hardware vulnerabilities. Hardware-based experiments are indisputable in their results, but rely upon expensive expert knowledge and manual testing yielding ad hoc and extremely limited results. Further, there is very limited connection between software-based simulation results and hardware-based experiments. This work bridges software-based and hardware-based fault injection vulnerability detection by contrasting results of both approaches. This demonstrates that: not all software-based vulnerabilities can be reproduced in hardware; prior conjectures on the fault model for electromagnetic pulse attacks may not be accurate; and that there is a co-relation between software-based and hardware-based approaches. Further, combining both approaches can yield a vastly more accurate and efficient approach to detecting genuine fault injection vulnerabilities.

MeltdownDetector: A runtime approach for detecting meltdown attacks

In this work, we present a runtime approach, called MeltdownDetector, for detecting, isolating, and preventing ongoing Meltdown attacks that operate by causing segmentation faults. Meltdown exploits a hardware vulnerability that allows a malicious process to access memory locations, which do not belong to the process, including the physical and kernel memory. The proposed approach is based on a simple observation that in order for a Meltdown attack to be worthwhile, either a single byte of data located at a particular memory address or a sequence of consecutive memory addresses (i.e., sequence of bytes) need to be read, so that a meaningful piece of information can be extracted from the data leaked. MeltdownDetector, therefore, monitors segmentation faults occurring at memory addresses that are close to each other and issues a warning at runtime when these faults become “suspicious.” Furthermore, MeltdownDetector flushes the cache hierarchy after every suspicious segmentation fault, which, in turn, prevents any information leakage. In the experiments, MeltdownDetector successfully detected all the attacks and correctly pinpointed all the malicious processes involved in these attacks and did so without issuing any false alarms and without leaking even a single byte of data. Furthermore, the runtime overhead of the fastest MeltdownDetector implementation was about 1%, on average.

Cyber Attack and Defense Emulation Agents

As the scale of the system and network grows, IT infrastructure becomes more complex and hard to be managed. Many organizations have a serious problem to manage their system and network security. In addition, vulnerabilities of hardware and software are increasing in number rapidly. In such a complex IT environment, security administrators need more practical and automated threat assessment methods to reduce their manual tasks. Adversary emulation based automated assessment is one of the solutions to solve the aforementioned problems because it helps to discover the attack paths and vulnerabilities to be exploited. However, it is still inefficient to perform the adversary emulation because adversary emulation requires well-designed attack scenarios created by security experts. Besides, a manual-based penetration test cannot be frequently performed. To overcome this limitation, we propose an adversary emulation framework composed of the red team and blue team agent. The red team agent carries out automated attacks based on the automatically generated scenarios by the proposed framework. The blue team agent deploys defense measures to react to the red team agent’s attack patterns. To test our framework, we test multiple attack scenarios on remote servers that have various vulnerable software. In the experiment, we show the red team agent can gain an administrator’s privilege from the remote side when the blue team agent’s intervention is not enabled. The blue team agent can successfully block the red team’s incoming attack when enabled. As a result, we show our proposed framework is beneficial to support routine threat assessment from the adversary’s perspective. It will be useful for security administrators to make security defense strategy based on the test results.

РЕЗИЛЬЄНТНІСТЬ КОМП’ЮТЕРНИХ СИСТЕМ В УМОВАХ КІБЕРЗАГРОЗ: ТАКСОНОМІЯ ТА ОНТОЛОГІЯ

The rapid development of information technology has expanded the capabilities of cyberthreads regarding computer systems. Cybercriminals are developing new ways to avoid attack detection, so existing approaches are not able to withstand the growing threat of attacks. Meanwhile, the consequences of cyberattacks are becoming more dangerous and destructive. One of the approaches to solve the problem is the construction of resilient systems that are able to quickly recover and continue to function under attack conditions. The subject of research is the construction process of the resilient computer systems in the face of cyber threats. The goal is to develop a taxonomy and ontology of resilient computer systems under cyberthreats. Results. The article presents the definitions of the resilience from the point of view of cybersecurity, presents the gap between the concepts of resilience and dependability. The paper presents the main elements of the taxonomic scheme of computer system resilience, which include threats (changes in the environment and requirements, network attacks, attacks on software, software and hardware vulnerabilities, errors, failures), information and technical conditions that computer system passes during its operating cycle, the principles on which resilience is based (proactivity, adaptability, resistance, diversity, elasticity, controlled degradation, defense in depth, ability to evolvability), as well as primary and secondary properties. Based on the above elements, a generalized taxonomic scheme of resilience related to information security has been developed. The work presents the operational cycle of a resilient CS as a set of information and technical states that the system goes through (preparation, system protection, threat detection, threat absorption, response to a threat, system recovery after a cyberattack, adaptation.) An ontology scheme of the resilience from the point of view of information security of computer systems in the presence of cyberthreats is developed. Conclusions A taxonomy and ontology of resilient computer systems in the presence of cyberthreats has been developed.

International Biobanking Interface Service – A Concept for Health Sciences in the Digital Age

Cyber security has become an increasingly important topic in recent years. The increasing popularity of systems and devices such as computers, servers, smartphones, tablets and smart home devices is causing a rapidly increasing attack surface. In addition, there are a variety of security vulnerabilities in software and hardware that make the security situation more complex and unclear. Many of these systems and devices also process personal or secret data and control critical processes in the industry. The need for security is tremendously high. The owners and administrators of modern computer systems are often overwhelmed with the task of securing their systems as the systems become more complex and the attack methods increasingly intelligent. In these days a there are a lot of encryption and hiding techniques available. They are used to make the detection of malicious software with signature based scanning methods very difficult. Therefore, novel methods for the detection of such threats are necessary. This paper examines whether cyber threats can be detected using modern artificial intelligence methods. We develop, describe and test a prototype for windows systems based on neural networks. In particular, an anomaly detection based on autoencoders is used. As this approach has shown, it is possible to detect a wide range of threats using artificial intelligence. Based on the approach in this work, this research topic should be continued to be investigated. Especially cloud-based solutions based on this principle seem to be very promising to protect against modern threats in the world of cyber security.

Meet the Sherlock Holmes’ of Side Channel Leakage: A Survey of Cache SCA Detection Techniques

Cache Side Channel Attacks (SCAs) have gained a lot of attention in the recent past. Since, these attacks exploit the caching hardware vulnerabilities, they are fast and dangerous. Detection of cache side channel attacks is an important step towards mitigating against such hostile entities. Researchers have already proposed different techniques to detect cache side channel attacks. This paper provides a detailed survey of literature related to the state-of-the-art detection techniques for cache based side channel attacks. We identify a set of important characteristics that can be used to characterize a CSCA (cache side channel attack) detection technique. We use the identified features to compare and contrast the most important detection techniques and provide the important observations. We also identify some of the challenges that the research community will have to resolve in future to improve the efficiency of cache side channel detection techniques. To the best of our knowledge, this is the first work to do such a study. We believe that this paper will prove useful to researchers in the area of systems security.