Open Source Security Research Articles

AI-Enabled OSSEC Framework for Power Sector

In the dynamic realm of cybersecurity, where the sophistication of threats continues to escalate, the integration of AI-driven technologies into Security Operations Centers (SOC) presents a groundbreaking paradigm shift. This paper introduces an AI-enabled OSSEC (Open Source SECurity), which amalgamates advanced linguistic capabilities with the foundational core of Security Operations Centers. Traditional security setups often grapple with the overwhelming influx of data logs, hindering their ability to discern crucial patterns and respond effectively to potential threats. The AI-driven OSSEC addresses this challenge by harnessing natural language processing prowess to efficiently analyze and interpret diverse logs. This innovation not only streamlines the monitoring process but also empowers the system to identify nuanced anomalies that might evade conventional detection mechanisms. Furthermore, the AI-enabled OSSEC doesn't confine itself to analysis alone; it proactively provides actionable insights and strategies for mitigating identified risks. This proactive approach ensures organizations not only detect potential threats but also respond promptly with well-informed measures. Embracing this technology fortifies cybersecurity posture, enabling Security Operations Centers to navigate the complexities of the digital landscape with unparalleled agility and precision. This convergence of linguistic intelligence with cybersecurity operations signifies a monumental advancement in building a more resilient and responsive defense against the continuously evolving cyber threat landscape within the power sector.

Web Application Penetration Testing on Udayana University's OASE E-learning Platform Using Information System Security Assessment Framework (ISSAF) and Open Source Security Testing Methodology Manual (OSSTMM)

Education is a field that utilizes information technology to support academic and operational activities. One of the technologies widely used in the education sector is web-based applications. Web-based technologies are vulnerable to exploitation by attackers, which highlights the importance of ensuring strong security measures in web-based systems. As an educational organization, Udayana University utilizes a web-based application called OASE. OASE, being a web-based system, requires thorough security verification. Penetration testing is conducted to assess the security of OASE. This testing can be performed using the ISSAF and OSSTMM frameworks. The penetration testing based on the ISSAF framework consists of 9 steps, while the OSSTMM framework consists of 7 steps for assessment. The results of the OASE penetration testing revealed several system vulnerabilities. Throughout the ISSAF phases, only 4 vulnerabilities and 3 information-level vulnerabilities were identified in the final testing results of OASE. Recommendations for addressing these vulnerabilities are provided as follows. Implement a Web Application Firewall (WAF) to reduce the risk of common web attacks in the OASE web application. input and output validation to prevent the injection of malicious scripts addressing the stored XSS vulnerability. Update the server software regularly and directory permission checks to eliminate unnecessary information files and prevent unauthorized access. Configure a content security policy on the web server to ensure mitigation and prevent potential exploitation by attackers.

Implementation of Security Information & Event Management (SIEM) Wazuh with Active Response and Telegram Notification for Mitigating Brute Force Attacks on The GT-I2TI USAKTI Information System

In an era of widespread information system usage across various sectors, digital threats to organizations have become increasingly significant. These threats have the potential to disrupt operations and result in substantial financial losses. One enduring threat is brute force attacks, which exploit human tendencies to use easily remembered passwords. By utilizing The Security Lifecycle Methodology, this research aims to identify an efficient and cost-effective solution to enhance information system security and continuously evaluate the implemented solution rather than stop right after the policy or solution implementation. The study proposes the utilization of the open-source Security Information and Event Management (SIEM) platform, Wazuh. When combined with the Active Response feature, this platform not only detects security threats but also automatically takes mitigating actions against detected attacks. Additionally, the integration with the Telegram messaging application streamlines the SIEM monitoring process, making it more practical and efficient. After implementation, the testing phase confirms the effectiveness of the implemented solution as the Wazuh SIEM is able to detect 100% of brute force testing scenarios in multi- protocol attacks with an average of 80,51 seconds time required to detect brute force attacks with a 1-second interval between attack, 172,18 seconds for 10-seconds attack interval, and 434,58 seconds for 30-seconds attack interval. The active response can mitigate 100% of the detected brute force attack with only 0,51 seconds time required between detection and mitigation action taken. The implemented telegram integration successfully sends all the notifications on time to Telegram Chat by utilizing Telegram API.

Building Cyber-Resilient Smart Grids with Digital Twins and Data Spaces

The rapid expansion of digital twin technology has revolutionized management and testing across various sectors, particularly in safeguarding critical infrastructure like smart grids. Aligned with the NIS2 Directive, Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, digital twins play a critical role in bolstering cybersecurity measures by enabling advanced simulation and real-time monitoring, key aspects emphasized in the directive for enhancing the security of networks and information systems. Concurrently, Europe’s shift towards communal data spaces amplifies the need for robust cyber defences. This paper aims to bolster cybersecurity defences in critical infrastructure, with a particular focus on the energy sector and smart grids. It proposes an innovative architecture for cybersecurity monitoring, converting a Common Information Model-compliant system into a digital twin via the FIWARE platform and incorporating an open-source Security Information and Event Management solution. Validated by a real-world case study, our approach demonstrates significant advancements in protecting smart grids against cyber threats.

SecureLog: Open-Source Security Information and Event Management (SIEM) Solution for Enhanced Threat Detection and Incident Response

Purpose of the study: As organizations face increasingly sophisticated and persistent cyber threats, the need for robust Security Information and Event Management (SIEM) solutions becomes paramount. This paper presents "SecureLog," an open-source SIEM solution designed to enhance threat detection and incident response capabilities.
 Methodology: This paper explores the architecture and components of SecureLog, detailing its data collection and log management capabilities. It examines the threat detection algorithms employed, emphasizing real-time event correlation and alerting mechanisms. The paper addresses the scalability and performance considerations associated with deploying SecureLog in large-scale environments.
 Main Findings: The findings highlight the benefits of using fuzzy logic in cyber threat intelligence and pave the way for further research and development in this promising field. The future prospects and challenges of integrating fuzzy logic with other advanced technologies such as machine learning and artificial intelligence.
 Applications of this study: SecureLog emerges as a valuable open-source SIEM solution, empowering organizations with enhanced threat detection and incident response capabilities. With its feature-rich architecture and active community support, SecureLog proves to be a reliable choice for organizations seeking to fortify their cybersecurity defences.
 Novelty/Originality of this study: The paper also includes practical use cases and case studies to demonstrate the effectiveness of SecureLog in enhancing threat detection and incident response. Security and compliance considerations, including data privacy and regulatory compliance, are examined, along with recommendations for securing the SecureLog deployment.

SecTKG: A Knowledge Graph for Open-Source Security Tools

As the complexity of cyberattacks continues to increase, multistage combination attacks have become the primary method of attack. Attackers plan and organize a series of attack steps, using various attack tools to achieve specific goals. Extracting knowledge about these tools is of great significance for both defense and tracing of attacks. We have noticed that there is a wealth of security tool-related knowledge within the open-source community, but research in this area is limited. It is challenging to achieve large-scale automated security tool information extraction. To address this, we propose automated knowledge graph construction architecture, named SecTKG, for open-source security tools. Our approach involves designing a security tool ontology model to describe tools, users, and relationships, which guides the extraction of security tool knowledge. In addition, we develop advanced entity recognition and classification methods, ensuring efficient and accurate knowledge extraction. As far as we know, this work is the first to construct the large-scale security tool knowledge graph, containing 4 million entities and 10 million relationships. Furthermore, we investigate the tendencies and particularities of security tools based on the SecTKG and developed a security tool influence-measuring application. The research fills a gap in the field of automated security tools’ knowledge extraction and provides a foundation for future research and practical applications.

Addressing the Dilemma of a “Crisis within a crisis”: Exploring the Penetration Testing challenges in a Mobile Field Hospital Setting

This paper focuses on evaluating the security challenges faced by mobile field hospitals, which play a crucial role in emergency response and disaster management in remote and austere environments. The authors conducted a penetration test using the Open Source Security Testing Methodology Manual (OSSTMM) framework to assess the security posture of a mobile field hospital. The methodology employed in the study included a combination of automated and manual techniques such as network scanning, vulnerability assessments, social engineering, and exploitation. The penetration test revealed several security vulnerabilities in the mobile field hospital, including weak passwords, unpatched software, and inadequate network segmentation. Additionally, the study identified vulnerabilities in the hospital's medical devices and equipment, posing a risk of cyber-attacks that could disrupt operations and compromise patient safety. The results underscore the importance of implementing enhanced security measures in mobile field hospitals to mitigate cyber threats and ensure the uninterrupted functioning of medical operations during emergencies and disasters. This study provides a comprehensive analysis of the mobile field hospital's security posture using the OSSTMM framework and emphasizes the urgent need for improved security practices in such settings. Keywords: Cybersecurity, Healthcare, Penetration Testing, Mobile Field Hospitals, Data, Emergency Response, Open Source, Security Testing, Ethical Hacking, Security Frameworks, Proceedings Citation Format Ahmed, N.B., Daclin, N., Olivaux, M. & 4usserre, G. (2023): Addressing the Dilemma of a “Crisis within a crisis”: Exploring the Penetration Testing challenges in a Mobile Field Hospital Setting. Proceedings of the Cyber Secure Nigeria Conference. Nigerian Army Resource Centre (NARC) Abuja, Nigeria. 11-12th July, 2023. Pp 67-80 https://www.csean.org.ng/. dx.doi.org/10.22624/AIMS/CSEAN-SMART2023P9

Full-stack vulnerability analysis of the cloud-native platform

Cloud-native systems have recently emerged as one of the most popular platforms for application development, providing lightweight virtualization, simplified DevOps procedures, scaling, resource efficiency, monitoring, and more. The typical cloud-native system may include containers, container orchestrators, and service meshes. However, a number of attacks exploit vulnerabilities in different components, leading the attacker to gain control over the cloud-native system. In this paper, we collect, classify, exploit, and mitigate vulnerabilities of different components. Firstly, we choose Docker, Kubernetes, and Istio as the most popular cloud technologies and give each an overview. Secondly, we give an in-depth analysis of the vulnerabilities. We collect cloud-native vulnerabilities over the past five years and propose two classifications of those vulnerabilities. One is based on the architecture of the component, and the other is based on the attack enabled. We exploit vulnerabilities that enable us to discover some insightful findings and provide mitigation solutions. Third, we analyze 15 open-source security tools provided for the cloud-native environment. We argue that among all these security tools, none of them covers all features which we will discuss in this paper. We believe that our analysis of cloud security vulnerabilities and open-source security tools can benefit the security of the cloud-native ecosystem.

Важная веха в безопасности открытого программного обеспечения

Важная веха в безопасности открытого программного обеспечения

A Theory of Open Source Security: The Spillover of Security Knowledge in Vulnerability Disclosures Through Software Supply Chains

A Theory of Open Source Security: The Spillover of Security Knowledge in Vulnerability Disclosures Through Software Supply Chains

SYNFI: Pre-Silicon Fault Analysis of an Open-Source Secure Element

Fault attacks are active, physical attacks that an adversary can leverage to alter the control-flow of embedded devices to gain access to sensitive information or bypass protection mechanisms. Due to the severity of these attacks, manufacturers deploy hardware-based fault defenses into security-critical systems, such as secure elements. The development of these countermeasures is a challenging task due to the complex interplay of circuit components and because contemporary design automation tools tend to optimize inserted structures away, thereby defeating their purpose. Hence, it is critical that such countermeasures are rigorously verified post-synthesis. Since classical functional verification techniques fall short of assessing the effectiveness of countermeasures (due to the circuit being analyzed when no faults are present), developers have to resort to methods capable of injecting faults in a simulation testbench or into a physical chip sample. However, developing test sequences to inject faults in simulation is an error-prone task and performing fault attacks on a chip requires specialized equipment and is incredibly time-consuming. Moreover, identifying the fault-vulnerable circuit is hard in both approaches, and fixing potential design flaws post-silicon is usually infeasible since that would require another tape-out. To that end, this paper introduces SYNFI, a formal pre-silicon fault verification framework that operates on synthesized netlists. SYNFI can be used to analyze the general effect of faults on the input-output relationship in a circuit and its fault countermeasures, and thus enables hardware designers to assess and verify the effectiveness of embedded countermeasures in a systematic and semi-automatic way. The framework automatically extracts sensitive parts of the circuit, induces faults into the extracted subcircuit, and analyzes the faults’ effects using formal methods. To demonstrate that SYNFI is capable of handling unmodified, industry-grade netlists synthesized with commercial and open tools, we analyze OpenTitan, the first opensource secure element. In our analysis, we identified critical security weaknesses in the unprotected AES block, developed targeted countermeasures, reassessed their security, and contributed these countermeasures back to the OpenTitan project. For other fault-hardened IP, such as the life cycle controller, we used SYNFI to confirm that existing countermeasures provide adequate protection.

AKER: An open-source security platform integrating IDS and SIEM functions with encrypted traffic analytic capability

ABSTRACT This research proposes Aker, an open-source security platform that integrates IDS and SIEM functions while supporting the automated investigation of threats hidden in encrypted traffic. Aker is based on open-source technologies, whose aim is to simplify and integrate network monitoring and security alerts management through coherent and interconnected dashboards. Aker enables the detection of malware concealed in encrypted traffic and uses a heuristic-based decision-tree model to classify these threats into different severity levels, based on seven specific criteria and indicators originating mainly from TLS handshake unencrypted metadata, and HTTP/ DNS contextual flows linked to the encrypted traffic. Our approach does not require deep packet inspection nor intensive traffic analysis, but rather relies on the analysis of a reduced set of network telemetry indicators and session descriptors. Aker permits to automate data collection and investigation while providing user-friendly dedicated dashboards to provide SOC analysts and threat intelligence experts with valuable decision support tools. We present the design and implementation aspects of the proposed platform along with some validation results.

OSSDIP: Open Source Secure Data Infrastructure and Processes Supporting Data Visiting

Meeting the conflicting goals of protecting and maintaining control over sensitive data while also allowing access by third parties constitutes a significant challenge. Secure data infrastructures support data visiting in a highly controlled and monitored environment which, if properly set-up and operated, provide high security guarantees through a combination of technical, legal and procedural mechanisms. To ease the process of deploying such a secure data infrastructure, we present a detailed documentation of the architecture and processes of such an infrastructure and provide a pre-configured reference implementation based entirely on open source software that can be flexibly configured to meet differing security requirements and deployment scenarios. We combine mechanisms for data visiting on secured infrastructure components with optional components of data anonymization and fingerprinting, covered by extensive logging and monitoring functions and embedded in defined processes and contractual frameworks. The set-up is based upon the experience of operating such a secure infrastructure in the medical domain for almost ten years, addressing the emerging need to make such a solution available to a larger set of stakeholders. We show that our system significantly enhances data visiting, offers a higher level of data isolation and present our open source reference implementation thereof.

Performance Evaluation of Open-Source Endpoint Detection and Response Combining Google Rapid Response and Osquery for Threat Detection

Detecting the latest advanced persistent threats (APTs) using conventional information protection systems is a challenging task. Although various systems have been employed to detect such attacks, they are limited by their respective operating systems. Furthermore, they are developed as closed platforms and cannot be customized to meet user environments. To overcome these limitations, open-source endpoint detection and response (EDR) techniques are needed. In this study, we construct one that integrates open-source security frameworks combining GRR (Google Rapid Response) and osquery. A threat-detecting case study is conducted to validate the feasibility of the proposed open-source EDR system. Additionally, APT coverage for the proposed EDR system is analyzed using MITRE’s Adversarial Tactics, Techniques, and Common Knowledge model. The assessment result shows that APT tactics having high levels of threat detection using non-customized osquery configurations comprise 28.5 % of all detections, which is lower than the other response levels. The performance of open-source EDR can be increased by customizing osquery for specific purposes and environments. Open-source EDR combining GRR and osquery has the potential to provide the detection-coverage efficient threat detection system and has the advantage of flexible integration with other applications; it can also be developed for evolving system environments such as cloud and internet of things.

Security and Trust in Open Source Security Tokens

Using passwords for authentication has been proven vulnerable in countless security incidents. Hardware security tokens effectively prevent most password-related security issues and improve security indisputably. However, we would like to highlight that there are new threats from attackers with physical access which need to be discussed. Supply chain adversaries may manipulate devices on a large scale and install backdoors before they even reach end users. In evil maid scenarios, specific devices may even be attacked while already in use. Hence, we thoroughly investigate the security and trustworthiness of seven commercially available open source security tokens, including devices from the two market leaders: SoloKeys and Nitrokey. Unfortunately, we identify and practically verify significant vulnerabilities in all seven examined tokens. Some of them are based on severe, previously undiscovered, vulnerabilities of two major microcontrollers which are used at a large scale in various products. Our findings clearly emphasize the significant threat from supply chain and evil maid scenarios since the attacks are practical and only require moderate attacker efforts. Fortunately, we are able to describe software-based countermeasures as effective improvements to retrofit the examined devices. To improve the security and trustworthiness of future security tokens, we also derive important general design recommendations.

Evaluation indicators for open-source software: a review

In recent years, the widespread applications of open-source software (OSS) have brought great convenience for software developers. However, it is always facing unavoidable security risks, such as open-source code defects and security vulnerabilities. To find out the OSS risks in time, we carry out an empirical study to identify the indicators for evaluating the OSS. To achieve a comprehensive understanding of the OSS assessment, we collect 56 papers from prestigious academic venues (such as IEEE Xplore, ACM Digital Library, DBLP, and Google Scholar) in the past 21 years. During the process of the investigation, we first identify the main concerns for selecting OSS and distill five types of commonly used indicators to assess OSS. We then conduct a comparative analysis to discuss how these indicators are used in each surveyed study and their differences. Moreover, we further undertake a correlation analysis between these indicators and uncover 13 confirmed conclusions and four cases with controversy occurring in these studies. Finally, we discuss several possible applications of these conclusions, which are insightful for the research on OSS and software supply chain.

Improvement of Software-Defined Network Performance Using Queueing Theory: A Survey

Software-Defined Networking (SDN) is a growing network technology that has brought significant benefits to a wide range of disciplines, from science to technology to various fields. This structure can be used in network-based environments, data centers and various research sites. OpenFlow is one of the most widely used protocols for interaction between a controller and a switch in a Software-Defined Networking. Understanding the performance and limitations of the network defined by open source software, including bottlenecks and security vulnerabilities due to the centralized network structure, are important prerequisites for the efficient deployment of these systems. These points of view led researchers to examine various related mathematical models to address these issues. Queueing theory provides the most important and accurate model for evaluating the performance of the SDN networks affected by these restrictions, which has attracted the attention of researchers recently. Regarding to extensive mathematical modeling, this theory has also been used to improve network efficiency. Researchers have used this theory to investigate operational power and improve time consumption and control of data planes due to the nature of classification and storage of packets in SDN buffers. These methods overcome controller performance bottlenecks and increase SDN control capacity, especially for large distributed networks. In this paper, we examine the queueing models for different applications in different layers of SDN, in which researchers use these methods to monitor network loads, evaluate and predict performance changes due to diversity in network traffic. We introduce and review a collection of articles that explore, different applications of Queueing theory in SDN networks. In addition, in order to increase the efficiency of this research, detailed comparisons are performed in terms of structure, mathematical models and the final simulation results.

Cobot attack: a security assessment exemplified by a specific collaborative robot

The market for cyber-physical systems, such as collaborative robots (cobots), continues to grow fast. Primarily, this is driven by megatrends, such as smart factories, which include interconnected machines and human-robot interaction. On the one hand, these new technologies lead to flexible manufacturing and a higher level of automation. On the other hand, however, it drives the demand for the safety and security of the systems, as the potential of harm to human beings is increased in such collaborative scenarios. Therefore, in the case of a cobot, increased awareness of cyber security aspects and their relations to the system’s safety is advisable. In this paper, a security assessment for the Franka Emika Panda has been performed. For this specific c obot, potential a ttack s urfaces and t heir possible i mpacts on s afety-relevant parameters a re a nalyzed. Furthermore, the defined attack surfaces of Panda are tested in a systematic penetration test based on the Open Source Security Testing Methodology (OSSTM) and the OWASP testing guide. Different vulnerabilities are found, of which some could have a safety impact on the human worker. Finally, for each of the findings, countermeasures are provided to prevent a possible cyber-attack.

Editorial for special issue on security, trust, and privacy in internet of things: Challenges and solutions

Editorial for special issue on security, trust, and privacy in internet of things: Challenges and solutions

Підходи до побудови моделі загроз для аналізу безпеки відкритого програмного кода

Гарантування безпеки програмного продукту з відкритим вихідним кодом є актуальною проблемою, бо навіть у проектах з закритим вихідним кодом можуть бути присутні open source бібліотеки, що робить можливим появу вразливості у них. Серед методів, що використовують для виявлення вразливостей, варто виділити моделювання загроз, бо цей метод дозволяє вже на ранніх етапах розробки програмного коду прийняти заходи, що знизять витрати на ліквідацію вразливостей та спростять їх усунення і зміни до архітектури додатку. Підбір відповідного підходу при побудові моделі загроз залежить від специфіки проекту, ресурсів, а також кваліфікації адміністраторів.