Vulnerabilities In Operating Systems Research Articles

Cybersecurity Challenges in Net Energy Metering: Legal Frameworks and Practical Solutions

Net Energy Metering (NEM) has emerged as a key factor in Modern Energy Management, empowering consumers to produce their own electricity and return Net Excess Generation (NEG) to the grid. However, the increased usage of NEM has introduced significant network security challenges. As millions of electronic devices are interconnected through communication networks across critical power facilities cybersecurity has become a concerning factor, directly affecting the reliability of such extensive infrastructure. This paper gives an insight into the rising cyber offences associated with NEM systems, stipulates the legal framework, e-governance, and liabilities under the Information Technology (IT) Act, 2000. Categorization of potential cyber threats like Access control, database security and encryption, intrusion detection, malicious software, operating system vulnerabilities and security, application security has been highlighted. Evaluation of Time of Day (ToD) pricing mechanism focusing on real time monitoring and energy efficiency during peak and off-peak consumption. Incorporating Virtual Private Networks (VPNs) and other cybersecurity measures to safeguard the integrity and reliability of NEM systems. The paper illustrates the impact of cybercrimes on NEM, by exploring existing applications and case studies. It underscores the necessity of implementing robust cybersecurity practices to protect these systems. The objective of the paper is to raise awareness about the cybersecurity challenges encountered in NEM systems and to propose practical solutions to mitigate these risks, ensuring a safe and regulated environment for the functioning of smart grids in a progressively growing digital world.

Horus : Accelerating Kernel Fuzzing through Efficient Host-VM Memory Access Procedures

Kernel fuzzing is an effective technique in operating system vulnerability detection. Fuzzers such as Syzkaller and Moonshine frequently pass highly structured data between fuzzer processes in guest virtual machines and manager processes in the host operating system to synchronize fuzzing-relevant data and information. Since the guest virtual machines’ and the host operating system’s memory spaces are mutually isolated, fuzzers conduct synchronization operations using mechanisms such as Remote Procedure Calls over TCP/IP networks, incurring significant overheads that negatively impact the fuzzer’s efficiency and effectiveness in increasing code coverage and finding vulnerabilities. In this paper, we propose Horus , a kernel fuzzing data transfer mechanism that mitigates the aforementioned data transfer overheads. Horus removes host-VM memory isolation and performs data transfers through copying to and from target memory locations in the guest virtual machine. Horus facilitates such efficient transfers through using fixed stub structures in the guest’s memory space, whose addresses, along with the guest’s RAM contents, are exposed to the host during the fuzzer’s initialization process. When conducting transfers, Horus passes highly-structured non-trivial data between the host and guest instances through copying the data directly to and from the stub structures, reducing the overall overhead significantly compared to that of using a network-based approach. We implemented Horus upon state-of-the-art kernel fuzzers Syzkaller , Moonshine and kAFL and evaluated its effectiveness. For Syzkaller and Moonshine , Horus increased their transfer speeds by 84.5% and 85.8% for non-trivial workloads on average and improved their fuzzing throughputs by 31.07% and 30.62%, respectively. Syzkaller and Moonshine both achieved a coverage speedup of 1.6× through using Horus . For kAFL, Horus improved specifically its Redqueen component’s execution speeds by 19.4%.

MUDROID: Android malware detection and classification based on permission and behavior for autonomous vehicles

AbstractWith the growing popularity of autonomous vehicles, ensuring their safety has become a significant concern. Vehicle manufacturers have incorporated the Android operating system to enhance user convenience. However, the Android operating system's diversity and vulnerability may significantly impact autonomous vehicles because these natures lead to a critical threat in autonomous vehicle security: Android malware. The complex nature of multi‐data sources fusion in autonomous driving systems has resulted in low detection efficiency and accuracy for Android malware. Given the security requirements for autonomous‐driving systems, this article presents an Android malware classification method centered around the multifeature fusion and deep learning architecture designed to detect and classify Android malware within autonomous‐driving systems. The proposed MUDROID framework relies on the Android permission mechanism and behavioral feature to formulate a malware classification model. Comprising four essential components—feature extraction, representation, multifeature fusion, and classifier training, MUDROID leverages the advantages of CNN and GCN combination model and is adept at extracting and interpreting multidimensional features, consequently constructing a multifeature fusion classifier to amplify the efficiency and accuracy of Android malware detection and classification. The experiment results support MUDROID's superior classification performance, with an impressive Android malware detection accuracy rate of 98.69% and family classification (95.42%). The proposed method can detect and classify Android malware effectively, thus elevating the security and robustness of the self‐driving system. Additionally, the approach in this article also addresses feature representation issues in detecting malware variants, facilitating the recognition of Android malware variants across diverse platforms.

Unveiling the Landscape of Operating System Vulnerabilities

Operating systems play a crucial role in computer systems, serving as the fundamental infrastructure that supports a wide range of applications and services. However, they are also prime targets for malicious actors seeking to exploit vulnerabilities and compromise system security. This is a crucial area that requires active research; however, OS vulnerabilities have not been actively studied in recent years. Therefore, we conduct a comprehensive analysis of OS vulnerabilities, aiming to enhance the understanding of their trends, severity, and common weaknesses. Our research methodology encompasses data preparation, sampling of vulnerable OS categories and versions, and an in-depth analysis of trends, severity levels, and types of OS vulnerabilities. We scrape the high-level data from reliable and recognized sources to generate two refined OS vulnerability datasets: one for OS categories and another for OS versions. Our study reveals the susceptibility of popular operating systems such as Windows, Windows Server, Debian Linux, and Mac OS. Specifically, Windows 10, Windows 11, Android (v11.0, v12.0, v13.0), Windows Server 2012, Debian Linux (v10.0, v11.0), Fedora 37, and HarmonyOS 2, are identified as the most vulnerable OS versions in recent years (2021–2022). Notably, these vulnerabilities exhibit a high severity, with maximum CVSS scores falling into the 7–8 and 9–10 range. Common vulnerability types, including CWE-119, CWE-20, CWE-200, and CWE-787, are prevalent in these OSs and require specific attention from OS vendors. The findings on trends, severity, and types of OS vulnerabilities from this research will serve as a valuable resource for vendors, security professionals, and end-users, empowering them to enhance OS security measures, prioritize vulnerability management efforts, and make informed decisions to mitigate risks associated with these vulnerabilities.

ЗАХИСТ НЕСТРУКТУРОВАНОЇ ІНФОРМАЦІЇ НА МОБІЛЬНОМУ ПРИСТРОЮ

Information technology (IT) and computer systems are becoming an integral part of modern man's life, irreplaceable assistants. The development of IT happens at lightning speed and has a great impact on our society, every day we could observe new technical and engineering inventions. Moreover, it can be both a certain integration into the work process - automation of the daily routine, and part of leisure - communication and entertainment, etc. The entire complex of technologies and systems improve and facilitate the performance of everyday tasks, open new opportunities and remove borders. It is difficult to imagine a modern person without a mobile phone or tablet, which has almost continuous and unlimited access to the Internet or the worldwide global network. Today, a mobile device has a certain sacred meaning, it can contain a lot of different information or data. The nature and importance of this information may vary, but protection is a priority. And considering the developed dynamics and the uncertainty of some processes, engineers and developers face a difficult and important task to protect information systems and ensure reliable operation. To some extent, the mobile device can be considered the most problematic component. This device has a few advantages and features - this is exactly what makes it vulnerable to potential attackers and user actions can cause a few problems. This article is devoted to the problems of using mobile devices and protecting unstructured information. Protecting unstructured information on a mobile device is an important task from a cybersecurity perspective. Unstructured information can be in the form of text documents, emails, photos, videos, voice recordings, and other content stored on mobile devices. The main problems include loss or theft of a mobile device; operating system and software vulnerabilities; insufficient level of encryption and insufficient level of complexity of passwords; neglect of cyber hygiene. Existing engineering and architectural solutions do not always fulfill the task and may have problems with integration. Do not forget about the economic component. The analysis of the application area and the research results indicate that information protection in general is important and there is a demand for quick and effective solutions regarding the security of information systems in general and mobile devices. Only an integrated approach can provide an effective solution. The future of protecting unstructured information on mobile devices will be based on a combination of technological innovations and increased user awareness of cybersecurity issues. Some areas of development include the use of artificial intelligence (AI) and machine learning: AI can help develop advanced defense mechanisms that automatically detect anomalous or suspicious activity and block potential threats; biometric authentication, improvements in biometric authentication technologies, such as facial recognition, fingerprints, can provide more reliable protection of unstructured information; application of blockchain technologies: blockchain can play an important role in ensuring information security, as it allows data to be stored distributed and protected from changes; development of quantum-resistant encryption algorithms: with the development of quantum computers, there is a need for new encryption algorithms that can withstand the power of quantum hacking; privacy by design (Privacy by Design): designing mobile devices and applications with user privacy in mind will help protect unstructured information on mobile devices; user education and awareness: increasing users' awareness of cyber security and teaching them effective methods of protecting information on mobile devices will help reduce the risk of security incidents; development of the legislation and regulatory framework, improvement of the legislation and regulatory framework in the field of cyber security will contribute to the creation of a reliable environment for the protection of unstructured information. Securing unstructured information on mobile devices will rely on a combination of technological advances, user education, and collaboration between various parties such as developers, service providers, and lawmakers. Ensuring data security and privacy in the digital world remains a priority as the number of mobile devices and their use continues to grow. The modern user of mobile devices has certain requirements related to ergonomics and the level of information awareness. The development of the industry requires fast, reliable, and effective solutions that fall not only in the economic plane, but also in the plane of cyber security. The use of mobile devices can adapt to the fast-paced modern security needs of an organization and can be easily configured to meet specific requirements. A mobile device is convenient and affordable for many users, it is usually close to the user and can be used as an additional security element.

Tourism industry resilience issues in urban areas during COVID-19

PurposeCOVID-19 impacts different groups and subsectors of tourism unevenly, with massive vulnerabilities in tourism operating systems among urban tourism areas. Different types of COVID-19 related crises depend on isolation or returning to “normal” in various urban areas. Boosting domestic tourism activities to spark resilience before international demand returns is essential to stimulating local demand worldwide. This paper aims to build upon a non-exhaustive review of the scientific literature about tourism resilience issues to see the bigger picture of tourism resilience on three levels worldwide.Design/methodology/approachThis research applies a content analysis technique to collect research data from the latest scientific papers on tourism resilience issues. This study will use searching and filtering on the Scopus web database and based on the VOSviewer algorithm to identify useful insights and determine a framework for tourism resilience issues on three levels.FindingsThe outcome of three aspects of resilience, which mainly relate to the development of tourism industry sectors (transportation, accommodation, food and beverage) and other industries (research and education) connected to urban tourism resilience, could be useful for future researchers to explore less-studied issues and policymakers’ future application.Research limitations/implicationsThe research data are mostly from literature reviews of papers that may not interpret all contemporary resilience issues and the research data are based on urban areas alone.Originality/valueThe research idea is fresh and adds new knowledge to professionals’ or policymakers’ future applications.

Access Android Device Using The FatRat and Metasploit

At present, smartphones are widely used for both business and personal purposes. As we all know that android is the popular mobile operating system. Like Windows operating system vulnerability the android has also vulnerability. And on the basis of these vulnerabilities, an attacker can obtain a user’s privacy data. But one possible way to avoid accessing of system and network i.e. penetration testing
 This paper describes penetration testing, Kali Linux tools such as Metasploit and TheFatRat. These tools have proved to be effective in Android exploitation. For example, by using TheFatRat, create a payload using msfvenom. Furthermore, the Payload creates a backdoor to access the system, using Metasploit, which exploits the android device and finds the vulnerability and, according to vulnerability, access the victim's system.

The Presence, Trends, and Causes of Security Vulnerabilities in Operating Systems of IoT's Low-End Devices.

Internet of Things Operating Systems (IoT OSs) run, manage and control IoT devices. Therefore, it is important to secure the source code for IoT OSs, especially if they are deployed on devices used for human care and safety. In this paper, we report the results of our investigations of the security status and the presence of security vulnerabilities in the source code of the most popular open source IoT OSs. Through this research, three Static Analysis Tools (Cppcheck, Flawfinder and RATS) were used to examine the code of sixteen different releases of four different C/C++ IoT OSs, with 48 examinations, regarding the presence of vulnerabilities from the Common Weakness Enumeration (CWE). The examination reveals that IoT OS code still suffers from errors that lead to security vulnerabilities and increase the opportunity of security breaches. The total number of errors in IoT OSs is increasing from version to the next, while error density, i.e., errors per 1K of physical Source Lines of Code (SLOC) is decreasing chronologically for all IoT Oss, with few exceptions. The most prevalent vulnerabilities in IoT OS source code were CWE-561, CWE-398 and CWE-563 according to Cppcheck, (CWE-119!/CWE-120), CWE-120 and CWE-126 according to Flawfinder, and CWE-119, CWE-120 and CWE-134 according to RATS. Additionally, the CodeScene tool was used to investigate the development of the evolutionary properties of IoT OSs and the relationship between them and the presence of IoT OS vulnerabilities. CodeScene reveals strong positive correlation between the total number of security errors within IoT OSs and SLOC, as well as strong negative correlation between the total number of security errors and Code Health. CodeScene also indicates strong positive correlation between security error density (errors per 1K SLOC) and the presence of hotspots (frequency of code changes and code complexity), as well as strong negative correlation between security error density and the Qualitative Team Experience, which is a measure of the experience of the IoT OS developers.

About the cybersecurity of automated process control systems

Recently, the number of hacker attacks on industrial production facilities has increased significantly. That growth is associated with the rapid development of information technologies for the control systems. The increase in the number of incidents has led to the emergence of cybersecurity – a new field of scientific and technical research that deals with the industrial companies security issues. Several widely discussed incidents are related to cybersecurity. For example, the STUXNET worm has infected Siemens industrial systems and inflicted heavy losses for the Iranian nuclear program. That worm made use of operating system vulnerabilities and the «human factor». The STUXNET worm has been also served as the basis for a number of modified viruses that have been used to successfully attack on various industrial networks. As Siemens is one of the world’s key manufacturers of industrial equipment, the STUXNET has become widespread. Currently, many publications discuss STUXNET from different points of view. Researchers dealing with this problem often overlook the important fact that the existing standard communication protocols, interaction interfaces and embedded algorithms are in most cases unreliable and are not able to provide the proper level of security, but they focus on the vulnerabilities of intrusion detection and prevention systems. With the increasing number of cyber attacks and their expansion, it is necessary to develop secure communication channels and devices to implement the concept of safe industrial manufacturing. This paper analyzes modern process control systems from the point of view of information security.

Modeling Web Security Analysis Attacks with CySeMoL Tool

The utilize of the web has made humans and companies powerless to exterior assaults. Indeed, cyber problems essentially influence information frameworks with distinctive types of malicious attacks such as spyware, virus, social engineering, etc. The Internet e-mail service, in particular, has become one of the most dependable methods of communication among people, institutions, and companies. The development of digital signatures to e-mail services has raised the e-mail security, which led to replacing the standard mailing of registered letters. Unfortunately, the process of sending and receiving e-mails has created a negative impact means on security and privacy from cybercriminals by diffusing spam and malware. As a result, e-mail hosts are constantly under attack by malicious programs that are often attached to e-mails. In this paper, the simulation model and prototype of an email traffic monitor developed and tested in order to prove the ability of our proposed method for detecting new viruses. This paper states the success possibility of this new method based on the simulation results. The results of the analysis suggest that the Cyber Security Modeling Language (CySeMoL) model has a good performance of operating system vulnerability prediction. At last, some useful suggestions in the context of the CySeMoL model are presented.

Additional kernel observer: privilege escalation attack prevention mechanism focusing on system call privilege changes

Cyberattacks, especially attacks that exploit operating system vulnerabilities, have been increasing in recent years. In particular, if administrator privileges are acquired by an attacker through a privilege escalation attack, the attacker can operate the entire system and cause serious damage. In this paper, we propose an additional kernel observer (AKO) that prevents privilege escalation attacks that exploit operating system vulnerabilities. We focus on the fact that a process privilege can be changed only by specific system calls. AKO monitors privilege information changes during system call processing. If AKO detects a privilege change after system call processing, whereby the invoked system call does not originally change the process privilege, AKO regards the change as a privilege escalation attack and applies countermeasures against it. AKO can therefore prevent privilege escalation attacks. Introducing the proposed method in advance can prevent this type of attack by changing any process privilege that was not originally changed in a system call, regardless of the vulnerability type. In this paper, we describe the design and implementation of AKO for Linux x86 64-bit. Moreover, we show that AKO can be expanded to prevent the falsification of various data in the kernel space. Then, we present an expansion example that prevents the invalidation of Security-Enhanced Linux. Finally, our evaluation results show that AKO is effective against privilege escalation attacks, while maintaining low overhead.

CLOSURE: A cloud scientific workflow scheduling algorithm based on attack–defense game model

The multi-tenant coexistence service mode makes the cloud-based scientific workflow encounter the risks of being intruded. For this problem, we propose a CLoud scientific wOrkflow SchedUling algoRithm based on attack–defensE game model (CLOSURE). In the algorithm, attacks based on different operating system vulnerabilities are regarded as different “attack” strategies; and different operating system distributions in a virtual machine cluster executing the workflows are regarded as different “defense” strategies. The information of the attacker and defender is not balanced. In other words, the defender cannot obtain the information about the attacker’s strategies, while the attacker can acquire information about the defender’s strategies through a network scan. Therefore, we propose to dynamically switch the defense strategies during the workflow execution, which can weaken the network scan effects and transform the workflow security problem into an attack–defense game problem. Then, the probability distribution of the optimal mixed defense strategies can be achieved by calculating the Nash Equilibrium in the attack–defense game model. Based on this probability, diverse VMs are provisioned for workflow execution. Furthermore, a task-VM mapping algorithm based on dynamic Heterogeneous Earliest Finish Time (HEFT) is presented to accelerate the defense strategy switching and improve workflow efficiency. The experiments are conducted on both simulation and actual environment, experimental results demonstrate that compared with other algorithms, the proposed algorithm can reduce the attacker’s benefits by around 15.23%, and decrease the time costs of the algorithm by around 7.86%.

An Android-based Trojan Spyware to Study the NotificationListener Service Vulnerability

Security attacks continue to emerge on daily basis due to the fast growth in the number of smart devices and mobile applications. Attacks take different malware forms such as Spyware and Trojan exploiting different operating system vulnerabilities, specially the well known vulnerable operating system; Android OS. In this paper, we study the malicious use of the “NotificationListener” service in Android 4.3 and 5.0. A Trojan application, known as SMS backup, is developed to spy the notifications of other applications. Such an application requires only two permissions that include “Notification Access” and “Internet”. These permissions are used to extract and send user's messages of other applications to the attacker's email through Internet. Our malware is able to alter and/or delete the notification before being displayed. For experimental results, the malware was tested against notifications of WhatsApp, BBM, SMS, and Facebook messenger using different Android versions including Lollipop 5.0. Experiments show that our malware succeeded against all the tested applications running Android version 4.3. Moreover, BBM and SMS messages are still extractable in the newer version of Android (Lollipop 5.0).

From botnets to MobiBots: a novel malicious communication paradigm for mobile botnets

Cyber security is moving from traditional infrastructure to sophisticated mobile infrastructureless threats. A major concern is that such imminent transition is happening at a rate far exceeding the evolution of security solutions. In fact, the transformation of mobile devices into highly capable computing platforms makes the possibility of security attacks originating from within the mobile network a reality. Today, mobile devices are capable of initiating sophisticated cyberattacks, especially when they coordinate together to form what we call a MobiBot. MobiBots differ from classical botnets in that they exploit mobile operating system vulnerabilities and the advantages of device-to-device communication to mask malicious code propagation.

The Endpoint Application Execution Control Scheme based on the Whitelist

Under the situation that existing information protection systems adopt an approach that tackles malicious codes based on already known signatures or analyzed behavior/feature, they are limited in detecting and identifying the unknown and the deformation of the malicious code. The present study, as a means of overcoming such a shortcoming, proposes a way of endpoint application control capable of more securely protecting endpoint devices (PCs) from intrusion of malicious codes and attacks through exploitation of an application or operating system vulnerability, by implementing a hybrid of technology such as whitelist-based application execution control via authentication of integrity, media access control, prevention of modification of important files, and control over IP/port attempting for process access or reverse link.

Quantitative Risk Assessment in Major Smartphone Operating Systems in Asian Countries

Since smartphones are utilized in the ranges from personal usages to governmental data exchanges, known but not patched vulnerabilities in smartphone operating systems are considered as major threats to the public. To minimize potential security breaches on smartphones, it is necessary to estimate possible security threats. So far, there have been numerous studies conducted to evaluate the security risks caused by mobile devices qualitatively, but there are few quantitative manners. For a large scale risk evaluation, a qualitative assessment is a never ending task. In this paper, we try to calculate relative risk levels tiggered by software vulnerabiliters from unsecured smartphone operating systems (Android and iOS) among 51 Asian countries. The proposed method combines widely accepted risk representation in both theory and industrial fields. When policy makers need to make a strategic decision on mobile security related agendas, they might find the presented approach useful.

Технология разработки прикладных многоагентных систем в инструментальной среде MASDK

The paper reviews the state-of-the-art of perspective research directions in the field of computer networks security fulfilled on basis of the International Workshop «Mathematical models, methods and architectures for computer networks security» (MMM-ACNS-2005), which took place from September, 25th till September, 27th 2005 in Saint-Petersburg. The common information on the workshop is presented, the invited and sectional reports of leading scientists in the field of information security in such perspective research directions as models, architectures and protocols for information security, authentication, authorization and access control, informational flow analysis, covert channels, security policy and operating system security, vulnerability assessment, network forensics and intrusion detection are described.

Research on Vulnerability Identification and Quantitative Evaluation of Operating System

As the most basic and core part of an information system, operating system is the basis of all software running. All kinds of computer operating system existing this or that kind of potential safety problems, become information system is not the root cause of security. This paper introduces the operating system vulnerability found that way, common vulnerability analysis technology and its development present situation, and the most widely used in the current Windows operating system, such as reference level protection of relevant national standards, lists the operating system of the common vulnerability checkpoint, etc. Finally, this paper provides an operating system vulnerability quantitative assignment reference method.

Graph based signature classes for detecting polymorphic worms via content analysis

Malicious softwares such as trojans, viruses, or worms can cause serious damage for information systems by exploiting operating system and application software vulnerabilities. Worms constitute a significant proportion of overall malicious software and infect a large number of systems in very short periods. Polymorphic worms combine polymorphism techniques with self-replicating and fast-spreading characteristics of worms. Each copy of a polymorphic worm has a different pattern so it is not effective to use simple signature matching techniques. In this work, we propose a graph based classification framework of content based polymorphic worm signatures. This framework aims to guide researchers to propose new polymorphic worm signature schemes. We also propose a new polymorphic worm signature scheme, Conjunction of Combinational Motifs (CCM), based on the defined framework. CCM utilizes common substrings of polymorphic worm copies and also the relation between those substrings through dependency analysis. CCM is resilient to new versions of a polymorphic worm. CCM also automatically generates signatures for new versions of a polymorphic worm, triggered by partial signature matches. Experimental results support that CCM has good flow evaluation time performance with low false positives and low false negatives.

Code hacking: a developer's guide to network security

Networking basics tools of the trade authentication, authorization, encryption, non-repudiation hacking the web applications, hacks and vulnerabilities firewalls operating system vulnerabilities passive defense technologies wireless LANS.