Redirection Attack Research Articles

SecChecker: Inspecting the security implementation of 5G Commercial Off-The-Shelf (COTS) mobile devices

Although 5G security has been further improved with the evolution of the standard, it remains to be checked whether 5G cellular devices (i.e., User Equipment or UE) have correctly implemented the designed security features following the specification. In this work, we present SecChecker, a security inspection system, to examine the security implementation of 5G devices. Firstly, to determine which security items to check, we extract 11 general Security Requirements (SRs) for 5G UEs after a comprehensive study of the 3GPP standard. Then we design corresponding Inspection Cases (ICs) for testing the UE implementation of these SRs. We implemented a prototype of SecChecker based on open-source 5G projects and utilized it to inspect 7 Commercial Off-The-Shelf (COTS) devices using 5G baseband chips from the top five vendors. The results indicate that most of the required key security features in the specification are securely implemented by the tested 5G devices. However, we also found several UE security implementations that do not meet the extracted SRs or that are vulnerable to exploits, as well as some protocol mismatches. To show the implications on mobile users using the affected 5G devices, we implement two proof-of-concept attacks including the 5G redirection attack and the 5G user plane Man-in-the-Middle attack, to exploit the identified security flaws. Finally, the mitigations are discussed.

Detection of Internet‐wide traffic redirection attacks using machine learning techniques

AbstractInternet‐wide traffic redirection attacks have been reported for long, and are mainly caused by Border Gateway Protocol route hijacking. Such attacks can be quite harmful, impairing access to popular Internet sites for long periods. This work addresses the use of machine learning techniques (both unsupervised and supervised) leveraging from a distributed monitoring infrastructure of probes that measure the round trip time to Internet sites under surveillance. The detection process is separated into two stages: per‐probe classification and a combination of individual probe decisions. Our results show that the best strategy is to classify using an unsupervised technique based on Tukey's method and to combine using Hidden Markov Models, due to its performance and adaptability to different attack types.

Theoretical derivation of interval principal component analysis

Principal Component Analysis is a well-known method that can be used for dimensionality reduction, a useful technique in the Big Data era. There have been a series of proposed adaptations of the Principal Component Analysis method for interval-valued symbolic data, all of which have the downside of having intermediate steps that deal with conventional data. In this work, we put forward an interval Principal Component Analysis that only deals with symbolic data by developing a theoretical framework that allows for the definition of symbolic principal components. This framework provides the mathematical tools needed to use the symbolic principal components to transform the original data in a way that is mathematically coherent with the remainder of the framework and defines the principal components as solutions to maximisation problems, similarly to what is done in conventional Principal Component Analysis. After the theoretical foundations are laid down, we explore real-world data from the telecommunications sector, in an attempt to detect Internet redirection attacks in real-time. In particular, we use our symbolic method to improve and simplify an anomaly detection method that has been proposed in the literature for conventional data.

Prevalence of Poisoned Google Search Results of Erectile Dysfunction Medications Redirecting to Illegal Internet Pharmacies: Data Analysis Study.

Illegal online pharmacies function as affiliate networks, in which search engine results pages (SERPs) are poisoned by several links redirecting site visitors to unlicensed drug distribution pages upon clicking on the link of a legitimate, yet irrelevant domain. This unfair online marketing practice is commonly referred to as search redirection attack, a most frequently used technique in the online illegal pharmaceutical marketplace. This study is meant to describe the mechanism of search redirection attacks in Google search results in relation to erectile dysfunction medications in European countries and also to determine the local and global scales of this problem. The search engine query results regarding 4 erectile dysfunction medications were documented using Google. The search expressions were "active ingredient" and "buy" in the language of 12 European countries, including Hungary. The final destination website legitimacy was checked at LegitScript, and the estimated number of monthly unique visitors was obtained from SEMrush traffic analytics. Compromised links leading to international illegal medicinal product vendors via redirection were analyzed using Gephi graph visualization software. Compromised links redirecting to active online pharmacies were present in search query results of all evaluated countries. The prevalence was highest in Spain (62/160, 38.8%), Hungary (52/160, 32.5%), Italy (46/160, 28.8%), and France (37/160, 23.1%), whereas the lowest was in Finland (12/160, 7.5%), Croatia (10/160, 6.3%), and Bulgaria (2/160, 1.3%), as per data recorded in November 2020. A decrease in the number of compromised sites linking visitors to illegitimate medicine sellers was observed in the Hungarian data set between 2019 and 2021, from 41% (33/80) to 5% (4/80), respectively. Out of 1920 search results in the international sample, 380 (19.79%) search query results were compromised, with the majority (n=342, 90%) of links redirecting individuals to 73 international illegal medicinal product vendors. Most of these illegal online pharmacies (41/73, 56%) received only 1 or 2 compromised links, whereas the top 3 domains with the highest in-degree link value received more than one-third of all incoming links. Traffic analysis of 35 pharmacy specific domains, accessible via compromised links in search engine queries, showed a total of 473,118 unique visitors in November 2020. Although the number of compromised links in SERPs has shown a decreasing tendency in Hungary, an analysis of the European search query data set points to the global significance of search engine poisoning. Our research illustrates that search engine poisoning is a constant threat, as illegitimate affiliate networks continue to flourish while uncoordinated interventions by authorities and individual stakeholders remain insufficient. Ultimately, without a dedicated and comprehensive effort on the part of search engine providers for effectively monitoring and moderating SERPs, they may never be entirely free of compromised links leading to illegal online pharmacy networks.

Use chains to block DNS attacks: A trusty blockchain-based domain name system

The Internet has become one of the most important technologies in the world, and hackers use various methods to launch cyber attacks to profit from it. Phishing is one of famous social engineering attacks, it is often used to steal user data, including login credentials and credit card numbers. Although the Transport Layer Security certificate is used to verify the trust of websites, there are still a series of vulnerabilities. The demand for trusted IP addresses has led a lot of research, including IP whitelisting, DNS filtering and so on. However, these technologies still have many shortcomings. In view of this, we proposed a novel mechanism for verifying websites using blockchain technology. The URL and IP address of a permissioned website are recorded in blockchain through a specific smart contract. A DNS query is executed through a smart contract designed to avoid URL redirection attacks. With the help of immutable nature of blockchian, phishing websites can be detected. The mechanism will not add any load to users and provides tamper-proof functions based on the characteristics of blockchain. The comparison of related works shows that the proposed mechanism is more secure. We also provided a reference implementation of the proposed mechanism on Ethereum Quorum simulation platform, which proves the effectiveness and practicability of the mechanism.

URL Redirection Attack Mitigation in Social Communication Platform using Data Imbalance Aware Machine Learning Algorithm

Objectives: To present a model which can detect malicious attacks using the URL of the Social Communication Platform using the data imbalance machine learning algorithm. The main objective is to detect the attack and prevent it from happening. Methods: This study presents an efficient feature extraction and selection method addressing feature imbalance problems; and also presents an improved concept drift and machine learning-based classification. This paper extracts the URL of the undesired tweets, identifies them, and filters them for classification. Findings: The experiments have been conducted using the drifted twitter spam dataset. Our model DIA-XGBoost extracts the URL of the undesired tweets, identifies them, and filters them for classification. Further, the attack pattern varies with respect to time. Furthermore, the results show that our DIA-XGBoost attains higher accuracy performance by 1.254%, URL recall performance by 0.14%, and increased Fmeasure performance by 10% when compared with the existing ML techniques (Random Forest, K-Nearest Neighbour, XGBoost). Thus, the existing ML-based classification model achieves poor classification accuracy whereas our model solves this issue. Novelty: Various Machine Learning (ML) techniques have been applied for the classification of URL redirection attacks. However, the spam data generally exhibit feature imbalance. Further, the attack pattern varies with respect to time. Thus, the existing ML-based classification model achieves poor classification accuracy. Hence, our model solves the issue using the DIA-XGBoost algorithm, detects and prevents URL malicious attacks. Keywords: Data Imbalance; Feature Extraction; Concept Drift; URL; Machine Learning; URL Redirection Attack

Security Analysis of Shadowsocks(R) Protocol

Shadowsocks(R) is a proxy software based on Socks5, which is the collective name of shadowsocks and shadowsocksR. Shadowsocks(R) is a private protocol without a handshake negotiation mechanism. Peng broke the confidentiality of shadowsocks by exploiting vulnerability in the shadowsocks protocol and decrypted the shadowsocks packets encrypted with none-AEAD encryption options using a redirection attack. Chen et al. started with the cryptographic algorithm used by shadowsocks(R) and preliminarily discussed the confidentiality of user data under the protection of shadowsocks(R) in theory. Based on Chen’s work, this paper further clarifies the shadowsocks(R) protocol format and studies the encryption mechanism of shadowsocks(R) from the perspective of protocol analysis. The vulnerability of the shadowsocks(R) encryption mechanism is found, and an attack method of shadowsocks(R) is proposed. The attack method is a passive attack and can decrypt the shadowsocks packets encrypted with any encryption option. Compared with Peng’s attack method, the method is more effective and more suitable for actual attacks. Finally, some methods to improve the protocol security of shadowsocks(R) are proposed.

NDPsec: Neighbor Discovery Protocol Security Mechanism

Internet Protocol version 6 (IPv6) is envisioned as the cornerstone for future internet connectivity and information technology (IT) expansion. Due to its enormous address pool, extendable headers, high level of security, and mobility, IPv6 is positioned as the next-generation Internet Protocol. NDP is an integral component of IPv6 since it resolves addresses, locates routers, and finds duplicated addresses in a local-link network. Because NDP is based on the premise that all nodes in the network are trustworthy, it is subject to a variety of attacks, including Denial of Service (DoS) on Duplicate Address Detection (DAD) attacks (aka. DoS-on-DAD), Address Resolution-based attacks, Router Advertisement (RA) based attacks, and Redirect attacks. This paper proposes an NDP security (NDPsec) mechanism based on the Ed25519 digital signature to authenticate IPv6 hosts to prevent unauthorized devices from joining the network. The proposed NDPsec mechanism is evaluated and compared to Secure NDP (SeND), Match-Prevention, and Trust-ND mechanisms. The performance is measured in terms of processing time, traffic overhead, and resilience against network-based attacks. The results obtained from the experiments showed that NDPsec successfully prevented cyberattacks, with approximately 144% less processing time and over 50% less traffic overhead compared to SeND (the default security mechanism for NDP protocol). The proposed NDPsec mechanism has remarkable superiority in terms of resilience against attacks compared to Match-Prevention and Trust-ND mechanisms.

FUZZY DEFINITION FOR TASKS AND RESOURCES CATEGORIZATION IN SOFTWARE PROJECTS

WSN is one of the modern networks that use technologies and applications in public places. It consists of hundreds and thousands of tiny sensor nodes scattered in the network and has limited scope and range resources connected to the base stations. The specifications of these nodes are low cost and low energy and used for monitoring purposes. Since the sensors are small and many, it is easy to attack these networks. Therefore, there will be many potential attacks on the network of sensors, and among these attacks are jamming, sinkhole, eavesdropping, and other attacks. The sinkhole attack is the most attack that works to destroy paths by announcing the update of the fake routing related to it; the attack occurs through the compromised node (the malicious node) So that it announces a file containing the routing information and works to attract the rest of the nodes to do this routing the data towards it and then operating the sphere of influence. One of the effects of this attack is to reduce the overall network performance, and it can also be used to make another attack, such as a selective redirection attack and a spoofing attack. This paper aims to analyze and detect sinkhole attacks in wireless sensor networks.

WIRELESS SENSOR NETWORK PERFORMANCE ANALYSIS UNDER SINKHOLE ATTACKS

WSN is one of the modern networks that use technologies and applications in public places. It consists of hundreds and thousands of tiny sensor nodes scattered in the network and has limited scope and range resources connected to the base stations. The specifications of these nodes are low cost and low energy and used for monitoring purposes. Since the sensors are small and many, it is easy to attack these networks. Therefore, there will be many potential attacks on the network of sensors, and among these attacks are jamming, sinkhole, eavesdropping, and other attacks. The sinkhole attack is the most attack that works to destroy paths by announcing the update of the fake routing related to it; the attack occurs through the compromised node (the malicious node) So that it announces a file containing the routing information and works to attract the rest of the nodes to do this routing the data towards it and then operating the sphere of influence. One of the effects of this attack is to reduce the overall network performance, and it can also be used to make another attack, such as a selective redirection attack and a spoofing attack. This paper aims to analyze and detect sinkhole attacks in wireless sensor networks.

Cascading attack on trusted-relay quantum key distribution networks

Trusted relays are the main state-of-the-art way to realize quantum key distribution networks. However, it is hard to require that all nodes in the network are fully trusted. In a multipath key-transmission mechanism, the nodes can be weakly trusted because the secret key can be split into many parts and each part is transmitted to the receiver through a different path. However, if the capacity of a node’s quantum key pool is poorly designed, an attacker, Eve may eavesdrop on the communicating parties’ secret message by initiating a redirection attack. In this paper, we show that Eve can trigger a cascading collapse effect by collapsing one of the edges in the network and forcing the communication parties to transmit the message through the nodes controlled by Eve. The influence of the traffic transfer ratio and the control parameters of the edge load on the breakdown probability of the edge are analyzed using a simulation. In order to effectively defend against the cascading attack, it is important for the designer to handle the relationship between the traffic and the capacity of the quantum key pool of each node in the network.

Probabilistic Hardware Trojan Attacks on Multiple Layers of Reconfigurable Network Infrastructure

Over the past decades, there has been an exponential growth in the number of connected devices, often without well-thought out security mechanisms in place for the relevant network standards and protocols. As a result, security loopholes have been discovered and widely exploited for these vulnerable connected devices, often with devastating consequences. As a countermeasure to these attacks, subsequently some of these original network standards have been enhanced with addition of security features, e.g., the original insecure Ethernet protocol (IEEE 802.3) was supplemented by the IEEE 802.1AE Media Access Control Security (MACSec) standard. In this paper, we present a network packet redirection attack on reconfigurable network devices, specifically a MACSec-enabled NetFPGA-SUME based Ethernet switch, as well as on a NetFPGA-SUME based IPv4 router, by means of Hardware Trojan (HT) insertion. Our HT design is probabilistic in its functionality, with multi-level trigger mechanism. In the MAC layer attack, an activated HT redirects a frame to an incorrect port leading to possible eavesdropping by a malicious attacker as well as denial-of-service, while in the network layer attack, upon activation it forwards all IP packets through a sub-optimal router port causing a denial-of-service attack on the receiver. The proposed HT evades most state-of-the-art HT detection schemes, while having very low resource footprint. We present the complete architecture, detailed description of the mode of operation, and implementation of the HT, with promising experimental results.

Secure VM management with strong user binding in semi-trusted clouds

In Infrastructure-as-a-Service (IaaS) clouds, remote users access provided virtual machines (VMs) via the management server. The management server is managed by cloud operators, but not all the cloud operators are trusted in semi-trusted clouds. They can execute arbitrary management commands to users’ VMs and redirect users’ commands to malicious VMs. We call the latter attack the VM redirection attack. The root cause is that the binding of remote users to their VMs is weak. In other words, it is difficult to enforce the execution of only users’ management commands to their VMs. In this paper, we propose UVBond for strongly binding users to their VMs to address this issue. UVBond boots user’s VM by decrypting its encrypted disk inside the trusted hypervisor. Then it issues a VM descriptor to securely identify that VM. To bridge the semantic gap between high-level management commands and low-level hypercalls, UVBond uses hypercall automata, which accept the sequences of hypercalls issued by commands. We have implemented UVBond in Xen and created hypercall automata for various management commands. Using UVBond, we confirmed that a VM descriptor and hypercall automata prevented insider attacks and that the overhead was not large in remote VM management.

DMM-SEP: Secure and Efficient Protocol for Distributed Mobility Management Based on 5G Networks

In the 5G era, network mobility management is recognized as a very important factor for user service availability. Especially, due to fast speed and shrinking cell coverage, frequent handover is expected than before. Hence, efficient handover procedure is essential to guarantee seamless service to users. Distributed IP Mobility Management (DMM), a major mobility management solution, is a flat architecture that achieves efficiency and fault tolerance by excluding a centralized anchor and minimizing the distance between a mobile device and its serving network. However, DMM, which has no dominant security scheme specified to itself, is excessively dependent on the security of Layer 2 and is vulnerable to various threats. Especially, the existing security schemes are still venerable to redirection attacks launched by malicious Mobile Access Gateways (MAGs) or Control Mobility Database (CMD). Motivated by this, we proposed a DMM-based handover security protocol that can support privacy and defend against redirection attacks in addition to providing essential security properties such as confidentiality, integrity, mutual authentication, and key exchange. The proposed protocol was formally verified to be correct through AVISPA and BAN logic. Moreover, the comparison analysis showed that the proposed protocol is better than the previous studies and standards.

Integrated Distributed Authentication Protocol for Smart Grid Communications

In the smart grid, an integrated distributed authentication protocol is needed to not only securely manage the system but also efficiently authenticate many different entities for the communications. In addition, a lightweight authentication protocol is required to handle frequent authentications among billions of devices. Unfortunately, in the literature, there is no such integrated protocol that provides mutual authentication among the home environment, energy provider, gateways, and advanced metering infrastructure network. Therefore, in this paper, we propose a lightweight cloud-trusted authorities-based integrated (centrally controlled) distributed authentication protocol that provides mutual authentications among communicated entities in a distributed manner. Based on certificateless cryptosystem, our protocol is lightweight and efficient even when there are invalid requests in a batch. Security and performance analysis show that the protocol provides privacy preservation, forward secrecy, semantic security, perfect key ambiguous, and protection against identity thefts while generating lower overheads in comparison with the existing protocols. Also, the protocol is secure against man-in-the-middle attacks, redirection attacks, impersonation attacks, and denial-of-service attacks. Moreover, our protocol provides a complete resistance against flood-based denial-of-service attacks.

ESAP: Efficient and secure authentication protocol for roaming user in mobile communication networks

The Global System for Mobile communication (GSM) network is proposed to mitigate the security problems and vulnerabilities observed in the mobile telecommunication system. However, the GSM network is vulnerable to different kinds of attacks such as redirection attack, impersonation attack and Man in-the Middle (MiTM) attack. The possibility of these attacks makes the wireless mobile system vulnerable to fraudulent access and eavesdropping. Different authentication protocols of GSM were proposed to overcome the drawbacks but many of them lead to network signalling overload and increases the call set-up time. In this paper, an efficient and secure authentication and key agreement protocol (ESAP-AKA) is proposed to overcome the flaws of existing authentication protocol for roaming users in the GSM network. The formal verification of the proposed protocol is presented by BAN logic and the security analysis is shown using the AVISPA tool. The security analysis shows that the proposed protocol avoids the different possible attacks on the communication network. The performance analysis based on the fluid flow mobility model shows that the proposed protocol reduces the communication overhead of the network by reducing a number of messages. On an average, the protocol reduces 60% of network signalling congestion overhead as compared with other existing GSM-AKA protocols. Moreover, the protocol not only removes the drawbacks of existing protocols but also accomplishes the needs of roaming users.

A dynamic per-context verification of kernel address integrity from external monitors

The introduction of Address Translation Redirection Attack (ATRA) has revealed a critical weakness in all existing hardware-based external kernel integrity monitors. The attack redefines system's memory mappings in favor of the attacker so that the monitored kernel regions are relocated out of the monitor's sight. We provide a generalized approach and a prototype evaluation to prove our proposed scheme for ensuring the integrity of kernel address mapping from external monitors.With a slight modification on the hardware-side on the host, we were able to enable the monitor to continuously trace Page Table Base Register (PTBR) of the host – which is an essential capability in monitoring the host memory mapping integrity.In conjunction with this hardware feature, we incorporate our findings on the invariant of the kernel memory mapping patterns to implement a dynamic per-context page table monitoring scheme. Our experiment proves the viability of our work in terms of its effectiveness against memory mapping manipulation attacks such as ATRA and satisfies the time constraints required by the proposed per-context mapping verification scheme.

메모리 주소 변환 공격을 탐지하기 위한 Snoop기반의 커널 검사 시스템

메모리 주소 변환 공격을 탐지하기 위한 Snoop기반의 커널 검사 시스템

Tamper-Indicating Quantum Seal

Technical means for identifying when tampering occurs is a critical part of many containment and surveillance technologies. Conventional fiber optic seals provide methods for monitoring enclosed inventories, but they are vulnerable to spoofing attacks based on classical physics. We address these vulnerabilities with the development of a quantum seal that offers the ability to detect the intercept-resend attack using quantum integrity verification. Our approach represents an application of entanglement to provide guarantees in the authenticity of the seal state by verifying it was transmitted coherently. We implement these ideas using polarization-entangled photon pairs that are verified after passing through a fiber-optic channel testbed. Using binary detection theory, we find the probability of detecting inauthentic signals is greater than 0.9999 with a false alarm chance of $10^{-9}$ for a 10 second sampling interval. In addition, we show how the Hong-Ou-Mandel effect concurrently provides a tight bound on redirection attack, in which tampering modifies the shape of the seal. Our measurements limit the tolerable path length change to sub-millimeter disturbances. These tamper-indicating features of the quantum seal offer unprecedented security for unattended monitoring systems.

ES-AKA: An Efficient and Secure Authentication and Key Agreement Protocol for UMTS Networks

The authentication and key agreement (AKA) protocol of the Universal Mobile Telecommunication System (UMTS) was proposed to solve the vulnerabilities found in the Global System for Mobile Communications (GSM) systems. The UMTS-AKA provides mutual authentication, but is still vulnerable to redirection attack, denial of service attack, and man-in-the-middle attack. Apart from various attacks possibilities, the UMTS-AKA has a problem of counter synchronization, generates huge overhead, and utilizes more bandwidth and message exchanges during the authentication. An intruder may apply these attacks to impersonate the network or mischarge the mobile users. In this paper, we propose an efficient and secure AKA protocol namely ES-AKA to prevent the UMTS network against these problems and attacks. This protocol also solves the synchronization problem occurred between a mobile station MS and its home network HLR. The ES-AKA protocol generates lesser communication overhead as compared to UMTS-AKA, EXT-AKA, COCKTAIL-AKA, SKA-AKA, AP-AKA, X-AKA, EURASIP-AKA, Full-AKA, and U-AKA protocols. In addition, it also generates less computation overhead than the UMTS-AKA, EXT-AKA, COCKTAIL-AKA, S-AKA, Full-AKA, and U-AKA protocols. On an average, the ES-AKA protocol reduces 62 % of the bandwidth, which is the maximum reduction of the bandwidth by any AKA protocol referred in the paper. This protocol is also able to reduce 6 % of the messages exchanged (in terms of computations) during the authentication in comparison to UMTS-AKA.