Relay Attacks Research Articles

MTSFBet: A Hand-Gesture-Recognition-Based Identity Authentication Approach for Passive Keyless Entry Against Relay Attack

The Passive Keyless Entry and Start system (PKES) has become an essential element of vehicle systems since it allows owners to lock or unlock their properties without having to take out the keys. However, the system suffers from a potential and serious security problem because of a relay attack. This paper introduces dynamic biometrics to resolve such potential problems. Precisely, it opts for hand-gesture and proposes a Multi-Task Siamese Feature-pyramid network with Bidirectional Gated Recurrent Units (MTSFBet) against relay attack. MTSFBet is made up of a Dynamic Biometrics Extraction Module (DBEM) and Multi-Task Operation Module (MTOM). DBEM extracts trajectory and kinematic features from the gesture data of owners, whereas MTOM performs gesture classification and identity authentication using these features. Moreover, we designed a loss function for the identity authentication part. Eventually, based on the dataset collected by mobile devices, we constructed comparative experiments and ablation studies to demonstrate the effectiveness of the method. Our comprehensive model achieves an accuracy of 0.86 in gesture classification and an accuracy of 0.73 in identity authentication. The results showed that our MTSFBet significantly outperforms other comparison methods. The MTSFBet can also be used in any scenario associated with identity authentication based on hand gestures.

Using Ambient Sensors for Proximity and Relay Attack Detection in NFC Transactions: A Reproducibility Study

Using Ambient Sensors for Proximity and Relay Attack Detection in NFC Transactions: A Reproducibility Study

FVF-AKA: A Formal Verification Framework of AKA Protocols for Multi-server IoT

As IoT in a multi-server environment increases resources’ utilization, more and more problems of IoT authentication and key agreement are being revealed. The Authentication and Key Agreement (AKA) protocol plays an important role in solving these problems. Many AKA protocols have been proposed, and some of them support their own verifications. However, a unifying verification framework for multi-server IoT is lacking. In this article, we propose a formal verification framework of AKA protocols for multi-server IoT (FVF-AKA). It supports the construction of CSP models for the AKA protocol, the implementation of the CSP models in PAT with C#, and the verification of formal models. With the help of C#, many complex functions in the AKA protocol can be implemented. We also design an algorithm to support automatic conversion from the CSP model to the PAT model. FVF-AKA can verify four fundamental properties (deadlock freedom, entity legitimacy, timeout delay, and session key consistency). It also supports the verification of security properties for the AKA protocol suffering from four different attacks (relay attacks, denial of service attacks, server spoofing attacks, and session key attacks). Our approach can be applied to most AKA protocols for multi-server IoT generally. By applying FVF-AKA to two AKA protocols, we can verify whether they satisfy the fundamental properties and analyze their security properties in vulnerable environments. Our work would help to analyze the AKA protocol for multi-server IoT and provide the foundation for the analysis of enhancing its security and robustness.

A new location verification protocol and blockchain-based drone rental mechanism in smart farming

In smart farming, information and communication technologies such as IoT are driving the agricultural industry towards improved efficiency and productivity while reducing human intervention. As agricultural systems become increasingly connected to the Internet, they provide many new opportunities but also introduce new challenges. Connecting such systems to a network exposes them to cyberattacks and vulnerabilities; therefore, security and privacy are important challenges that should be addressed. Specifically, because of the distinct characteristics of smart farming such as environmental and farm conditions, security solutions suitable for smart farming are indispensable. In this paper, we propose a location verification (LV) protocol as a security solution for autonomous and intelligent moving devices such as drones and robots deployed in smart farming. Moreover, as an application of the proposed LV protocol, we propose a blockchain-based secure drone rental mechanism for smart farming. We present a security analysis in which the proposed LV protocol and rental mechanism are secure against man-in-the-middle, impersonation, modification, replay, and relay attacks, with the rental mechanism providing mutual authentication. Through a performance evaluation of the LV protocol in terms of the communication overhead, computation cost, and storage cost and a performance evaluation of the blockchain for drone rental with regard to throughput and latency, we confirm the feasibility and efficiency of the LV protocol and drone rental mechanism in the smart farming.

On the optimal resistance against mafia and distance fraud in distance-bounding protocols

Distance-bounding protocols are security protocols with a time measurement phase used to detect relay attacks, whose security is typically measured against mafia-fraud and distance-fraud attacks. A prominent subclass of distance-bounding protocols, known as lookup-based protocols, use simple lookup operations to diminish the impact of the computation time in the distance calculation. Independent results have found theoretical lower bounds 12nn2+1 and 12n, where n is the number of time measurement rounds, on the security of lookup-based protocols against mafia and distance-fraud attacks, respectively. However, it is still an open question whether there exists a protocol achieving both security bounds. This article closes this question in two ways. First, we prove that the two lower bounds are mutually exclusive, meaning that there does not exist a lookup-based protocol that provides optimal protection against both types of attacks. Second, we provide a lookup-based protocol that approximates those bounds by a small constant factor. Our experiments show that, restricted to a memory size that linearly grows with n, our protocol offers strictly better security than previous lookup-based protocols against both types of fraud.

BackProx: Secure Backscatter-Assisted Proximity Detection for Passive Keyless Entry and Start Systems.

A passive keyless entry and start (PKES) system is an electronic lock for an automobile that provides the great convenience of opening the door when the user is in proximity. However, the system suffers from relay attacks. Recent studies revealed that relayed signals result in valid packets that are sufficient to unlock doors. In particular, the adversary causes proximity errors by injecting a certain time delay before relaying to manipulate the phase rotation in the response signal. To this end, we present a novel relay-resilient proximity detection solution, BackProx, which uses pseudo-random frequency hopping with the assistance of a reference backscattering device. Since the relay adversary transmits the relayed signals from the key fob at long distances, the signals should propagate over longer distances, resulting in inevitable significant phase rotation with different frequencies. Inspired by this finding, BackProx uses an additional backscattering device to ensure the proximity of the key fob using the invariant characteristics of radio frequency signals in the physical layer (i.e., phase rotation). Our evaluation demonstrates the effectiveness of BackProx in resisting three types of relay attacks. The results show that it achieved a 98% true positive rate at close range and a 0.3% false positive rate at long range.

Deep-Learning-Aided RF Fingerprinting for NFC Relay Attack Detection

Near field communication (NFC) has been a widely used radiofrequency identification (RFID) technology, credited to its convenience and security features. However, the transmitted signals can be easily eavesdropped or relayed in an open wireless channel. One of the challenges is relay attack, where an attacker simply relays the signal and bypasses encryption or other means in the application layer. Prior works on relay attack countermeasures have focused on distance-bounding protocols or ambient-based solutions. This paper focuses on ISO/IEC 14443-A and proposes an NFC relay detection method based on RF fingerprinting of transmitted wireless signals in the physical layer. To this end, we first designed and implemented two realizations of NFC relay attacks, wired and wireless relays, and built an SDR-based testbed. We collected the normal and relayed signals of four NFC tags, and the answer to request type A (ATQA) segments were selected for RF fingerprinting. The created dataset comprised 66,366 samples, with four tags’ normal and wired relayed signals and the wireless relayed signals. The dataset was then fed into a deep CNN for training. Finally, our experiment results showed that the method effectively distinguished normal and relayed signals with a high accuracy of 99%, confirming that RF fingerprinting can be a promising countermeasure to NFC relay attacks.

Rethinking Tag Collisions for Replay and Relay Attack Resistance in Backscatter Networks

Distinguishable physical layer features of radio frequency have the potential to serve as new fingerprints for authentication in backscatter networks. They have a definite advantage that backscatter tags do not have to run resource-intensive operations that commodity tags rarely implement. However, current physical layer authentication schemes impose substantial burdens on both service providers and users. Since physical layer features are highly susceptible to environmental factors, labor-intensive and time-consuming fingerprint library establishment is indispensable to make sufficient statistics for authentication. In this paper, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TagDuet</i> , a collision-assisted authentication scheme that adopts an auxiliary tag to RFID systems, a typical type of backscatter networks, without the requirement of fingerprint library establishment. TagDuet places an independent backscatter tag in the proximity of a reader and utilizes the features in intended tag collisions to improve wireless security. Our phase cancellation decoding algorithm accurately decodes the collisions, which leads TagDuet fully compatible with the commodity RFID tags. TagDuet provides freshness, the paramount property to resist replay attacks, and robustness to relay attacks under FCC regulations for frequency hopping. We implement a prototype of TagDuet with commodity tags, evaluate the performance in randomized channels by the auxiliary tag, and demonstrate the resilience against replay and relay attacks.

Recent advances of Captcha security analysis: a short literature review

CAPTCHA has long been used to keep bots from misusing web services. Various CAPTCHA schemes have been proposed over the years, principally to increase usability and security against emerging bots and hackers performing malicious operations. However, automated attacks have effectively cracked all common conventional schemes, and the majority of present CAPTCHA methods are also vulnerable to human-assisted relay attacks. Invisible reCAPTCHA and some approaches have not yet been cracked. However, with the introduction of fourth generation bots accurately mimicking human behavior, a secure CAPTCHA would be hardly designed without additional special devices. In this paper, we presented a short literature review of the current CAPTCHA schemes, as well as highlighting new trends and open issues, the challenges, and the opportunities as a solid starting point for designing the future secure and usable CAPTCHA schemes.

Human-artificial intelligence approaches for secure analysis in CAPTCHA codes

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) has long been used to keep automated bots from misusing web services by leveraging human-artificial intelligence (HAI) interactions to distinguish whether the user is a human or a computer program. Various CAPTCHA schemes have been proposed over the years, principally to increase usability and security against emerging bots and hackers performing malicious operations. However, automated attacks have effectively cracked all common conventional schemes, and the majority of present CAPTCHA methods are also vulnerable to human-assisted relay attacks. Invisible reCAPTCHA and some approaches have not yet been cracked. However, with the introduction of fourth-generation bots accurately mimicking human behavior, a secure CAPTCHA would be hardly designed without additional special devices. Almost all cognitive-based CAPTCHAs with sensor support have not yet been compromised by automated attacks. However, they are still compromised to human-assisted relay attacks due to having a limited number of challenges and can be only solved using trusted devices. Obviously, cognitive-based CAPTCHA schemes have an advantage over other schemes in the race against security attacks. In this study, as a strong starting point for creating future secure and usable CAPTCHA schemes, we have offered an overview analysis of HAI between computer users and computers under the security aspects of open problems, difficulties, and opportunities of current CAPTCHA schemes.

Anomaly-Based Detection of Cyberattacks on Line Current Differential Relays

Currently, the architecture of Line Current Differential Relays (LCDRs) is designed to respond to internal faults on the protected line using local and remotely-communicated current measurements. However, this architecture cannot distinguish between real faults and cyber-induced attacks whose goal is to cause false tripping of the line protected by the LCDR. In this paper, we propose an Anomaly-Based Scheme (ABS) for detecting false-tripping attacks against LCDRs, in the form of relay attacks, replay attacks, general false-data-injection attacks, and time-synchronization attacks. The ABS employs the Isolation Forest algorithm, which is trained on features determined from local current measurements to confirm real faults and differentiate them from false-tripping attacks. No trip command will be issued unless the sensed fault is confirmed as a non-attack by the ABS. The performance of the proposed ABS is tested and validated using the IEEE 9-bus benchmark in PSCAD/EMTDC environment. Simulation results show that the proposed ABS: (i) can accurately detect different categories of cyberattacks, (ii) does not negatively impact the accuracy of the fault-detection function, and (iii) is robust to the change in the power system’s operating point.

Sub-GHz Two-Way Ranging Based on Phase Detection for Remote Keyless Entry Systems

Remote keyless entry systems have penetrated the vehicular market due to its convenience. However, its vulnerability against relay attacks exploiting the wireless channel is a serious threat. One of the prominent countermeasures is radio ranging between the key fob and the vehicle. Taking into account radio regulations, usability and power consumption among other things, a suitable approach is necessary to devise. This article proposes sub-GHz two-way ranging based on phase detection which offers high tolerance against reference clock offset between a pair of transceiver devices and a novel compensation scheme against multipath effects. We present the operation principle and theoretical performance under a two-path model of radio propagation and additive white Gaussian noise. In field experiments with prototype devices, the ranging accuracy is validated. We show that the proposed ranging produces sufficient performance for remote keyless entry systems, confirming if the key fob is within a few meters of the vehicle.

Secure contact tracing platform from simplest private set intersection cardinality

Contact tracing is an essential tool for controlling the spread of disease through human populations. However, existing contact tracing applications are either vulnerable to privacy and security attacks or heavy bandwidth/computational requirements on the client's devices. In this work, we introduce SecureCT, a Secure Contact Tracing platform with strong privacy protection and lightweight cost. SecureCT prevents linkage attacks, eliminates replay and relay attacks, and allows the phone's holder to delegate their contact tracing computation to untrusted servers while maintaining the user's privacy. The technical core of our scheme is an efficient Private Set Intersection Cardinality protocol which only relies on symmetric-key primitives. We evaluate its performance to show the feasibility of our proposed system in practice.

A Review on Various Implemented CAPTCHA in the Field of Web Security

Abstract: CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a process of identifying whether user is human or robot. It is very important to know the user end because security can be breach. There are different CAPTCHA problems accessible like twisted string, image recognition, math and gaming CAPTCHA. Game based problem is intuitive and profoundly got as contrast with the other CAPTCHA. In this sort of CAPTCHA client needs to tackle an AI problem either by drag and drop technique or click based, contingent upon the game. The paper is expected to audit different carried out CAPTCHA and analyze their shortcoming and security boundaries. A large number of the CAPTCHAs are based on click based strategies where client needs to recognize the photos according to its appearance and snap in like manner. However, this sort of CAPTCHA can be mediated by image processing like object classifier. Dragging an item to the objective region is a successful way however it must be performed or tackled by a scholarly problem. On the off chance that dragging an item to the objective region by object acknowledgment, framework might get broken by relay attacks. Keywords: CAPTCHA, Gaming CAPTCHA, Picture Recognition, Web Security, Image Processing, Relay Attacks.

A Scalable Lower Bound for the Worst-Case Relay Attack Problem on the Transmission Grid

We consider a bilevel attacker–defender problem to find the worst-case attack on the relays that control transmission grid components. The attacker infiltrates some number of relays and renders all of the components connected to them inoperable with the goal of maximizing load shed. The defender responds by minimizing the resulting load shed, redispatching using a DC optimal power flow (DCOPF) problem on the remaining network. Though worst-case interdiction problems on the transmission grid have been studied for years, there remains a need for exact and scalable methods. Methods based on using duality on the inner problem rely on the bounds of the dual variables of the defender problem in order to reformulate the bilevel problem as a mixed integer linear problem. Valid dual bounds tend to be large, resulting in weak linear programming relaxations and, hence, making the problem more difficult to solve at scale. Often smaller heuristic bounds are used, resulting in a lower bound. In this work, we also consider a lower bound, but instead of bounding the dual variables, we drop the constraints corresponding to Ohm’s law, relaxing DCOPF to capacitated network flow. We present theoretical results showing that, for uncongested networks, approximating DCOPF with network flow yields the same set of injections and, thus, the same load shed, which suggests that this restriction likely gives a high-quality lower bound in the uncongested case. Furthermore, we show that, in the network flow relaxation of the defender problem, the duals are bounded by one, so we can solve our restriction exactly. Finally, because the big-M values in the linearization are equal to one and network flow has a well-known structure, we see empirically that this formulation scales well computationally with increased network size. Through empirical experiments on 16 networks with up to 6,468 buses, we find that this bound is almost always as tight as we can get from guessing the dual bounds even for congested networks in which the theoretical results do not hold. In addition, calculating the bound is approximately 150 times faster than achieving the same bound with the reformulation guessing the dual bounds.

Contactless Credit Cards Payment Fraud Protection by Ambient Authentication

In recent years, improvements to the computational ability of mobile phones and support for near-field-communication have enabled transactions to be performed by using mobile phones to emulate a credit card or by using quick response codes. Thus, users need not carry credit cards but can simply use their mobile phones. However, the Europay MasterCard Visa (EMV) protocol is associated with a number of security concerns. In contactless transactions, attackers can make purchases by launching a relay attack from a distance. To protect message transmission and prevent relay attacks, we propose a transaction protocol that is compatible with EMV protocols and that can perform mutual authentication and ambient authentication on near-field-communication-enabled mobile phones. Through mutual authentication, our protocol ensures the legitimacy of transactions and establishes keys for a transaction to protect the subsequent messages, thereby avoiding security problems in EMV protocols, such as man-in-the-middle attacks, skimming, and clone attacks on credit cards. By using ambient factors, our protocol verifies whether both transacting parties are located in the same environment, and it prevents relay attacks in the transaction process.

A Review on Evolution of various CAPTCHA in the field of Web Security

Abstract: CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) which is a security challenge through which human and bots intervention can be measured. It is a type of turing test through which programmed intervention can be detected by it behavior or solving the problem. There are various CAPTCHA problems available such as distorted string, picture recognition, audio, math and gaming CAPTCHA. Game based problem is interactive and highly secured as compare to the other CAPTCHA. In this kind of CAPTCHA user has to solve an AI problem either by drag &amp; drop method or click based, depending on the game. The paper is intended to review various implemented CAPTCHA and compare their weakness and security parameters. Many of the CAPTCHAs are based on click based methods where user has to identify the pictures as per its appearance and click accordingly. But this kind of CAPTCHA can be intervened by image processing techniques such as object classifier. Dragging an object to the target area is an effective way but it has to be performed or solved by an intellectual problem. If dragging an object to the target area by object recognition then system may get cracked by relay attacks. Keywords: CAPTCHA, Web Security, Game, Picture Recognition, Math CATPCHA, Image Processing, Relay Attack.

My other car is your car: compromising the Tesla Model X keyless entry system

This paper documents a practical security evaluation of the Tesla Model X keyless entry system. In contrast to other works, the keyless entry system analysed in this paper employs secure symmetric-key and public-key cryptographic primitives implemented by a Common Criteria certified Secure Element. We document the internal workings of this system, covering the key fob, the body control module and the pairing protocol. Additionally, we detail our reverse engineering techniques and document several security issues. The identified issues in the key fob firmware update mechanism and the key fob pairing protocol allow us to bypass all of the cryptographic security measures put in place. To demonstrate the practical impact of our research we develop a fully remote Proof-of-Concept attack that allows to gain access to the vehicle’s interior in a matter of minutes and pair a modified key fob, allowing to drive off. Our attack is not a relay attack, as our new key fob allows us to start the car anytime anywhere. Finally, we provide an analysis of the update performed by Tesla to mitigate our findings. Our work highlights how the increased complexity and connectivity of vehicular systems can result in a larger and easier to exploit attack surface.

A new secure authentication based distance bounding protocol.

Numerous systems are being employed in daily life where two entities authenticate each other over a range of distance. The distance involved is relatively small, but still attacks were documented. The distance bounding (DB) protocol was introduced to cater to security requirements. The schemes, however, are still prone to several threats; mainly the Relay Attack (Terrorist and Mafia Fraud). In Mafia Fraud, an attempts are made to get accepted as the prover either by replaying of messages or by the help a malicious key. In Terrorist fraud, an attempt is made to extract the secret from the verifying entity, either by extracting the key from the message captured or by physically tempering the verifying/proving entity. Therefore the mitigation of these attacks needs to be done; as to not put computational overhead on the scheme. The paper presents a comprehensive and comparative performance analysis of twelve DB protocols based on defined metrics. It also proposes a protocol which incorporates the design elements needed for added security, is computationally easy to implement and resistant to most of the threats mentioned. Analysis of the protocol is carried out against the security requirements.

Secure, Accurate, and Practical Narrow-Band Ranging System

Relay attacks pose a serious security threat to wireless systems, such as, contactless payment systems, keyless entry systems, or smart access control systems. Distance bounding protocols, which allow an entity to not only authenticate another entity but also determine whether it is physically close by, effectively mitigate relay attacks. However, secure implementation of distance bounding protocols, especially of the time critical challenge-response phase, has been a challenging task. In this paper, we design and implement a secure and accurate distance bounding protocol based on Narrow-Band signals, such as Bluetooth Low Energy (BLE), to particularly mitigate relay attacks. Narrow-Band ranging, specifically, phase-based ranging, enables accurate distance measurement, but it is vulnerable to phase rollover attacks. In our solution, we mitigate phase rollover attacks by also measuring time-of-flight (ToF) to detect the delay introduced by such attacks. Therefore, our protocol effectively combines the best of both worlds: phase-based ranging for accuracy and time-of-flight (ToF) measurement for security. To demonstrate the feasibility and practicality of our solution, we prototype it on NXP KW36 BLE chips and evaluate its performance and relay attack resistance. The obtained precision and accuracy of the presented ranging solution are 2.5 cm and 30 cm, respectively, in wireless measurements.