Accepted Papers
Commercial Anti-Smishing Tools and Their Comparative Effectiveness Against Modern Threats
1 California State University, San Marcos, California, USA
Smishing, also known as SMS phishing, is a type of fraudulent communication in which an attacker disguises SMS communications to deceive a target into providing their sensitive data. Smishing attacks use a variety of tactics; however, they have a similar goal of stealing money or personally identifying information (PII) from a victim. In response to these attacks, a wide variety of anti-smishing tools have been developed to block or filter these communications. Despite this, the number of phishing attacks continue to rise.
In this paper, we developed a test bed for measuring the effectiveness of popular anti-smishing tools against fresh smishing attacks.
To collect fresh smishing data, we introduce Smishtank.com, a collaborative online resource for reporting and collecting smishing data sets. The SMS messages were validated by a security expert and an in-depth qualitative analysis was performed on the collected messages to provide further insights.
To compare tool effectiveness, we experimented with 20 smishing and benign messages across 3 key segments of the SMS messaging delivery ecosystem. Our results revealed significant room for improvement in all 3 areas against our smishing set. Most anti-phishing apps and bulk messaging services didn’t filter smishing messages beyond the carrier blocking. The 2 apps that blocked the most smish also blocked 85-100% of benign messages. Finally, while carriers did not block any benign messages, they were only able to reach a 25-35% blocking rate for smishing messages.
Our work provides insights into the performance of anti-smishing tools and the roles they play in the message blocking process.
This paper would enable the research community and industry to be better informed on the current state of anti-smishing technology on the SMS platform.
BarrierBypass: Out-of-Sight Clean Voice Command Injection Attacks through Physical Barriers
1 Texas A&M University, College Station, Texas, USA
2 Rutgers University, New Brunswick, New Jersey, USA
The growing adoption of voice-enabled devices (e.g., smart speakers), particularly in smart home environments, has introduced many security vulnerabilities that pose significant threats to users’ privacy and safety. When multiple devices are connected to a voice assistant, an attacker can cause serious damage if they can gain control of these devices. We ask where and how can an attacker issue clean voice commands stealthily across a physical barrier, and perform the first academic measurement study of this nature on the command injection attack. We present the BarrierBypass attack that can be launched against three different barrier-based scenarios termed across-door, across-window, and across-wall. We conduct a broad set of experiments to observe the command injection attack success rates for multiple speaker samples (TTS and live human recorded) at different command audio volumes (65, 75, 85 dB), and smart speaker locations (0.1-4.0m from barrier).
Against Amazon Echo Dot 2, BarrierBypass is able to achieve 100% wake word and command injection success for the across-wall and across-window attacks, and for the across-door attack (up to 2 meters). At 4 meters for the across-door attack, BarrierBypass can achieve 90% and 80% injection accuracy for the wake word and command, respectively. Against Google Home mini BarrierBypass is able to achieve 100% wake word injection accuracy for all attack scenarios. For command injection BarrierBypass can achieve 100% accuracy for all the three barrier settings (up to 2 meters). For the across-door attack at 4 meters, BarrierBypass can achieve 80% command injection accuracy. Further, our demonstration using drones yielded high command injection success, up to 100%. Overall, our results demonstrate the potentially devastating nature of this vulnerability to control a user’s device from outside of the device’s physical space, and its limitations, without the need for complex and error-prone command injection.
Owfuzz: Discovering Wi-Fi Flaws in Modern Devices through Over-The-Air Fuzzing
1 Ant Group, Beijing, China
2 Ant Group, Hangzhou, China
Fuzzing is a practical approach to discovering flaws in the design and
implementation of Wi-Fi protocols. However, existing Wi-Fi fuzzers
are either vendor- or ecosystem-specific. Besides, they only cover a subset of 802.11 protocols and frame types. The growing complexity of Wi-Fi protocols, which have evolved to Wi-Fi6 and WPA3 already,
calls for a free and comprehensive fuzzing tool for modern Wi-Fi devices. In this paper, we present such a fuzzing tool named Owfuzz. Unlike previous works using mostly firmware emulation fuzzing or driver fuzzing, Owfuzz takes the over-the-air fuzzing approach. It can perform fuzzing tests on arbitrary Wi-Fi devices from any vendor and can fuzz all three types of Wi-Fi frames (management, control, and data) defined in all versions of the 802.11 standards. It can be easily extended to support interactive testing of various protocol models. With Owfuzz, we have tested the products of mainstream Wi-Fi chip and device vendors, leading to the discovery of 23 flaws. We have reported most of these flaws to the related vendors with 8 CVE IDs assigned. Moreover, we have open-sourced Owfuzz to the community to facilitate future research.
VoicePM: A Robust Privacy Measurement on Voice Anonymity
1 North Carolina State University, Raleigh, North Carolina, USA
Voice-based human-computer interaction has become pervasive in laptops, smartphones, home voice assistants, and Internet of Thing (IoT) devices. However, voice interaction comes with security and privacy risks. Numerous privacy-preserving measures have been proposed for hiding the speaker’s identity while maintaining speech intelligibility. However, existing works do not consider the overall tradeoff between speech utility, speaker verification, and inference of voice attributes, including emotional state, age, accent, and gender. In this study, we first develop a tradeoff metric to capture voice biometrics as well as different voice attributes. We then propose VoicePM, a robust Voice Privacy Measurement framework, to study the feasibility of applying different state-of-the-art voice anonymization solutions to achieve the optimum tradeoff between privacy and utility.
We conduct extensive experiments using anonymization approaches covering signal processing, voice synthesis, voice conversion, and adversarial techniques on three speech datasets that include both English and Chinese speakers to showcase the effectiveness and feasibility of VoicePM.
The Devil is in the Details: Hidden Problems of Client-Side Enterprise Wi-Fi Configurators
1 The Chinese University of Hong Kong, Sha Tin, Hong Kong
2 Georgia Institute of Technology, Atlanta, GA, USA
In the context of connecting to enterprise Wi-Fi, previous works show that relying on human users to manually configure or enforce server authentication often leads to insecure outcomes. Consequently, many user credentials can potentially be stolen by the so-called “Evil-Twin” (ET) attack. To ease the burden of human users, various easy-to-use Wi-Fi configurators have been released and deployed. In this work, we investigate whether such configurators can indeed protect users from variants of the ET attack. To our surprise, the results of our investigation show that all configurators considered in the study suffer from certain weaknesses due to their design, implementation, or deployment practices. Notable findings include a series of design flaws in the new trust-on-first-use (TOFU) configurator on Android (available since version 12), which can be exploited in tandem to achieve a stealthy ET attack. Moreover, we found that 2 open-source Android Wi-Fi configurators fail to properly enforce server authentication under specific situations. The cause of these could be partly attributed to the complexity stemmed from certificate name matching as well as the limitations of the Android API. Last but not least, we found that a commercial configurator not only allows insecure Wi-Fi configurations to be deployed, but also the covert injection of certificates on the user device to facilitate interception of other TLS traffic, posing yet another hidden security and privacy threat to its users. All in all, this study shows that despite years of research on the topic, developing a user-friendly yet reliable Wi-Fi configurator remains an elusive goal, and thus the threat of ET attacks continues to be relevant. As such, it is time to rethink whether the complexity of the standard certificate chain validation is actually good for enterprise Wi-Fi.
E-Spoofer: Attacking and Defending Xiaomi Electric Scooter Ecosystem
1 EURECOM, Sophia Antipolis, France
2 University of Padova, Padova, Italy
Xiaomi is the market leader in the electric scooter (e-scooter) segment, with
millions of active users. It provides several e-scooter models and Mi Home,
a mobile application for Android and iOS to manage and control an e-scooter. Mi Home and the e-scooter
interact via Bluetooth Low Energy (BLE). No prior research evaluated the security of
this communication channel, as it employs security protocols proprietary to Xiaomi.
Exploiting these protocols results in severe security, privacy, and safety issues, e.g., an attacker could steal
an e-scooter or prevent the owner from controlling it. In this work, we fill this research gap by
performing the first security evaluation on all proprietary wireless protocols deployed to Xiaomi e-scooters from 2016 to 2021.
We identify and reverse-engineer four of them, each having ad-hoc Pairing and
Session phases. We develop four attacks exploiting these protocols at the architectural level,
and we call them Malicious Pairing (MP) and Session Downgrade (SD). Both attacks can be performed from proximity,
if the attacker’s machine is within BLE range of the target e-scooter, or remotely, via a malicious application co-located with Mi Home.
An adversary can utilize MP and SD to steal a password-protected and software-locked
e-scooter, or to prevent a victim from accessing it via Mi Home. We isolate six attack root causes, including the
lack of authentication while pairing, and the improper enforcement of the e-scooter password.
We open-source the E-Spoofer toolkit. Our toolkit automates the MP and SD attacks, and
includes a reverse-engineering module for future research. We empirically confirm the effectiveness of our attacks by exploiting
three e-scooters (i.e., M365, Essential, and Mi 3), embedding five BLE subsystem boards and eight BLE firmware
versions that support all four Xiaomi protocols. We design and evaluate two practical countermeasures that address our
impactful attacks and their root causes, and we release them as part of E-Spoofer.
We responsibly disclosed our findings to Xiaomi.
Portability of Deep-Learning Side-Channel Attacks against Software Discrepancies
1 Auburn University at Montgomery, Montgomery, AL, USA
2 University of Cincinnati, Cincinnati, OH, USA
3 Cedarville University, Cedarville, OH, USA
Deep-learning side-channel attacks can reveal encryption keys on a device by analyzing power consumption with neural networks. However, the portability of deep-learning side-channel attacks can be affected when training data (from the training device) and test data (from the test device) are discrepant. Recent studies have examined the portability of deep-learning side-channel attacks against hardware discrepancies between two devices.
In this paper, we investigate the portability of deep-learning side-channel attacks against software discrepancies between the training device and test device. Specifically, we examine four factors that can lead to software discrepancies, including random delays, instruction rewriting, optimization levels, and code obfuscation. Our experimental results show that software discrepancies caused by each factor can significantly downgrade the attack performance of deep-learning side-channel attacks, and even prevent an attacker from recovering keys. To mitigate the impacts of software discrepancies, we investigate three mitigation methods, including adjusting Points of Interest, domain adaptation, and multi-domain training, from the perspective of an attacker. Our results indicate that multi-domain training is the most effective approach among the three, but it can be difficult to scale given the diversity of software discrepancies.
JaX: Detecting and Cancelling High-power Jammers Using Convolutional Neural Network
1 Northeastern University, Boston, MA, USA
In this paper, we present JaX, a novel approach for detecting and cancelling high-power jammers in the scenarios when the traditional spread spectrum techniques and other jammer avoidance approaches are not sufficient. JaX does not require explicit probes, sounding, training sequences, channel estimation, or the cooperation of the transmitter. We identify and address multiple challenges, resulting in a convolutional neural network for a multi-antenna system to infer the existence of interference, the number of interfering emissions and their respective phases. This information is continuously fed into an algorithm that cancels the interfering signal. We develop a two-antenna prototype system and evaluate our approach in various environment settings and modulation schemes using SDR platforms. We demonstrate that the receiving node equipped with our approach can detect a jammer with over 99% of accuracy and achieve a Bit Error Rate as low as 10^?6 even when the jammer
power is nearly two orders of magnitude (19 dB) higher than the legitimate signal, and without modifying the link modulation. JaX is resilient against various jammers with different characteristics of jamming signals, jamming power, and timing pattern.
SoK: An Analysis of End-to-End Encryption and Authentication Ceremonies in Secure Messaging Systems
1 Texas A&M University, College Station, TX, USA
Instant-messaging (IM) and voice over IP (VoIP) applications like WhatsApp, Zoom, and Skype have made people extremely reliant on online communications for their audio, video, and text conversations. Since more people are using these platforms to talk to each other and share sensitive information, many ongoing concerns have been raised about how the government and law enforcement monitor these platforms. Due to these concerns, the need for a method to secure confidential messages and electronic conversations has grown. This solution could be achieved by implementing an end-to-end encryption (E2EE) system without relying on any first or third parties, such as an online service or a centralized infrastructure like a public key infrastructure (PKI), which may be attacked, malicious, or coerced by law enforcement and government surveillance programs. In this systematization of knowledge paper, we first introduce the most popular E2EE apps, including their underlying E2EE messaging protocols. Then, based on the existing research literature, we investigate and systematize their E2EE features, including their underlying authentication ceremonies. Even though many research studies have examined some messaging services, we analyze and evaluate a broader set of the most popular E2EE apps and their underlying authentication ceremonies. Based on our evaluation, we have determined that all current E2EE apps, particularly when operating in opportunistic E2EE mode, are incapable of repelling active man-in-the-middle (MitM) attacks. In addition, we find that none of the current E2EE apps provide better and more usable authentication ceremonies, resulting in insecure E2EE communications against active MitM attacks. The conclusions of this systematization paper could influence future research in the field, including any improvements to the implementation of E2EE systems and authentication ceremonies that provide powerful protections against eavesdropping and MitM attacks.
Never Let Me Down Again: Bidding-Down Attacks and Mitigations in 5G and 4G
1 Ruhr University Bochum, Bochum, Germany
2 Software Radio Systems, Barcelona, Spain
3 Radix Security, Bochum, Germany
4 Radboud University, Nijmegen, Netherlands
Bidding-down attacks reduce the security of a mobile network connection. Weaker encryption algorithms or even downgrades to prior network generations enable an adversary to exploit numerous attack vectors and harm the users of a network. The problem of bidding-down attacks has been known for generations, and various mitigations are integrated into the latest 4G and 5G specifications. However, current research lacks a systematic identification and analysis of the variety of potential attack vectors. In this work, we classify an extensive set of bidding-down attack vectors and mitigations and analyze their specification and implementation in phones and networks.
Our results demonstrate vulnerabilities for all attacks and devices, including the latest mobile generation 5G and recent flagship phones. To further prove how the identified attack vectors can be exploited in sophisticated attacks, we conduct two case studies in which we apply a full downgrade attack from 5G SA to 2G and bid down a 5G NSA connection by enforcing null encryption. Again, we find a majority of systems vulnerable. With this paper, we hope to improve the state of bidding-down mitigations in the specification and implementation.
Android OS Privacy Under the Loupe -- A Tale from the East
1 The University of Edinburgh, Edinburgh, United Kingdom
2 Trinity College Dublin, Dublin, Ireland
China is currently the country with the largest number of Android smartphone users. We use a combination of static and dynamic code analysis techniques to study the data transmitted by the preinstalled system apps on Android smartphones from three of the most popular vendors in China. We find that an alarming number of preinstalled system, vendor and third-party apps are granted dangerous privileges. Through traffic analysis, we find these packages transmit to many third-party domains privacy sensitive information related to the user’s device (persistent identifiers), geolocation (GPS coordinates, network-related identifiers), user profile (phone number, app usage) and social relationships (e.g., call history), without consent or even notification. This poses serious deanonymization and tracking risks that extend outside China when the user leaves the country, and calls for a more rigorous enforcement of the recently adopted data privacy legislation.
What is Your Location Privacy Worth? Monetary Valuation of Different Location Types and Privacy Influencing Factors
1 Technische Unversität Berlin, Berlin, Germany
2 Berlin Institute of Health, Berlin, Germany
Nowadays, many apps use location data to estimate the user’s behavior for targeted advertising, predicting significant locations, personal preferences, state of health, and sports activities. Users of location-based services are often left with no other choice than to accept or reject location tracking when they want to use various applications. Especially, users with higher privacy concerns may reduce the frequency of location tracking by turning it off in the settings. However, most users are unaware that many applications installed on their phones are continuously tracking them. Therefore, this study attempts to answer how (obviously) being tracked over one-week influences a user’s privacy concerns. The study was implemented using an iOS app, which participants could install on their smartphones. Moreover, over one week, the participants were requested to answer daily mini-questionnaires about how much they would be willing to pay for the protection of their location information on a monthly basis and how much money they were willing to accept in exchange for their location information. Hereby, the context was an important criterion to determine how the monetary values vary among different location types for, among others, home location, work location, and meeting family and friends. The participants (N=51) interacted with the app on a daily basis by filling out various daily mini-surveys based on their significant locations visited. The results show a significant difference between the monetary valuating of willingness to pay and to accept for all location types except work location and sharing scenarios contributing to further empirical evidence for the endowment effect. The obvious fact of continuously being tracked did not increase the privacy concern of participants.
Swarm attestation protocols extend remote attestation by allowing a verifier to efficiently measure the integrity of software code running on a collection of heterogeneous devices across a network. Many swarm attestation protocols have been proposed for a variety of system configurations. However, these protocols are currently missing explicit specifications of the properties guaranteed by the protocol and formal proofs of correctness. In this paper, we address this gap in the context of list swarm attestation protocols, a category of swarm attestation protocols that allow a verifier to identify the set of healthy provers in a swarm. We describe the security requirements of swarm attestation protocols. We focus our work on the SIMPLE+ protocol, which we model and verify using the Tamarin prover. Our proofs enable us to identify two variations of SIMPLE+: (1) we remove one of the keys used by SIMPLE+ without compromising security, and (2) we develop a more robust design that increases the resilience of the swarm to device compromise. Using Tamarin, we demonstrate that both modifications preserve the desired security properties.
Mag-Auth: Authenticating Wireless Transmitters and Receivers on the Receiver Side via Magnetic Emissions
1 Hamad Bin Khalifa University (HBKU), Doha, Qatar
Device authentication over the wireless channel is still an open issue. This is especially true for low-end devices like the IoT ones, where the overhead required by traditional asymmetric cryptographic techniques can be overwhelming, or—more in general—when the crypto material might have been compromised. A robust solution for the above scenarios is Physical-Layer Authentication (PLA), which exploits the inherent intrinsic unique features of the wireless devices to achieve low-cost, crypto-less authentication.
In this paper, we present Mag-Auth, a novel and lightweight authentication scheme that leverages the Electro-Magnetic (EM) emissions released at the joint connection between the wireless device and its antenna in response to an excitation signal. Specifically, Mag-Auth trains, on the collected EM emissions, an autoencoder and a Neural Network (NN). The autoencoder is employed to reject wireless devices that do not belong to the set the autoencoder and the NN have been trained over, while the NN is applied to uniquely identify the different classes of wireless transmitter-receiver pairs.
Mag-Auth enjoys some unique features: it is privacy-preserving as it does not require to have access to the radio board (unlike, for instance, in-phase/quadrature (IQ)-based PLA methods); it caters to both wireless transmitter and receiver authentication scenarios; and, it sports striking performance. Indeed, our extensive experimental campaign involving 600 combinations of various wireless devices and antennas (including SDRs and IoTs) unveiled a minimum average F1-Score of 0.94 when classifying samples collected over a maximum length of 1s, proving the effectiveness and viability of using EM emissions as a lightweight, efficient, and robust authentication mechanism. Finally, we also released the collected EM emissions raw data to foster further investigations and development by Academia, Industry, and practitioners.
Authenticating Mobile Users to Public Internet Commodity Services Using SIM Technology
1 Nokia Bell Labs, Espoo, Finland
The traditional use of the Subscriber Identity Module (SIM), which resides in a mobile device, is to authenticate a user to cellular mobile networks. However, we believe that the cryptographic capabilities of SIM are not fully utilized for authenticating a user to other types of services. To address this concern, we introduce a novel SIM-based solution to authenticate users to Commodity Services (CS) on the public Internet. We present SIM-Based Authentication (SIMBA), a protocol that comprises registration, key establishment, authentication, and revocation. Our solution consists of a variant of the Remote SIM Provisioning (RSP) protocol that can be run between a commodity service, users, and a Mobile Network Operator (MNO). Furthermore, we introduce the concept of a \textit{sub-profile} for CS that can reside inside an operating SIM profile of an MNO. Unlike the SIM profiles defined in the RSP, our solution can have multiple active sub-profiles that allow users to simultaneously log in to different commodity services without swapping between profiles. We formally define a threat model and present an analysis to prove the protocol’s security guarantees. SIMBA offers several benefits to mobile end-users, CS providers, and MNOs. In this realm, we believe that our work contributes to the ongoing research on novel authentication methods.
Wavefront Manipulation Attack via Programmable mmWave Metasurfaces: from Theory to Experiments
1 Princeton University, Princeton, USA
2 North Carolina State University, Raleigh, USA
Reconfigurable surfaces enable on-demand manipulation of electromagnetic wave properties in a controllable manner. These surfaces have been shown to enhance mmWave wireless networks in many ways, including blockage recovery. In this paper, we investigate the security vulnerabilities associated with the deployment of reconfigurable surfaces, i.e., an adversary may deploy new rogue surfaces or tamper with already-deployed surfaces to maliciously engineer the reflection pattern. In particular, we introduce \textit{Metasurface-enabled Sideband Steering (MeSS)}, a new metasurface-in-the-middle attack in which the spectral-spatial properties of the reflected wavefront are manipulated such that a concealed sideband channel is created in the spectral domain and steered toward the eavesdropper location, while maintaining the legitimate link toward the victim intact. We fabricate a custom reconfigurable surface prototype and evaluate MeSS through theoretical analysis as well as over-the-air experiments at the 60 GHz band. Our results indicate that MeSS significantly reduces empirical secrecy capacity (up to 81.7%) while leaving a small power penalty at the victim that can be masked under normal channel fluctuations.
SoK: A Comprehensive Evaluation of 2FA-based Schemes in the Face of Active Concurrent Attacks from User Terminal
1 Texas A&M University, College Station, TX, USA
Malware-infected terminals pose a pervasive threat to authentication systems. As password-only authentication cannot adequately protect against malware on terminals, the literature proposes several authentication methods claiming to provide security in the presence of significant security threats, including infected terminals. Most methods incorporate a password-independent factor in the authentication process to mitigate these threats. According to the community view in the literature, 2FA-oriented methods appear to be secure in the presence of malware on the authentication terminal. In this work, we systematize these 2FA-based academic schemes’ threat models and authentication procedures to examine how they ensure security at every step of the authentication process. Additionally, we present an active concurrent attack framework named CSI(Concurrent Session Injection) and have done a comprehensive analysis of studied academic authentication systems against it. Furthermore, we systematize secure authentication systems from the literature that claim to provide protection against user terminal malware and concurrent attacks and point out their potential vulnerabilities. Our research emphasizes the significance of taking proper security measures against such threats and creates the opportunity to design more secure authentication systems in future research.
Provable Non-Frameability for 5G Lawful Interception
1 Linköping University, Linköping, Sweden
2 University of Waikato, Hamilton, New Zealand
Mobile networks have grown in size and relevance, with novel applications in areas including transportation, finance, and health. The wide use of mobile networks generates rich data about users, raising interest in using such data for law enforcement and antiterrorism through Lawful Interception (LI). Countries worldwide have established legal frameworks to conduct LI, and technical standards have been created for its implementation and deployment, but without sufficient (and rigorous) security controls. While LI originated for benign purposes, we show in this paper that malicious entities could exploit it to frame users into suspicion of criminal activity. Further, we propose a solution for non-frameability, which we formally prove uphold desired properties even in scenarios where attackers completely infiltrate the operator networks. To perform the formal verification, we extend prior work with a more complete model of the fifth generation (5G) of mobile networks in the Tamarin prover.
HoneyIoT: Adaptive High-Interaction Honeypot for IoT Devices Through Reinforcement Learning
1 The Pennsylvania State University, University Park, PA, USA
As IoT devices are becoming widely deployed, there exist many threats to IoT-based systems due to their inherent vulnerabilities. One effective approach to improving IoT security is to deploy IoT honeypot systems, which can collect attack information and reveal the methods and strategies used by attackers. However, building high-interaction IoT honeypots is challenging due to the heterogeneity of IoT devices. Vulnerabilities in IoT devices typically depend on specific device types or firmware versions, which encourages attackers to perform pre-attack checks to gather device information before launching attacks. Moreover, conventional honeypots are easily detected because their replying logic differs from that of the IoT devices they try to mimic.To address these problems, we develop an adaptive high-interaction honeypot for IoT devices, called em HoneyIoT. We first build a real device based attack trace collection system to learn how attackers interact with IoT devices. We then model the attack behavior through markov decision process and leverage reinforcement learning techniques to learn the best responses to engage attackers based on the attack trace. We also use differential analysis techniques to mutate response values in some fields to generate high-fidelity responses.HoneyIoT has been deployed on the public Internet. Experimental results show that HoneyIoT can effectively bypass the pre-attack checks and mislead the attackers into uploading malware. Furthermore, HoneyIoT is covert against widely used reconnaissance and honeypot detection tools.
MS-PTP: Protecting Network Timing from Byzantine Attacks
1 Virginia Polytechnic Institute and State University, Arlington, VA, USA
2 Washington University in St. Louis, St. Louis, MO, USA
Time-sensitive applications, such as 5G and IoT, are imposing increasingly stringent security and reliability requirements on network time synchronization. Precision time protocol (PTP) is a de facto solution to achieve high precision time synchronization. It is widely adopted by many industries. Existing efforts in securing the PTP focus on the protection of communication channels, but little attention has been given to the threat of malicious insiders.
In this paper, we first present the security vulnerabilities of PTP and discuss why the current defense mechanisms are unable to counter Byzantine insiders. We demonstrate how a malicious insider can spoof a time source to arbitrarily shift the system time of a victim node on an IoT testbed. We further demonstrate the harmful consequence of the attack on a real Turtlebot3 robotic platform as the robot fails to locate itself and follows a false trajectory. As a countermeasure, we propose multi-source PTP, in short, MS-PTP, a Byzantine-resilient network time synchronization mechanism that relies on time crowdsourcing. MS-PTP changes the current PTP’s single source hierarchy to a multi-source client-server architecture, in which PTP clients take responses from multiple time servers and apply a novel secure aggregation scheme to eliminate the effect of malicious responses from unreliable sources. MS-PTP is able to counter f Byzantine failures when the total number of time sources n used by a client satisfies n>=3f+1. We provide rigorous proof for its non-parametric accuracy guarantee—achieving bounded error regardless of the Byzantine population. We implemented a prototype of MS-PTP on our IoT testbed and the results show its resilience against Byzantine insiders while maintaining high synchronization accuracy.
Countering Relay and Spoofing Attacks in the Connection Establishment Phase of Wi-Fi Systems
1 Rochester Institute of Technology, Rochester, NY, USA
To establish a secure Wi-Fi connection, a station first exchanges several unprotected management frames with an access point (AP) to eventually authenticate each other and install a pairwise key. It is, therefore, possible for an adversary to spoof elements of those unprotected frames at the physical (PHY) or MAC layers, facilitating additional attacks (e.g., man-in-the-middle and starvation attacks). Despite a few ad hoc efforts, there is still no practical way to counter these attacks jointly. In this paper, we propose practical schemes to employ cryptography at the PHY layer combined with a time-bound technique to detect and mitigate such attacks in enterprise and 802.1X-based public networks. Our backward-compatible schemes embed a digital signature of the AP (or a message authentication code) in frame preamble signals and add only a negligible delay to the connection establishment process and achieve a 98.9% true positive rate in detecting an attacker who tries to relay valid preambles. Furthermore, we conduct a formal security analysis of our scheme using a model checker and a cryptographic protocol verifier and evaluate its performance in a commercial AP-and-USRP~testbed.
In this work, we demonstrate the possibility of spoofing a GNSS receiver to arbitrary locations without modifying the navigation messages.
Due to increasing spoofing threats, Galileo and GPS are evaluating broadcast authentication techniques to validate the integrity of navigation messages.
Prior work required an adversary to record the GNSS signals at the intended spoofed location and relay them to the victim receiver.
Our attack demonstrates the ability of an adversary to receive signals close to the victim receiver and in real-time generate spoofing signals for an arbitrary location without modifying the navigation message contents. We exploit the essential common reception and transmission time method used to estimate pseudorange in GNSS receivers, thereby potentially rendering any cryptographic authentication useless. We build a proof-of-concept real-time spoofer capable of receiving authenticated GNSS signals and generating spoofing signals for any arbitrary location and motion without requiring any high-speed communication networks or modifying the message contents. Our evaluations show that it is possible to spoof a victim receiver to locations as far as 4000~km away from the actual location and with any dynamic motion path. This work further highlights the fundamental limitations in securing a broadcast signaling-based localization system even if all communications are cryptographically protected.
Our attack demonstrates the ability of an adversary to receive signals close to the victim receiver and in real-time generate spoofing signals for an arbitrary location without modifying the navigation message contents. We exploit the essential common reception and transmission time method used to estimate pseudorange in GNSS receivers, thereby potentially rendering any cryptographic authentication useless. We build a proof-of-concept real-time spoofer capable of receiving authenticated GNSS signals and generating spoofing signals for any arbitrary location and motion without requiring any high-speed communication networks or modifying the message contents. Our evaluations show that it is possible to spoof a victim receiver to locations as far as 4000~km away from the actual location and with any dynamic motion path. This work further highlights the fundamental limitations in securing a broadcast signaling-based localization system even if all communications are cryptographically protected.
BARON: Base-Station Authentication Through Core Network for Mobility Management in 5G Networks
1 University of Padua, Padua, Italy
2 University of Washington, Seattle, USA
3 Western Washington University, Bellingham, USA
Fifth-generation (5G) cellular communication networks are being deployed on applications beyond mobile devices, including vehicular networks and industry automation. Despite their increasing popularity, 5G networks, as defined by the Third Generation Partnership Project (3GPP), have been shown to be vulnerable against fake base station (FBS) attacks. An adversary carrying out an FBS attack emulates a legitimate base station by setting up a rogue base station. This enables the adversary to control the connection of any user equipment that (inadvertently) connects with the rogue base station. Such an adversary can gather sensitive information belonging to the user. While there is a large body of work focused on the development of tools to detect FBSs, the user equipment will continue to remain vulnerable to an FBS attack.
In this paper, we propose BARON, a defense methodology to enable user equipment to determine whether a target base station that it is connecting to is legitimate or rogue. BARON accomplishes this by ensuring that the user receives an authentication token from the target base station which can be computed only by a legitimate and trusted entity. As a consequence, receiving such an authentication token from a base station ensures legitimacy of the base station. We evaluate BARON through extensive experiments on the handover process between base stations in 5G networks. Our experimental results show that BARON introduces an overhead of less than 1% during handover completion, which is 10000× lower than the overhead reported by a state-of-the-art method. BARON is also effective in thwarting an FBS attack and quickly recovering connection to a legitimate base station.
MAVERICK: An App-independent and Platform-agnostic Approach to Enforce Policies in IoT Systems at Runtime
1 The University of Iowa, Iowa City, IA, USA
2 Syracuse University, Syracuse University, NY, USA
3 Stony Brook University, Stony Brook, NY, USA
Many solutions have been proposed to curb unexpected behavior of automation apps installed on programmable IoT platforms by enforcing safety policies at runtime. However, all prior work addresses a weaker version of the actual problem due to a simpler, unrealistic threat model. These solutions are not general enough as they are heavily dependent on the installed apps and catered to specific IoT platforms. Here, we address a stronger version of the problem via a realistic threat model, where (i) undesired cyber actions can come from not only automation platform backends (e.g., SmartThings) but also close-sourced third-party services (e.g., IFTTT), and (ii) physical actions (e.g., user interactions) on devices can move the IoT system to an undesirable state. We propose a runtime mechanism, dubbed Maverick, which employs an app-independent, platform-agnostic mediator to enforce policies against all undesired cyber actions and applies corrective-actions to bring the IoT system back to a safe state from an unsafe state transition. Maverick is equipped with a policy language capable of expressing rich temporal invariants and an automated toolchain that includes a policy synthesizer and a policy analyzer for user assistance. We
implemented Maverick in a prototype and showed its efficacy in both physical and virtual testbeds, incurring minimal overhead.
VSMask: Defending Against Voice Synthesis Attack via Real-Time Predictive Perturbation
1 Michigan State University, East Lansing, USA
Deep learning based voice synthesis technology generates artificial human-like speeches, which has been used in deepfakes or identity theft attacks. Existing defense mechanisms inject subtle adversarial perturbations into the raw speech audios to mislead the voice synthesis models. However, optimizing the adversarial perturbation not only consumes substantial computation time, but it also requires the availability of entire speech. Therefore, they are not suitable for protecting live speech streams, such as voice messages or online meetings. In this paper, we propose VSMask, a real-time protection mechanism against voice synthesis attacks. Different from offline protection schemes, VSMask leverages a predictive neural network to forecast the most effective perturbation for the upcoming streaming speech. VSMask introduces a universal perturbation tailored for arbitrary speech input to shield a real-time speech in its entirety. To minimize the audio distortion within the protected speech, we implement a weight-based perturbation constraint to reduce the perceptibility of the added perturbation. We comprehensively evaluate VSMask protection performance under different scenarios. The experimental results indicate that VSMask can effectively defend against 3 popular voice synthesis models. None of the synthetic voice could deceive the speaker verification models or human ears with VSMask protection. In a physical world experiment, we demonstrate that VSMask successfully safeguards the real-time speech by injecting the perturbation over the air.
Satellite Spoofing from A to Z: On the Requirements of Satellite Downlink Overshadowing Attacks
1 University of Oxford, United Kingdom
2 armasuisse S+T, Zurich, Switzerland
Satellite communications are increasingly crucial for telecommunications, navigation, and Earth observation. However, many widely used satellites do not cryptographically secure the downlink, opening the door for radio spoofing attacks. Recent developments in software-defined radio hardware have enabled attacks on wireless systems including GNSS, which can be effectively spoofed using only cheap hardware available off the shelf. However, these conclusions do not generalize well to other satellite systems such as high data rate backhauls or satellite-to-customer connections, where the spoofing requirements are currently unknown.
In this paper, we present a systematic review of spoofing attacks against satellite downlink communications systems. We establish a threat model linking attack feasibility and impact to required budget through real-world experiments and channel simulations. Our results show that nearly all evaluated satellite systems were overshadowable at a distance of 1 km in the worst case, for a budget of ~2000 USD or less.
We evaluate how key challenges surrounding modulation schemes, antenna directionality, and legitimate satellite signal strength can be overcome in practice through antenna sidelobe targeting, overshadowing, and automatic gain control takeover. We also show that, surprisingly, protocols designed to be more robust against channel noise are significantly less robust against an overshadowing attacker. We conclude with a discussion of physical-layer countermeasures specifically applicable to satellite systems which can not be cryptographically upgraded.
EMI-LiDAR: Uncovering Vulnerabilities of LiDAR Sensors in Autonomous Driving Setting using Electromagnetic Interference
1 University of Florida, Gainesville, USA
2 The University of Electro-Communications, Tokyo, Japan
Autonomous Vehicles (AVs) using LiDAR-based object detection systems are rapidly improving and becoming an increasingly viable method of transportation. While effective at perceiving the surrounding environment, these detection systems are shown to be vulnerable to attacks using lasers which can cause obstacle misclassifications or removal. These laser attacks, however, are challenging to perform, requiring precise aiming and accuracy. Our research exposes a new threat in the form of Intentional Electro-Magnetic-Interference (IEMI), which affects the time-of-flight (TOF) circuits that make up modern LiDARs. We show that these vulnerabilities can be exploited to force the AV Perception system to misdetect, misclassify objects, and perceive non-existent obstacles. We evaluate the vulnerability in three AV perception modules (PointPillars, PointRCNN, and Apollo) and show how the classification rate drops below 50%. We also analyze the impact of the IEMI injection on two fusion models (AVOD and Frustum-ConvNet) and in real-world scenarios. Finally, we discuss potential countermeasures and propose two strategies to detect signal injection.
Malicious Relay Detection and Legitimate Channel Recovery
1 The Ohio State University, Columbus, OH, USA
Full-duplex devices can compromise the integrity of wireless channel measurements through signal relaying and several attacks have been proposed based on this vulnerability. Existing source authentication methods relying on previously-collected signatures face significant challenges in detecting these attacks because a relay attacker can gradually inject the channels so that the manipulated channels will fall within the tolerance range of the authentication methods and are mistaken as new signatures. In this paper, we propose RelayShield, a system for detecting malicious relays and recovering the legitimate transmitter-receiver channels from the manipulated channels. RelayShield requires only one channel measurement at the receiver. It analyzes signal path information resolved from input channels to detect relays and recover channels. RelayShield achieves over 95% detection accuracy with channels collected in two typical indoor environments. The recovered channels can support a wide range of applications, including secret generation protocols and sensing systems.
UE Security Reloaded: Developing a 5G Standalone User-Side Security Testing Framework
1 Northeastern University, Boston, USA
2 New York University Abu Dhabi, Abu Dhabi, UAE
3 Google, New York, USA
Security flaws and vulnerabilities in cellular networks lead to severe security threats given the data-plane services that are involved, from calls to messaging and Internet access. While the 5G Standalone (SA) system is currently being deployed worldwide, practical security testing of User Equipment (UE) has only been conducted and reported publicly for 4G/LTE and earlier network generations. In this paper, we develop and present the first open-source based security testing framework for 5G SA User Equipment. To that end, we modify the functionality of open-source suites (Open5GS and srsRAN) and develop a broad set of test cases for the 5G NAS and RRC layers. We apply our testing framework in a proof-of-concept manner to 5G SA mobile phones and provide detailed insights from our experiments. While being a framework in development, the results of our experiments presented in this paper can assist other researchers in the field and have the potential to improve 5G SA security.
Short papers
European 5G Security in the Wild: Reality versus Expectations
1 i2CAT Foundation, Barcelona, Spain
2 University of Murcia, Murcia, Spain
3 NEC Laboratories Europe, i2CAT Foundation and ICREA, Heidelberg, Germany
5G cellular systems are slowly being deployed worldwide delivering the promised unprecedented levels of throughput and latency to hundreds of millions of users. At such scale security is crucial, and consequently, the 5G standard includes a new series of features to improve the security of its predecessors (i.e., 3G and 4G). In this work, we evaluate the actual deployment in practice of the promised 5G security features by analysing current commercial 5G networks from several European operators. By collecting 5G signalling traffic in the wild in several cities in Spain, we i) fact-check which 5G security enhancements are actually implemented in current deployments, ii) provide a rich overview of the implementation status of each 5G security feature in a wide range of 5G commercial networks in Europe and compare it with previous results in China, iii) analyse the implications of optional features not being deployed, and iv) discuss on the still remaining 4G-inherited vulnerabilities.
Our results show that in European 5G commercial networks, the deployment of the 5G security features is still on the works. This is well aligned with results previously reported from China [16] and keeps these networks vulnerable to some 4G attacks, during their migration period from 4G to 5G.
LTE sniffers are important for security and performance analysis because they can passively capture the wireless traffic of users in LTE network.
However, existing open-source LTE sniffers have only limited functionality and cannot decode data traffic.
This paper introduces LTESniffer, the first open-source LTE sniffer that can passively decode both uplink and downlink data traffic.
Implementing a sniffer is not trivial because one needs to understand detailed configurations and parameters to successfully decode each user’s traffic.
Using multiple techniques, we found mechanisms to understand these, which improves our decoding performance.
To this end, we implement several techniques that leverage our decoding results to enhance the performance.
We evaluated the performance of LTESniffer on both testbed and commercial network environments.
We also compare the performance of LTESniffer with AirScope, a popular commercial LTE sniffer.
Additionally, LTESniffer provides a proof-of-concept API with three functions that can be used for security applications, including identity mapping, identity collecting, and device capability profiling.
We release LTESniffer as open-source for future research.
BigMac 🍔 Performance Overhead of User Plane Integrity Protection in 5G Networks
1 Radboud University, Nijmegen, Netherlands
2 Ruhr University, Bochum, Germany
3 Radix Security, Bochum, Germany
5G introduces a series of new security features that overcome known issues of the previous mobile generations. One of these features is integrity protection for user plane data. While this addition protects against manipulations like DNS spoofing, it also introduces extra overhead to user plane traffic. As it is optional to enable, this additional overhead can be the decision point for network operators to avoid the additional security feature. In this work, we investigate the overhead induced by different integrity protection algorithms and test the burden they add to the workload of a device. Our results indicate how visible performance differences would be on the end-devices of users, and how the performance of the algorithms differs in isolation. With these results we aim to initiate a discussion regarding the benefits of enabling user plane integrity protection and to overcome misconceptions regarding the performance impairments for end users.
Circumventing the Defense against Modulation Classification Attacks
1 Rochester Institute of Technology, Rochester, NY, USA
Modulation classification (MC) has a wide range of applications in spectrum sharing, management, and enforcement and can also be used by an adversary to launch traffic analysis or selective jamming. While recent modulation obfuscation techniques show promising results in mitigating MC attacks, in this paper we develop a novel convolution neural network (CNN)-based model to attack those defenses and successfully identify the true modulation scheme. Our extensive simulation and over-the-air experiments using show that our classification technique achieves around 85-99% accuracy for SNR levels 0 dB and above. Furthermore, our results demonstrate that the proposed model can effectively differentiate between obfuscated and non-obfuscated symbols, even when a transmitter switches between them as a new defense mechanism, achieving an accuracy of 95%.
Testing and Improving the Correctness of Wi-Fi Frame Injection
1 imec-DistriNet & KU Leuven, Leuven, Belgium
Investigating the security of Wi-Fi devices often requires writing scripts that send unexpected or malformed frames, to subsequently monitor how the devices respond. Such tests generally use Linux and off-the-self Wi-Fi dongles. Typically, the dongle is put into monitor mode to get access to the raw content of received Wi-Fi frames and to inject, i.e., transmit, customized frames.
In this paper, we demonstrate that monitor mode on Linux may, unbeknownst to the user, mistakenly inject Wi-Fi frames or even drop selected frames instead of sending them. We discuss cases where this causes security testing tools to misbehave, making users to believe that a device under test is secure while in reality it is vulnerable to an attack. To remedy this problem, we create a script to test raw frame injection, and we extend the Radiotap standard to gain more control over frame injection. Our extension is now part of the Radiotap standard and has been implemented in Linux. We tested it using commercial Wi-Fi dongles and using openwifi, which is an open implementation of Wi-Fi on top of software-defined radios. With our improved setup, we reproduced tests for the KRACK and FragAttack vulnerabilities, and discovered previously unknown vulnerabilities in three smartphones.
Posters
spaceQUIC: Securing Communication in Computationally Constrained Spacecraft
1 University of Oxford, United Kingdom
Recent years have seen a rapid increase in the number of CubeSats and other small satellites in orbit – these have highly constrained computational and communication resources, but still require robust secure communication to operate effectively. The QUIC transport layer protocol is designed to provide efficient communication with cryptography guarantees built-in, with a particular focus on networks with high latency and packet loss. In this work, we provide spaceQUIC, a proof of concept implementation of QUIC for NASA’s “core Flight System” satellite operating system, and assess its performance.
Enhancing Security and Privacy Control for Voice Assistants Using Speaker Orientation
1 North Carolina State University, USA
Imperfect voice recognition can lead to unintentional activations when similar-sounding words are spoken in the background. Existing privacy controls are not effective in preventing such misactivations. Recent studies have shown that the visual gaze plays an important role when interacting with conservation agents such as Voice Assistants (VA), and users tend to turn their heads or body toward the VA when invoking it. In this study, we propose a device-free, non-obtrusive acoustic sensing system called HeadTalk to thwart the misactivation of VAs. The proposed system leverages the user’s head direction information and verifies that a human generates the sound to minimize accidental activations.
Wavefront Manipulation Attack via Programmable mmWave Metasurfaces: From Theory to Experiments
1 Princeton University, USA
2 North Carolina State University, USA
We investigate the security vulnerabilities associated with the deployment of reconfigurable surfaces. We present the design and the 60 GHz implementation of Metasurface-enabled Sideband Steering (MeSS), a new metasurface-in-the-middle attack in which the spectral-spatial properties of the reflected wavefront are manipulated such that a concealed sideband channel is created in the spectral domain and steered toward the eavesdropper location, while maintaining the legitimate link toward the victim intact.
Dishing out DoS: How to Disable and Secure the Starlink User Terminal
1 University of Oxford, United Kingdom
Satellite user terminals are a promising target for adversaries seeking to target satellite communication networks. Despite this, many protections commonly found in terrestrial routers are not present in some user terminals. As a case study, we audit the attack surface presented by the Starlink router’s admin interface, using fuzzing to uncover a denial of service attack on the Starlink user terminal. We explore the attack’s impact, particularly in the cases of drive-by attackers, and attackers that are able to maintain a continuous presence on the network. Finally, we discuss wider implications, looking at lessons learned in terrestrial router security, and how to properly implement them in this new context.
The architectural design of Open Radio Access Networks (ORAN) was recently causing concerns and debates about its security, which is considered one of its major drawbacks. Several theoretical risk analyses related to ORAN have been conducted, but to the best of our knowledge, not even a single practical one has been performed yet. In this poster, we discuss and propose a way for a minimal, future-proof deployment of an ORAN 5G network, able to accommodate various hands-on security analyses for its different elements.
CONNECT: Road-Map Towards Adoption of Dynamic Trust Assurances for Sustainability in CCAM
1 University of Surrey, United Kingdom
2 Technikon, Austria
3 Huawei, Germany
4 Ubitech, Greece
CONNECT will address the convergence of security and safety in CCAM by assessing dynamic trust relationships and defining a trust model and trust reasoning framework based on which involved entities can establish trust for cooperatively executing safety-critical functions. The CONNECT Trust Management framework is the basis that models and captures the trust relationships of the next-generation CCAM systems. CONNECT’s new safety paradigm is a key element in bringing autonomous driving to a completely new level of trustworthiness and is expected to lead to long-term consumer acceptance as a result.
DEMOS
European 5G Security in the Wild: Reality versus Expectations
1 i2CAT Foundation
2 University of Murcia, Spain
3 NEC Laboratories Europe
Current 5G deployments are still not devoid of security issues, and researchers, engineers, and end-users have limited knowledge of what is the actual, effective level of security existing in a given 5G network. This demonstrator discloses the insights of deployed 5G networks by exposing the information presented in the existing work. The collected information was directly gathered in the wild from different operators in Europe to evaluate the security aspects present in current commercial 5G deployments.
Most commercial protocols are vulnerable to nearby adversaries as they do not probe for human presence at the speaker or proximity between both devices. In addition to security, the protocol must provide a user-friendly way for initial bootstrapping of the speaker. We design an open pairing protocol for the establishment of a shared secret between both devices using acoustic messaging to guarantee proximity, and release our implementation for the smart speaker as well as Android and Linux clients as open-source software on GitHub.
The FLoRa Tool — Analysis and Attacks for LoRaWan, IoT Traffic
1 University of Surrey, United Kingdom
2 NCC Group
In this demo, we will present the newest version of the Flora tool: this is a Wireshark-like tool for LoRaWAN IoT traffic. Flora has initially been developed by NCC Group in 2020, and — since — members of Surrey’s security group extended it, in collaboration with NCC Group, to perform/detect new attacks onto LoRaWAN devices/systems. The demo is based on our NDSS 2023 paper.
Implementation of the 5G AKMA Service & Security-driven Improvements of AKMA, onto Open5GCore
1 University of Surrey, UK
2 BT Research, UK
In this demo, we present a working implementation of the 5G AKMA (Authentication and Key Management for Application) Service over Open5GCore, as well as slight modification of AKMA such as to increase its backwards secrecy and postcompromise-security properties. We show that the efficiency depreciation of the “patch" is negligible. We reported the findings to 3GPP.