Authentication and Data Protection under Strong Adversarial Model

We are interested in addressing a series of existing and plausible threats to cybersecurity where the adversary possesses unconventional attack capabilities. Such unconventionality includes, in our exploration but not limited to, crowd-sourcing, physical/juridical coercion, substantial (but bounded) computational resources, malicious insiders, etc. Our studies show that unconventional adversaries can be counteracted with a special anchor of trust and/or a paradigm shift on a case-specific basis. Complementing cryptography, hardware security primitives are the last defense in the face of co-located (physical) and privileged (software) adversaries, hence serving as the special trust anchor. Examples of hardware primitives are architecture-shipped features (e.g., with CPU or chipsets), security chips or tokens, and certain features on peripheral/storage devices. We also propose changes of paradigm in conjunction with hardware primitives, such as containing attacks instead of counteracting, pretended compliance, and immunization instead of detection/prevention. In this thesis, we demonstrate how our philosophy is applied to cope with several exemplary scenarios of unconventional threats, and elaborate on the prototype systems we have implemented. Specifically, Gracewipe is designed for stealthy and verifiable secure deletion of on-disk user secrets under coercion; Hypnoguard protects in-RAM data when a computer is in sleep (ACPI S3) in case of various memory/guessing attacks; Uvauth mitigates large-scale human-assisted guessing attacks by receiving all login attempts in an indistinguishable manner, i.e., correct credentials in a legitimate session and incorrect ones in a plausible fake session; Inuksuk is proposed to protect user files against ransomware or other authorized tampering. It augments the hardware access control on self-encrypting drives with trusted execution to achieve data immunization. We have also extended the Gracewipe scenario to a network-based enterprise environment, aiming to address slightly different threats, e.g., malicious insiders. We believe the high-level methodology of these research topics can contribute to advancing the security research under strong adversarial assumptions, and the promotion of software-hardware orchestration in protecting execution integrity therein

“Be a Pattern for the World”: The Development of a Dark Patterns Detection Tool to Prevent Online User Loss

Dark Patterns are designed to trick users into sharing more information or spending more money than they had intended to do, by configuring online interactions to confuse or add pressure to the users. They are highly varied in their form, and are therefore difficult to classify and detect. Therefore, this research is designed to develop a framework for the automated detection of potential instances of web-based dark patterns, and from there to develop a software tool that will provide a highly useful defensive tool that helps detect and highlight these patterns

Minding the Gap: Computing Ethics and the Political Economy of Big Tech

In 1988 Michael Mahoney wrote that “[w]hat is truly revolutionary about the computer will become clear only when computing acquires a proper history, one that ties it to other technologies and thus uncovers the precedents that make its innovations significant” (Mahoney, 1988). Today, over thirty years after this quote was written, we are living right in the middle of the information age and computing technology is constantly transforming modern living in revolutionary ways and in such a high degree that is giving rise to many ethical considerations, dilemmas, and social disruption. To explore the myriad of issues associated with the ethical challenges of computers using the lens of political economy it is important to explore the history and development of computer technology

Technical Debt is an Ethical Issue

We introduce the problem of technical debt, with particular focus on critical infrastructure, and put forward our view that this is a digital ethics issue. We propose that the software engineering process must adapt its current notion of technical debt – focusing on technical costs – to include the potential cost to society if the technical debt is not addressed, and the cost of analysing, modelling and understanding this ethical debt. Finally, we provide an overview of the development of educational material – based on a collection of technical debt case studies - in order to teach about technical debt and its ethical implication

The Advanced Framework for Evaluating Remote Agents (AFERA): A Framework for Digital Forensic Practitioners

Digital forensics experts need a dependable method for evaluating evidence-gathering tools. Limited research and resources challenge this process and the lack of multi-endpoint data validation hinders reliability in distributed digital forensics. A framework was designed to evaluate distributed agent-based forensic tools while enabling practitioners to self-evaluate and demonstrate evidence reliability as required by the courts. Grounded in Design Science, the framework features guidelines, data, criteria, and checklists. Expert review enhances its quality and practicality

Selected Papers from the First International Symposium on Future ICT (Future-ICT 2019) in Conjunction with 4th International Symposium on Mobile Internet Security (MobiSec 2019)

The International Symposium on Future ICT (Future-ICT 2019) in conjunction with the 4th International Symposium on Mobile Internet Security (MobiSec 2019) was held on 17–19 October 2019 in Taichung, Taiwan. The symposium provided academic and industry professionals an opportunity to discuss the latest issues and progress in advancing smart applications based on future ICT and its relative security. The symposium aimed to publish high-quality papers strictly related to the various theories and practical applications concerning advanced smart applications, future ICT, and related communications and networks. It was expected that the symposium and its publications would be a trigger for further related research and technology improvements in this field

An Analysis of Computer Systems for the Secure Creation and Verification of User Instructions

The ongoing digitisation of previously analogue systems through the Fourth Industrial Revolution transforms modern societies. Almost every citizen and businesses operating in most parts of the economy are increasingly dependent on the ability of computer systems to accurately execute people's command. This requires efficient data processing capabilities and effective data input methods that can accurately capture and process instructions given by a user. This thesis is concerned with the analysis of state-of-the-art technologies for reliable data input through three case studies. In the first case study, we analyse the UI of Windows 10 and macOS 10.14 for their ability to capture accurate input from users intending to erase data. We find several shortcomings in how both OS support users in identifying and selecting operations that match their intentions and propose several improvements. The second study investigates the use of transaction authentication technology in online banking to preserve the integrity of transaction data in the presence of financial malware. We find a complex interplay of personal and sociotechnical factors that affect whether people successfully secure their transactions, derive representative personas, and propose a novel transaction authentication mechanism that ameliorates some of these factors. In the third study, we analyse the Security Code AutoFill feature in iOS and macOS and its interactions with security processes of remote servers that require users to handle security codes delivered via SMS. We find novel security risks arising from this feature's design and propose amendments, some of which were implemented by Apple. From these case studies, we derive general insights on latent failure as causes for human error that extend the Swiss Cheese model of human error to non-work environments. These findings consequently extend the Human Factors Analysis and Classification System and can be applied to human error incident investigations

Universal Communication model and evaluation with the Elderly Society

Telecommunication uses today various devices, operating systems, network technologies and applications. The multiplicity and diversity of these items are expected to increase due to the development of new technologies. As a result communication becomes a challenge. Communication is according to the World Health Organization a basic requirement for participation of elderly people in the society. In this thesis the architecture model ¿Universal Communication Model¿ (UCM) for the unified application of these items is developed and investigated. The future society will merely be 60+ and lowered physical abilities for communication need to be compensated. Two hypotheses that represent challenges of the UCM are provided and investigated: First, ¿Elderlies have difficulties in stress and ad-hoc situations to cope with ICT solutions¿ (H 1), and second ¿Elderlies have problems to reach destinations¿ (H 2). Both hypotheses are divided into sub-hypotheses without and with UCM support. Two use cases are applied to the UCM: Elderly father at home called by his daughter from her car, and disoriented grandma walking to her appointment at the medical clinic using the public transportation system. The two use cases are detailed with scenarios and corresponding prototypes. 24 tasks for elderly probands are developed and executed in a laboratory setting with 30 elderlies (including a questionnaire): Half of the tasks, namely twelve, are designed without the UCM and the other half with the application of the UCM. The time measurements to solve the tasks are evaluated using two statistical methods: The Euclidean distance and the Kullback-Leibler divergence of the measured data distributions and the corresponding Gaussian distributions are computed. The experiments demonstrate that the task execution durations were reduced by a factor of up to six due to the application of the UCM (compared to the situation without UCM). And the (qualitative) satisfaction factor of the probands increased by a factor of up to four for all tasks due to the seamless and multimodal UCM. These results show that the UCM supports communication for the elderly society in a seamless and intuitive way.Ingeniería, Industria y Construcció

Proceedings of the ETHICOMP 2022: Effectiveness of ICT ethics - How do we help solve ethical problems in the field of ICT?

This Ethicomp is again organized in exceptional times. Two previous ones were forced to turn to online conferences because of Covid-pandemic but it was decided that this one would be the physical one or cancelled as the need for real encounters and discussion between people are essential part of doing philosophy. We need possibility to meet people face to face and even part of the presentation were held distance–because of insurmountable problems of arriving by some authors– we manage to have real, physical conference, even the number of participants was smaller than previous conferences.The need of Ethicomp is underlined by the way world nowadays is portrayed for us. The truthfulness and argumentation seem to be replaced by lies, strategic games, hate and disrespect of humanity in personal, societal and even global communication. EThicomp is many times referred as community and therefore it is important that we as community do protect what Ethicomp stands for. We need to seek for goodness and be able to give argumentation what that goodness is. This lead us towards Habermass communicative action and Discourse ethics which encourages open and respectful discourse between people (see eg.Habermass 1984;1987;1996). However, this does not mean that we need to accept everything and everybody. We need to defend truthfulness, equality and demand those from others too. There are situations when some people should be removed from discussions if they neglect the demand for discourse. Because by giving voice for claims that have no respect for argumentation, lacks the respect of human dignity or are not ready for mutual understanding (or at least aiming to see possibility for it) we cannot have meaningful communication. This is visible in communication of all levels today and it should not be accepted, but resisted. It is duty of us all.</p

Construction, Operation and Maintenance of Network System(Junior Level)

This open access book follows the development rules of network technical talents, simultaneously placing its focus on the transfer of network knowledge, the accumulation of network skills, and the improvement of professionalism. Through the complete process from the elaboration of the theories of network technology to the analysis of application scenarios then to the design and implementation of case projects, readers are enabled to accumulate project experience and eventually acquire knowledge and cultivate their ability so as to lay a solid foundation for adapting to their future positions. This book comprises six chapters, which include “General Operation Safety of Network System,” “Cabling Project,” “Hardware Installation of Network System,” “Basic Knowledge of Network System,” “Basic Operation of Network System,” and “Basic Operation and Maintenance of Network System.” This book can be used for teaching and training for the vocational skills certification of network system construction, operation, and maintenance in the pilot work of Huawei’s “1+X” Certification System, and it is also suitable as a textbook for application-oriented universities, vocational colleges, and technical colleges. In the meantime, it can also serve as a reference book for technicians engaged in network technology development, network management and maintenance, and network system integration. As the world’s leading ICT (information and communications technology) infrastructure and intelligent terminal provider, Huawei Technologies Co., Ltd. has covered many fields such as data communication, security, wireless, storage, cloud computing, intelligent computing, and artificial intelligence. Taking Huawei network equipment (routers, switches, wireless controllers, and wireless access points) as the platform, and based on network engineering projects, this book organizes all the contents according to the actual needs of the industry