Firmware enhancements for BYOD-aware network security

In today’s connected world, users migrate within a complex set of networks, including, but not limited to, 3G and 4G (LTE) services provided by mobile operators, Wi-Fi hotspots in private and public places, as well as wireless and/or wired LAN access in business and home environments. Following the widely expanding Bring Your Own Device (BYOD) approach, many public and educational institutions have begun to encourage customers and students to use their own devices at all times. While this may be cost-effective in terms of decreased investments in hardware and consequently lower maintenance fees on a long-term basis, it may also involve some security risks. In particular, many users are often connected to more than one network and/or communication service provider at the same time, for example to a 3G/4G mobile network and to a Wi-Fi. In a BYOD setting, an infected device or a rogue one can turn into an unwanted gateway, causing a security breach by leaking information across networks. Aiming at investigating in greater detail the implications of BYOD on network security in private and business settings we are building a framework for experiments with mobile routers both in home and business networks. This is a continuation of our earlier work on communications and services with enhanced security for network appliances

MySmartPi

Nowadays, accessing the Internet in a secure way in a big concern for many people due to the increase of cybersecurity attacks and the vulnerability of the data that is transferred online. In order to address such vulnerabilities, the use of a Virtual Private Network is really important. Not only for security reasons, but also to access resources of the network, such as printers, files or web pages. Considering that many people, especially IT students, have curiosity and enjoy creating their own technologies, this project aims to create a user manual to teach how people can create their own VPN server at home using a Raspberry Pi and to access their files and folders which are in the network. For that, tutorials were used and adapted in order to install the VPN server and NAS. In order to prove that the whole process was successful, some tools, such as, Wireshark, were used to show how the network traffic works once the VPN is used. The process was successful and many concepts were learnt and used such as Cryptography, Port forwarding, dynamic DNS, OpenVPN, etc

Adaptive Traffic Fingerprinting for Darknet Threat Intelligence

Darknet technology such as Tor has been used by various threat actors for organising illegal activities and data exfiltration. As such, there is a case for organisations to block such traffic, or to try and identify when it is used and for what purposes. However, anonymity in cyberspace has always been a domain of conflicting interests. While it gives enough power to nefarious actors to masquerade their illegal activities, it is also the cornerstone to facilitate freedom of speech and privacy. We present a proof of concept for a novel algorithm that could form the fundamental pillar of a darknet-capable Cyber Threat Intelligence platform. The solution can reduce anonymity of users of Tor, and considers the existing visibility of network traffic before optionally initiating targeted or widespread BGP interception. In combination with server HTTP response manipulation, the algorithm attempts to reduce the candidate data set to eliminate client-side traffic that is most unlikely to be responsible for server-side connections of interest. Our test results show that MITM manipulated server responses lead to expected changes received by the Tor client. Using simulation data generated by shadow, we show that the detection scheme is effective with false positive rate of 0.001, while sensitivity detecting non-targets was 0.016+-0.127. Our algorithm could assist collaborating organisations willing to share their threat intelligence or cooperate during investigations.Comment: 26 page

Secure ADS-B: Towards Airborne Communications Security in the Federal Aviation Administration\u27s Next Generation Air Transportation System

The U.S. Congress has mandated that all aircraft operating within the National Airspace System, military or civilian, be equipped with ADS-B transponders by the year 2020. The ADS-B aircraft tracking system, part of the Federal Aviation Administration\u27s NextGen overhaul of the Air Transportation System, replaces Radar-based surveillance with a more accurate satellite-based surveillance system. However, the unencrypted nature of ADS-B communication poses an operational security risk to military and law enforcement aircraft conducting sensitive missions. The non-standard format of its message and the legacy communication channels used by its transponders make the ADS-B system unsuitable for traditional encryption mechanisms. FPE, a recent development in cryptography, provides the ability to encrypt arbitrarily formatted data without padding or truncation. Indeed, three new algorithms recommended by the NIST, may be suitable for encryption of ADS-B messages. This research assesses the security and hardware performance characteristics of the FF1, FF2, and FF3 algorithms, in terms of entropy of ciphertext, operational latency and resource utilization when implemented on a Field-Programmable Gate Array. While all of the algorithms inherit the security characteristics of the underlying AES block cipher, they exhibit differences in their performance profiles. Findings demonstrate that a Bump-in-the-Wire FPE cryptographic engine is a suitable solution for retrofitting encryption to ADS-B communication