Car-to-Smartphone Interactions: Experimental Setup, Risk Analysis and Security Technologies

International audienceVehicle access control and in particular access to in-vehicle functionalities from smart mobile devices, e.g., phones or watches, has become an increasingly relevant topic. Security plays a critical part, due to both a long history of car keys that succumbed to attacks and recently reported intrusions that use various vehicle communication interfaces to further gain access to in-vehicle safety-critical components. In this work we discuss existing technologies and functionalities that should be embedded in an experimental setup that addresses such a scenario. We make emphasis on existing cryptographic technologies, from symmetric to asymmetric primitives, identity-based cryptography and group signatures. We also discuss risks associated with in-vehicle functionalities and mitigation, e.g., intrusion detection systems

Understanding Railway Trespassing in a South African City: The Case Of Cape Town

Trespassing behaviour is a problem for railway operations and manifests itself through train-pedestrian collisions, incidents of theft and vandalism to rail infrastructure, as well as encroachment on railway property. The study has consisted of a quantitative and a qualitative part. The quantitative part analyses demographic, temporal and spatial data on train-pedestrian fatalities and injuries, as well as data on occurrences of theft and malicious damage to rail infrastructure in the Cape Town Functional Region between 2015 and 2018. The qualitative part presents the perspective from a diverse group of subject matter experts, having explored opinions on trespassing behaviours and preventative measures. Additionally, the trespassing behaviour at several sites was investigated and a case study evaluation of the efficacy of a pilot Rail Enforcement Unit was carried out. There were 456 railway-related deaths during the study period with 330 of this being train-pedestrian collisions. There were 4715 occurrences of theft and malicious damage to railway assets over the period. Several hot-spot areas were identified via the data and interviews with experts and several sites chosen for further verification. Site visits confirmed widespread trespassing behaviours with the two worst locations recording an average of over 300 persons in a 15-minute period. The case study reviewing the effectiveness of the security and enforcement countermeasure revealed that occurrences of train-pedestrian incidents, as well as security occurrences have increased by 1.4% and 7.5% respectively. Evidence of geographical displacement of crime is evident, suggesting that enforcement countermeasures are temporarily effective and need to be considered in combination with other measures to ensure its durability. In conclusion, this research presents a detailed analysis of railway trespassing and its main effects in order to understand the problem locally. Different approaches are required to combat the various guises of railway trespassing. Certain countermeasures may well be within the rail operator's remit, but essentially, the nature of problems experienced by the rail operator is beyond a rail problem, and requires a systems approach involving multiple authoritie

NASA Capability Roadmaps Executive Summary

This document is the result of eight months of hard work and dedication from NASA, industry, other government agencies, and academic experts from across the nation. It provides a summary of the capabilities necessary to execute the Vision for Space Exploration and the key architecture decisions that drive the direction for those capabilities. This report is being provided to the Exploration Systems Architecture Study (ESAS) team for consideration in development of an architecture approach and investment strategy to support NASA future mission, programs and budget requests. In addition, it will be an excellent reference for NASA's strategic planning. A more detailed set of roadmaps at the technology and sub-capability levels are available on CD. These detailed products include key driving assumptions, capability maturation assessments, and technology and capability development roadmaps

Automated and intelligent hacking detection system

Dissertação de mestrado integrado em Informatics EngineeringThe Controller Area Network (CAN) is the backbone of automotive networking, connecting many Electronic ControlUnits (ECUs) that control virtually every vehicle function from fuel injection to parking sensors. It possesses,however, no security functionality such as message encryption or authentication by default. Attackers can easily inject or modify packets in the network, causing vehicle malfunction and endangering the driver and passengers. There is an increasing number of ECUs in modern vehicles, primarily driven by the consumer’s expectation of more features and comfort in their vehicles as well as ever-stricter government regulations on efficiency and emissions. Combined with vehicle connectivity to the exterior via Bluetooth, Wi-Fi, or cellular, this raises the risk of attacks. Traditional networks, such as Internet Protocol (IP), typically have an Intrusion Detection System (IDS) analysing traffic and signalling when an attack occurs. The system here proposed is an adaptation of the traditional IDS into the CAN bus using a One Class Support Vector Machine (OCSVM) trained with live, attack-free traffic. The system is capable of reliably detecting a variety of attacks, both known and unknown, without needing to understand payload syntax, which is largely proprietary and vehicle/model dependent. This allows it to be installed in any vehicle in a plug-and-play fashion while maintaining a large degree of accuracy with very few false positives.A Controller Area Network (CAN) é a principal tecnologia de comunicação interna automóvel, ligando muitas Electronic Control Units (ECUs) que controlam virtualmente todas as funções do veículo desde injeção de combustível até aos sensores de estacionamento. No entanto, não possui por defeito funcionalidades de segurança como cifragem ou autenticação. É possível aos atacantes facilmente injetarem ou modificarem pacotes na rede causando estragos e colocando em perigo tanto o condutor como os passageiros. Existe um número cada vez maior de ECUs nos veículos modernos, impulsionado principalmente pelas expectativas do consumidores quanto ao aumento do conforto nos seus veículos, e pelos cada vez mais exigentes regulamentos de eficiência e emissões. Isto, associada à conexão ao exterior através de tecnologias como o Bluetooth, Wi-Fi, ou redes móveis, aumenta o risco de ataques. Redes tradicionais, como a rede Internet Protocol (IP), tipicamente possuem um Intrusion Detection Systems (IDSs) que analiza o tráfego e assinala a presença de um ataque. O sistema aqui proposto é uma adaptação do IDS tradicional à rede CAN utilizando uma One Class Support Vector Machine (OCSVM) treinada com tráfego real e livre de ataques. O sistema é capaz de detetar com fiabilidade uma variedade de ataques, tanto conhecidos como desconhecidos, sem a necessidade de entender a sintaxe do campo de dados das mensagens, que é maioritariamente proprietária. Isto permite ao sistema ser instalado em qualquer veículo num modo plug-and-play enquanto mantém um elevado nível de desempenho com muito poucos falsos positivos

The Projected Al Qaeda Use of Body Cavity Suicide Bombs Against High Value Targets

This work is initially derived from a non-public disclosure series of early warning presentations, first delivered in September 2006, by the author on the projected terrorist use of body cavity suicide bombs against high value targets. Subsequent terrorist use of such a device, in August 2009 in Saudi Arabia by an Al Qaeda operative, has allowed for this body of research (along with post-incident analysis) to now be published in an open venue. The work provides a historical overview of the use of suicide bombs by military forces and terrorists; addresses the co-evolution of suicide bombs and countermeasures by security groups; analyzes future suicide bomb placement options; and explores Islamic views on the acceptability of foreign object placement in body cavities. It then focuses on issues pertaining to body cavity bomb placement options; bomb components, assembly, and detonation issues; putty, cheese, and the Fadhel al-Maliki incident; Al Qaeda use validation— the Abdullah al-Asiri incident; and concludes with a discussion on body cavity bomb countermeasures and strategic use implications. The work signifies the value of early warning and futures analysis applied to counter-terrorism activities and also highlights the tensions and inherent contradictions involved with individuals who wear the dual hats of practitioner and scholar. These individuals, given the requirements of operational security and secrecy, are challenged with ensuring that open discourse and publication in no way threatens the greater public good