Security Applications of Formal Language Theory

We present an approach to improving the security of complex, composed systems based on formal language theory, and show how this approach leads to advances in input validation, security modeling, attack surface reduction, and ultimately, software design and programming methodology. We cite examples based on real-world security flaws in common protocols representing different classes of protocol complexity. We also introduce a formalization of an exploit development technique, the parse tree differential attack, made possible by our conception of the role of formal grammars in security. These insights make possible future advances in software auditing techniques applicable to static and dynamic binary analysis, fuzzing, and general reverse-engineering and exploit development. Our work provides a foundation for verifying critical implementation components with considerably less burden to developers than is offered by the current state of the art. It additionally offers a rich basis for further exploration in the areas of offensive analysis and, conversely, automated defense tools and techniques. This report is divided into two parts. In Part I we address the formalisms and their applications; in Part II we discuss the general implications and recommendations for protocol and software design that follow from our formal analysis

Increasing security in the physical layer of wireless communication

This paper introduces a concept of increasing securing in the Physical layer (PHY) of wireless communication. It gives a short description of current status of wireless standards and their security. Despite the existence of advanced security protocols such as IEEE 802.11i or WLAN VPNs, wireless networks still remain vulnerable to denial-of-service (DoS) attacks aiming at PHY and Data Link Layers. The new solution challenges the problems with the currently defined PHY and Data Link layers. The concept introduced here, holds a promise of descending with some of the security measures to the lower layers of the TCP/IP and in this way not only increases security but also efficiency and performance. In addition this model would reduce management overhead and security architecture complexity. The proposed solution is dealing with: encryption implemented as part of modulation techniques as well as authentication procedures partially deployed within the first two layers of Open System Interconnection (OSI) protocol stack. The introduced model attempts to solve problems related to DoS that is focused on Data Link Layer, eavesdropping and man-in-the-middle (MITM) attacks. Additionally, there are presented some ideas for future research in the area of protection from malicious activity aimed at the PHY Layer – e.g., jamming attacks, as well as other security issues such as eavesdropping prevention by use of physics laws and tunnelling as another layer of protection to ensure privacy and signal robustness. The potential deployment of this technology embraces Wireless Local Area Networks (WLANs) as well as the emerging IEEE 802.16e (mobile WiMAX) standard. In this paper there are considered and analysed practical needs, defined necessary steps and set priorities. In the final part, there are presented challenges concerning the research and there is established a background for the consecutive papers

A Just and Sustainable Solution to the Boat People Predicament in Australia?

Since the year 2000, there have been close to two thousand deaths of asylum seekers at sea as a result of foiled attempts to travel to Australia in order to seek protection under the United Nations Convention and Protocol on the Status of Refugees.[1] Many thousands more have made it to shore. Growing numbers of irregular or unauthorized migrants attempting to reach the United States and the European Union has long been known as a contentious policy issue in these states, but perhaps less known is the situation on the other side of the Pacific. Australia is the eight-largest recipient of asylum seekers in the industrialized world, receiving around 4% of the global applications for asylum, a relatively minimal amount considering that the state has the capacity to take on a much greater burden of the international refugee crisis.[2] In addition, the policies that are currently in place are primarily seeking to deter the arrival of ‘boat people’ and associated people smuggling activity, rather than to constructively manage the flow while upholding the individual rights of those seeking refuge under international law. This paper deconstructs the restrictive policies of the Australian government and proposes a more sustainable solution, drawing widely from research literature, government publications and media reports that use both primary and secondary sources to build a strong case for an alternative program. The policy that I found best balances the costs and benefits for both the asylum seekers in question as well as the Australian government is a combination of short-term onshore detention and community-based processing and integration. There is a robust debate in Australia over refugees and asylum policy, but in order for such a bill to be feasible in the Australian context, a major transformation of the public’s attitude is essential. [1] The study sponsored by Monash University has compiled a database of border deaths, and has found that 1911 deaths have occurred at sea since 2000, how the true numbers are not known as there is no official government database that has been published. See: Macleod, Kenneth. Deadly Voyages: Border Related Deaths Associated with Australia. SBS News. April 23, 2015, and Australian Border Deaths Database. Monash University: The Border Crossing Observatory. October, 2014 and Bullock, Chris. Asylum Seekers: Drowning on Our Watch. ABC Radio National. September 1, 2013.[2] Australia Asylum: Why Is It Controversial? - BBC News. BBC News. December 5, 2014

Speaking the Local Dialect: Exploiting differences between IEEE 802.15.4 Receivers with Commodity Radios for fingerprinting, targeted attacks, and WIDS evasion

Producing IEEE 802.15.4 PHY-frames reliably accepted by some digital radio receivers, but rejected by others---depending on the receiver chip\u27s make and model---has strong implications for wireless security. Attackers could target specific receivers by crafting shaped charges, attack frames that appear valid to the intended target and are ignored by all other recipients. By transmitting in the unique, slightly non-compliant dialect of the intended receivers, attackers would be able to create entire communication streams invisible to others, including wireless intrusion detection and prevention systems (WIDS/WIPS). These scenarios are no longer theoretic. We present methods of producing such IEEE 802.15.4 frames with commodity digital radio chips widely used in building inexpensive 802.15.4-conformant devices. Typically, PHY-layer fingerprinting requires software-defined radios that cost orders of magnitude more than the chips they fingerprint; however, our methods do not require a software-defined radio and use the same inexpensive chips. Knowledge of such differences, and the ability to fingerprint them is crucial for defenders. We investigate new methods of fingerprinting IEEE 802.15.4 devices by exploring techniques to differentiate between multiple 802.15.4-conformant radio-hardware manufacturers and firmware distributions. Further, we point out the implications of these results for WIDS, both with respect to WIDS evasion techniques and countering such evasion

Iran\u27s Nuclear Program

Iran\u27s nuclear program is a serious issue for the international community, particularly Israel. Iran has sought greater uranium enrichment, most likely to develop nuclear arms. Many in the international community believe that Iran\u27s nuclear ambitions must be limited. Five possible options for slowing Iran\u27s nuclear development are sanctions, pre-emptive strikes, regime change, clandestine operations (to sabotage nuclear facilities and assassinate Iranian nuclear scientists) and to allow Iran to continue its nuclear development. These five options will be examined, and the pros and cons of the options will be analyze

Assessing the Competing Characteristics of Privacy and Safety within Vehicular Ad Hoc Networks

The introduction of Vehicle-to-Vehicle (V2V) communication has the promise of decreasing vehicle collisions, congestion, and emissions. However, this technology places safety and privacy at odds; an increase of safety applications will likely result in the decrease of consumer privacy. The National Highway Traffic Safety Administration (NHTSA) has proposed the Security Credential Management System (SCMS) as the back end infrastructure for maintaining, distributing, and revoking vehicle certificates attached to every Basic Safety Message (BSM). This Public Key Infrastructure (PKI) scheme is designed around the philosophy of maintaining user privacy through the separation of functions to prevent any one subcomponent from identifying users. However, because of the high precision of the data elements within each message this design cannot prevent large scale third-party BSM collection and pseudonym linking resulting in privacy loss. In addition, this philosophy creates an extraordinarily complex and heavily distributed system. In response to this difficulty, this thesis proposes a data ambiguity method to bridge privacy and safety within the context of interconnected vehicles. The objective in doing so is to preserve both Vehicle-to-Vehicle (V2V) safety applications and consumer privacy. A Vehicular Ad-Hoc Network (VANET) metric classification is introduced that explores five fundamental pillars of VANETs. These pillars (Safety, Privacy, Cost, Efficiency, Stability) are applied to four different systems: Non-V2V environment, the aforementioned SCMS, the group-pseudonym based Vehicle Based Security System (VBSS), and VBSS with Dithering (VBSS-D) which includes the data ambiguity method of dithering. By using these evaluation criteria, the advantages and disadvantages of bringing each system to fruition is showcased

The Cowl - v.77 - n.20 - Apr 11, 2013

The Cowl - student newspaper of Providence College. Vol 77 - No. 20 - April 11, 2013. 28 pages