Engineering needs environmental and global thinkers: a contextual analysis of student learning preferences

The need for engineering graduates who are environmentally and globally aware is now a recognised priority in professional practice. This paper presents an analysis of learning preferences of entry level students in a course which builds an early awareness of global environmental practice. The course on Engineering and the Environment started in 1991 as part of the undergraduate Environmental Engineering program at RMIT University. Subsequently the course was extended to Geological and then to Civil Engineering programs. The curriculum has paralleled the development of environmental practice in the professions of engineering and mining and provides a fundamental environmental context for students' subsequent learning in their programs and on-going professional practice. Curriculum development and some specific learning activities are briefly outlined. A challenge has been how to engage a diverse and increasingly large cohort of almost several hundred students in "non traditional" engineering lectures. A detailed analysis of student responses to a set of multiple choice exam questions has been conducted to test the hypothesis that various factors such as student choice of program may influence receptivity to different modes of learning and curriculum content. The study shows no significant difference between the various groups in regards to preference for evaluative type environmental learning, versus more traditional factual based engineering learning

Gender differences in outcomes of patients with cystic fibrosis

Background: Cystic fibrosis (CF) is a common life-shortening genetic disease in which women have been described to have worse outcomes than males, particularly in response to respiratory infections with Pseudomonas aeruginosa. However, as advancements in therapies have improved life expectancy, this gender disparity has been challenged. The objective of this study is to examine whether a gender-based survival difference still exists in this population and determine the impact of common CF respiratory infections on outcomes in males versus females with CF. Methods: We conducted a retrospective cohort analysis of 32,766 patients from the United States Cystic Fibrosis Foundation Patient Registry over a 13-year period. Kaplan-Meier and Cox proportional hazards models were used to compare overall mortality and pathogen based survival rates in males and females. Results: Females demonstrated a decreased median life expectancy (36.0 years; 95% confidence interval [CI] 35.0–37.3) compared with men (38.7 years; 95% CI 37.8–39.6; p<0.001). Female gender proved to be a significant risk factor for death (hazard ratio 2.22, 95% CI 1.79–2.77), despite accounting for variables known to influence CF mortality. Women were also found to become colonized earlier with several bacteria and to have worse outcomes with common CF pathogens. Conclusions: CF women continue to have a shortened life expectancy relative to men despite accounting for key CF-related comorbidities. Women also become colonized with certain common CF pathogens earlier than men and show a decreased life expectancy in the setting of respiratory infections. Explanations for this gender disparity are only beginning to be unraveled and further investigation into mechanisms is needed to help develop therapies that may narrow this gender gap

HardIDX: Practical and Secure Index with SGX

Software-based approaches for search over encrypted data are still either challenged by lack of proper, low-leakage encryption or slow performance. Existing hardware-based approaches do not scale well due to hardware limitations and software designs that are not specifically tailored to the hardware architecture, and are rarely well analyzed for their security (e.g., the impact of side channels). Additionally, existing hardware-based solutions often have a large code footprint in the trusted environment susceptible to software compromises. In this paper we present HardIDX: a hardware-based approach, leveraging Intel's SGX, for search over encrypted data. It implements only the security critical core, i.e., the search functionality, in the trusted environment and resorts to untrusted software for the remainder. HardIDX is deployable as a highly performant encrypted database index: it is logarithmic in the size of the index and searches are performed within a few milliseconds rather than seconds. We formally model and prove the security of our scheme showing that its leakage is equivalent to the best known searchable encryption schemes. Our implementation has a very small code and memory footprint yet still scales to virtually unlimited search index sizes, i.e., size is limited only by the general - non-secure - hardware resources

A rapid non-destructive DNA extraction method for insects and other arthropods

Preparation of arthropods for morphological identification often damages or destroys DNA within the specimen. Conversely, DNA extraction methods often destroy the external physical characteristics essential for morphological identification. We have developed a rapid, simple and non-destructive DNA extraction technique for arthropod specimens. This technique was tested on four arthropod orders, using specimens that were fresh, preserved by air drying, stored in ethanol, or collected with sticky or propylene glycol traps. The technique could be completed in twenty minutes for Coleoptera, Diptera and Hemiptera, and two minutes for the subclass Acarina, without significant distortion, discolouration, or other damage to the specimens

Targeted Automatic Integer Overflow Discovery Using Goal-Directed Conditional Branch Enforcement

We present a new technique and system, DIODE, for auto- matically generating inputs that trigger overflows at memory allocation sites. DIODE is designed to identify relevant sanity checks that inputs must satisfy to trigger overflows at target memory allocation sites, then generate inputs that satisfy these sanity checks to successfully trigger the overflow. DIODE works with off-the-shelf, production x86 binaries. Our results show that, for our benchmark set of applications, and for every target memory allocation site exercised by our seed inputs (which the applications process correctly with no overflows), either 1) DIODE is able to generate an input that triggers an overflow at that site or 2) there is no input that would trigger an overflow for the observed target expression at that site.United States. Defense Advanced Research Projects Agency (Grant FA8650-11-C-7192

SoK : Remote Power Analysis

In recent years, numerous attacks have appeared that aim to steal secret information from their victim using the power side-channel vector, yet without direct physical access. These attacks are called Remote Power Attacks or Remote Power Analysis, utilizing resources that are natively present inside the victim environment. However, there is no unified definition about the limitations that a power attack requires to be defined as remote. This paper aims to propose a unified definition and concrete threat models to clearly differentiate remote power attacks from non-remote ones. Additionally, we collect the main remote power attacks performed so far from the literature, and the principal proposed countermeasures to avoid them. The search of such countermeasures denoted a clear gap in preventing remote power attacks at the technical level. Thus, the academic community must face an important challenge to avoid this emerging threat, given the clear room for improvement that should be addressed in terms of defense and security of devices that work with private information.acceptedVersionPeer reviewe

Validation of Memory Accesses Through Symbolic Analyses

International audienceThe C programming language does not prevent out-of- bounds memory accesses. There exist several techniques to secure C programs; however, these methods tend to slow down these programs substantially, because they populate the binary code with runtime checks. To deal with this prob- lem, we have designed and tested two static analyses - sym- bolic region and range analysis - which we combine to re- move the majority of these guards. In addition to the analy- ses themselves, we bring two other contributions. First, we describe live range splitting strategies that improve the effi- ciency and the precision of our analyses. Secondly, we show how to deal with integer overflows, a phenomenon that can compromise the correctness of static algorithms that validate memory accesses. We validate our claims by incorporating our findings into AddressSanitizer. We generate SPEC CINT 2006 code that is 17% faster and 9% more energy efficient than the code produced originally by this tool. Furthermore, our approach is 50% more effective than Pentagons, a state- of-the-art analysis to sanitize memory accesses

Attestation Waves : Platform Trust via Remote Power Analysis

Attestation is a strong tool to verify the integrity of an untrusted system. However, in recent years, different attacks have appeared that are able to mislead the attestation process with treacherous practices as memory copy, proxy, and rootkit attacks, just to name a few. A successful attack leads to systems that are considered trusted by a verifier system, while the prover has bypassed the challenge. To mitigate these attacks against attestation methods and protocols, some proposals have considered the use of side-channel information that can be measured externally, as it is the case of electromagnetic (EM) emanation. Nonetheless, these methods require the physical proximity of an external setup to capture the EM radiation. In this paper, we present the possibility of performing attestation by using the side-channel information captured by a sensor or peripheral that lives in the same System-on-Chip (SoC) than the processor system (PS) which executes the operation that we aim to attest, by only sharing the Power Distribution Network (PDN). In our case, an analog-to-digital converter (ADC) that captures the voltage fluctuations at its input terminal while a certain operation is taking place is suitable to characterize itself and to distinguish it from other binaries. The resultant power traces are enough to clearly identify a given operation without the requirement of physical proximity.acceptedVersionPeer reviewe

MicroWalk: A Framework for Finding Side Channels in Binaries

Microarchitectural side channels expose unprotected software to information leakage attacks where a software adversary is able to track runtime behavior of a benign process and steal secrets such as cryptographic keys. As suggested by incremental software patches for the RSA algorithm against variants of side-channel attacks within different versions of cryptographic libraries, protecting security-critical algorithms against side channels is an intricate task. Software protections avoid leakages by operating in constant time with a uniform resource usage pattern independent of the processed secret. In this respect, automated testing and verification of software binaries for leakage-free behavior is of importance, particularly when the source code is not available. In this work, we propose a novel technique based on Dynamic Binary Instrumentation and Mutual Information Analysis to efficiently locate and quantify memory based and control-flow based microarchitectural leakages. We develop a software framework named \tool~for side-channel analysis of binaries which can be extended to support new classes of leakage. For the first time, by utilizing \tool, we perform rigorous leakage analysis of two widely-used closed-source cryptographic libraries: \emph{Intel IPP} and \emph{Microsoft CNG}. We analyze $15$ different cryptographic implementations consisting of $112$ million instructions in about $105$ minutes of CPU time. By locating previously unknown leakages in hardened implementations, our results suggest that \tool~can efficiently find microarchitectural leakages in software binaries