Shimware: Toward Practical Security Retrofitting for Monolithic Firmware Images

In today’s era of the Internet of Things, we are surrounded by security- and safety-critical, network-connected devices. In parallel with the rise in attacks on such devices, we have also seen an increase in devices that are abandoned, reached the end of their support periods, or will not otherwise receive future security updates. While this issue exists for a wide array of devices, those that use monolithic firmware, where the code and data are opaquely intermixed, have traditionally been difficult to examine and protect. In this paper, we explore the challenges of retrofitting monolithic firmware images with new security measures. First, we outline the steps any analyst must take to retrofit firmware, and show that previous work is missing crucial aspects of the process, which are required for a practical solution. We then automate three of these aspects-locating attacker-controlled input, a safe retrofit injection location, and self-checks preventing modifications-through the use of novel automated program analysis techniques. We assemble these analyses into a system, Shimware, that can simplify and facilitate the process of creating a retrofitted firmware image, once the vulnerability is identified. To evaluate Shimware, we employ both a synthetic evaluation and actual retrofitting of three case study devices: a networked bench power supply, a Bluetooth-enabled cardiac implant monitor, and a high-end programmable logic controller (PLC). Not only could our system identify the correct sources of input, injection locations, and self-checks, but it injected payloads to correct serious safety and security-critical vulnerabilities in these devices.</p

Targeted lipidomics distinguishes patient subgroups in mild cognitive impairment (MCI) and late onset Alzheimer's disease (LOAD)

AbstractBackgroundDiverse research approaches support the concept that a clinical diagnosis of Late-Onset Alzheimer's Disease (LOAD) does not distinguish between subpopulations with differing neuropathologies, including dementia patients with amyloid deposition and dementia patients without amyloid deposition but with cortical thinning. Mild cognitive impairment (MCI) is generally considered the prodromal phase for LOAD, however, while a number of studies have attempted to define plasma biomarkers for the conversion of MCI to LOAD, these studies have not taken into account the heterogeneity of patient cohorts within a clinical phenotype.MethodsStudies of MCI and LOAD in several laboratories have demonstrated decrements in ethanolamine plasmalogen levels in plasma and brain and increased levels of diacylglycerols in plasma and brain. To further extend these studies and to address the issue of heterogeneity in MCI and LOAD patient groups we investigated the levels of diacylglycerols and ethanolamine plasmalogens in larger cohorts of patients utilizing, high-resolution (0.2 to 2ppm mass error) mass spectrometry.ResultsFor the first time, our lipidomics data clearly stratify both MCI and LOAD subjects into 3 different patient cohorts within each clinical diagnosis. These include i) patients with lower circulating ethanolamine plasmalogen levels; ii) patients with augmented plasma diacylglycerol levels; and iii) patients with neither of these lipid alterations.ConclusionsThese represent the first serum biochemical data to stratify MCI and LOAD patients, advancing efforts to biochemically define patient heterogeneity in cognitive disorders.General significanceLipidomics offers a new approach for identifying biomarkers and biological targets in cognitive disorders

Overconfidence, incentives and digit ratio

This paper contributes to a better understanding of the biological underpinnings of overconfidence by analyzing performance predictions in the Cognitive Reflection Test with and without monetary incentives. In line with the existing literature we find that the participants are too optimistic about their performance on average; incentives lead to higher performance; and males score higher than females on this particular task. The novelty of this paper is an analysis of the relation between participants’ performance prediction accuracy and their second to fourth digit ratio. It has been reported that the digit ratio is a negatively correlated bio-marker of prenatal testosterone exposure. In the un-incentivized treatment, we find that males with low digit ratios, on average, are significantly more overconfident about their performance. In the incentivized treatment, however, we observe that males with low digit ratios, on average, are less overconfident about their performance. These effects are not observed in females. We discuss how these findings fit into the literature on testosterone and decision making and how they might help to explain seemingly opposing evidence

L’influence des relations familiales et sociales sur la consommation de médicaments psychotropes chez les personnes âgées

Les psychotropes occupent le deuxième rang dans la consommation de médicaments chez les personnes âgées. L'objectif de cette étude est de vérifier un modèle explicatif de la consommation de psychotropes dans cette population. Notre principale hypothèse est que la qualité des relations qu'entretient une personne âgée avec autrui, et particulièrement avec ses enfants, a une influence directe sur son bien-être psychologique, lequel a une influence directe sur la non-consommation de psychotropes. Une enquête a été réalisée auprès d'un échantillon de 500 personnes âgées de 65 à 84 ans, vivant à domicile. Au cours des trois mois précédant l'entrevue, 31,8 % des répondants ont consommé des psychotropes. Les données empiriques n'ayant pas permis de vérifier le modèle théorique retenu, des analyses multivariées ont conduit à l'élaboration d'un modèle explicatif de la consommation qui met en évidence que le bien-être psychologique et la santé sont les meilleurs prédicteurs de cette consommation. Un bien-être psychologique élevé diminue la consommation alors qu'un mauvais état de santé l'augmente. Les relations sociales influencent directement le bien-être psychologique alors que les relations familiales ont un effet de moindre importance. Le modèle explicatif proposé explique 13 % du phénomène de la consommation de psychotropes chez les personnes âgées.Psychotropic drugs are the second most commonly used medication by Quebec's elderly. The objective of this study is to test a theoretical model of psychotropic drug use in the elderly. The principal hypothesis is that the quality of relationships the elderly person has with others, particularly with his or her children, has a direct influence on his or her psychological well-being, which, in turn, directly affects the consumption of psychotropic agents. A survey was conducted on a sample of 500 elderly people, aged 65-84 years, living at home. 31.8% of the respondents used psychotropic drugs during the three-month period preceding the interview. Path analysis led to the elaboration of a modified model for the consumption of psychotropic drugs by the elderly which indicates that the best predictors of consumption are both the psychological well-being and the state of health of the individual. More elevated is the psychological well-being, less is the consumption of psychotropic drugs, whereas poor health condition increases it. The quality of an individual's social relationships has a direct influence on his or her psychological well-being, whereas family relationships are of lesser importance. Our model accounts for 13% of the predictors of psychotropic consumption by the elderly

Astrophysics with the Laser Interferometer Space Antenna

Laser Interferometer Space Antenna (LISA) will be a transformative experiment for gravitational wave astronomy as it will offer unique opportunities to address many key astrophysical questions in a completely novel way. The synergy with ground-based and other space-based instruments in the electromagnetic domain, by enabling multi-messenger observations, will add further to the discovery potential of LISA. The next decade is crucial to prepare the astrophysical community for LISA's first observations. This review outlines the extensive landscape of astrophysical theory, numerical simulations, and astronomical observations that are instrumental for modeling and interpreting the upcoming LISA datastream. To this aim, the current knowledge in three main source classes for LISA is reviewed: ultra-compact stellar-mass binaries, massive black hole binaries, and extreme or intermediate mass ratio inspirals. The relevant astrophysical processes and the established modeling techniques are summarized. Likewise, open issues and gaps in our understanding of these sources are highlighted, along with an indication of how LISA could help make progress in the different areas. New research avenues that LISA itself, or its joint exploitation with studies in the electromagnetic domain, will enable, are also illustrated. Improvements in modeling and analysis approaches, such as the combination of numerical simulations and modern data science techniques, are discussed. This review is intended to be a starting point for using LISA as a new discovery tool for understanding our Universe