Exploitation from Malicious PCI Express Peripherals

The thesis of this dissertation is that, despite widespread belief in the security community, systems are still vulnerable to attacks from malicious peripherals delivered over the PCI Express (PCIe) protocol. Malicious peripherals can be plugged directly into internal PCIe slots, or connected via an external Thunderbolt connection. To prove this thesis, we designed and built a new PCIe attack platform. We discovered that a simple platform was insufficient to carry out complex attacks, so created the first PCIe attack platform that runs a full, conventional OS. To allows us to conduct attacks against higher-level OS functionality built on PCIe, we made the attack platform emulate in detail the behaviour of an Intel 82574L Network Interface Controller (NIC), by using a device model extracted from the QEMU emulator. We discovered a number of vulnerabilities in the PCIe protocol itself, and with the way that the defence mechanisms it provides are used by modern OSs. The principal defence mechanism provided is the Input/Output Memory Management Unit (IOMMU). The remaps the address space used by peripherals in 4KiB chunks, and can prevent access to areas of address space that a peripheral should not be able to access. We found that, contrary to belief in the security community, the IOMMUs in modern systems were not designed to protect against attacks from malicious peripherals, but to allow virtual machines direct access to real hardware. We discovered that use of the IOMMU is patchy even in modern operating systems. Windows effectively does not use the IOMMU at all; macOS opens windows that are shared by all devices; Linux and FreeBSD map windows into host memory separately for each device, but only if poorly documented boot flags are used. These OSs make no effort to ensure that only data that should be visible to the devices is in the mapped windows. We created novel attacks that subverted control flow and read private data against systems running macOS, Linux and FreeBSD with the highest level of relevant protection enabled. These represent the first use of the relevant exploits in each case. In the final part of this thesis, we evaluate the suitability of a number of proposed general purpose and specific mitigations against DMA attacks, and make a number of recommendations about future directions in IOMMU software and hardware.EPSRC and ARM iCASE Awar

Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals

Direct Memory Access (DMA) attacks have been known for many years: DMA-enabled I/O peripherals have complete access to the state of a computer and can fully compromise it including reading and writing all of system memory. With the popularity of Thunderbolt 3 over USB Type-C and smart internal devices, opportunities for these attacks to be performed casually with only seconds of physical access to a computer have greatly broadened. In response, commodity hardware and operating-system (OS) vendors have incorporated support for Input-Output Memory Management Units (IOMMUs), which impose memory protection on DMA, and are widely believed to protect against DMA attacks. We investigate the state-of-the-art in IOMMU protection across OSes using a novel I/O security research platform, and find that current protections fall short when faced with a functional network peripheral that uses its complex interactions with the OS for ill intent, and demonstrate compromises against macOS, FreeBSD, and Linux, which notionally utilize IOMMUs to protect against DMA attackers. Windows only uses the IOMMU in limited cases and remains vulnerable. Using Thunderclap, an open-source FPGA research platform we built, we explore a number of novel exploit techniques to expose new classes of OS vulnerability. The complex vulnerability space for IOMMU-exposed shared memory available to DMA-enabled peripherals allows attackers to extract private data (sniffing cleartext VPN traffic) and hijack kernel control flow (launching a root shell) in seconds using devices such as USB-C projectors or power adapters. We have worked closely with OS vendors to remedy these vulnerability classes, and they have now shipped substantial feature improvements and mitigations as a result of our work.DARPA I2O FA8750-10-C-0237 ("CTSRD") DARPA MTO HR0011- 18-C-0016 ("ECATS") Arm Ltd Google Inc This work was also supported by EPSRC EP/R012458/1 (“IOSEC”)

Discordant and heterogeneous clinically relevant genomic alterations in circulating tumor cells vs plasma DNA from men with metastatic castration resistant prostate cancer

Circulating tumor cell (CTC) and cellâ free (cf) DNAâ based genomic alterations are increasingly being used for clinical decisionâ making in oncology. However, the concordance and discordance between paired CTC and cfDNA genomic profiles remain largely unknown. We performed comparative genomic hybridization (CGH) on CTCs and cfDNA, and lowâ pass whole genome sequencing (lpWGS) on cfDNA to characterize genomic alterations (CNA) and tumor content in two independent prospective studies of 93 men with mCRPC treated with enzalutamide/abiraterone, or radiumâ 223. Comprehensive analysis of 69 patient CTCs and 72 cfDNA samples from 93 men with mCRPC, including 64 paired samples, identified common concordant gains in FOXA1, AR, and MYC, and losses in BRCA1, PTEN, and RB1 between CTCs and cfDNA. Concordant PTEN loss and discordant BRCA2 gain were associated with significantly worse outcomes in Epic ARâ V7 negative men with mCRPC treated with abiraterone/enzalutamide. We identified and externally validated CTCâ specific genomic alternations that were discordant in paired cfDNA, even in samples with high tumor content. These CTC/cfDNAâ discordant regions included key genomic regulators of lineage plasticity, osteomimicry, and cellular differentiation, including MYCN gain in CTCs (31%) that was rarely detected in cfDNA. CTC MYCN gain was associated with poor clinical outcomes in ARâ V7 negative men and small cell transformation. In conclusion, we demonstrated concordance of multiple genomic alterations across CTC and cfDNA platforms; however, some genomic alterations displayed substantial discordance between CTC DNA and cfDNA despite the use of identical copy number analysis methods, suggesting tumor heterogeneity and divergent evolution associated with poor clinical outcomes.Peer Reviewedhttps://deepblue.lib.umich.edu/bitstream/2027.42/153751/1/gcc22824.pdfhttps://deepblue.lib.umich.edu/bitstream/2027.42/153751/2/gcc22824_am.pd

Low serum cortisol predicts early death following acute myocardial infarction

<b>Objective</b>: Low serum cortisol concentrations have been associated with adverse prognosis in critical illness of diverse aetiology. We aimed to determine whether low serum cortisol concentrations are associated with adverse prognosis in patients with acute myocardial infarction. <b>Design</b>: Nested case-control study. <b>Setting</b>: Prospective cohort study of consecutive patients admitted with acute myocardial infarction to 9 Scottish hospitals. <b>Patients</b>: 100 patients who survived 30 days (controls) and 100 patients who died within 30 days (cases). <b>Measurements and Main Results</b>: Admission cortisol concentrations were lower in patients who died than those who survived (median 1,189 versus 1,355 nmol/L, p<0.001). A cortisol concentration in the bottom quartile (<1,136 nmol/L) was a strong predictor of death within 30 days, and remained so after adjustment for age and cardiac troponin concentration (adjusted OR 8.78, 95% CI 3.09-24.96, p<0.001). <b>Conclusions</b>: Patients who mount a lesser cortisol stress response to acute myocardial infarction have a poorer early prognosis

Genome-wide association study identifies a variant in HDAC9 associated with large vessel ischemic stroke

Genetic factors have been implicated in stroke risk but few replicated associations have been reported. We conducted a genome-wide association study (GWAS) in ischemic stroke and its subtypes in 3,548 cases and 5,972 controls, all of European ancestry. Replication of potential signals was performed in 5,859 cases and 6,281 controls. We replicated reported associations between variants close to PITX2 and ZFHX3 with cardioembolic stroke, and a 9p21 locus with large vessel stroke. We identified a novel association for a SNP within the histone deacetylase 9(HDAC9) gene on chromosome 7p21.1 which was associated with large vessel stroke including additional replication in a further 735 cases and 28583 controls (rs11984041, combined P = 1.87×10−11, OR=1.42 (95% CI) 1.28-1.57). All four loci exhibit evidence for heterogeneity of effect across the stroke subtypes, with some, and possibly all, affecting risk for only one subtype. This suggests differing genetic architectures for different stroke subtypes

Leaders, leadership and future primary care clinical research

Background: A strong and self confident primary care workforce can deliver the highest quality care and outcomes equitably and cost effectively. To meet the increasing demands being made of it, primary care needs its own thriving research culture and knowledge base. Methods: Review of recent developments supporting primary care clinical research. Results: Primary care research has benefited from a small group of passionate leaders and significant investment in recent decades in some countries. Emerging from this has been innovation in research design and focus, although less is known of the effect on research output. Conclusion: Primary care research is now well placed to lead a broad re-vitalisation of academic medicine, answering questions of relevance to practitioners, patients, communities and Government. Key areas for future primary care research leaders to focus on include exposing undergraduates early to primary care research, integrating this early exposure with doctoral and postdoctoral research career support, further expanding cross disciplinary approaches, and developing useful measures of output for future primary care research investment

Accurate and Rapid Estimation of Phosphene Thresholds (REPT)

To calibrate the intensity of transcranial magnetic stimulation (TMS) at the occipital pole, the phosphene threshold is used as a measure of cortical excitability. The phosphene threshold (PT) refers to the intensity of magnetic stimulation that induces illusory flashes of light (phosphenes) on a proportion of trials. The existing PT estimation procedures lack the accuracy and mathematical rigour of modern threshold estimation methods. We present an improved and automatic procedure for estimating the PT which is based on the well-established Ψ Bayesian adaptive staircase approach. To validate the new procedure, we compared it with another commonly used procedure for estimating the PT. We found that our procedure is more accurate, reliable, and rapid when compared with an existing PT measurement procedure. The new procedure is implemented in Matlab and works automatically with the Magstim Rapid2 stimulator using a convenient graphical user interface. The Matlab program is freely available for download

Genetics of the thrombomodulin-endothelial cell protein C receptor system and the risk of early-onset ischemic stroke

Background and purpose Polymorphisms in coagulation genes have been associated with early-onset ischemic stroke. Here we pursue an a priori hypothesis that genetic variation in the endothelial-based receptors of the thrombomodulin-protein C system (THBD and PROCR) may similarly be associated with early-onset ischemic stroke. We explored this hypothesis utilizing a multi-tage design of discovery and replication. Methods Discovery was performed in the Genetics-of-Early-Onset Stroke (GEOS) Study, a biracial population-based case-control study of ischemic stroke among men and women aged 1549 including 829 cases of first ischemic stroke (42.2% African-American) and 850 age-comparable stroke-free controls (38.1% African-American). Twenty-four single-nucleotide-polymorphisms (SNPs) in THBD and 22 SNPs in PROCR were evaluated. Following LD pruning (r(2)>= 0.8), we advanced uncorrelated SNPs forward for association analyses. Associated SNPs were evaluated for replication in an early-onset ischemic stroke population (onset-ge Results Among GEOS Caucasians, PROCR rs9574, which was in strong LD with 8 other SNPs, and one additional independent SNP rs2069951, were significantly associated with ischemic stroke (rs9574, OR = 1.33, p = 0.003; rs2069951, OR = 1.80, p = 0.006) using an additive-model adjusting for age, gender and population-structure. Adjusting for risk factors did not change the associations; however, associations were strengthened among those without risk factors. PROCR rs9574 also associated with early-onset ischemic stroke in the replication sample (OR = 1.08, p = 0.015), but not older-onset stroke. There were no PROCR associations in African-Americans, nor were there any THBD associations in either ethnicity. Conclusion PROCR polymorphisms are associated with early-onset ischemic stroke in Caucasians.Peer reviewe

Contribution of Common Genetic Variants to Risk of Early-Onset Ischemic Stroke

Background and Objectives Current genome-wide association studies of ischemic stroke have focused primarily on late-onset disease. As a complement to these studies, we sought to identify the contribution of common genetic variants to risk of early-onset ischemic stroke. Methods We performed a meta-analysis of genome-wide association studies of early-onset stroke (EOS), ages 18-59 years, using individual-level data or summary statistics in 16,730 cases and 599,237 nonstroke controls obtained across 48 different studies. We further compared effect sizes at associated loci between EOS and late-onset stroke (LOS) and compared polygenic risk scores (PRS) for venous thromboembolism (VTE) between EOS and LOS. Results We observed genome-wide significant associations of EOS with 2 variants in ABO, a known stroke locus. These variants tag blood subgroups O1 and A1, and the effect sizes of both variants were significantly larger in EOS compared with LOS. The odds ratio (OR) for rs529565, tagging O1, was 0.88 (95% confidence interval [CI]: 0.85-0.91) in EOS vs 0.96 (95% CI: 0.92-1.00) in LOS, and the OR for rs635634, tagging A1, was 1.16 (1.11-1.21) for EOS vs 1.05 (0.99-1.11) in LOS; p-values for interaction = 0.001 and 0.005, respectively. Using PRSs, we observed that greater genetic risk for VTE, another prothrombotic condition, was more strongly associated with EOS compared with LOS (p = 0.008). Discussion The ABO locus, genetically predicted blood group A, and higher genetic propensity for venous thrombosis are more strongly associated with EOS than with LOS, supporting a stronger role of prothrombotic factors in EOS.Peer reviewe

Phylogenetic ctDNA analysis depicts early-stage lung cancer evolution.

The early detection of relapse following primary surgery for non-small-cell lung cancer and the characterization of emerging subclones, which seed metastatic sites, might offer new therapeutic approaches for limiting tumour recurrence. The ability to track the evolutionary dynamics of early-stage lung cancer non-invasively in circulating tumour DNA (ctDNA) has not yet been demonstrated. Here we use a tumour-specific phylogenetic approach to profile the ctDNA of the first 100 TRACERx (Tracking Non-Small-Cell Lung Cancer Evolution Through Therapy (Rx)) study participants, including one patient who was also recruited to the PEACE (Posthumous Evaluation of Advanced Cancer Environment) post-mortem study. We identify independent predictors of ctDNA release and analyse the tumour-volume detection limit. Through blinded profiling of postoperative plasma, we observe evidence of adjuvant chemotherapy resistance and identify patients who are very likely to experience recurrence of their lung cancer. Finally, we show that phylogenetic ctDNA profiling tracks the subclonal nature of lung cancer relapse and metastasis, providing a new approach for ctDNA-driven therapeutic studies