Side-channel based intrusion detection for industrial control systems

Industrial Control Systems are under increased scrutiny. Their security is historically sub-par, and although measures are being taken by the manufacturers to remedy this, the large installed base of legacy systems cannot easily be updated with state-of-the-art security measures. We propose a system that uses electromagnetic side-channel measurements to detect behavioural changes of the software running on industrial control systems. To demonstrate the feasibility of this method, we show it is possible to profile and distinguish between even small changes in programs on Siemens S7-317 PLCs, using methods from cryptographic side-channel analysis.Comment: 12 pages, 7 figures. For associated code, see https://polvanaubel.com/research/em-ics/code

Scanning Tunneling Microscopy and Tunneling Luminescence of the Surface of GaN Films Grown by Vapor Phase Epitaxy

We report scanning tunneling microscopy (STM) images of surfaces of GaN films and the observation of luminescence from those films induced by highly spatially localized injection of electrons or holes using STM. This combination of scanning tunneling luminescence (STL) with STM for GaN surfaces and the ability to observe both morphology and luminescence in GaN is the first step to investigate possible correlations between surface morphology and optical properties.Comment: 12 pages, Revtex 3.0, submitted to Appl. Phys. Lett., three figures available from Jian Ma at [email protected]

Prolactin

During an oral glucose tolerance test (OGTT) glucose and insulin levels were measured in 26 patients with prolactin-producing pituitary tumours without growth hormone excess. Basal glucose and insulin levels did not differ from the values of an age-matched control group. After glucose load the hyperprolactinaemic patients showed a decrease in glucose tolerance and a hyperinsulinaemia. Bromocriptine (CB 154), which suppressed PRL, improved glucose tolerance and decreased insulin towards normal in a second OGTT. — Human PRL or CB 154 had no significant influence on insulin release due to glucose in the perfused rat pancreas. — These findings suggest a diabetogenic effect of PRL. CB 154 might be a useful drug in improving glucose utilization in hormone-active pituitary tumours

Error-Tolerant Algebraic Side-Channel Attacks Using BEE

Algebraic side-channel attacks are a type of side-channel analysis which can recover the secret information with a small number of samples (e.g., power traces). However, this type of side-channel analysis is sensitive to measurement errors which may make the attacks fail. In this paper, we propose a new method of algebraic side-channel attacks which considers noisy leakages as integers restricted to intervls and finds out the secret information with a constraint programming solver named BEE. To demonstrate the efficiency of this new method in algebraic side-channel attacks, we analyze some popular implementations of block ciphers---PRESENT, AES, and SIMON under the Hamming weight or Hamming distance leakage model. For AES, our method requires the least leakages compared with existing works under the same error model. For both PRESENT and SIMON, we provide the first analytical results of them under algebraic side-channel attacks in the presence of errors. To further demonstrate the wide applicability of this new method, we also extend it to cold boot attacks. In the cold boot attacks against AES, our method increases the success rate by over $25\%$ than previous works

Alteration of pulmonary immunity to Listeria monocytogenes by diesel exhaust particles (DEPs). II. Effects of DEPs on T-cell-mediated immune responses in rats.

Previously, we showed that diesel exhaust particles (DEPs) suppressed pulmonary clearance of Listeria monocytogenes (Listeria) and inhibited the phagocytosis of alveolar macrophages and their response to Listeria in the secretion of interleukin (IL)-1 beta, tumor necrosis factor alpha, and IL-12. In this report we examined the effects of DEPs and/or Listeria on T-cell development and secretion of IL-2, IL-6, and interferon (IFN)-gamma. We exposed Brown Norway rats to clean air or DEPs at 50 or 100 mg/m3 for 4 hr by nose-only inhalation and inoculated with 100,000 Listeria. Lymphocytes in the lung-draining lymph nodes were isolated at 3 and 7 days postexposure, analyzed for CD4+ and CD8+ cells, and measured for cytokine production in response to concanavalin A or heat-killed L. monocytogenes. Listeria infection induced lymphocyte production of IL-6. At 7 days postinfection, lymphocytes from Listeria-infected rats showed significant increases in CD4+ and CD8+ cell counts and the CD8+/CD4+ ratio and exhibited increased production of IFN-gamma and IL-2 receptor expression compared with the noninfected control. These results suggest an immune response that involves the action of IL-6 on T-cell activation, yielding Listeria-specific CD8+ cells. DEP exposure alone enhanced lymphocyte production of both IL-2 and IL-6 but inhibited lymphocyte secretion of IFN-gamma. In rats exposed to 100 mg/m3 DEPs and Listeria, a 10-fold increase occurred in pulmonary bacterial count at 3 days postinfection when compared with the Listeria-only exposure group. The isolated lymphocytes showed a significant increase in the CD4+ and CD8+ cell counts and the CD8+/CD4+ ratio and exhibited increased IL-2 responsiveness and increased capacity in the secretion of IL-2, IL-6, and IFN-gamma. This T-cell immune response was sufficient to allow the Brown Norway rats to clear the bacteria at 7 days postinfection and overcome the down-regulation of the innate immunity by the acute DEP exposure

Alpha and lambda interferon together mediate suppression of CD4 T cells induced by respiratory syncytial virus

The mechanism by which respiratory syncytial virus (RSV) suppresses T-cell proliferation to itself and other antigens is poorly understood. We used monocyte-derived dendritic cells (MDDC) and CD4 T cells and measured [(3)H]thymidine incorporation to determine the factors responsible for RSV-induced T-cell suppression. These two cell types were sufficient for RSV-induced suppression of T-cell proliferation in response to cytomegalovirus or Staphylococcus enterotoxin B. Suppressive activity was transferable with supernatants from RSV-infected MDDC and was not due to transfer of live virus or RSV F (fusion) protein. Supernatants from RSV-infected MDDC, but not MDDC exposed to UV-killed RSV or mock conditions, contained alpha interferon (IFN-alpha; median, 43 pg/ml) and IFN-lambda (approximately 1 to 20 ng/ml). Neutralization of IFN-alpha with monoclonal antibody (MAb) against one of its receptor chains, IFNAR2, or of IFN-lambda with MAb against either of its receptor chains, IFN-lambdaR1 (interleukin 28R [IL-28R]) or IL-10R2, had a modest effect. In contrast, blocking the two receptors together markedly reduced or completely blocked the RSV-induced suppression of CD4 T-cell proliferation. Defining the mechanism of RSV-induced suppression may guide vaccine design and provide insight into previously uncharacterized human T-cell responses and activities of interferons

Making Masking Security Proofs Concrete - Or How to Evaluate the Security of any Leaking Device

We investigate the relationships between theoretical studies of leaking cryptographic devices and concrete security evaluations with standard side-channel attacks. Our contributions are in four parts. First, we connect the formal analysis of the masking countermeasure proposed by Duc et al. (Eurocrypt 2014) with the Eurocrypt 2009 evaluation framework for side-channel key recovery attacks. In particular, we re-state their main proof for the masking countermeasure based on a mutual information metric, which is frequently used in concrete physical security evaluations. Second, we discuss the tightness of the Eurocrypt 2014 bounds based on experimental case studies. This allows us to conjecture a simplified link between the mutual information metric and the success rate of a side-channel adversary, ignoring technical parameters and proof artifacts. Third, we introduce heuristic (yet well-motivated) tools for the evaluation of the masking countermeasure when its independent leakage assumption is not perfectly fulfilled, as it is frequently encountered in practice. Thanks to these tools, we argue that masking with non-independent leakages may provide improved security levels in certain scenarios. Eventually, we consider the tradeoff between measurement complexity and key enumeration in divide-and-conquer side-channel attacks, and show that it can be predicted based on the mutual information metric, by solving a non-linear integer programming problem for which efficient solutions exist. The combination of these observations enables significant reductions of the evaluation costs for certification bodies