A Prevention Model for Session Hijack Attacks in Wireless Networks Using Strong and Encrypted Session ID

Timing attacks in web applications have been known for over a decade. Recently, new attacks have been reported to exploit timing techniques to probe sensitive information from web applications. In this paper, we present a tool to detect timing-based probing attacks in web applications. The main idea of our approach is to monitor the browser behaviors and identify anomalous timing behaviors. We prototyped our approach in the Google Chrome browser, and demonstrated its effectiveness.

Web applications typically interact with a back-end database to retrieve persistent data and then present the data to the user as dynamically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dynamically constructing query strings within a general-purpose programming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web application to generate unintended output. This is called a command injection attack , which poses a serious threat to web application security. This paper presents the first formal definition of command injection attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the intended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SqlCheckS , an implementation for the setting of SQL command injection attacks. We evaluated SqlCheckS on real-world web applications with systematically compiled real-world attack data as input. SqlCheckS produced no false positives or false negatives, incurred low runtime overhead, and applied straightforwardly to web applications written in different languages.

Web applications typically interact with a back-end database to retrieve persistent data and then present the data to the user as dynamically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dynamically constructing query strings within a general-purpose programming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web application to generate unintended output. This is called a command injection attack, which poses a serious threat to web application security. This paper presents the first formal definition of command injection attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the intended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SqlCheckS, an implementation for the setting of SQL command injection attacks. We evaluated SqlCheckS on real-world web applications with systematically compiled real-world attack data as input. SqlCheckS produced no false positives or false negatives, incurred low runtime overhead, and applied straightforwardly to web applications written in different languages.

We introduce a process-driven experiment named "CookieMonster" that can be ran against any cookie granting (i.e. session identification generation) application to test for strength of the cookie generation algorithm. The Cookie Monster processes are applicable to any operating system, web server, and web application as long as session identifiers are granted to requesting client machines. Our goal is to decipher how likely session hijacking attacks may be successful strictly because of weak session identifier generation by the web application. These processes and necessary infrastructure setup can be followed for future generations of web application and web server products because of the universal approach we created. Setup for the experiment includes a web server running a web application that grants session identifiers (cookies), an attack machine running our rapid request software (Bockscar) and a database for archival and analysis of the cookies.

Semantic security against web application attacks

SQL injection is one of the major threats to the security of the web applications. Attackers try to gain unauthorized access to the database, which has vital and private information of the users. Many researchers have provided various techniques and practices to protect the web applications from attackers. There is a plethora of techniques available to perform SQL injection and usually not everyone is familiar with every attack. Hence, this kind of attack is still the most prevalent. In this paper, we have presented the types of SQL injections attacks and most dominant ways to prevent them.

Web application security has become real concern due to increase in attacks and data breaches. As Application becomes critical, complex and connected, the difficulty of achieving application security increases exponentially. Also there are tools and techniques to detect such attacks, threat and vulnerabilities that exist in application which developer prevent and mitigate the risk associated to it. This paper evaluates various web application attack detection mechanisms and how resistant they are against various attacking techniques. Such an evaluation is important for not only measuring the available attack defense against web application attacks but also identifying gaps to build effective solutions for different defense techniques on web application and use it for study. Based on the research, the limitations of these application attack detection techniques are identified and remedies proposed for improving the current state attack detection on web applications.

Wormhole attacks in wireless networks can severely deteriorate the network performance and compromise the security through spoiling the routing protocols and weakening the security enhancements. This paper develops an approach, interactive visualization of wormholes (IVoW), to monitor and detect such attacks in large scale wireless networks in real time. We characterize the topology features of a network under wormhole attacks through the node position changes and visualize the information at dynamically adjusted scales. We integrate an automatic detection algorithm with appropriate user interactions to handle complicated scenarios that include a large number of moving nodes and multiple worm-hole attackers. Various visual forms have been adopted to assist the understanding and analysis of the reconstructed network topology and improve the detection accuracy. Extended simulation has demonstrated that the proposed approach can effectively locate the fake neighbor connections without introducing many false alarms. IVoW does not require the wireless nodes to be equipped with any special hardware, thus avoiding any additional cost. The proposed approach demonstrates that interactive visualization can be successfully combined with network security mechanisms to greatly improve the intrusion detection capabilities

Intrusion Detection Systems(IDSs) are widely used to detect both known attacks and unknown attacks performed by internal and external attackers in wireless networks. However, challenging issues for developing IDSs in Wireless Mesh Networks (WMNs) are 1) supporting interoperability and 2) handling volatile parameters. In addition, security standards for WMN are still in draft stage, and to protect the WMN, IDSs of similar wireless networks such as wireless sensor, Ad-Hoc, MANET can be adopted, but the best performance is not guaranteed. In this paper, we have classified the existing IDSs for wireless networks into four categories namely single layer IDS, cross-layer IDS, reputation-based IDS, reputation based cross-layer IDS, and analyzed the performance of these IDSs with core-layer attacks and detection methodology. Based on our analysis, we address the loopholes in existing IDSs and specify research directions for strengthening the existing IDSs and for developing new efficient IDSs with respect to backbone mesh and client mesh networks.

XCS (Cross Channel Scripting) is a dangerous web application vulnerability, in which injection of the malicious code and attack execution is performed through network protocols. This vulnerability is the variant and sophistication concept of XSS (Cross-Site Scripting). We disclose a range of XCS attacks on embedded servers, which make use of electronic devices such as photo frames, cameras, wireless routers and wireless access points. All these devices have web interfaces, which permits an admin to perform various tasks on the device that is connecting from a web browser to the web server. An attack execution is carried by inserting malevolent code in the device, which is executed in the context of a legitimate user when he/she opens the page containing injected malicious code. This malevolent code can be inserted in the device through non web channels like SNMP (Simple Network Management Protocol), FTP (File Transfer Protocol) or NFS (Network File System). Unfortunately, the injected malicious code can fully compromise the security of devices, which are embedded in web servers. In this paper, a comprehensive analysis of the XCS exploitation and mitigation techniques have been presented.

This chapter presents an approach to mitigate cross-site scripting (XSS) vulnerabilities in web-based environments using static and dynamic analysis. In order to identify and mitigate XSS attack vectors in web-based environments, a novel approach which successfully identifies and prevents XSS attack strings from injection points has been presented. Static analysis is the process of identifying whether a given web page is vulnerable to cross-site scripting. In addition, dynamic analysis approach is able to verify whether a given web application with vulnerable page assessed by static analysis approach is actually vulnerable. To identify XSS vulnerability of a web page, we make use of the Control-Flow Graph suggested by Lucca et al. The proposed approach involves a secure XSS interception layer placed in the client’s browser. To defend against XSS attacks, the proposed approach makes use of training phase, where every benevolent script is promoted by an identifier.

Predictive Analytics of Injection Attacks in Web Applications

Cyber-physical systems are realized as those systems where the computation, communication and physical processes interact with each other (e.g., robotic systems, automotives, etc). A large class of cyber-physical systems are associated with strict timeliness requirements. They are known as ‘real-time systems’ (e.g., smart grids, avionics, etc). Industrial control systems (ICS) are real-time systems that consist of several closed-loop controls. The main components of a control loop are — a physical plant, sensors, actuators and a controller. The sensors transmit the measurement data to the controller that generates appropriate control signals to actuate the physical plant. Large-scale wireless sensor actuator networks form the main communication framework among the network devices in ICS. Most of the communications between each of these devices are periodic real-time flows with hard deadlines. To ensure reliability, the communication in these systems are time-division multiple access (TDMA) based. Dedicated network resources (time-slots and frequencies) are allocated to these devices in advance and the communication schedule is pre-computed to satisfy the hard deadlines of the real-time flows. The same schedule is repeated over time which makes the schedule predictable in nature. However, a malicious attacker can exploit this predictable time-slots in the schedules to launch timing attacks. Since these applications are time-critical, timing attacks can completely undermine the system performance leading the system to an unsafe state. Schedule randomization is a popular defense mechanism to mitigate timing attacks. Although a few works exist in the literature that use schedule randomization as a countermeasure against timing attacks in real-time uniprocessor systems, none of them are applicable for real-time wireless networks. Schedule randomization as a countermeasure against timing attacks in real-time wireless networks remained largely unexplored. With this objective in focus, this thesis addresses some schedule randomization techniques to mitigate timing attacks in real-time wireless networks. Among the existing wireless network protocols that are in use, the WirelessHART is the most suitable and widely adopted protocol in ICS. A WirelessHART protocol supports centralized architecture, TDMA based communication, multiple channels, etc. All of these characteristics of a WirelessHART network facilitate reliable and predictable communication with real-time flow guarantees in ICS. However, the predictable communication exposes the system to timing attacks, such as selective jamming attacks. Selective jamming attacks are stealthy attacks, however, it can lead the system to an unstable state and can disrupt the safety of the system. As a countermeasure against such attack in WirelessHART network, we propose a centralized schedule randomization technique that randomizes the time-slots and channels in the schedule over every hyperperiod (least common multiple of the periods of the real-time flows) without violating the hard deadlines of the real-time flows, while still satisfying the feasibility constraints of a schedule in a WirelessHART network. The centralized technique generates the schedules offline and distributes the schedules online, hence, cannot support any change in topology in the network. Further, this technique has energy overheads in distributing the schedules to all the network devices at runtime. Hence, we propose a distributed online schedule randomization technique that can generate random feasible schedules at runtime in each network device without affecting the closed-loop control stability. To increase the extent of randomization of time-slots in the schedules, this online distributed technique adopts a period adaptation strategy that can adjust the transmission periods of the real-time flows at runtime depending on the stability of the closed-loop controls. To support an ever-growing number of devices and dense connectivity, the fifth generation (5G) cellular networks is expected to serve as the main communication standard in the future wireless sensor networks. Among the different service categories supported by 5G, the ultra-reliable low-latency communication (URLLC) is mostly suitable for time-critical applications such as the ICS. The communication in 5G is organized into slots over multiple frequencies. To satisfy the hard deadlines of the URLLC flows in ICS, a part of the resources (slots and frequencies) in 5G are reserved for URLLC traffic and the same schedule is repeated over time. The repetition of the same schedule over time makes the slots in the schedules predictable. This, in turn, makes the 5G networks vulnerable to timing attacks. However, the proposed schedule randomization techniques for WirelessHART networks are not applicable for dynamic networks like 5G where the number of flows and the amount of available network resources for URLLC flows vary at runtime. Moreover, the feasibility of the real-time flows need to be guaranteed at runtime. Hence, we propose an online schedule randomization technique that randomizes the slots and the frequencies of the periodic URLLC flows while guaranteeing the feasibility of the flows at runtime.

Wireless networks are extremely vulnerable to a plethora of security threats, including eavesdropping, jamming, and spoofing, to name a few. Recently, a number of next-generation cross-layer attacks have been unveiled, which leverage small changes on one network layer to stealthily and significantly compromise another target layer. Since cross-layer attacks are stealthy, dynamic, and unpredictable in nature, novel security techniques are needed. Since models of the environment and attacker's behavior may be hard to obtain in practical scenarios, machine learning techniques become the ideal choice to tackle cross-layer attacks. In this paper, we propose FORMAT, a novel framework to tackle cross-layer security attacks in wireless networks. FORMAT is based on Bayesian learning and made up by a detection and a mitigation component. On one hand, the attack detection component constructs a model of observed evidence to identify stealthy attack activities. On the other hand, the mitigation component uses optimization theory to achieve the desired trade-off between security and performance. The proposed FORMAT framework has been extensively evaluated and compared with existing work by simulations and experiments obtained with a real-world testbed made up by Ettus Universal Software Radio Peripheral (USRP) radios. Results demonstrate the effectiveness of the proposed methodology as FORMAT is able to effectively detect and mitigate the considered cross-layer attacks.

A closer look into DHCP starvation attack in wireless networks