GPS+

Cyber security of distribution power systems is of an increasing and pressing importance due to the fast modernisation of current systems. Cyber attacks on distribution power systems may aim to operate the system inefficiently, steal private smart meter data or cause intentional false tripping of few or all feeders. In this paper, a Man in The Middle (MiTM) attack on a power factor correction unit is implemented and demonstrated to overload a distribution feeder and cause an intentional false tripping of the entire feeder causing regional blackout. Experimental implementation of the attack is carried out in a laboratory-scale setup using commercial power equipment under different loading conditions to demonstrate the effectiveness of this attack.

Zero conf protocols date from 1999. They provide plug and play mechanisms to set up networks without having to conFigure DNS or DHCP servers. Almost every device (PCs, printers, scanners, etc.) nowadays “speaks” one of these protocols, sometimes without its owner being even aware of it. The booming IoT ecosystem, in particular, relies heavily on them. Unfortunately, these protocols offer a number of different ways to run, so called, man in the middle attacks (MITM). Some previous publications have mentioned and have taken advantage of one or another of these design flaws. In this paper, we provide a deep dive into the various issues at hand and show the extent of the problem. We consider that the growing reliance of networks on these protocols represent an underestimated and ill covered threat. We have run a number of experiments (300) to test various implementations and discuss our results. We also propose means to detect these attacks thanks to Zeek (aka Bro). We make the attack code as well as the Zeek scripts available to the research community in a format that makes replication of our results possible by researchers while not easy to use by script kiddies.

In recent years, radio frequency identification technology has moved into the mainstream applications that help to speed up handling of manufactured goods and materials. RFID tags are divided into two classes: active and passive. Active tag requires a power source that's why its cost is more than passive tags. However, the low-cost RFID tags are facing new challenges to security and privacy. Some solutions utilize expensive cryptographic primitives such as hash or encryption functions, and some lightweight approaches have been reported to be not secure. This paper describes a lightweight Mutual authentication and ownership transfer protocol utilizing minimalistic cryptography using Physically Unclonable Functions (PUF) and Linear Feedback Shift Registers (LFSR). PUFs and LFSRs are very efficient in hardware and particularly suitable for the low-cost RFID tags. To functioning security in low cost RFID tag minimum gate requirement is 2000 gates. To implement security protocols using PUF and LFSR functions need only approx 800 gates. In this paper it is explained how we can authenticate and transfer ownership of low cost RFID tag securely using LFSR and PUF as compared to existing solutions based on hash functions.

The limited computational and memory resources available in the Radio Frequency Identification (RFID) tags constitute the essential challenge to find a technique that satisfies high security requirements. In this paper, security and privacy requirements for an RFID authentication system are defined. Although some of the conventional cryptographic operations provide these requirements partially, they are not considered as suitable solution for RFID applications because operations cost is high especially for RFID tags. An unconventional use of homomorphic encryption is proposed to provide low‐cost security and privacy in this research. HEADA is proposed as a novel authentication technique, which consists of deployment and authentication process stages. The homomorphic encryption is used solely in the generation of keys during deployment stage. These keys are used by RFID tags to generate anonymous authentication keys during the authentication process using only integer addition operations. Moreover, some of the conventional approaches have to use a brute–force search in the server side to identify a tag. Unlike these techniques, HEADA enables the server to identify a tag only by a binary search. It is shown that HEADA is the only technique to satisfy all security and privacy requirements using low‐cost operations in both tag and server sides. Copyright © 2016 John Wiley & Sons, Ltd.

ABSTRAK Penelitian ini bertujuan untuk mengevaluasi tingkat keamanan jaringan WLAN yang telah diterapkan di SMK Kristen Getsemani Manado dengan menggunakan metode Penetration Testing. Dalam Analisa keamanan jaringan WLAN dilakukan dengan menggunakan metode Penetration Testing dengan mensimulasikan bentuk serangan terhadap jaringan menggunakan sistem operasi yang biasa digunakan dalam penetration yaitu Kali Linux. Berdasarkan hasil pengujian ditemukan bahwa jaringan WLAN di SMK Kristen Getsemani Manado masih memiliki kerentanan yang dapat dimanfaatkan oleh pihak yang tidak bertanggung jawab.Dua jenis serangan yang berhasil dilakukan dalam penelitian ini adalah Analisis Lalu lintas Jaringan(Traffic Network) dan Man In The Middle Attack. Dari temuan tersebut disimpulkan bahwa Jaringan WLAN di SMK Kristen Getsemani Manado belum memberikan perilndungan yang optimal bagi pengguna yang terhubung, sehingga masih memungkinkan terjadinya gangguan saat mengakses layanan internet. ABSTRACT This study aims to broadcast the level of WLAN network security that has been implemented at SMK Kristen Getsemani Manado using the Penetration Testing method. In the WLAN network security analysis is carried out using the Penetration Testing method with a copy of the form of attack on the network using the operating system commonly used in penetration, namely Kali Linux. Based on the test results, it was found that the WLAN network at SMK Kristen Getsemani Manado still has vulnerabilities that can be exploited by irresponsible parties. Two types of attacks that were successfully carried out in this study were Network Traffic Analysis and Man In The Middle Attack. From these findings, it is concluded that the WLAN Network at SMK Kristen Getsemani Manado has not provided optimal protection for connected users, so it is still possible for disruptions to occur when accessing internet services.

The open stack communication protocol of the internet of things always in security threats. The vulnerability of protocol faces a problem of man in middle attacks and loss of integrity of communication. Cryptography plays a vital role in security authentication on IoT based enable communication system. IoT devices' limited resource constraints cannot offer any security mechanism on the physical level and network level. The key generation methods uplift the security provision in IoT enables communication model. The process of key generation applied three types of cryptography algorithm, symmetric, asymmetric and hybrid algorithm. The complexity of key generation methods needs more computational time and memory; this is the limitation of IoT devices. So various authors proposed a lightweight key generation algorithm for security and authentication. This paper analyzed the performance of key generation methods based on different cryptography approaches and measured their security strength. For the analysis process, use MATLAB software and sample text data file for the communication of two parties. Some ADHOC methods apply to measure protocol weakness during the communication network compromised with a man in the middle attack. The variable key size also reflects the security strength of IoTs enable devices.

Clients and brokers have to communicate via secure channels in the broker-based publish/subscribe model which can be regarded as one of the communication models usually used in the Internet of Things (IoT). A secure channel setup needs an authentic key exchange which in turn requires an authentication process. Moreover, it is required to verify that clients publish or subscribe only to authorized topics managed by authorized brokers. Additionally, IoT includes its own security requirements. This paper introduces a novel handshake protocol providing authentication, authorization, and access control with key exchange for the broker-based publish/subscribe model in IoT. In contrast to related work, realizations of these security goals are not disjunct processes and are integrated with each other in our approach combining zero-knowledge and identitybased schemes while meeting the IoT security requirements. Thus, it supports autonomy in IoT and does not require any public data pre-distribution or secret pre-sharing between communicating entities. Moreover, no third party has to hold any entity-specific authentication and authorization data. While being independent of publish/subscribe protocols without requiring additional components and procedures, our handshake protocol is resistant to active man in the middle attacks and does not include costly cryptographic operations. This paper also evaluates the performance of our approach with regard to multiple affecting factors.

Secure authentication scheme to thwart RT MITM, CR MITM and malicious browser extension based phishing attacks

Evaluating the Impact of Cyberattacks on PLC Performance: A Systematic Implementation and Empirical Investigation

Short Messaging Service (SMS) has removed difference between near and far. Because of guaranteed delivery, people use it on daily basis for connectivity. Not only humans but Information Systems have also utilized it to connect, known as automated messaging. Although automated messaging holds prominent SMS market share but full potential was not reached because of the fact that SMS has no security at all. Any SMS sent or received can be intercepted and manipulated by Man In The Middle (MITM). To resist MITM in next generation smartphones we have proposed a new framework which can be used to secure both human and automated messaging. This automated messaging. This new framework use HTTPS for secure key exchange, ECC, RSA as encryption algorithm and GSM network to send and receive encrypted messages.

Software systems are becoming more complex, interconnected and liable to adopt continuous change and evolution. It’s necessary to develop appropriate methods and techniques to ensure security and privacy of such systems. Research efforts that aim to ensure security and privacy of software systems are distinguished through two main categories: (1) the development of requirements engineering methods, and (2) implementation techniques. Approaches that fall in the first category usually aim to address either security or privacy in an implicit way, with emphasis on the security aspects by developing methods to elicit and analyse security (and privacy) requirements. Works that fall in the latter categories focus specifically on the later stages of the development process irrespective of the organisational context in which the system will be incorporated. This work introduces a model-based process for security and privacy requirements engineering. In particular, the authors’ work includes activities which support to identify and analyse security and privacy requirements for the software system. Their purpose process combines concepts from two well-known requirements engineering methods, Secure Tropos and PriS. A real case study from the EU project E-vote, i.e., an Internet based voting system, is employed to demonstrate the applicability of the approach.

The explosion in recent interest in radio-frequency identification (RFID) tags stems primarily from advances in information processing in supply chain management. Given their processing power and memory capabilities, RFID tags can be used in a wide range of applications including those where barcodes can and cannot be used. Although the potential exists, it is hampered by the relatively high unit cost of implementation and issues related to privacy and security. As with any technology, unit cost of RFID tags and their related systems is bound to come down. As for security and privacy issues, the main impediments are limited processing power, memory, and external power to operate these tags. In spite of these resource constraints, recent years have seen a plethora of new authentication protocols that promise to alleviate security and privacy concerns associated with the use of RFID tags. We evaluate a few protocols that have been suggested for use in passive RFID-tagged systems and identify vulnerabilities that may be present. When appropriate, we present modifications of existing protocols to prevent identified vulnerabilities.

Contactless smart cards are more and more used in access control and payment systems. However, most of such cards are vulnerable to relay attacks, also known as mafia fraud attacks. This attack requires simpler technical resources than tampering or cryptanalysis. In this the adversary deceives, the verifier into thinking that a genuine prover is close by relaying the messages between both genuine parties. The main countermeasure against this attack is the use of so‐called distance bounding protocols. In the radio frequency identification (RFID) framework, Hancke and Kuhn proposed the first distance bounding protocol, which resorts to an expensive and complex ultra wide band (UWB) radio link. Reid et al. remove this extra radio link and propose a low‐cost protocol, but some aspects still need to be further investigated. In this paper, we propose an enhanced low‐cost protocol which takes advantage of the special characteristics of the inductive communication in RFID, and the use of ‘void‐challenges’ to protect against relay attacks. The processing delay of this protocol is zero and it can be directly implemented on RFID devices, without resorting to any extra resources. We present experimental results to support our arguments. Copyright © 2009 John Wiley & Sons, Ltd.

Our modern technologies are increasingly moving towards cryptography to secure the data transmission via a wireless medium. This is because transmission via wireless media is convenient to the modern world, but there still exists a major drawback cryptography in the name of Security. The Vigenere cipher belongs to the family of ciphers in which the cipher text is the ‘sum’ of the plaintext and some keystream. The Vigenere cipher is the encryption technique used in most of the communications, particularly in SMS encryption and decryption. The Vigenere key stream is not random, and therefore the cipher is vulnerable to attack. The plaintext attack and dictionary attack are the most commonly occurring attack leading to man in the middle attack. To overcome these two common attacks in vigenere cipher, we propose a noble approach that uses numbers instead of English alphabets to generate the key.

Over the past decade, the frequency of cyber attacks against power grids has steadily increased, requiring researchers to find and patch vulnerabilities before they can be exploited. Our research introduces the prototype of a man-in-the-middle attack to be implemented on a microgrid emulator of a smart grid. We present a method of violating the integrity and authentication of packets that are using the IEEE Synchrophasor Protocol in a controlled environment, but this same approach could be used on any other protocol that lacks the proper overhead to ensure the integrity and authenticity of packets. In future research, we plan to implement and test the attack on the previously mentioned smart grid testbed in order to assess the attacks feasibility and tangible effects on Wide Area Monitoring and Control applications, as well as propose possible countermeasures. For this paper, we developed a working simulation of our intended attack using the software ModelSim 10.4. The attack will modify network packet data coming from a Schweitzer Engineering Labs (SEL) Phasor Measurement Unit (PMU) hardware sensor, which provides a stream of precise timing values associated with current and voltage values, as these measured values are en route to the Open Phasor Data Concentrator (OpenPDC) application running on a Windows server. Our simulation provides and validates all of the necessary code in order to program a Field Programmable Gate Array and execute our attack on the testbed in future research.