Study of Security Flaws in the Linux Kernel by Fuzzing

Today, Linux is one of the main operating systems (OS) used both on desktop computers and various mobile devices. This OS is also widely applied in state and municipal structures, including law enforcement agencies and automated control systems used in the Armed Forces of the Russian Federation. It’s worth noting that the process of replacing the Linux OS with domestic protected OSs that use the Linux kernel has now begun. In this regard, the analysis of threats to information security of the Linux OS is highly relevant. In this article, the authors discuss the security problems of Linux OS associated with unauthorized user privileges increase, as a result of which an attacker can gain full control over the OS. The approaches to differentiating user privileges in Linux are analyzed and their advantages and disadvantages are considered. As an example, the causes of the vulnerability CVE-2018-14665 were identified and measures to eliminate it were proposed.

The Internet of Things (IoT) are being enthusiastically adopted by consumers. By the year 2020 the sum of 31 billon IoT devices will be deployed globally. Subsequent as the IoT device landscape is expanding at such speed, so does the threat landscape and vulnerabilities it introduces increases. Thus, making IoT devices easily prone to attacks or to be used to for launching attacks at large economical scale and society is seeing a growth in the scale and frequencies of these attacks. The large scale of attacks and frequency have caught global attention and causing governments to take the security and privacy threats of IoT very seriously and the UK government amongst others are now turning these concerns into actionable measures by considering ways of protecting consumers against the vulnerabilities and threats of IoT. It is part of these actionable measures that the NCSC (National Cyber Security Centre) recently published in a report about the new laws being proposed by the government to strengthen IoT devices. This chapter will look at the IoT security threats and privacy issues, it will explore whether the growing concern of the government to protect consumer has a foundation by investigating consumers awareness and attitude towards IoT security threats and privacy issues and propose a framework to facilitate the introduction of the new initiative of the government to bring in laws to govern IoT products thereby shifting the responsibility of the security threats to the manufacturers and away from the consumer.

Internet of Things (IoT) have opened the door to a world of unlimited possibilities for implementations in varied sectors in society, but it also has many challenges. One of those challenges is security and privacy. IoT devices are more susceptible to security threats and attacks. Due to constraints of the IoT devices such as area, power, memory, etc., there is a lack of security solutions that are compatible with IoT devices and applications, which is leading this world of securely connected things to the “internet of insecure things.” A promising solution to this problem is going beyond the standard or classical techniques to implementing the security solutions in the hardware of the IoT device. The integration of emerging technologies in IoT networks, such as machine learning, blockchain, fog/edge/cloud computing, and quantum computing have added more vulnerable points in the network. This paper introduces a comprehensive study on IoT security threats and solutions. Additionally, this survey outlines how emerging technologies such as machine learning and blockchain are integrated in IoT, challenges resulted from this integration, and potential solutions to these challenges. The paper utilizes the 4-layer IoT architecture as a reference to identify security issues with corresponding solutions.

The Internet of Things (IoT) is leading today’s digital transformation. Relying on a combination of technologies, protocols, and devices such as wireless sensors and newly developed wearable and implanted sensors, IoT is changing every aspect of daily life, especially recent applications in digital healthcare. IoT incorporates various kinds of hardware, communication protocols, and services. This IoT diversity can be viewed as a double-edged sword that provides comfort to users but can lead also to a large number of security threats and attacks. In this survey paper, a new compacted and optimized architecture for IoT is proposed based on five layers. Likewise, we propose a new classification of security threats and attacks based on new IoT architecture. The IoT architecture involves a physical perception layer, a network and protocol layer, a transport layer, an application layer, and a data and cloud services layer. First, the physical sensing layer incorporates the basic hardware used by IoT. Second, we highlight the various network and protocol technologies employed by IoT, and review the security threats and solutions. Transport protocols are exhibited and the security threats against them are discussed while providing common solutions. Then, the application layer involves application protocols and lightweight encryption algorithms for IoT. Finally, in the data and cloud services layer, the main important security features of IoT cloud platforms are addressed, involving confidentiality, integrity, authorization, authentication, and encryption protocols. The paper is concluded by presenting the open research issues and future directions towards securing IoT, including the lack of standardized lightweight encryption algorithms, the use of machine-learning algorithms to enhance security and the related challenges, the use of Blockchain to address security challenges in IoT, and the implications of IoT deployment in 5G and beyond.

The convergence of the Internet of Things (IoT), fog computing, and block chain technology has revolutionized contemporary digital ecosystems by making data management decentralized, efficient, and scalable. Nonetheless, this integration poses serious security and privacy threats. IoT devices produce enormous amounts of sensitive data, making them easy targets for cyber attacks, unauthorized access, and data breaches. Classic cloud-based solutions tend to be challenged by latency, bandwidth limitations, and centralized attacks, making the use of fog computing inevitable to decentralize data processing for better responsiveness and decreased dependency on remote cloud servers. While fog computing offers advantages, it also poses new security threats through possible insider attacks and data integrity issues. Block chain technology solves these problems by presenting a tamper-resistant, decentralized ledger that improves trust, security, and transparency for IoT networks. Block chain, via cryptographic authentication, consensus protocols, and smart contracts, ensures the secure transaction of data while alleviating risks against unauthorized data manipulation. Scalability, computational complexity, and energy efficiency are still challenges that need to be met for widespread IoT adoption. This chapter discusses the complex security and privacy problems in IoT, fog, and blockchain networks and examines current threats and countermeasures. Advanced cryptographic methods, secure communication schemes, and access control techniques for strengthening the security of these connected systems are mentioned. It further presents future research directions and trends that will improve a safer, more efficient, and privacy-augmented digital infrastructure.

As mobile devices and applications continue to grow in popularity worldwide, so do the rise of cybersecurity attacks and threats to daily users of both Android and iOS devices on a widespread basis. These attacks not only target mobile devices at the application level but also at the Operating System (OS) device level and Application Programming Interface (API) level extending the Internet of Things (IoT). This paper will address the security vulnerabilities in Android Operating System at the intersection of APIs, device OS, and application-level vulnerabilities by identifying an intersection of commonalities to create mitigation strategies and best practices for securing mobile devices for organizations. The study recommends the adoption of processes of authentication on mobile devices and web-based log-ins as well as access control mechanisms that can mitigate the overlapping security challenges of APIs, mobile devices OS and applications using optimal resources to enhance security. This was achieved by analyzing the threats and vulnerabilities of API.KeywordsAPIsSecurity vulnerabilitiesMobile OSAndroidiOS

Modern multi-core, multi-socket hardware powering the "cloud" is designed with memory and cache resources that have local associativity to a group of cores. Operating systems have characterized these associativities as part of Non-Uniform Memory Architecture (NUMA) optimizations within their virtual memory manager (VMM) and scheduler which improves application performance. Mature NUMA optimizations are prevalent for an OS running on bare-hardware. However, their benefits are reduced within virtual machines(VM) in the cloud. Even though cloud applications are executed by standard multi-core multi-socket hardware, the abstraction brought in by the virtualization layer makes it challenging to optimize resource management within a VM. This paper describes new paradigms in hypervisor technology-- scheduling VMs on cores and managing their memory resources which streamlines their execution on underlying multicore hardware. Being Linux kernel developers, we base our work on Linux operating system and Kernel Virtual Machine (KVM) --a subsystem which turns the Linux kernel into a scalable hypervisor. We evaluate few approaches for optimal resource allocation with KVM. We summarize our findings with a comparative study of how different scheduling algorithms can be employed with KVM for various systems to support efficient resource placement while running cloud workloads.

Privacy preserving Internet of Things: From privacy techniques to a blueprint architecture and efficient implementation

The Internet of Things has a very wide range of applications, and embedded devices are widely used in new fields such as smart home, smart transportation, medical care, and smart cars. The embedded operating system for the Internet of Things should have good real-time performance and reliability, can make more reasonable and effective use of CPU resources, simplify the design of application software, and improve the efficiency of system development. With the rapid development of the Internet of Things and the gradual maturity of Internet of Things applications, the Internet of Things OS developed on the basis of embedded real-time operating systems is emerging. The embedded operating system running in the Internet of Things environment is different from the ordinary RTOS and has new technical characteristics and requirements. Through the study of the development history of the Internet of Things operating system and a brief analysis of the technical architecture of several emerging and powerful Internet of Things operating systems such as Huawei LiteOS, AliOS Things, and RT-Thread, this article summarizes the characteristic requirements of the kernel and peripheral modules of the embedded operating system oriented to the Internet of Things.

The key technological developments in the current era include Blockchain and the Internet of Things in varied application fields. There’s a difference between the above two technologies but the unison of the above two has a wider and practical acceptability in today’s technological scenario. The IoT is responsible for generating a large amount of data in varied fields like healthcare, retail, real-time forecasting, and smart city development. The data is quite useful in terms of big data analytics whereas the Blockchain will promote secure transactions of data along with varied application integration. Smart city can be considered as a prime application area for IoT and there are a lot of progressions among IoT devices, sensors, and actuators. IoT devices are capable enough of communicating among themselves via the Internet using lightweight protocols which results in making them more and more user-friendly. Though the Internet connectivity of IoT devices makes them more vulnerable in regards to data scalability, consistency, and safety, blockchain confirms the integrity of data as it is able in trailing and synchronizing connected devices. As it is based on a decentralized approach, which restricts the condition of a single point of failure thereby forming a steady interoperable safe system. Internet of Things (IoT) requires various tools and techniques for the purpose of information security which necessitates the operative expansion of any IoT cantered smart city. Various security threats are always looking for any ambiguities or loopholes, which can be exploited in any network; security threats are a perilous contest, which needs some action to be taken and implemented instantaneously. The book chapter will be discussing the implications of Blockchain and IoT in a metropolitan urban scenario.KeywordsBlockchainIoTSmart Metropolitan Development

ABSTRACTAn operating system is the essence of software, serving as the foundation for the operation of various application software. The security of the operating system is crucial for national informatization construction. Data indicate that many cybersecurity incidents result from exploiting security vulnerabilities in the operating system. Linux is currently the most widely used open‐source operating system, with thousands of Common Vulnerabilities and Exposures (CVEs) related to Linux systems reported each year. Therefore, research and prevention of vulnerabilities in the Linux system are particularly important. To gain a better understanding of the characteristics of Linux system vulnerabilities, this paper leverages knowledge in the field of software security to analyze nearly 10,000 historical vulnerability data in two core systems of Linux: Linux Kernel and Debian Linux. The study explores the evolutionary patterns of vulnerability characteristics. Specific research contents include the following: (1) data collection and cleaning of vulnerability data in Linux Kernel and Debian Linux systems; (2) cross‐statistical analysis of structured data features in vulnerability reports; (3) unstructured data characteristics mining in vulnerability reports based on domain knowledge; (4) analysis of the evolution of vulnerability characteristics. This paper provides empirical lessons and guidance for Linux system vulnerabilities to assist practitioners and researchers in better preventing and detecting vulnerabilities in Linux and Linux‐based systems.

A very large amount of data is produced by mobile and Internet-of-Thing (IoT) devices today. Increasing computational abilities and more sophisticated operating systems (OS) on these devices have allowed us to create applications that are able to leverage this data to deliver better services. But today's mobile and IoT solutions are heavily limited by low battery capacity and limited cooling capabilities. This motivates a search for new ways to optimize for energy-efficiency. Advanced data analytics and machine-learning techniques are becoming increasingly popular to analyze and extract meaning from Big Data. In this paper, we make the case for designing and deploying data analytics and learning mechanisms to improve energy-efficiency in IoT and mobile devices with minimal overheads. We focus on middleware for inserting energy-efficient data analytics-driven solutions and optimizations in a robust manner, without altering the OS or application code. We discuss several case studies of powerful and promising developments in deploying data analytics middleware for energy-efficient and robust execution of a variety of applications on commodity mobile devices.

Nowadays, the internet of things (IOT) has attracted the attention of the researchers. As a key technology of the Internet of Things, RFID (Radio Frequency Identification) has also attracted the interest of industry and academia. One of the most important issues for the applications of the IOT based on RFID is security. In order to promote the development of IOT based on RFID, first of all, we briefly introduce the IOT system components and work process based on RFID, and then we deeply analyze the security threats in the IOT based on RFID, by the means of these analysis we discuss the current countermeasures for the security threats of RFID. Aiming at the RFID system, the corresponding technologies are raised such as Tag killing, Tag sleeping and blocker Tag; and the authentication based on HASH is the main method aiming at the communication process.

The Internet of Things (IoT) is becoming an increasingly common paradigm. As IoT usage scenarios have increased, many challenges in IoT operating systems’ safety and adaptability have remained. According to the programming model, IoT operating systems can be categorized into three types: multithreading, event-driven, and hybrid. Different operating system models are applied in different scenarios depending on the real-time requirements or resource richness. The safety of IoT operating systems is critical; hence, formal verification is an important method of detecting potential vulnerabilities and providing safety guarantees. This paper proposes a hybrid model for an IoT operating system and employs the Event-B method for modeling and verification. We rewrite the requirements and divide the Event-Bus hybrid operating system model into eight levels for refinement. The safety and liveness properties of Event-Bus are guaranteed by generating and proving the proof obligations at each model level. A large proportion of the proof obligations (91%) are automatically proven on the Rodin platform to simplify the development process.

Computing systems are experiencing an explosive growth, both in complexities and diversities, ushered in by the proliferation of cloud computing, mobile computing, and Internet of Things. This growth has also exposed the consequences of unsafe, insecure, and unreliable computing systems. These all point to the great needs of sophisticated system validation techniques. Recent advances in research on symbolic execution has shown great promises for automated software analysis, e.g., generating test cases, finding bugs, and detecting security vulnerabilities. However, symbolic execution is mostly adopted to analyze user applications, while modern computing systems in practice consist of many components shipped by various vendors, besides user applications, e.g., operating systems, firmware and hardware devices. In this dissertation, we propose versatile binary-level concolic testing, which defines a standard execution-trace format, and features an open and highly extensible architecture. It allows easy integration of multiple concrete execution frontends and symbolic execution backends, which significantly improves the applicability and flexibility of symbolic execution, especially to modern computing systems with various components. First, we present the design and implementation of CRETE, the infrastructure of versatile binary-level concolic testing. CRETE provides an open and highly extensible architecture allowing easy integration of multiple concrete and symbolic execution environments, which communicate with each other only by exchanging standardized traces and test cases. We also present several optimizations for scaling CRETE to practical user applications. Our experiments show CRETE outperformed state-of-the-art open-source systems for automated program analysis at source-level and binary-level. It also found numerous bugs that were previously unreported from mature open-source projects. Second, we present COD, a framework based on versatile binary-level concolic testing for automated bug detection and replay of commercial off-the-shelf (COTS) Linux kernel modules (LKMs). Our framework automatically generates compact sets of test cases for COTS LKMs, proactively checks for common kernel bugs, and allows to reproduce reported bugs repeatedly with actionable test cases. Our experiments show that COD can effectively detect various kernel bugs, and reports 5 new kernel vulnerabilities including an unknown flaw that allows non-privileged users to trigger a kernel panic. With the replay capability of our framework, we patched all the reported bugs in the Linux kernel upstream, including 3 patches were selected to the stable release of Linux kernel and back-ported to numerous production kernel versions. Last, we present how we leverage versatile binary-level concolic testing for system-level validation of Systems-on-Chips (SoC). We capture run-time traces of Hardware/Software (HW/SW) components across