Zero Conf Protocols and their numerous Man in the Middle (MITM) Attacks

Cyber security of distribution power systems is of an increasing and pressing importance due to the fast modernisation of current systems. Cyber attacks on distribution power systems may aim to operate the system inefficiently, steal private smart meter data or cause intentional false tripping of few or all feeders. In this paper, a Man in The Middle (MiTM) attack on a power factor correction unit is implemented and demonstrated to overload a distribution feeder and cause an intentional false tripping of the entire feeder causing regional blackout. Experimental implementation of the attack is carried out in a laboratory-scale setup using commercial power equipment under different loading conditions to demonstrate the effectiveness of this attack.

ABSTRAK Penelitian ini bertujuan untuk mengevaluasi tingkat keamanan jaringan WLAN yang telah diterapkan di SMK Kristen Getsemani Manado dengan menggunakan metode Penetration Testing. Dalam Analisa keamanan jaringan WLAN dilakukan dengan menggunakan metode Penetration Testing dengan mensimulasikan bentuk serangan terhadap jaringan menggunakan sistem operasi yang biasa digunakan dalam penetration yaitu Kali Linux. Berdasarkan hasil pengujian ditemukan bahwa jaringan WLAN di SMK Kristen Getsemani Manado masih memiliki kerentanan yang dapat dimanfaatkan oleh pihak yang tidak bertanggung jawab.Dua jenis serangan yang berhasil dilakukan dalam penelitian ini adalah Analisis Lalu lintas Jaringan(Traffic Network) dan Man In The Middle Attack. Dari temuan tersebut disimpulkan bahwa Jaringan WLAN di SMK Kristen Getsemani Manado belum memberikan perilndungan yang optimal bagi pengguna yang terhubung, sehingga masih memungkinkan terjadinya gangguan saat mengakses layanan internet. ABSTRACT This study aims to broadcast the level of WLAN network security that has been implemented at SMK Kristen Getsemani Manado using the Penetration Testing method. In the WLAN network security analysis is carried out using the Penetration Testing method with a copy of the form of attack on the network using the operating system commonly used in penetration, namely Kali Linux. Based on the test results, it was found that the WLAN network at SMK Kristen Getsemani Manado still has vulnerabilities that can be exploited by irresponsible parties. Two types of attacks that were successfully carried out in this study were Network Traffic Analysis and Man In The Middle Attack. From these findings, it is concluded that the WLAN Network at SMK Kristen Getsemani Manado has not provided optimal protection for connected users, so it is still possible for disruptions to occur when accessing internet services.

The open stack communication protocol of the internet of things always in security threats. The vulnerability of protocol faces a problem of man in middle attacks and loss of integrity of communication. Cryptography plays a vital role in security authentication on IoT based enable communication system. IoT devices' limited resource constraints cannot offer any security mechanism on the physical level and network level. The key generation methods uplift the security provision in IoT enables communication model. The process of key generation applied three types of cryptography algorithm, symmetric, asymmetric and hybrid algorithm. The complexity of key generation methods needs more computational time and memory; this is the limitation of IoT devices. So various authors proposed a lightweight key generation algorithm for security and authentication. This paper analyzed the performance of key generation methods based on different cryptography approaches and measured their security strength. For the analysis process, use MATLAB software and sample text data file for the communication of two parties. Some ADHOC methods apply to measure protocol weakness during the communication network compromised with a man in the middle attack. The variable key size also reflects the security strength of IoTs enable devices.

Secure authentication scheme to thwart RT MITM, CR MITM and malicious browser extension based phishing attacks

Evaluating the Impact of Cyberattacks on PLC Performance: A Systematic Implementation and Empirical Investigation

Short Messaging Service (SMS) has removed difference between near and far. Because of guaranteed delivery, people use it on daily basis for connectivity. Not only humans but Information Systems have also utilized it to connect, known as automated messaging. Although automated messaging holds prominent SMS market share but full potential was not reached because of the fact that SMS has no security at all. Any SMS sent or received can be intercepted and manipulated by Man In The Middle (MITM). To resist MITM in next generation smartphones we have proposed a new framework which can be used to secure both human and automated messaging. This automated messaging. This new framework use HTTPS for secure key exchange, ECC, RSA as encryption algorithm and GSM network to send and receive encrypted messages.

Our modern technologies are increasingly moving towards cryptography to secure the data transmission via a wireless medium. This is because transmission via wireless media is convenient to the modern world, but there still exists a major drawback cryptography in the name of Security. The Vigenere cipher belongs to the family of ciphers in which the cipher text is the ‘sum’ of the plaintext and some keystream. The Vigenere cipher is the encryption technique used in most of the communications, particularly in SMS encryption and decryption. The Vigenere key stream is not random, and therefore the cipher is vulnerable to attack. The plaintext attack and dictionary attack are the most commonly occurring attack leading to man in the middle attack. To overcome these two common attacks in vigenere cipher, we propose a noble approach that uses numbers instead of English alphabets to generate the key.

Over the past decade, the frequency of cyber attacks against power grids has steadily increased, requiring researchers to find and patch vulnerabilities before they can be exploited. Our research introduces the prototype of a man-in-the-middle attack to be implemented on a microgrid emulator of a smart grid. We present a method of violating the integrity and authentication of packets that are using the IEEE Synchrophasor Protocol in a controlled environment, but this same approach could be used on any other protocol that lacks the proper overhead to ensure the integrity and authenticity of packets. In future research, we plan to implement and test the attack on the previously mentioned smart grid testbed in order to assess the attacks feasibility and tangible effects on Wide Area Monitoring and Control applications, as well as propose possible countermeasures. For this paper, we developed a working simulation of our intended attack using the software ModelSim 10.4. The attack will modify network packet data coming from a Schweitzer Engineering Labs (SEL) Phasor Measurement Unit (PMU) hardware sensor, which provides a stream of precise timing values associated with current and voltage values, as these measured values are en route to the Open Phasor Data Concentrator (OpenPDC) application running on a Windows server. Our simulation provides and validates all of the necessary code in order to program a Field Programmable Gate Array and execute our attack on the testbed in future research.

Secure end-to-end information exchange is a constant challenge in electronic communications. Novel security architectures and approaches are proposed constantly, to be followed by announcements of sophisticated attack methods that compromise them, while people suspect others, even more sophisticated attack methods never see the daylight. In the present work we propose a novel method for secure end-to-end communication based on biometric evidence to ensure security and integrity of the information exchanged. The traditional approach for securing the communication between two peers is through the use of secret key encryption combined with a public key approach for exchanging the common secret key to be used by the end peers. The public key part of the communication is based on a trusted authority for providing the public keys, a service provided through a Public Key Infrastructure (PKI). Public key infrastructures are vulnerable to man in the middle attacks, among other approaches that compromise their integrity. There has been a lot of work for providing robust PKI infrastructures, the proposed solutions are fairly demanding on network resources, hence public key solutions are not the security approach of choice in several applications that require light weight solutions. Here we propose an approach for providing secure end-to-end communications in environments where it is possible to have biometric based authentication, exploiting the nature of the application; voice communication being the typical example that we use as our paradigm for describing the method. During the establishment of the communication session, the end-peers exchange a challenge/signature token, the integrity of which is confirmed vocally when the voice communication initiates. The security of the method relies on the inability to mechanically impersonate an individual both because of the biometric user specific attributes of the human voice and video as well as the user customized profile of the exchanged information. The method is appropriate for ensuring the security of an encrypted phone conversation, guaranteeing the integrity of the session key exchanged in the beginning of the conversation. It requires minimal resources from the user handsets and no additional support from the network, so it is inherently scalable and readily deployable as it only needs an appropriately enhanced secure handset. ©2006 IEEE.

Federated Learning (FL) enables cooperative model training across dispersed edge devices while protecting data privacy and providing localized insights without the need for centralized data aggregation. In the Internet of Things (IoT), federated learning enables cooperative model training among dispersed edge devices while protecting data privacy and providing localized insights without the need for centralized data aggregation. Nevertheless, Federated Learning’s local model sharing approach makes it susceptible to Man-in-the-Middle (MITM) attacks. In FL, attackers have the ability to manipulate local models. As a result, a global model produced from the altered local models may be inaccurate. In this paper, we suggest a blockchain-based FL architecture to prevent intermediaries from readily altering the FL parameters throughout the transmission process. All of the clients' parameters are combined by a cloud server, which is acting as the federated parameter server. By integrating blockchain technology into the overall architecture, we link all cloud and edge servers. This paper uses a PoC algorithm based on the SHA-256 hashing function in order to validate the data. The results and comparison analysis show that the suggested framework has a low false-positive rate and a high accuracy in detecting MITM attacks in their early stages, with a detection rate ranging from 98 to 100%.

Most of the various sectors in today’s life such as bank, transport, voting, health, electricity, etc., are currently digitalized. In our research paper, we have surveyed the voting system and explored the existing drawbacks of the voting system concerning security and malfunction. The demerits in the existing schemes include less data security, vote modification, man in the middle attack, masquerade attack, denial of service attack, impersonation attack, etc. Such attacks can compromise security and allows attackers to modify the results. To resolve the above-mentioned issues as well as the attacks, this research paper proposes a protocol to overcome security-based issues. In the proposed system, a secure online e-voting system is developed for end-to-end users to avoid misappropriation on the vote during the result publication in India or any other country. The proposed E-Voting Cloud System (ECS) system has three phases: The first phase is the registration phase, the second phase is vote polling, and the third phase is result announcements. In the proposed system, the election commission of India can search and verify the vote data through cloud computing. For a detailed description of our proposed protocol, a cube data storage structure and user differentiated system are first implemented. Based on the cube data structure and user differentiated system model, the proposed protocol helps to store voter data in the cloud with the encrypted model and ECS. Finally, the candidate can decrypt the data using their key. The people can verify the result announced by the ECS. The performance analysis clearly shows that our proposed system is highly secure when compared to the existing system. Using the proposed work, secure data transfer can be performed in an efficient way for online e-voting applications.

Security and privacy for RFID systems are very challenging topics. First, the RFID passive tags prevailing in most of the RFID applications are very limited in processing power, thus making most of the ordinary security mechanisms inappropriate. Second, tags do answer to any reader requests, for this the most innovative RFID proposed protocols are not suitable whether for privacy problems or the high cost of tags.So far, a variety of public-key identification/authentication protocols have been proposed, but none of them satisfy both the security and privacy requirements within the acceptable restricted resources. Girault described a storage-computation trade-off approach of the famous GPS scheme for low cost RFID tag using t coupons stored on tag, but for moderate security level, this approach is still beyond current capabilities of low-cost RFID tags as storage capacity is the most expensive part of the hardware. Moreover, as we demonstrate the GPS scheme cannot be private against active adversary.In this paper, we present a new private efficient storage-security trade-off of GPS public key scheme for low-cost RFID tags. The ideas are twofold. First, the coupons are stored only on the back-end and not on the tag, so the protocol is private, the number of coupons can be much higher than in Girault's approach, and consumed coupons can be easily replaced with new ones. Second, for authenticating to the reader, the tag only needs simple integer operations, so implemention can be done in less than 1000 gate equivalents(GEs). Our approach takes advantages of the GPS scheme, and is resistant to the classical security attacks including replays, tracking, man in the middle attacks, etc.

With the rapidly increasing rate of theft and insecurity, surveillance cameras have become a piece of conventional household equipment for many. Although these cameras just record the footage and make it conceivable to review these recordings after a sense of malicious activity being spotted by somebody. There have been approaches to robotize this procedure by introducing a movement discovery framework and utilizing other IoT based sensors. Such solutions were not reliable as, in adverse conditions, these systems could not adequately detect the human presence and during the mishap the individuals deemed necessary were not alerted. In this paper, we introduce a compact and complete solution to this problem, all packed in single Raspberry Pi by implementing an effective object detection model using Machine Learning and integrating it with advanced Image Enhancement technology to detect only the human activity even under adverse conditions. Also, the entire data that is being collected by this system has been end-to-end encrypted by using Cryptography in order to prevent Man in the middle attacks.

Mobile banking, sometimes referred to as M-Banking, Mbanking or SMS Banking, is a term used for performing balance checks, account transactions, payments, credit applications and other banking transactions through a mobile device such as a mobile phone or Personal Digital Assistant (PDA). Mobile banking has until recently most often been performed via SMS or the Mobile Web. Apple's initial success with iPhone and the rapid growth of phones based on Google's Android (operating system) have led to increasing use of special client programs, called apps, downloaded to the mobile device hence increasing the number of banking applications that can be made available on mobile phones . This in turn has increased the popularity of mobile device use in regards to personal banking activities. Due to the characteristics of wireless medium, limited protection of the nodes, nature of connectivity and lack of centralized managing point, wireless networks tend to be highly vulnerable and more often than not they become subjects of attack. This paper proposes to identify potential threats associated with communication between a mobile device and the back end server in mobile banking applications. The paper should be able to identify the techniques associated with Man in the middle attacks during communication between a mobile device and a back end server and propose controls that will ensure that data theft does not occur during such sessions.

This study aims to show that a secure, trustable and immutable voting system can be established with Blockchain technology. Decentralized structure of the Blockchain excludes the central authority and provides transparency. Moreover, its cryptographic functions enable secure transactions. Therefore, the operation is prevented from potential frauds, such as multiple votes, fake vote attempts, and fraudulent vote counts. The proposed method, VOTEMAT, covers both electronic voting and paper ballot as a complete solution. A mobile application and a Website, connected to Ethereum private Blockchain network, were developed for the voters who prefer to cast their votes remotely. It is also possible to vote in the voting centres via the mobile device or paper ballot placed in the vote boxes; but these votes are also recorded in the same Blockchain and equally secure. For the remote users, a two-step authentication is designed, based on the information on the national identity card and face recognition. An additional encryption based security measure is used to avoid hacking attempts, such as man in the middle attacks. Since the proposed system is more practical than the traditional voting methods, it can increase the participation and be utilized in all kinds of local or national elections.