No description available.

No description available.

No description available.

No description available.

Context: In today’s era, many things are dependent on the internet thus the devices and applications that are using it proliferates. Every day, many devices are getting targeted by malevolent virus authors. To protect the data from malicious factors becomes a preposterous dispute. A ransomware named CryptoLocker has caused many individuals, hospitals, and institutions thousands if not millions of dollars in damage due to encrypting the computer files thus demanding a ransom in return. Once the ransomware strikes a system, the recoverability is almost non-existent if no backup or system restore is present due to the private key which was used to encrypt files is encrypted and sent to the attacker’s database. Without the key, there is no recovery for restoring files. Objective: Exploratory research is conducted to reveal unique methods ransomware and keylogger may use to strike a system. The goal is to disclose protection policies of the Windows systems for the security enthusiasts and computer users. Three main objectives are present; how viruses hide in a system without servicing any rootkits to hide the malware, how ransomware and keylogger can be used together to deliver damage, and how to covert CPU usage of the ransomware during the encryption routine. Method: To answer the questions and exploit new features, ransomware, keylogger and a trojan horse is built. Original CryptoLocker architecture has been analyzed, and some methods have been derived. The final application is running on the Windows operating system; Windows 10. Win32 API, C++, and C# are used for the construction of the malware programs. Visual Studio 2017 has been used as an IDE. Results: The testing results reveal that running encryption routine as a background thread covert the CPU usage except the operation time increases by five times. The experiments show that disguising a malware program among the task manager process list is possible by setting Win32 API flag within the execution of the program. Changing the malware name, signature, and description of the program further enhance the sustainability rate from the everyday users.

In 2016, NIST started a post quantum cryptography (PQC) standardization project in response to the rapid development of quantum algorithms which break many public-key cryptographic schemes. As the project nears its end, it is necessary to assess the resistance of its finalists to side-channel attacks. Although several side-channel attacks on software implementations PQCfinalists have been presented in recent papers, hardware implementations have been investigated much less. In this thesis, we present the first side-channel attack on an FPGA implementation of one of the NIST PQC finalists, Saber. Our experiments are performed on a publicly availible implementation of Saber compiled with Xilinx Vivado for an Artix-7 XC7A100T FPGA. We trained several deep learning models in an attempt to recover the Hamming weight and value of messages using their corresponding power traces. We also proposed a method to determine the Hamming weight of messages through binary search based on these models. We found out that, due to the difference in software and hardware implementations, the previously presented message recovery method that breaks a masked software implementation of Saber cannot be directly applied to the hardware implementation. The main reason for this is that, in the hardware implementation used in our experiments, all 256 bits of a message are processed in parallel, while in the software implementation used in the previous work, the bits are processed one-by-one. Future works includes finding new methods for analyzing hardware implementations. / Under 2016 startade NIST ett standardiseringsprojekt efter kvantkryptering (PQC) som svar på den snabba utvecklingen av kvantalgoritmer som bryter många kryptografiska system med offentliga nyckel. När projektet närmar sig sitt slut är det nödvändigt att bedöma finalisternas motstånd mot sidokanalsattacker. Även om flera sidokanalsattacker på programvaruimplementationer PQC-finalister har presenterats i de senaste tidningarna, har hårdvaruimplementationer undersökts mycket mindre. I denna avhandling presenterar vi den första sidokanalsattacken på en FPGA-implementering av en av NIST PQC-finalisterna, Sabre. Våra experiment utförs på en allmänt tillgänglig implementering av Sabre kompilerad med Xilinx Vivado för en Artix-7 XC7A100T FPGA. Vi tränade f lera modeller för djupinlärning i ett försök att återställa Hamming-vikten och värdet av meddelanden med hjälp av deras motsvarande kraftspår. Vi föreslog också en metod för att bestämma Hamming-vikten för meddelanden genom binär sökning baserat på dessa modeller. Vi fick reda på att, på grund av skillnaden i mjukvaru- och hårdvaruimplementationer, kan den tidigare presenterade meddelandeåterställningsmetoden som bryter en maskerad mjukvaruimplementering av Sabre inte direkt appliceras på hårdvaruimplementeringen. Den främsta anledningen till detta är att i hårdvaruimplementeringen som används i våra experiment bearbetas alla 256 bitar i ett meddelande parallellt, medan i mjukvaruimplementeringen som användes i det tidigare arbetet bearbetas bitarna en i taget. Framtida arbete inkluderar att hitta nya metoder för att analysera hårdvaruimplementationer.

Electronic devices such as phones and computers use cryptography to achieve information security. However, while cryptographic algorithms may be strong theoretically, their physical implementations in hardware can leak unintentional side information as a byproduct of performing their computations. A device's security can be compromised from this leakage through side-channel attacks. Research in hardware security reveals how dangerous these attacks can be and provides security countermeasures. This thesis focuses on a category of side-channel attacks called fault attacks, and contributes a new fault attack method that can compromise a cryptographic device more rapidly than the previous methods when using practical fault injection techniques. We observe that as a circuit is further overclocked, new faults are often superimposed upon previous ones. We analyze the incremental changes rather than the total sum in order to extract more secret information. Unlike many previous methods, ours does not require precise fault injection techniques and requires no knowledge of when the internal state is in a specific algorithmic stage. Results are confirmed experimentally on hardware implementations of AES-128, 192, and 256. / Thesis / Master of Applied Science (MASc)

In this thesis, we investigate attack vectors against Markov decision processes anddynamical systems. This work is motivated by the recent interest in the researchcommunity towards making Machine Learning models safer to malicious attacks. Wefocus on different attack vectors: (I) attacks that alter the input/output signal of aMarkov decision process; (II) eavesdropping attacks whose aim is to detect a change ina dynamical system; (III) poisoning attacks against data-driven control methods.(I) For attacks on Markov decision processes we focus on 2 types of attacks: (1) attacksthat alter the observations of the victim, and (2) attacks that alter the control signalof the victim. Regarding (1), we investigate the problem of devising optimal attacksthat minimize the collected reward of the victim. We show that when the policy andthe system are known to the attacker, designing optimal attacks amounts to solving aMarkov decision process. We also show that, for the victim, the system uncertaintiesinduced by the attack can be modeled using a Partially Observable Markov decisionprocess (POMDP) framework. We demonstrate that using Reinforcement Learningmethods tailored to POMDP lead to more resilient policies. Regarding (2), we insteadinvestigate the problem of designing optimal stealthy poisoning attacks on the controlchannel of Markov decision processes. Previous work constrained the amplitude ofthe adversarial perturbation, with the hope that this constraint will make the attackimperceptible. However, such constraints do not grant any level of undetectabilityand do not take into account the dynamic nature of the underlying Markov process.To design an optimal stealthy attack, we investigate a new attack formulation, basedon information-theoretical quantities, that considers the objective of minimizing thedetectability of the attack as well as the performance of the controlled process.(II) In the second part of this thesis we analyse the problem where an eavesdropper triesto detect a change in a Markov decision process. These processes may be affected bychanges that need to remain private. We study the problem using theoretical tools fromoptimal detection theory to motivate a definition of online privacy based on the averageamount of information per observation of the underlying stochastic system. We provideways to derive privacy upper-bounds and compute policies that attain a higher privacylevel, concluding with examples and numerical simulations.(III) Lastly, we investigate poisoning attacks against data-driven control methods.Specifically, we analyse how a malicious adversary can slightly poison the data soas to minimize the performance of a controller trained using this data. We show thatidentifying the most impactful attack boils down to solving a bi-level non-convexoptimization problem, and provide theoretical insights on the attack. We present ageneric algorithm finding a local optimum of this problem and illustrate our analysisfor various techniques. Numerical experiments reveal that minimal but well-craftedchanges in the data-set are sufficient to deteriorate the performance of data-drivencontrol methods significantly, and even make the closed-loop system unstable. / <p>QC 20220510</p><p></p><p>Topic: Alessio Russo - LicentiateTime: May 31, 2022 04:00 PM Madrid</p><p> Zoom Meeting link https://kth-se.zoom.us/j/69452765598</p>

No / In recent years, the Internet has enabled access to widespread remote services in the distributed computing environment; however, integrity of data transmission in the distributed computing platform is hindered by a number of security issues. For instance, the botnet phenomenon is a prominent threat to Internet security, including the threat of malicious codes. The botnet phenomenon supports a wide range of criminal activities, including distributed denial of service (DDoS) attacks, click fraud, phishing, malware distribution, spam emails, and building machines for illegitimate exchange of information/materials. Therefore, it is imperative to design and develop a robust mechanism for improving the botnet detection, analysis, and removal process. Currently, botnet detection techniques have been reviewed in different ways; however, such studies are limited in scope and lack discussions on the latest botnet detection techniques. This paper presents a comprehensive review of the latest state-of-the-art techniques for botnet detection and figures out the trends of previous and current research. It provides a thematic taxonomy for the classification of botnet detection techniques and highlights the implications and critical aspects by qualitatively analyzing such techniques. Related to our comprehensive review, we highlight future directions for improving the schemes that broadly span the entire botnet detection research field and identify the persistent and prominent research challenges that remain open. / University of Malaya, Malaysia (No. FP034-2012A)

yes / Cyber-attacks have been an increasing threat on people and organisations, which led to massive unpleasant impact. Therefore, there were many solutions to handle cyber-attacks, including Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS). These solutions will provide a huge number of alarms that produce more are false positives. Therefore, the IDS tool result should be operated by a human intelligent be filtered effectively the huge amount of alerts to identify true positive attacks and perform accordingly to the incident response rule. This requires the IT employees to have enough knowledge and competency on operating IDS, IPS and incident handling. This paper aims to examine the awareness of cyber security threat among all IT employees, focusing on three domains: Knowledge, Monitoring and Prevention.