Due to digitalization, computer systems have become integral to every aspect of oursociety. Not all the software and systems behind the wave of digitalization are securelydeveloped, tested, or properly configured and are, therefore, vulnerable to attacks. Thebest way to protect ourselves is through increased awareness about these threats, wherelaboratory exercises are an excellent way to teach about the practical aspects of thesethings. To better understand what makes an excellent cyber security exercise, this thesisaims to develop a CTF-based laboratory exercise for the course Ethical Hacking atKarlstad University and analyze requirements and how different factors influence thedevelopment and user experience. To do this, we set up an environment for hosting,designed and implemented the exercises, and created questionnaires to gather partici-pant data. As a result, we have created a list of 3 requirements and 4 critical factorstogether with an analysis of how they influence the development and user experience ofthe exercise. The most important results were that a correlation between difficulty andhow much the participants liked the lab was found, questionnaire options should not betoo broad since that makes the analysis of them less accurate, and distributing flags inweb environments is more complex than we first assessed.

The aim of this thesis is to evaluate the artificial intelligence model ChatGPT as a tool in the cybersecurity domain. With the purpose of analysing and facilitating understanding of the technology’s effects on possible threats. The development of AI models has a potential to alter the knowledge required to perform malicious activities. The method for evaluating ChatGPT effectiveness in aiding actors to breach a vulnerable system is a experimental capture the flag based approach. This is a type of cyber-security challenge, simulating a target system. The goal is to find and exploit vulnerabilities on the target and obtain a so-called flag to prove the breach. ChatGPT is used as an assistant and information gathering tool in the simulations. The responses collected from ChatGPT in the simulation challenges is analysed to fulfil the thesis purpose. The results shows that ChatGPT is useful as a tool. However, as with any tool, knowledge on how to use it is required. A potential threat actor do need profound comprehension and technical knowledge to make relevant queries. 41.3% of all 46 collected responses is categorised as partly usable in conjunction with previously obtained knowledge. Furthermore, to successfully breach the simulated targets the actor need to be able to modify and deploy any suggested exploit provided by ChatGPT. The findings show a correlation between more difficult capture the flag challenges and the importance of tester knowledge. The harder challenges had a higher degree of responses categorized as partly usable compared to responses deemed directly usable. In conclusion ChatGPT do not provide enough assistance at this time to increase the potential of malicious actors with limited technical knowledge. Future work in this area includes testing internet connected and newer versions of ChatGPT and further analyse the importance of prompt engineering. / Målbilden med denna avhandling är att utvärdera AI-modellen ChatGPT som ett verktyg i en cybersäkerhets-kontext. Detta syftar till att möjliggöra utökad förståelse för teknologins effekter på möjliga hot. Utvecklingen på AI-området har potentialen att förändra kunskapsbehovet hos en aktör att genomföra olika typer av cyberangrepp. Metoden för att utvärdera ChatGPT:s möjlighet till att underlätta intrång i sårbara system är ”capture the flag” baserad. Detta är en typ av cybersäkerhetsutmaning där sårbara system simuleras. Målet är att hitta och utnyttja sårbarheter i systemen för att få tag i så kallade flagor. Dessa flaggor används sedan för att bevisa ett lyckat intrång i systemet. ChatGPT kommer att användas som en assistent och för att inhämta information under dessa simuleringar. Utdata som ChatGPT genererar kommer att samlas in och analyseras för att uppnå syftet med avhandlingen. Resultaten visar att ChatGPT är ett användbart verktyg men ett verktyg som kräver långtgående förkunskaper från användaren för att uppnå effekt. En aktör behöver besitta specifika tekniska kunskaper för att ställa relevanta frågor till AI-assistenten. 41.3% av 46 insamlade svar är kategoriserade som delvis användbara tillsammans med förkunskaper hos testaren. För att lyckas genomföra de simulerade intrången behöver aktören även kunna modifiera och implementera de förslag och lösningar som ges av ChatGPT. Resultaten visar även en korrelation mellan svårare simuleringar och vikten av testarens förkunskaper. Sammanfattningsvis ger inte ChatGPT tillräckligt hög grad av assistans för att utgöra ett hot i sig. Aktörer med begränsad teknisk kännedom kan därmed i nuläget inte utöka sin potential genom att nyttja detta verktyg. Framtida arbete innefattar liknande tester av senare, internetanslutna, versioner av ChatGPT och vidare analys av så kallad ”prompt engineering”

abstract: As the gap widens between the number of security threats and the number of security professionals, the need for automated security tools becomes increasingly important. These automated systems assist security professionals by identifying and/or fixing potential vulnerabilities before they can be exploited. One such category of tools is exploit generators, which craft exploits to demonstrate a vulnerability and provide guidance on how to repair it. Existing exploit generators largely use the application code, either through static or dynamic analysis, to locate crashes and craft a payload. This thesis proposes the Automated Reflection of CTF Hostile Exploits (ARCHES), an exploit generator that learns by example. ARCHES uses an inductive programming library named IRE to generate exploits from exploit examples. In doing so, ARCHES can create an exploit only from example exploit payloads without interacting with the service. By representing each component of the exploit interaction as a collection of theories for how that component occurs, ARCHES can identify critical state information and replicate an executable exploit. This methodology learns rapidly and works with only a few examples. The ARCHES exploit generator is targeted towards Capture the Flag (CTF) events as a suitable environment for initial research. The effectiveness of this methodology was evaluated on four exploits with features that demonstrate the capabilities and limitations of this methodology. ARCHES is capable of reproducing exploits that require an understanding of state dependent input, such as a flag id. Additionally, ARCHES can handle basic utilization of state information that is revealed through service output. However, limitations in this methodology result in failure to replicate exploits that require a loop, intricate mathematics, or multiple TCP connections. Inductive programming has potential as a security tool to augment existing automated security tools. Future research into these techniques will provide more capabilities for security professionals in academia and in industry. / Dissertation/Thesis / Masters Thesis Computer Science 2019

abstract: As technology enhances our communication capabilities, the number of distributed teams has risen in both public and private sectors. There is no doubt that these technological advancements have addressed a need for communication and collaboration of distributed teams. However, is all technology useful for effective collaboration? Are some methods (modalities) of communication more conducive than others to effective performance and collaboration of distributed teams? Although previous literature identifies some differences in modalities, there is little research on geographically distributed mobile teams (DMTs) performing a collaborative task. To investigate communication and performance in this context, I developed the GeoCog system. This system is a mobile communications and collaboration platform enabling small, distributed teams of three to participate in a variant of the military-inspired game, "Capture the Flag". Within the task, teams were given one hour to complete as many "captures" as possible while utilizing resources to the advantage of the team. In this experiment, I manipulated the modality of communication across three conditions with text-based messaging only, vocal communication only, and a combination of the two conditions. It was hypothesized that bi-modal communication would yield superior performance compared to either single modality conditions. Results indicated that performance was not affected by modality. Further results, including communication analysis, are discussed within this paper. / Dissertation/Thesis / M.S. Applied Psychology 2012

This paper will talk about the videos and sculptural installation in my thesis exhibition. Shooting videos outside of the studio developed into a project overarching any individual video or its particular signs. Thus, this paper will focus on the video project with examples that follow a timeline of development, rather than the actual 6 videos on display in the exhibit. The two-part sculpture "Deer in the Headlights" is created in the context of these videos, and coexists with them in a specific architectural space. This space, as well as the clichéd meaning of the deer's gaze, have a relation to the title of the show.

Multi-Agent coordination and control has been studied for a long time, but has recently gained more interest because of technology improvements allowing smaller, more versatile robots and other types of agents. To facilitate multi-agent experiments between heterogeneous agents, including robots and UAVs, we have created a test-bed with both simulation and hardware capabilities. This thesis discusses the creation of this unique, versatile test-bed for multi-agent experiments, also a unique graph creation algorithm, and some experimental results obtained using the test-bed.