As embedded systems become more connected and more ubiquitous in mission- and safety-critical systems, embedded devices have become a high- value target for hackers and security researchers. Attacks on real-time embedded systems software can put lives in danger and put our critical infrastructure at risk. Despite this, security techniques for embedded systems have not been widely studied. Many existing software security techniques for general purpose computers rely on assumptions that do not hold in the embedded case. This thesis focuses on one such technique, control-flow integrity (CFI), that has been vetted as an effective countermeasure against control-flow hijacking attacks on general purpose computing systems. Without the process isolation and fine-grained memory protections provided by a general purpose computer with a rich operating system, CFI cannot provide any security guarantees. This thesis explores a way to use CFI on ARM Cortex-R devices running minimal real-time operating systems. We provide techniques for protecting runtime structures, isolating processes, and instrumenting compiled ARM binaries with CFI protection.

Botnets are networks of computers which have been compromised by malicious software which enables a remotely located adversary to control them and focus their collective power on specific tasks. Botnets pose a significant global threat, with tangible political, economic and military ramifications and have resultingly become a field of significant interest within the cyber-security research community. While a number of effective defence techniques have been devised for botnets utilizing centralized command and control infrastructures, few of these techniques are suitable for defending against larger-scale peer-to-peer (P2P) botnets. In contrast, the sybil attack, combined with index poisoning is an established defence technique for P2P botnets. During a sybil attack, fake bots (\ie sybils) are inserted into the botnet. These sybils distribute fake commands to bots, causing them not to carry out illicit activities. Bots also then unwittingly redistribute the fake commands to other bots in the botnet. This work uses packet-level simulation of a Kademlia-based P2P botnet to evaluate 1) the impact that the location of sybils within the underlying network topology can have on the effectiveness of sybil attacks and 2) several potential optimizations to the placement of sybils within the underlying network topology. / Graduate / 0537 / 0544 / 0984

abstract: With the rise of the Internet of Things, embedded systems have become an integral part of life and can be found almost anywhere. Their prevalence and increased interconnectivity has made them a prime target for malicious attacks. Today, the vast majority of embedded devices are powered by ARM processors. To protect their processors from attacks, ARM introduced a hardware security extension known as TrustZone. It provides an isolated execution environment within the embedded device in which to deploy various memory integrity and malware detection tools. Even though Secure World can monitor the Normal World, attackers can attempt to bypass the security measures to retain control of a compromised system. CacheKit is a new type of rootkit that exploits such a vulnerability in the ARM architecture to hide in Normal World cache from memory introspection tools running in Secure World by exploiting cache locking mechanisms. If left unchecked, ARM processors that provide hardware assisted cache locking for performance and time-critical applications in real-time and embedded systems would be completely vulnerable to this undetectable and untraceable attack. Therefore, a new approach is needed to ensure the correct use of such mechanisms and prevent malicious code from being hidden in the cache. CacheLight is a lightweight approach that leverages the TrustZone and Virtualization extensions of the ARM architecture to allow the system to continue to securely provide these hardware facilities to users while preventing attackers from exploiting them. CacheLight restricts the ability to lock the cache to the Secure World of the processor such that the Normal World can still request certain memory to be locked into the cache by the secure operating system (OS) through a Secure Monitor Call (SMC). This grants the secure OS the power to verify and validate the information that will be locked in the requested cache way thereby ensuring that any data that remains in the cache will not be inconsistent with what exists in main memory for inspection. Malicious attempts to hide data can be prevented and recovered for analysis while legitimate requests can still generate valid entries in the cache. / Dissertation/Thesis / Masters Thesis Computer Science 2018

No abstract / Mini Dissertation (LLM)--University of Pretoria, 2016. / Mercantile Law / LLM / Unrestricted

This research investigates 202 data breach events occurring between 2015 and 2019 and the related financial effects on the USA's impacted private firms. From examining previous research, it is obvious that no known studies evaluate the financial impacts of cybercrimes on private firms. Prior studies mostly focus on public firms and stock market reactions even though there is the increasing number of cyberattacks on private firms too. This study seeks to fill the gap by providing the empirical evidence of the impacts on those firms' cash holding after experiencing a cybersecurity attack. Overall, the results of this research show if the private firms that have been cyberattacked face the connate aftermath and follow the similar precautions as public firms with data breaches or not. I find that the firms that experienced an attack two years ago increase their cash holdings significantly, while an attack that happened a year ago can only impact cash holdings while interacting with tangibility and ROA of a firm. These results are essential as the private firms draw up a budget and reform strategies for coping with cyber incidents.

Whitelisting IP addresses and hostnames allow organizations to employ a default-deny approach to network traffic. Organizations employing a default-deny approach can stop many malicious threats, even including zero-day attacks, because it only allows explicitly stated legitimate activities. However, creating a comprehensive whitelist for a default-deny approach is difficult due to user-supplied destinations that can only be known at the time of usage. Whitelists, therefore, interfere with user experience by denying network traffic to user-supplied legitimate destinations. In this thesis, we focus on creating dynamic whitelists that are capable of allowing user-supplied network activity. We designed and built a system called Harbinger, which leverages user interface activity to provide contextual information in which network activity took place. We built Harbinger for Microsoft Windows operating systems and have tested its usability and effectiveness on four popular Microsoft applications. We find that Harbinger can reduce false positives-positive detection rates from 44%-54% to 0%-0.4% in IP and DNS whitelists. Furthermore, while traditional whitelists failed to detect propagation attacks, Harbinger detected the same attacks 96% of the time. We find that our system only introduced six milliseconds of delay or less for 96% of network activity.

The space systems industry is moving towards smaller multi-vendor satellites, known as Small Space. This shift is driven by economic and technological factors that necessitate hardware and software components that are modular, reusable, and secure. This research addresses two problems associated with the development of modular, reusable, and secure space systems: developing software for space systems (the Development Problem) and securing space systems (the Security Problem). These two problems are interrelated and this research addresses them together. The Development Problem encompasses challenges that space systems developers face as they try to address the constraints induced by reduced budgets, design and development lifecycles, maintenance allowances, multi-vendor component integration and testing timelines. In order to satisfy these constraints a single small satellite might incorporate hardware and software components from dozens of organizations with independent workforces and schedules. The Security Problem deals with growing need to ensure that each one of these software or hardware components behaves according to policy or system design as well as the typical cybersecurity concerns that face any information system. This research addresses the Development Problem by exploring the needs and barriers of Small Space to find the best path forward for the space systems industry to catch up with the methodology advancements already being widely used in other software fields. To do this exploration a series of five surveys, referred to as SISDPA, was conducted to assess current attitudes and state of practice among space system developers. This crystallized a need in space system development — modular reusable open networks can help Small Space realize its potential, but there is still need to address certain security threats. This research addresses the Security Problem by augmenting a modular reusable open-network software development framework, called SSM, by adding policy enforcement in the form of authentication, access control, and encryption provisions, to create a new development framework, SSSM. This design and implementation adds security provisions while minimizing the impact on developers using the framework. SSSM is evaluated in terms of developer and system resource burden and shows that SSSM does not significantly increase developer burden and preserves the ease-of-use of SSM.

No description available.

The increase in solar energy installation capacity and the versatility of modern power inverters have enabled widespread penetration of distributed generation in modern power systems. Islanding detection techniques allow for fast identification and corrective action in the face of abnormal events. Current standards specify the operational limits for voltage, frequency, and detection time. Grid codes specify the procedures for disconnection to establish safe network maintenance conditions. Passive, active, and remote techniques require voltage, current, and frequency measurements and the definition of thresholds for detection. Operational parameters such as load mismatch and quality factors influence the detection capabilities. False-positive triggering due to grid transients can lead to unnecessary disconnection of distributed generation resources. Cybersecurity threats pose a critical challenge for power systems and can result in significant operational disruptions and security risks. In particular, when a power system initiates communication links between different nodes or ends, it becomes more vulnerable to various forms of cyber-attacks. As such, it is imperative to address the potential cybersecurity risks associated with communication links. Through a literature review, this work analyzes the performance of several islanding detection techniques and proposes a modified 9-bus benchmark system to verify the robustness of passive and active methods against false-positive detections upon severe grid-side transients. Furthermore, this thesis conducts a detailed analysis of cyber-attacks on the remote islanding detection technique, using a real-time simulator to assess the potential impact of such attacks on the technique's effectiveness by simulating various attack scenarios. The findings of this analysis can help power system operators to better protect their systems from cyber-attacks and ensure the reliable operation of their distributed generation resources. Moreover, it discusses a conceptual implementation of hardware-in-the-loop testing. The modeling of the systems is discussed. Guidelines and international standards are presented. Various setups for experimental work are suggested and implemented.

The criticality of desalination plants, which greatly rely on Industrial Control Systems (ICS), has heightened due to the scarcity of clean water. This reliance greatly emphasizes the necessity of securing these systems, alongside implementing a robust risk assessment protocol. To address these challenges and the existing limitations in prevalent risk assessment methodologies, this thesis proposes a risk assessment approach for ICS within desalination facilities. The proposed strategy integrates Bayesian Networks (BNs) and Dynamic Programming (DP). The thesis develops BNs into multilevel Bayesian Networks (MBNs), a form that effectively handles system complexity, aids inference, and dynamically modifies risk profiles. These networks account for the interactions and dynamic behaviors of system components,providing a level of responsiveness often missing in traditional methods. A standout feature of this approach is its consideration of the potential attackers’perspective, often neglected but critical for a comprehensive risk assessment and the development of solid defense strategies. DP supplements this approach by simplifying complex problems and and identifying the most optimal paths for potential attacks. Therefore, this thesis contributes greatly to enhancing the safety of critical infrastructures like water desalination plants, addressing key deficiencies in existing safety precautions.