Academic staff
Kambourakis Georgios
Personal Information
Kambourakis Georgios
Professor
Copyright Notice: This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. In most cases, these works may not be reposted or mass reproduced without the explicit permission of the copyright holder.
Conference Publications
E. Chatzoglou, V. Kampourakis, G. Kambourakis, A. Stavrou, Chaos by Design: The Death of Stochastic Race Conditions in HTTP/3, Black Hat USA, Aug, 2026, Las Vegas, USA, https://blackhat.com/us-26/briefings/sch...
Abstract:
Race conditions have long been regarded as stochastic, unreliable vulnerabilities. To date, the principle of exploitation has been Single-Packet Attacks (SPA) over HTTP/2 and HTTP/3. However, SPA relies entirely on aligning network delivery, making it inherently fragile and frequently neutralized by standard proxy buffering. This research obsoletes this field, proving that attackers no longer need to race the network; they can now deterministically orchestrate the server itself. In this Briefing, we will introduce two novel attack classes -- Temporal Hijacking and Server-Side Race Orchestration (SSRO) -- comprising in total nine attack variants that shift timing control to the protocol's internal state. By manipulating HTTP/3 QPACK Head-of-Line blocking, dynamic table saturation, and RFC 9218 priorities, we build an internal "crowded waiting room" within the proxy's memory. Unlike SPA, our SSRO techniques exploit the very buffers meant to protect the backend, maintaining high precision regardless of network jitter. We demonstrate how Temporal Hijacking reliably forces out-of-order execution to invert backend state transitions, while SSRO achieves 96.4% execution precision and triggers 20x transaction limit violations across major edge architectures. We also release TimeOrch, a novel open-source tool to automate these attacks. Backed by an analysis of 10,000 top-ranked domains revealing an 87% vulnerability rate, this research exposes a critical architectural void. With major vendors dismissing these findings as "working as intended", this talk equips attendees with the only remaining lifelines: recompiling binaries with security-hardened settings and adopting the pessimistic locking strategies required to survive these unpatchable, microsecond-level bursts.
Race conditions have long been regarded as stochastic, unreliable vulnerabilities. To date, the principle of exploitation has been Single-Packet Attacks (SPA) over HTTP/2 and HTTP/3. However, SPA relies entirely on aligning network delivery, making it inherently fragile and frequently neutralized by standard proxy buffering. This research obsoletes this field, proving that attackers no longer need to race the network; they can now deterministically orchestrate the server itself. In this Briefing, we will introduce two novel attack classes -- Temporal Hijacking and Server-Side Race Orchestration (SSRO) -- comprising in total nine attack variants that shift timing control to the protocol's internal state. By manipulating HTTP/3 QPACK Head-of-Line blocking, dynamic table saturation, and RFC 9218 priorities, we build an internal "crowded waiting room" within the proxy's memory. Unlike SPA, our SSRO techniques exploit the very buffers meant to protect the backend, maintaining high precision regardless of network jitter. We demonstrate how Temporal Hijacking reliably forces out-of-order execution to invert backend state transitions, while SSRO achieves 96.4% execution precision and triggers 20x transaction limit violations across major edge architectures. We also release TimeOrch, a novel open-source tool to automate these attacks. Backed by an analysis of 10,000 top-ranked domains revealing an 87% vulnerability rate, this research exposes a critical architectural void. With major vendors dismissing these findings as "working as intended", this talk equips attendees with the only remaining lifelines: recompiling binaries with security-hardened settings and adopting the pessimistic locking strategies required to survive these unpatchable, microsecond-level bursts.
K. Kampourakis, V. Kampourakis, E. Chatzoglou, G. Kambourakis, S. Gritzalis, Knowledge-to-Data: LLM-Driven Synthesis of Structured Network Traffic for Testbed-Free IDS Evaluation, The 8th International Conference on Application Intelligence and Blockchain Security (AIBlock 2026), Jul, 2026, Lancaster, UK, Springer LNCS
Abstract:
Realistic, large-scale, and well-labeled cybersecurity datasets are essential for training and evaluating Intrusion Detection Systems (IDS). However, they remain difficult to obtain due to privacy constraints, data sensitivity, and the cost of building controlled collection environments such as testbeds and cyber ranges. This paper investigates whether Large Language Models (LLMs) can operate as controlled knowledge-to-data engines for generating structured synthetic network traffic datasets suitable for IDS research. We propose a methodology that combines protocol documentation, attack semantics, and explicit statistical rules to condition LLMs without fine-tuning or access to raw samples. Using the AWID3 IEEE~802.11 benchmark as a demanding case study, we generate labeled datasets with four state-of-the-art LLMs and assess fidelity through a multi-level validation framework including global similarity metrics, per-feature distribution testing, structural comparison, and cross-domain classification. Results show that, under explicit constraints, LLM-generated datasets can closely approximate the statistical and structural characteristics of real network traffic, enabling gradient-boosting classifiers to achieve F1-scores up to 0.956 when evaluated on real samples. Overall, the findings suggest that constrained LLM-driven generation can facilitate on-demand IDS experimentation, providing a testbed-free, privacy-preserving alternative that overcomes the traditional bottlenecks of physical traffic collection and manual labeling.
Realistic, large-scale, and well-labeled cybersecurity datasets are essential for training and evaluating Intrusion Detection Systems (IDS). However, they remain difficult to obtain due to privacy constraints, data sensitivity, and the cost of building controlled collection environments such as testbeds and cyber ranges. This paper investigates whether Large Language Models (LLMs) can operate as controlled knowledge-to-data engines for generating structured synthetic network traffic datasets suitable for IDS research. We propose a methodology that combines protocol documentation, attack semantics, and explicit statistical rules to condition LLMs without fine-tuning or access to raw samples. Using the AWID3 IEEE~802.11 benchmark as a demanding case study, we generate labeled datasets with four state-of-the-art LLMs and assess fidelity through a multi-level validation framework including global similarity metrics, per-feature distribution testing, structural comparison, and cross-domain classification. Results show that, under explicit constraints, LLM-generated datasets can closely approximate the statistical and structural characteristics of real network traffic, enabling gradient-boosting classifiers to achieve F1-scores up to 0.956 when evaluated on real samples. Overall, the findings suggest that constrained LLM-driven generation can facilitate on-demand IDS experimentation, providing a testbed-free, privacy-preserving alternative that overcomes the traditional bottlenecks of physical traffic collection and manual labeling.
V. Kouliaridis, G. Karopoulos, G. Kambourakis, Assessing the Effectiveness of LLMs in Android Application Vulnerability Analysis, The 7th International Conference on Attacks and Defenses for Internet-of-Things (ADIoT 2024), Dec, 2024, Hangzhou, China, LNCS, Springer
Abstract:
The increasing frequency of attacks on Android applications coupled with the recent popularity of large language models (LLMs) necessitates a comprehensive understanding of the capabilities of the latter in identifying potential vulnerabilities, which is key to mitigate the overall risk. To this end, the work at hand compares the ability of nine state-of-the-art LLMs to detect Android code vulnerabilities listed in the latest Open Worldwide Application Security Project (OWASP) Mobile Top 10. Each LLM was evaluated against an open dataset of over 100 vulnerable code samples, assessing each model's ability to identify key vulnerabilities. Our analysis reveals the strengths and weaknesses of each LLM, identifying important factors that contribute to their performance. Additionally, we offer insights into context augmentation with retrieval-augmented generation (RAG) for detecting Android code vulnerabilities, which in turn may propel secure application development. Finally, while the reported findings regarding code vulnerability analysis show promise, they also reveal significant discrepancies among the different LLMs.
The increasing frequency of attacks on Android applications coupled with the recent popularity of large language models (LLMs) necessitates a comprehensive understanding of the capabilities of the latter in identifying potential vulnerabilities, which is key to mitigate the overall risk. To this end, the work at hand compares the ability of nine state-of-the-art LLMs to detect Android code vulnerabilities listed in the latest Open Worldwide Application Security Project (OWASP) Mobile Top 10. Each LLM was evaluated against an open dataset of over 100 vulnerable code samples, assessing each model's ability to identify key vulnerabilities. Our analysis reveals the strengths and weaknesses of each LLM, identifying important factors that contribute to their performance. Additionally, we offer insights into context augmentation with retrieval-augmented generation (RAG) for detecting Android code vulnerabilities, which in turn may propel secure application development. Finally, while the reported findings regarding code vulnerability analysis show promise, they also reveal significant discrepancies among the different LLMs.
Y. Ge, H. Wang, J. Cao, Y. Zhang, G. Kambourakis, Federated Genetic Algorithm: Two-Layer Privacy-Preserving Trajectory Data Publishing, The Genetic and Evolutionary Computation Conference (GECCO), Jul, 2024, Melbourne, Australia, ACM, https://doi.org/10.1145/3638529.3654200
Abstract:
Nowadays, trajectory data is widely available and used in various real-world applications such as urban planning, navigation services, and location-based services. However, publishing trajectory data can potentially leak sensitive information about identity, personal profiles, and social relationships, and requires privacy protection. This paper focuses on optimizing Privacy-Preserving Trajectory Data Publishing (PP-TDP) problems, addressing the limitations of existing techniques in the trade-off between privacy protection and information preservation. We propose the Federated Genetic Algorithm (FGA) in this paper, aiming to achieve better local privacy protection and global information preservation. FGA consists of multiple local optimizers and a single global optimizer. The parallel local optimizer enables the local data center to retain the original trajectory data and share only the locally anonymized outcomes. The global optimizer collects the local anonymized outcomes and further optimizes the preservation of information while achieving comprehensive privacy protection. To optimize the discrete-domain PP-TDP problems more efficiently, this paper proposes a grouping-based strategy, an intersection-based crossover operation, and a complement-based mutation operation. Experimental results demonstrate that FGA outperforms its competitors in terms of solution accuracy and search efficiency.
Nowadays, trajectory data is widely available and used in various real-world applications such as urban planning, navigation services, and location-based services. However, publishing trajectory data can potentially leak sensitive information about identity, personal profiles, and social relationships, and requires privacy protection. This paper focuses on optimizing Privacy-Preserving Trajectory Data Publishing (PP-TDP) problems, addressing the limitations of existing techniques in the trade-off between privacy protection and information preservation. We propose the Federated Genetic Algorithm (FGA) in this paper, aiming to achieve better local privacy protection and global information preservation. FGA consists of multiple local optimizers and a single global optimizer. The parallel local optimizer enables the local data center to retain the original trajectory data and share only the locally anonymized outcomes. The global optimizer collects the local anonymized outcomes and further optimizes the preservation of information while achieving comprehensive privacy protection. To optimize the discrete-domain PP-TDP problems more efficiently, this paper proposes a grouping-based strategy, an intersection-based crossover operation, and a complement-based mutation operation. Experimental results demonstrate that FGA outperforms its competitors in terms of solution accuracy and search efficiency.
E. Chatzoglou, V. Kampourakis, Z. Tsiatsikas, G. Karopoulos, G. Kambourakis, Keep your memory dump shut: Unveiling data leaks in password managers, The 39th International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2024), Jun, 2024, Edinburgh, UK, Springer, https://doi.org/10.1007/978-3-031-65175-...
Abstract:
Password management has long been a persistently challenging task. This led to the introduction of password management software, which has been around for at least 25 years in various forms, including desktop and browser-based applications. This work assesses the ability of two dozen password managers, 12 desktop applications and 12 browser plugins, to effectively protect the confidentiality of secret credentials in six representative scenarios. Our analysis focuses on the period during which a Password Manager (PM) resides in the RAM. Despite the sensitive nature of these applications, our results show that across all scenarios, only three desktop PM applications and two browser plugins do not store plaintext passwords in the system memory. Oddly enough, only one vendor recognized the exploit as a vulnerability, assigning it the at the time of writing reserved CVE-2023-23349, while the rest chose to disregard or underrate the issue.
Password management has long been a persistently challenging task. This led to the introduction of password management software, which has been around for at least 25 years in various forms, including desktop and browser-based applications. This work assesses the ability of two dozen password managers, 12 desktop applications and 12 browser plugins, to effectively protect the confidentiality of secret credentials in six representative scenarios. Our analysis focuses on the period during which a Password Manager (PM) resides in the RAM. Despite the sensitive nature of these applications, our results show that across all scenarios, only three desktop PM applications and two browser plugins do not store plaintext passwords in the system memory. Oddly enough, only one vendor recognized the exploit as a vulnerability, assigning it the at the time of writing reserved CVE-2023-23349, while the rest chose to disregard or underrate the issue.
M. You, Y. Ge, K. Wang, H. Wang, J. Cao, G. Kambourakis, TLEF: Two-Layer Evolutionary Framework for t-closeness Anonymization, The 24th International Conference on Web Information Systems Engineering (WISE 2023), pp. 10, Oct, 2023, Melbourne, Springer, https://doi.org/10.1007/978-981-99-7254-...
Abstract:
Data anonymization is a fundamental and practical privacy-preserving data publication (PPDP) method, while searching for the optimal anonymization scheme using traditional methods has been proven to be NP-hard. Some recent studies have introduced genetic algorithms (GA) into data anonymization to address this issue, revealing potential solutions. However, the discussions are restricted to a few privacy protection models and evolutionary algorithms (EAs). This paper extends this field by introducing differential evolution (DE) for the first time to optimize data anonymization schemes under the constraints of the t-closeness privacy model. To further enhance the algorithm’s performance, this paper designs a two-layer evolutionary framework (TLEF) that effectively explores optimal solutions by leveraging the unique properties of both GA and DE in a balanced manner. Experimental evaluations conducted on 16 test datasets highlight the advantages of DE in addressing optimal t-closeness anonymization and validate the effectiveness of the TLEF.
Data anonymization is a fundamental and practical privacy-preserving data publication (PPDP) method, while searching for the optimal anonymization scheme using traditional methods has been proven to be NP-hard. Some recent studies have introduced genetic algorithms (GA) into data anonymization to address this issue, revealing potential solutions. However, the discussions are restricted to a few privacy protection models and evolutionary algorithms (EAs). This paper extends this field by introducing differential evolution (DE) for the first time to optimize data anonymization schemes under the constraints of the t-closeness privacy model. To further enhance the algorithm’s performance, this paper designs a two-layer evolutionary framework (TLEF) that effectively explores optimal solutions by leveraging the unique properties of both GA and DE in a balanced manner. Experimental evaluations conducted on 16 test datasets highlight the advantages of DE in addressing optimal t-closeness anonymization and validate the effectiveness of the TLEF.
E. Chatzoglou, G. Karopoulos, G. Kambourakis, Z. Tsiatsikas, Bypassing antivirus detection: old-school malware, new tricks, The 20th International Workshop on Trust, Privacy and Security in the Digital Society (TrustBus), in conjunction with the 18th International Conference on Availability, Reliability and Security (ARES 2023), Aug, 2023, Benevento, ACM Press, https://doi.org/10.1145/3600160.3605010
Abstract:
Being on a mushrooming spree since at least 2013, malware can take a large toll on any system. In a perpetual cat-and-mouse chase with defenders, malware writers constantly conjure new methods to hide their code so as to evade detection by security products. In this context, focusing on the MS Windows platform, this work contributes a comprehensive empirical evaluation regarding the detection capacity of popular, off-the-shelf antivirus and endpoint detection and response engines when facing legacy malware obfuscated via more or less uncommon but publicly known methods. Our experiments exploit a blend of seven traditional AV evasion techniques in 16 executables built in C++, Go, and Rust. Furthermore, we conduct an incipient study regarding the ability of the ChatGPT chatbot in assisting threat actors to produce ready-to-use malware. The derived results in terms of detection rate are highly unexpected: approximately half of the 12 tested AV engines were able to detect less than half of the malware variants, four AVs exactly half of the variants, while only two of the rest detected all but one of the variants.
Being on a mushrooming spree since at least 2013, malware can take a large toll on any system. In a perpetual cat-and-mouse chase with defenders, malware writers constantly conjure new methods to hide their code so as to evade detection by security products. In this context, focusing on the MS Windows platform, this work contributes a comprehensive empirical evaluation regarding the detection capacity of popular, off-the-shelf antivirus and endpoint detection and response engines when facing legacy malware obfuscated via more or less uncommon but publicly known methods. Our experiments exploit a blend of seven traditional AV evasion techniques in 16 executables built in C++, Go, and Rust. Furthermore, we conduct an incipient study regarding the ability of the ChatGPT chatbot in assisting threat actors to produce ready-to-use malware. The derived results in terms of detection rate are highly unexpected: approximately half of the 12 tested AV engines were able to detect less than half of the malware variants, four AVs exactly half of the variants, while only two of the rest detected all but one of the variants.
E. Chatzoglou, V. Kampourakis, G. Kambourakis, Bl0ck: Paralyzing 802.11 connections through Block Ack frames, The 38th International Conference on ICT Systems Security and Privacy Protection (IFIP SEC 2023), Jun, 2023, Poznan, Poland, Springer, https://doi.org/10.1007/978-3-031-56326-...
Abstract:
Despite Wi-Fi is at the eve of its seventh generation, security concerns regarding this omnipresent technology remain in the spotlight of the research community. This work introduces two new denial of service attacks against contemporary Wi-Fi 5 and 6 networks. Differently to similar works in the literature which focus on 802.11 management frames, the introduced assaults exploit control frames. Both the attacks target the central element of any infrastructure-based 802.11 network, i.e., the access point (AP), and result in depriving the associated stations from any service. We demonstrate that, at the very least, the attacks affect a great mass of off-the-self AP implementations by different renowned vendors, and it can be mounted with inexpensive equipment, little effort, and a low level of expertise. With reference to the latest standard, namely, 802.11-2020, we elaborate on the root cause of the respected vulnerabilities, pinpointing shortcomings. Following a coordinated vulnerability disclosure process, our findings have been promptly communicated to each affected AP vendor, already receiving positive feedback as well as a – currently reserved – common vulnerabilities and exposures (CVE) ID, namely CVE-2022-32666.
Despite Wi-Fi is at the eve of its seventh generation, security concerns regarding this omnipresent technology remain in the spotlight of the research community. This work introduces two new denial of service attacks against contemporary Wi-Fi 5 and 6 networks. Differently to similar works in the literature which focus on 802.11 management frames, the introduced assaults exploit control frames. Both the attacks target the central element of any infrastructure-based 802.11 network, i.e., the access point (AP), and result in depriving the associated stations from any service. We demonstrate that, at the very least, the attacks affect a great mass of off-the-self AP implementations by different renowned vendors, and it can be mounted with inexpensive equipment, little effort, and a low level of expertise. With reference to the latest standard, namely, 802.11-2020, we elaborate on the root cause of the respected vulnerabilities, pinpointing shortcomings. Following a coordinated vulnerability disclosure process, our findings have been promptly communicated to each affected AP vendor, already receiving positive feedback as well as a – currently reserved – common vulnerabilities and exposures (CVE) ID, namely CVE-2022-32666.
Z. Tsiatsikas, G. Karopoulos, G. Kambourakis, Measuring the adoption of TLS Encrypted Client Hello extension and its forebear in the wild, The 6th International Workshop Security and Privacy Requirements Engineering (SECPRE), Sep, 2022, Copenhagen, Springer, LNCS, https://doi.org/10.1007/978-3-031-25460-...
Abstract:
The Transport Layer Security (TLS) protocol was introduced to solve the lack of security and privacy in the early versions of the world wide web. However, even though it has substantially evolved over the years, certain features still present privacy issues. One such feature is the Server Name Indication (SNI) extension, which allows multiple web servers to reside behind a provider hosting multiple domains with the same IP address; at the same time it allows third parties to discover the domains that end users visit. In the last few years, the Encrypted Server Name Indication (ESNI) Internet draft is being developed by the Internet Engineering Task Force (IETF); this encrypted variant of the extension was renamed to Encrypted Client Hello (ECH) in latest versions. In this paper, we measure the adoption of both these versions, given that they have substantial differences. By analyzing the top 1M domains in terms of popularity, we identify that only a small portion, less than 19%, supports the privacy-preserving ESNI extension and practically no domain supports ECH. Overall, these results demonstrate that there is still a long way to go to ensure the privacy of end users visiting TLS-protected domains which are co-located behind a common Internet-facing server.
The Transport Layer Security (TLS) protocol was introduced to solve the lack of security and privacy in the early versions of the world wide web. However, even though it has substantially evolved over the years, certain features still present privacy issues. One such feature is the Server Name Indication (SNI) extension, which allows multiple web servers to reside behind a provider hosting multiple domains with the same IP address; at the same time it allows third parties to discover the domains that end users visit. In the last few years, the Encrypted Server Name Indication (ESNI) Internet draft is being developed by the Internet Engineering Task Force (IETF); this encrypted variant of the extension was renamed to Encrypted Client Hello (ECH) in latest versions. In this paper, we measure the adoption of both these versions, given that they have substantial differences. By analyzing the top 1M domains in terms of popularity, we identify that only a small portion, less than 19%, supports the privacy-preserving ESNI extension and practically no domain supports ECH. Overall, these results demonstrate that there is still a long way to go to ensure the privacy of end users visiting TLS-protected domains which are co-located behind a common Internet-facing server.
Z. Tsiatsikas, G. Karopoulos, G. Kambourakis, The effects of the Russo-Ukrainian war on network infrastructures through the lens of BGP, The 8th Workshop on the Security of Industrial Control Systems and of Cyber-Physical Systems (CyberICPS 2022), Sep, 2022, Copenhagen, Springer, LNCS, https://doi.org/10.1007/978-3-031-25460-...
Abstract:
One of the most critical building blocks of the reliable operation of the Internet is the Border Gateway Protocol (BGP) that is used to exchange routing messages, signaling active and defective routing paths. During large-scale catastrophic incidents, such as conventional military operations or cyberwarfare, the stability of the Internet is affected, causing the announcements of defective routing paths to increase substantially. This work studies the relation between major incidents, such as armed conflicts in a country scale, and the corresponding network outages observed in the core of the Internet infrastructure as announced by BGP. We focus on the Russo-Ukrainian war as a timely and prominent use case and examine geolocalized BGP data for a 2-month period. Our methodology allows us to cherry-pick long-term network outages among temporary interruptions of service in this specific time window, and pinpoint them to the areas of the operations. Our results indicate that there is a high correlation between the start of military operations and network outages in a city and country level. Furthermore, we show that the last few days before the start of the operations network outages rise as well, indicating that preparatory cyberattack activities take place. No less important, network outages remain at much higher than usual levels during the operations, something that can be attributed to infrastructure destruction possibly backed by cyberattacks.
One of the most critical building blocks of the reliable operation of the Internet is the Border Gateway Protocol (BGP) that is used to exchange routing messages, signaling active and defective routing paths. During large-scale catastrophic incidents, such as conventional military operations or cyberwarfare, the stability of the Internet is affected, causing the announcements of defective routing paths to increase substantially. This work studies the relation between major incidents, such as armed conflicts in a country scale, and the corresponding network outages observed in the core of the Internet infrastructure as announced by BGP. We focus on the Russo-Ukrainian war as a timely and prominent use case and examine geolocalized BGP data for a 2-month period. Our methodology allows us to cherry-pick long-term network outages among temporary interruptions of service in this specific time window, and pinpoint them to the areas of the operations. Our results indicate that there is a high correlation between the start of military operations and network outages in a city and country level. Furthermore, we show that the last few days before the start of the operations network outages rise as well, indicating that preparatory cyberattack activities take place. No less important, network outages remain at much higher than usual levels during the operations, something that can be attributed to infrastructure destruction possibly backed by cyberattacks.
G. Karopoulos, D. Geneiatakis, G. Kambourakis, Neither good nor bad: A large-scale empirical analysis of HTTP security response headers, The 18th International Conference on Trust, Privacy and Security in Digital Business (TrustBUS 2021), pp. 83-95, Sep, 2021, Linz, Austria, Springer, LNCS, https://link.springer.com/chapter/10.100...
Abstract:
HTTP security-focused response headers can be of great aid to web applications towards augmenting their overall security level. That is, if set at the server side, these headers define whether certain security countermeasures are in place for protecting end-users. By utilising the curated Tranco list, this work conducts a wide-scale internet measurement that provides timely answers to the following questions: (a) How the adoption of these headers is developing over time?, (b) What is the penetration ratio of each key header in the community?, (c) Are there any differences in the support of these headers between diverse major browsers and platforms?, (d) Does the version of a browser (outdated vs. new) affects the support rate per key header?, and (e) Is the status of a header (active vs. deprecated) reflected to its support rate by web servers? Setting aside the use of the more robust Tranco corpus, to our knowledge, with reference to the literature, the contributions regarding the third and fifth questions are novel, while for the rest an updated, up-to-the-minute view of the state of play is provided. Amongst others, the results reveal that the support of headers is somewhat related to the browser version, the penetration ratio of all headers is less than 17% across all platforms, outdated browser versions may be better supported in terms of headers, while deprecated headers still enjoy wide implementation.
HTTP security-focused response headers can be of great aid to web applications towards augmenting their overall security level. That is, if set at the server side, these headers define whether certain security countermeasures are in place for protecting end-users. By utilising the curated Tranco list, this work conducts a wide-scale internet measurement that provides timely answers to the following questions: (a) How the adoption of these headers is developing over time?, (b) What is the penetration ratio of each key header in the community?, (c) Are there any differences in the support of these headers between diverse major browsers and platforms?, (d) Does the version of a browser (outdated vs. new) affects the support rate per key header?, and (e) Is the status of a header (active vs. deprecated) reflected to its support rate by web servers? Setting aside the use of the more robust Tranco corpus, to our knowledge, with reference to the literature, the contributions regarding the third and fifth questions are novel, while for the rest an updated, up-to-the-minute view of the state of play is provided. Amongst others, the results reveal that the support of headers is somewhat related to the browser version, the penetration ratio of all headers is less than 17% across all platforms, outdated browser versions may be better supported in terms of headers, while deprecated headers still enjoy wide implementation.
Z. Tsiatsikas, G. Kambourakis, D. Geneiatakis, At your service 24/7 or not? Denial of Service on ESInet systems, The 18th International Conference on Trust, Privacy and Security in Digital Business (TrustBUS 2021), pp. 35-49, Sep, 2021, Linz, Austria, Springer, LNCS, https://link.springer.com/chapter/10.100...
Abstract:
Emergency calling services are a cornerstone of public safety. During the last few years such systems are transitioning to VoIP and unified communications, and are continuously evolving under the umbrella of organizations, including NENA and EENA. The outcome of this effort is NG911 or NG112 services operating over the so-called Emergency Services IP network (ESInet). This work introduces and meticulously assesses the impact of an insidious and high-yield denial-of-service (DoS) attack against ESInet. Contrariwise to legacy SIP-based DoS, the introduced assault capitalizes on the SDP body of the SIP message with the sole purpose of instigating CPU-intensive transcoding operations at the ESInet side. We detail on the way such an attack can be carried out, and scrutinize on its severe, if not catastrophic, impact through different realistic scenarios involving a sufficient set of codecs. Finally, highlighting on the fact that 911 or 112 calls cannot be dropped, but need to be answered as fast as possible, we offer suggestions on how this kind of assault can be detected and mitigated.
Emergency calling services are a cornerstone of public safety. During the last few years such systems are transitioning to VoIP and unified communications, and are continuously evolving under the umbrella of organizations, including NENA and EENA. The outcome of this effort is NG911 or NG112 services operating over the so-called Emergency Services IP network (ESInet). This work introduces and meticulously assesses the impact of an insidious and high-yield denial-of-service (DoS) attack against ESInet. Contrariwise to legacy SIP-based DoS, the introduced assault capitalizes on the SDP body of the SIP message with the sole purpose of instigating CPU-intensive transcoding operations at the ESInet side. We detail on the way such an attack can be carried out, and scrutinize on its severe, if not catastrophic, impact through different realistic scenarios involving a sufficient set of codecs. Finally, highlighting on the fact that 911 or 112 calls cannot be dropped, but need to be answered as fast as possible, we offer suggestions on how this kind of assault can be detected and mitigated.
P. Nespoli, Félix Gómez Mármol, G. Kambourakis, AISGA: Multi-objective parameters optimization forcountermeasures selection through genetic algorithm, The 16th International Conference on Availability, Reliability and Security (ARES 2021), pp. 1-8, Aug, 2021, Vienna, Austria, ACM, https://dl.acm.org/doi/abs/10.1145/34654...
Abstract:
Cyberattacks targeting modern network infrastructures are increasing in number and impact. This growing phenomenon emphasizes the central role of cybersecurity and, in particular, the reaction against ongoing threats targeting assets within the protected system. Such centrality is reflected in the literature, where several works have been presented to propose full-fledged reaction methodologies to tackle offensive incidents’ consequences. In this direction, the work in [18] developed an immuno-based response approach based on the application of the Artificial Immune System (AIS) methodology. That is, the AIS-powered reaction is able to calculate the optimal set of atomic countermeasure to enforce on the asset within the monitored system, minimizing the risk to which those are exposed in a more than adequate time. To further contribute to this line, the paper at hand presents AISGA, a multi-objective approach that leverages the capabilities of a Genetic Algorithm (GA) to optimize the selection of the input parameters of the AIS methodology. Specifically, AISGA selects the optimal ranges of inputs that balance the tradeoff between minimizing the global risk and the execution time of the methodology. Additionally, by flooding the AIS-powered reaction with a wide range of possible inputs, AISGA intends to demonstrate the robustness of such a model. Exhaustive experiments are executed to precisely compute the optimal ranges of parameters, demonstrating that the proposed multi-objective optimization prefers a fast-but-effective reaction.
Cyberattacks targeting modern network infrastructures are increasing in number and impact. This growing phenomenon emphasizes the central role of cybersecurity and, in particular, the reaction against ongoing threats targeting assets within the protected system. Such centrality is reflected in the literature, where several works have been presented to propose full-fledged reaction methodologies to tackle offensive incidents’ consequences. In this direction, the work in [18] developed an immuno-based response approach based on the application of the Artificial Immune System (AIS) methodology. That is, the AIS-powered reaction is able to calculate the optimal set of atomic countermeasure to enforce on the asset within the monitored system, minimizing the risk to which those are exposed in a more than adequate time. To further contribute to this line, the paper at hand presents AISGA, a multi-objective approach that leverages the capabilities of a Genetic Algorithm (GA) to optimize the selection of the input parameters of the AIS methodology. Specifically, AISGA selects the optimal ranges of inputs that balance the tradeoff between minimizing the global risk and the execution time of the methodology. Additionally, by flooding the AIS-powered reaction with a wide range of possible inputs, AISGA intends to demonstrate the robustness of such a model. Exhaustive experiments are executed to precisely compute the optimal ranges of parameters, demonstrating that the proposed multi-objective optimization prefers a fast-but-effective reaction.
V. Kouliaridis, G. Kambourakis, T. Peng, Feature importance in Android malware detection, The 11th International Workshop on Collaborative Computing with Cloud and Client (C4W 2020) in conjunction with The 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2020), Dec, 2020, Guangzhou, China, IEEE Press, https://ieeexplore.ieee.org/document/934...
Abstract:
The topic of mobile malware detection on the Android platform has attracted significant attention over the last several years. However, while much research has been conducted toward mobile malware detection techniques, little attention has been devoted to feature selection and feature importance. That is, which app feature matters more when it comes to machine learning classification. After succinctly surveying all major, dated from 2012 to 2020, datasets used by state-of-the-art malware detection works in the literature, we analyse a critical mass of apps from the most contemporary and prevailing datasets, namely Drebin, VirusShare, and AndroZoo. Next, we rank the importance of app classification features pertaining to permissions and intents using the Information Gain algorithm for all the three above-mentioned datasets.
The topic of mobile malware detection on the Android platform has attracted significant attention over the last several years. However, while much research has been conducted toward mobile malware detection techniques, little attention has been devoted to feature selection and feature importance. That is, which app feature matters more when it comes to machine learning classification. After succinctly surveying all major, dated from 2012 to 2020, datasets used by state-of-the-art malware detection works in the literature, we analyse a critical mass of apps from the most contemporary and prevailing datasets, namely Drebin, VirusShare, and AndroZoo. Next, we rank the importance of app classification features pertaining to permissions and intents using the Information Gain algorithm for all the three above-mentioned datasets.
V. Kouliaridis, N. Potha, G. Kambourakis, Improving Android malware detection through dimensionality reduction techniques, The 3rd International Conference on Machine Learning for Networking (MLN 2020), Nov, 2020, Paris, France, Springer LNCS, https://link.springer.com/chapter/10.100...
Abstract:
Mobile malware poses undoubtedly a major threat to the continuously increasing number of mobile users worldwide. While researchers have been trying vigorously to find optimal detection solutions, mobile malware is becoming more sophisticated and its writers are getting more and more skilled in hiding malicious code. In this paper, we examine the usefulness of two known dimensionality reduction transformations namely, Principal Component Analysis (PCA) and t-distributed stochastic neighbor embedding (t-SNE) in malware detection. Starting from a large set of base prominent classifiers, we study how they can be combined to build an accurate ensemble. We propose a simple ensemble aggregated base model of similar feature type as well as a complex ensemble that can use multiple and possibly heterogeneous base models. The experimental results in contemporary Androzoo benchmark corpora verify the suitability of ensembles for this task and clearly demonstrate the effectiveness of our method.
Mobile malware poses undoubtedly a major threat to the continuously increasing number of mobile users worldwide. While researchers have been trying vigorously to find optimal detection solutions, mobile malware is becoming more sophisticated and its writers are getting more and more skilled in hiding malicious code. In this paper, we examine the usefulness of two known dimensionality reduction transformations namely, Principal Component Analysis (PCA) and t-distributed stochastic neighbor embedding (t-SNE) in malware detection. Starting from a large set of base prominent classifiers, we study how they can be combined to build an accurate ensemble. We propose a simple ensemble aggregated base model of similar feature type as well as a complex ensemble that can use multiple and possibly heterogeneous base models. The experimental results in contemporary Androzoo benchmark corpora verify the suitability of ensembles for this task and clearly demonstrate the effectiveness of our method.
V. Kouliaridis, K. Barbatsalou, G. Kambourakis, G. Wang, Mal-warehouse: A data collection-as-a-service of mobile malware behavioral patterns, The 15th IEEE International Conference on Ubiquitous Intelligence and Computing (UIC 2018), Oct, 2018, Guangzhou, China, IEEE Press, https://ieeexplore.ieee.org/document/856...
Abstract:
Smartphones are pervasively used in many everyday life extents, and have been both targets and victims of malware. While there are many anti-malware applications available in mobile markets, so far there are no public services that collect mobile usage data, so as to observe malware effects on mobile devices. The main contribution of this paper is the Mal-warehouse, an open-source tool performing data collection-as-a-service for Android malware behavioral patterns. During its initial development and experimentation phase, the tool extracts mobile device statistics, including CPU, memory and battery usage, process reports, and network statistics for 14 Android malware applications from a target device. It then stores them in a classified manner on a cloud database. Despite the fact that the work at hand is still in an early stage, the detection model is enhanced with a preliminary detection module. Machine learning techniques are used as a proof-of-concept so as to evaluate the detection capabilities of the detection model, when compared to a clean snapshot of the target device. Mal-warehouse is publicly available, meaning that anyone can download and use it locally and then upload their findings to the cloud service for further evaluation and processing by others.
Smartphones are pervasively used in many everyday life extents, and have been both targets and victims of malware. While there are many anti-malware applications available in mobile markets, so far there are no public services that collect mobile usage data, so as to observe malware effects on mobile devices. The main contribution of this paper is the Mal-warehouse, an open-source tool performing data collection-as-a-service for Android malware behavioral patterns. During its initial development and experimentation phase, the tool extracts mobile device statistics, including CPU, memory and battery usage, process reports, and network statistics for 14 Android malware applications from a target device. It then stores them in a classified manner on a cloud database. Despite the fact that the work at hand is still in an early stage, the detection model is enhanced with a preliminary detection module. Machine learning techniques are used as a proof-of-concept so as to evaluate the detection capabilities of the detection model, when compared to a clean snapshot of the target device. Mal-warehouse is publicly available, meaning that anyone can download and use it locally and then upload their findings to the cloud service for further evaluation and processing by others.
M. Anagnostopoulos, G. Kambourakis, S. Gritzalis, D. K. Y. Yau, Never say Never: Authoritative TLD nameserver-powered DNS amplification, NOMS 2018 16th IEEE/IFIP Network Operations and Management Symposium, Yu-Chee Tseng et al., (eds), pp. 1-9, Apr, 2018, Taipei, Taiwan, IEEE CPS Conference Publishing Services, http://noms2018.ieee-noms.org/
Abstract:
DNS amplification is considered a significant and constant threat to any networking environment. Certainly, the Authoritative Name Servers (ANS) of popular domain zones, and in particular the DNSSEC-enabled ones, do not elude the attention of attackers for entangling them in this type of assaults. The ANS list of Top Level Domains (TLD) are publicly accessible in the form of root.zone file, so even a casual attacker is able to acquire the list of TLD zones and their matching ANSs. In this context, the paper at hand examines the potential of ANSs of TLD to be unknowingly engaged by attackers in DNS amplification attacks. In particular, using two distinct versions of the root.zone file, we assess the amplification factor that these entities may produce when replying to both individual and multiple queries. As a side-goal, we measure the degree of adoption of Response Rate Limiting (RRL) by ANS. Our most important findings are that (i) an 25% and 37% of unique DNS queries for TLDs produce an amplification factor that respectively exceeds 60 and 50 when the query is sent individually or in batch, and (ii) an almost 43% of unique ANSs do not properly implement RRL or leave it inactive.
DNS amplification is considered a significant and constant threat to any networking environment. Certainly, the Authoritative Name Servers (ANS) of popular domain zones, and in particular the DNSSEC-enabled ones, do not elude the attention of attackers for entangling them in this type of assaults. The ANS list of Top Level Domains (TLD) are publicly accessible in the form of root.zone file, so even a casual attacker is able to acquire the list of TLD zones and their matching ANSs. In this context, the paper at hand examines the potential of ANSs of TLD to be unknowingly engaged by attackers in DNS amplification attacks. In particular, using two distinct versions of the root.zone file, we assess the amplification factor that these entities may produce when replying to both individual and multiple queries. As a side-goal, we measure the degree of adoption of Response Rate Limiting (RRL) by ANS. Our most important findings are that (i) an 25% and 37% of unique DNS queries for TLDs produce an amplification factor that respectively exceeds 60 and 50 when the query is sent individually or in batch, and (ii) an almost 43% of unique ANSs do not properly implement RRL or leave it inactive.
Download PDFM. Anagnostopoulos, G. Kambourakis, P. Drakatos, M. Karavolos, S. Kotsilitis, D. K. Y. Yau, Botnet command and control architectures revisited: Tor Hidden services and Fluxing, The 18th International Conference on Web Information Systems Engineering (WISE 2017), pp. 517-527, Oct, 2017, Moscow, Russia, Springer LNCS Vol. 10570, http://www.wise-conferences.org/
Abstract:
Botnet armies constitute a major and continuous threat to the Internet. Their number, diversity, and power grows with each passing day, and the last years we are witnessing their rapid expansion to mobile and even IoT devices. The work at hand focuses on botnets which comprise mobile devices (e.g. smartphones), and aims to raise the alarm on a couple of advanced Command and Control (C&C) architectures that capitalize on Tor's hidden services (HS) and DNS protocol. Via the use of such architectures, the goal of the perpetrator is dual; first to further obfuscate their identity and minimize the botnet's forensic signal, and second to augment the resilience of their army. The novelty of the introduced architectures is that it does not rely on static C&C servers, but on rotating ones, which can be reached by other botnet members through their (varied) onion address. Also, we propose a scheme called "Tor fluxing", which opposite to legacy IP or DNS fluxing, does not rely on A type of DNS resource records but on TXT ones. We demonstrate the soundness and effectiveness of the introduced C&C constructions via a proof-of-concept implementation, and suggest possible remedies.
Botnet armies constitute a major and continuous threat to the Internet. Their number, diversity, and power grows with each passing day, and the last years we are witnessing their rapid expansion to mobile and even IoT devices. The work at hand focuses on botnets which comprise mobile devices (e.g. smartphones), and aims to raise the alarm on a couple of advanced Command and Control (C&C) architectures that capitalize on Tor's hidden services (HS) and DNS protocol. Via the use of such architectures, the goal of the perpetrator is dual; first to further obfuscate their identity and minimize the botnet's forensic signal, and second to augment the resilience of their army. The novelty of the introduced architectures is that it does not rely on static C&C servers, but on rotating ones, which can be reached by other botnet members through their (varied) onion address. Also, we propose a scheme called "Tor fluxing", which opposite to legacy IP or DNS fluxing, does not rely on A type of DNS resource records but on TXT ones. We demonstrate the soundness and effectiveness of the introduced C&C constructions via a proof-of-concept implementation, and suggest possible remedies.
G. Kambourakis, C. Kolias, A. Stavrou, The Mirai Botnet and the IoT Zombie Armies, The 36th IEEE Military Communications Conference (MILCOM 2017), Oct, 2017, Baltimore, MD, USA, IEEE Press, http://events.afcea.org/milcom17/public/...
Abstract:
The rapidly growing presence of Internet of Things (IoT) devices is becoming a continuously alluring playground for malicious actors who try to harness their vast numbers and diverse locations. One of their primary goals is to assemble botnets that can serve their nefarious purposes from Denial of Service (DoS) to spam and advertisement fraud. The most recent example that highlights the severity of the problem is the Mirai family of malware, which is accountable for a plethora of massive DDoS attacks of unprecedented volume and diversity. The aim of this paper is to offer a comprehensive state-of-the-art review of the state of IoT malware and the underlying reasons of its success with a particular focus on Mirai and major similar worms. To that end, we provide extensive details on the internal workings of IoT malware, examine their interrelationships, and elaborate on the possible strategies for defending against them.
The rapidly growing presence of Internet of Things (IoT) devices is becoming a continuously alluring playground for malicious actors who try to harness their vast numbers and diverse locations. One of their primary goals is to assemble botnets that can serve their nefarious purposes from Denial of Service (DoS) to spam and advertisement fraud. The most recent example that highlights the severity of the problem is the Mirai family of malware, which is accountable for a plethora of massive DDoS attacks of unprecedented volume and diversity. The aim of this paper is to offer a comprehensive state-of-the-art review of the state of IoT malware and the underlying reasons of its success with a particular focus on Mirai and major similar worms. To that end, we provide extensive details on the internal workings of IoT malware, examine their interrelationships, and elaborate on the possible strategies for defending against them.
C. Gkountis, M. Taha, J. Lloret, G. Kambourakis, Lightweight Algorithm for Protecting SDN controller against DDoS attacks, The 10th IFIP Wireless and Mobile Networking Conference (WMNC 2017), Sep, 2017, Valencia, Spain, IEEE Press, http://jlloret.webs.upv.es/wmnc2017/
Abstract:
It is without a doubt that both the controller and switch of an SDN are vulnerable to Distributed Denial of Service (DDoS) attacks. Typically, this ilk of attacks targets the flow table of the deployed switches with the aim of producing overloading, high network delays, and consume bandwidth. Motivated by this fact, in this paper, we propose a lightweight scheme which is based on a set of rules to efficiently characterize packets sent to a network switch as malicious or not. Through testbed experimentation and comparison with legacy DDoS protection schemes, we demonstrate that our solution performs significantly better when it comes to SDN ecosystem for mobile and wireless users.
It is without a doubt that both the controller and switch of an SDN are vulnerable to Distributed Denial of Service (DDoS) attacks. Typically, this ilk of attacks targets the flow table of the deployed switches with the aim of producing overloading, high network delays, and consume bandwidth. Motivated by this fact, in this paper, we propose a lightweight scheme which is based on a set of rules to efficiently characterize packets sent to a network switch as malicious or not. Through testbed experimentation and comparison with legacy DDoS protection schemes, we demonstrate that our solution performs significantly better when it comes to SDN ecosystem for mobile and wireless users.
V. Cozza, Z. Tsiatsikas, M. Conti, G. Kambourakis, Why Snoopy loves online services: An Analysis of (lack of) Privacy in Online Services (ICISSP 2017), The 3rd International Conference on Information Systems Security and Privacy, Feb, 2017, Porto, Portugal, SCITEPRESS, http://www.icissp.org/
Abstract:
Over the last decade online services have penetrated the market and for many of us became an integral part of our software portfolio. On the one hand online services offer flexibility in every sector of the social web, but on the other hand these pros do not come without a cost in terms of privacy. This work focuses on online services, and in particular on the possible inherent design errors which make these services an easy target for privacy invaders. We demonstrate the previous fact using a handful of real-world cases pertaining to popular online web services. More specifically, we show that despite the progress made in raising security/privacy awareness amongst all the stakeholders (developers, admins, users) and the existence of mature security/privacy standards and practices, there still exist a plethora of poor implementations that may put user’s privacy at risk. We particularly concentrate on cases where a breach can happen even if the aggressor has limited knowledge about their target and/or the attack can be completed with limited resources. In this context, the main contribution of the paper at hand revolves around the demonstration of effortlessly exploiting privacy leaks existing in widely-known online services due to software development errors.
Over the last decade online services have penetrated the market and for many of us became an integral part of our software portfolio. On the one hand online services offer flexibility in every sector of the social web, but on the other hand these pros do not come without a cost in terms of privacy. This work focuses on online services, and in particular on the possible inherent design errors which make these services an easy target for privacy invaders. We demonstrate the previous fact using a handful of real-world cases pertaining to popular online web services. More specifically, we show that despite the progress made in raising security/privacy awareness amongst all the stakeholders (developers, admins, users) and the existence of mature security/privacy standards and practices, there still exist a plethora of poor implementations that may put user’s privacy at risk. We particularly concentrate on cases where a breach can happen even if the aggressor has limited knowledge about their target and/or the attack can be completed with limited resources. In this context, the main contribution of the paper at hand revolves around the demonstration of effortlessly exploiting privacy leaks existing in widely-known online services due to software development errors.
E. Mitakidis, D. Taketzis, A. Fakis, G. Kambourakis, SnoopyBot: An Android spyware to bridge the mixes in Tor, The 24th International Conference on Software, Telecommunications and Computer Networks (SoftCOM 2016), Sep, 2016, Split, Croatia, IEEE Press, http://marjan.fesb.hr/SoftCOM/2016/
Abstract:
We present a moderately simple to implement but very effective and silent deanonymization scheme for Tor traffic. This is done by bridging the mixes in Tor, that is, we control both the traffic leaving the Onion Proxy (OP) and the traffic entering the Exit node. Specifically, from a user’s viewpoint, our proposal has been implemented in the popular Android platform as a spyware, having the dual aim to manipulate user traffic before it enters the Tor overlay and explicitly instruct OP to choose an exit node that is controlled by the attacker. When the user traffic is received by the rogue exit node it is filtered, and the sender’s IP details become visible. Notably, apart from deobfuscating normal http traffic, say, send via the Tor browser, the proposed scheme is able to manipulate https requests as well.
We present a moderately simple to implement but very effective and silent deanonymization scheme for Tor traffic. This is done by bridging the mixes in Tor, that is, we control both the traffic leaving the Onion Proxy (OP) and the traffic entering the Exit node. Specifically, from a user’s viewpoint, our proposal has been implemented in the popular Android platform as a spyware, having the dual aim to manipulate user traffic before it enters the Tor overlay and explicitly instruct OP to choose an exit node that is controlled by the attacker. When the user traffic is received by the rogue exit node it is filtered, and the sender’s IP details become visible. Notably, apart from deobfuscating normal http traffic, say, send via the Tor browser, the proposed scheme is able to manipulate https requests as well.
Z. Tsiatsikas, D. Geneiatakis, G. Kambourakis, S. Gritzalis, Realtime DDoS detection in SIP Ecosystems: Machine Learning tools of the trade, NSS 2016 The 10th International Conference on Network and System Security, M. Yung et al., (eds), Sep, 2016, Taipei, Taiwan, Springer LNCS Lecture Notes in Computer Science, http://nsclab.org/nss2016/
Abstract:
Over the last decade, VoIP services and more especially the SIP-based ones, have gained much attention due to the low-cost and simple models they offer. Nevertheless, their inherently insecure design make them prone to a plethora of attacks. This work concentrates on the detection of resource consumption attacks targeting SIP ecosystems. While this topic has been addressed in the literature to a great extent, only a handful of works examine the potential of Machine Learning (ML) techniques to detect DoS and even fewer do so in realtime. Spurred by this fact, the work at hand assesses the potential of 5 different ML-driven methods in nipping SIP-powered DDoS attacks in the bud. Our experiments involving 17 realistically simulated (D)DoS scenarios of varied attack volume in terms of calls/sec and user population, suggest that some of the classifiers show promising detection accuracy even in low-rate DDoS incidents. We also show that the performance of ML-based detection in terms of classification time overhead does not exceed 3.5 ms in average with a mean standard deviation of 7.7 ms.
Over the last decade, VoIP services and more especially the SIP-based ones, have gained much attention due to the low-cost and simple models they offer. Nevertheless, their inherently insecure design make them prone to a plethora of attacks. This work concentrates on the detection of resource consumption attacks targeting SIP ecosystems. While this topic has been addressed in the literature to a great extent, only a handful of works examine the potential of Machine Learning (ML) techniques to detect DoS and even fewer do so in realtime. Spurred by this fact, the work at hand assesses the potential of 5 different ML-driven methods in nipping SIP-powered DDoS attacks in the bud. Our experiments involving 17 realistically simulated (D)DoS scenarios of varied attack volume in terms of calls/sec and user population, suggest that some of the classifiers show promising detection accuracy even in low-rate DDoS incidents. We also show that the performance of ML-based detection in terms of classification time overhead does not exceed 3.5 ms in average with a mean standard deviation of 7.7 ms.
F. Giannakas, G. Kambourakis, S. Gritzalis, CyberAware: A Mobile Game-based app for Cybersecurity Education and Awareness, IMCL 2015 International Conference on Interactive Mobile Communication, Technologies and Learning, M. Auer, (ed), Nov, 2015, Thessaloniki, Greece, IEEE CPS Conference Publishing Services, http://www.imcl-conference.org/imcl2015/
Abstract:
Nowadays, basic cybersecurity education and awareness is deemed necessary, even for children as young as elementary school-aged. If knowledge on this topic is delivered in the form of a digital game-based activity, then it has greater chances of being more joyful and efficient. The paper at hand discusses the development of a novel mobile app called CyberAware, destined to cybersecurity education and awareness. At present, the game is designed for K-6 aged children and can be used to support either or both formal or informal learning. Also, due to its mobile nature, it can be experienced as an outdoor or classroom activity. Opposite to similar studies found in the literature so far, our attention is not solely drawn to game's technological aspects but equally to the educational factor.
Nowadays, basic cybersecurity education and awareness is deemed necessary, even for children as young as elementary school-aged. If knowledge on this topic is delivered in the form of a digital game-based activity, then it has greater chances of being more joyful and efficient. The paper at hand discusses the development of a novel mobile app called CyberAware, destined to cybersecurity education and awareness. At present, the game is designed for K-6 aged children and can be used to support either or both formal or informal learning. Also, due to its mobile nature, it can be experienced as an outdoor or classroom activity. Opposite to similar studies found in the literature so far, our attention is not solely drawn to game's technological aspects but equally to the educational factor.
Z. Tsiatsikas, M. Anagnostopoulos, G. Kambourakis, S. Lambrou, D. Geneiatakis, Hidden in plain sight. SDP-based covert channel for Botnet communication, 12th International Conference on Trust, Privacy & Security in Digital Business (TrustBus 2015), Sep, 2015, Valencia, Spain, Springer, http://www.ds.unipi.gr/trustbus15/
Abstract:
Covert channels pose a significant threat for networking systems. In this paper, we examine the exploitation of Session Description Protocol (SDP) information residing in Session Initiation Protocol (SIP)requests with the aim to hide data in plain sight.While a significant mass of works in the literature cope with covert communication channels, only a very limited number of them rely on SIP to realize its goals. Also, none of them concentrates on SDP data contained in SIP messages to implement and evaluate such a hidden communication channel. Motivated by this fact, the work at hand proposes and demonstrates the feasibility of a simple but very effective in terms of stealthiness and simplicity SIP-based covert channel for botnet Command and Control (C&C). As a side contribution, we assess the soundness and the impact of such a deployment at the victim's side via the use of two different types of flooding attacks.
Covert channels pose a significant threat for networking systems. In this paper, we examine the exploitation of Session Description Protocol (SDP) information residing in Session Initiation Protocol (SIP)requests with the aim to hide data in plain sight.While a significant mass of works in the literature cope with covert communication channels, only a very limited number of them rely on SIP to realize its goals. Also, none of them concentrates on SDP data contained in SIP messages to implement and evaluate such a hidden communication channel. Motivated by this fact, the work at hand proposes and demonstrates the feasibility of a simple but very effective in terms of stealthiness and simplicity SIP-based covert channel for botnet Command and Control (C&C). As a side contribution, we assess the soundness and the impact of such a deployment at the victim's side via the use of two different types of flooding attacks.
Z. Tsiatsikas, A. Fakis, D. Papamartzivanos, D. Geneiatakis, G. Kambourakis, C. Kolias, Battling against DDoS in SIP. Is machine learning-based detection an effective weapon?, The 12th International Conference on Security and Cryptography (SECRYPT 2015) , Jul, 2015, Colmar, France, SCITEPRESS, http://www.secrypt.icete.org/
Abstract:
This paper focuses on network anomaly-detection and especially the effectiveness of Machine Learning (ML) techniques in detecting Denial of Service (DoS) in SIP-based VoIP ecosystems. It is true that until now several works in the literature have been devoted to this topic, but only a small fraction of them have done so in an elaborate way. Even more, none of them takes into account high and low-rate Distributed DoS (DDoS) when assessing the efficacy of such techniques in SIP intrusion detection. To provide a more complete estimation of this potential, we conduct extensive experimentations involving 5 different classifiers and a plethora of realistically simulated attack scenarios representing a variety of (D)DoS incidents. Moreover, for DDoS ones, we compare our results with those produced by two other anomaly-based detection methods, namely Entropy and Hellinger Distance. Our results show that ML-powered detection scores a promising false alarm rate in the general case, and seems to outperform similar methods when it comes to DDoS.
This paper focuses on network anomaly-detection and especially the effectiveness of Machine Learning (ML) techniques in detecting Denial of Service (DoS) in SIP-based VoIP ecosystems. It is true that until now several works in the literature have been devoted to this topic, but only a small fraction of them have done so in an elaborate way. Even more, none of them takes into account high and low-rate Distributed DoS (DDoS) when assessing the efficacy of such techniques in SIP intrusion detection. To provide a more complete estimation of this potential, we conduct extensive experimentations involving 5 different classifiers and a plethora of realistically simulated attack scenarios representing a variety of (D)DoS incidents. Moreover, for DDoS ones, we compare our results with those produced by two other anomaly-based detection methods, namely Entropy and Hellinger Distance. Our results show that ML-powered detection scores a promising false alarm rate in the general case, and seems to outperform similar methods when it comes to DDoS.
Z. Tsiatsikas, G. Kambourakis, D. Geneiatakis, Exposing Resource Consumption Attacks in Internet Multimedia Services, The 14th IEEE International Symposium on Signal Processing and Information Technology (ISSPIT 2014) - Security Track, Dec, 2014, Noida, India, IEEE Press, http://www.isspit.org/isspit/2014/
Abstract:
Attackers always find ways to elude the employed security mechanisms of a system, no matter how strong they are. Nevertheless, audit trails - which as a rule of thumb are kept by any service provider - store all the events pertaining to the service of interest. Therefore, audit trail data can be a valuable ally when it comes to the certification of the security level of a given service. This stands especially true for critical realtime services such as multimedia ones, which nowadays are on the rise. This work proposes a practical, simple to implement yet powerful solution based on the Hellinger Distance metric for conducting audit trail analysis destined to expose security incidents. Our solution relies on a set of different features existing in the app layer protocol for session handling in order to classify the analyzed traffic as intrusive or not. Taking the well-known Session Initiation Protocol (SIP) as an example, we thoroughly evaluate the effectiveness of the proposed detection scheme in terms of accuracy under various realistic scenarios. The outcomes reveal competitive detection rates in terms of false positives and negatives and can be used as a reference for future works in the field.
Attackers always find ways to elude the employed security mechanisms of a system, no matter how strong they are. Nevertheless, audit trails - which as a rule of thumb are kept by any service provider - store all the events pertaining to the service of interest. Therefore, audit trail data can be a valuable ally when it comes to the certification of the security level of a given service. This stands especially true for critical realtime services such as multimedia ones, which nowadays are on the rise. This work proposes a practical, simple to implement yet powerful solution based on the Hellinger Distance metric for conducting audit trail analysis destined to expose security incidents. Our solution relies on a set of different features existing in the app layer protocol for session handling in order to classify the analyzed traffic as intrusive or not. Taking the well-known Session Initiation Protocol (SIP) as an example, we thoroughly evaluate the effectiveness of the proposed detection scheme in terms of accuracy under various realistic scenarios. The outcomes reveal competitive detection rates in terms of false positives and negatives and can be used as a reference for future works in the field.
D. Kasiaras, T. Zafeiropoulos, N. Clarke, G. Kambourakis, Android Forensics: Correlation Analysis, The 9th International Conference for Internet Technology and Secured Transactions (ICITST), pp. 157-162, Dec, 2014, London, UK, IEEE Press, http://www.icitst.org/
Abstract:
With over 6 billion mobile phone subscribers, it is inevitable that such devices will be involved in criminal activities. Furthermore, the evolution of smartphones has changed the way people use their mobile phones in their everyday life. That is, a huge variety of services exist in the device that can be exploited for either perpetrating a criminal activity or being the subject of the crime. By conducting an analysis of existing forensic tools and the literature, it became evident that there is a significant lack of advanced tools that enable the correlation among the various events of forensic interest in order to facilitate an investigation and reduce the cognitive load on the analyst side. Motivated by this fact, the paper at hand proposes a novel tool that incorporates strong mechanisms to forensically analyze an Android device, aiming to reduce the workload of the investigator through advanced and intelligent correlation and visualization.
With over 6 billion mobile phone subscribers, it is inevitable that such devices will be involved in criminal activities. Furthermore, the evolution of smartphones has changed the way people use their mobile phones in their everyday life. That is, a huge variety of services exist in the device that can be exploited for either perpetrating a criminal activity or being the subject of the crime. By conducting an analysis of existing forensic tools and the literature, it became evident that there is a significant lack of advanced tools that enable the correlation among the various events of forensic interest in order to facilitate an investigation and reduce the cognitive load on the analyst side. Motivated by this fact, the paper at hand proposes a novel tool that incorporates strong mechanisms to forensically analyze an Android device, aiming to reduce the workload of the investigator through advanced and intelligent correlation and visualization.
D. Papamartzivanos, D. Damopoulos, G. Kambourakis, A cloud-based architecture to crowdsource mobile app privacy leaks, The 18th Panhellenic Conference on Informatics (PCI 2014), special session on Security and Privacy Issues in the Cloud Computing Era, pp. 1-6, Oct, 2014, Athens, Greece, ACM press, http://dl.acm.org/citation.cfm?id=264579...
Abstract:
Most would agree that modern app-markets have been flooded with applications that not only threaten the security of the OS uperficially, but also in their majority, trample on user’s privacy through the exposure of sensitive information not necessarily needed for their operation. In this context, the current work revolves around 3 key questions: Is there a way for the end-user to easily track - the many times - hidden privacy leaks occurring due to the way mobile apps operate? Can crowdsourcing provide the end-user with a quantitative assessment per app in terms of privacy exposure level? And if yes, in which way a cloud-based crowdsourcing mechanism can detect and alert for changes in the apps’ behavior? Motivated by the aforementioned questions, we design a cloud-based system that operates under a crowdsourcing logic, with the aim to provide i) a real-time privacy-flow tracking service, ii) a collaborative infrastructure for exchanging information related to apps’ privacy exposure level, and iii) potentially a behavior-driven detection mechanism in an effort to take advantage of the crowdsourcing data to its maximum efficasy.
Most would agree that modern app-markets have been flooded with applications that not only threaten the security of the OS uperficially, but also in their majority, trample on user’s privacy through the exposure of sensitive information not necessarily needed for their operation. In this context, the current work revolves around 3 key questions: Is there a way for the end-user to easily track - the many times - hidden privacy leaks occurring due to the way mobile apps operate? Can crowdsourcing provide the end-user with a quantitative assessment per app in terms of privacy exposure level? And if yes, in which way a cloud-based crowdsourcing mechanism can detect and alert for changes in the apps’ behavior? Motivated by the aforementioned questions, we design a cloud-based system that operates under a crowdsourcing logic, with the aim to provide i) a real-time privacy-flow tracking service, ii) a collaborative infrastructure for exchanging information related to apps’ privacy exposure level, and iii) potentially a behavior-driven detection mechanism in an effort to take advantage of the crowdsourcing data to its maximum efficasy.
G. Karopoulos, A. Fakis, G. Kambourakis, Complete SIP message obfuscation: PrivaSIP over Tor, The 9th International Conference on Availability, Reliability and Security (ARES 2014) - 9th International Workshop on Frontiers in Availability, Reliability and Security (FARES), A. M. Tjoa, E. Weippl et al., (eds), pp. 217-226, Sep, 2014, Fribourg, Switzerland , IEEE CPS, http://www.ares-conference.eu/conference...
Abstract:
Anonymity on SIP signaling can be achieved either by the construction of a lower level tunnel (via the use of SSL or IPSec protocols) or by employing a custom-tailored solution. Unfortunately, the former category of solutions present significant impediments including the requirement for a PKI and the hop-by-hop fashioned protection, while the latter only concentrate on the application layer, thus neglecting sensitive information leaking from lower layers. To remediate this problem, in the context of this paper, we employ the well-known Tor anonymity system to achieve complete SIP traffic obfuscation from an attacker’s standpoint. Specifically, we capitalize on Tor for preserving anonymity on network links that are considered mostly untrusted, i.e., those among SIP proxies and the one between the last proxy in the chain and the callee. We also, combine this Tor-powered solution with PrivaSIP to achieve an even greater level of protection. By employing PrivaSIP we assure that: (a) the first hop in the path (i.e., between the caller and the outbound proxy) affords anonymity, (b) the callee does not know the real identity of the caller, and (c) no real identities of both the caller and the callee are stored in log files. We also evaluate this scheme in terms of performance and show that even in the worst case, the latency introduced is not so high as it might be expected due to the use of Tor.
Anonymity on SIP signaling can be achieved either by the construction of a lower level tunnel (via the use of SSL or IPSec protocols) or by employing a custom-tailored solution. Unfortunately, the former category of solutions present significant impediments including the requirement for a PKI and the hop-by-hop fashioned protection, while the latter only concentrate on the application layer, thus neglecting sensitive information leaking from lower layers. To remediate this problem, in the context of this paper, we employ the well-known Tor anonymity system to achieve complete SIP traffic obfuscation from an attacker’s standpoint. Specifically, we capitalize on Tor for preserving anonymity on network links that are considered mostly untrusted, i.e., those among SIP proxies and the one between the last proxy in the chain and the callee. We also, combine this Tor-powered solution with PrivaSIP to achieve an even greater level of protection. By employing PrivaSIP we assure that: (a) the first hop in the path (i.e., between the caller and the outbound proxy) affords anonymity, (b) the callee does not know the real identity of the caller, and (c) no real identities of both the caller and the callee are stored in log files. We also evaluate this scheme in terms of performance and show that even in the worst case, the latency introduced is not so high as it might be expected due to the use of Tor.
D. Damopoulos, G. Kambourakis, G. Portokalidis, The Best of Both Worlds. A Framework for the Synergistic Operation of Host and Cloud Anomaly-based IDS for Smartphones, The 7th European Workshop on Systems Security (EuroSec 2014), Apr, 2014, Amsterdam, The Netherlands, ACM Press, http://www.syssec-project.eu/eurosec-201...
Abstract:
Smartphone ownership and usage has seen massive growth in the past years. As a result, their users have attracted unwanted attention from malicious entities and face many security challenges, including malware and privacy issues. This paper concentrates on IDS carefully designed to cater to the security needs of modern mobile platforms. Two main research issues are tackled: (a) the definition of an architecture which can be used towards implementing and deploying such a system in a dual-mode (host/cloud) manner and irrespectively of the underlying platform, and (b) the evaluation of a proof-of-concept anomaly-based IDS implementation that incorporates dissimilar detection features, with the aim to assess its performance qualities when running on state-of-the-art mobile hardware on the host device and on the cloud. This approach allow us to argue in favor of a hybrid host/cloud IDS arrangement (as it assembles the best characteristics of both worlds) and to provide quantitative evaluation facts on if and in which cases machine learning-driven detection is affordable when executed on-device.
Smartphone ownership and usage has seen massive growth in the past years. As a result, their users have attracted unwanted attention from malicious entities and face many security challenges, including malware and privacy issues. This paper concentrates on IDS carefully designed to cater to the security needs of modern mobile platforms. Two main research issues are tackled: (a) the definition of an architecture which can be used towards implementing and deploying such a system in a dual-mode (host/cloud) manner and irrespectively of the underlying platform, and (b) the evaluation of a proof-of-concept anomaly-based IDS implementation that incorporates dissimilar detection features, with the aim to assess its performance qualities when running on state-of-the-art mobile hardware on the host device and on the cloud. This approach allow us to argue in favor of a hybrid host/cloud IDS arrangement (as it assembles the best characteristics of both worlds) and to provide quantitative evaluation facts on if and in which cases machine learning-driven detection is affordable when executed on-device.
Z. Tsiatsikas, D. Geneiatakis, G. Kambourakis, A. Keromytis, Privacy-Preserving Entropy-Driven Framework for Tracing DoS Attacks in VoIP, The 8th International Conference on Availability, Reliability and Security (ARES 2013), pp. 224-229, Sep, 2013, Regensburg, Germany, IEEE Press, http://ieeexplore.ieee.org/xpl/login.jsp...
Abstract:
Network audit trails, especially those composed of application layer data, can be a valuable source of information regarding the investigation of attack incidents. Nevertheless, the analysis of log files of large volume is usually both complex (slow) and privacy-neglecting. Especially, when it comes to VoIP, the literature on how audit trails can be exploited to identify attacks remains scarce. This paper provides an entropy-driven, privacy-preserving, and practical framework for detecting resource consumption attacks in VoIP ecosystems. We extensively evaluate our framework under various attack scenarios involving single and multiple assailants. The results obtained show that the proposed scheme is capable of identifying malicious traffic with a false positive alarm rate up to 3.5%.
Network audit trails, especially those composed of application layer data, can be a valuable source of information regarding the investigation of attack incidents. Nevertheless, the analysis of log files of large volume is usually both complex (slow) and privacy-neglecting. Especially, when it comes to VoIP, the literature on how audit trails can be exploited to identify attacks remains scarce. This paper provides an entropy-driven, privacy-preserving, and practical framework for detecting resource consumption attacks in VoIP ecosystems. We extensively evaluate our framework under various attack scenarios involving single and multiple assailants. The results obtained show that the proposed scheme is capable of identifying malicious traffic with a false positive alarm rate up to 3.5%.
G. Kambourakis, D. Damopoulos, A competent post-authentication and non-repudiation biometric-based scheme for m-Learning, The 10th IASTED International Conference on Web-based Education (WBE 2013), V. Uskov, (ed), pp. 821-827, Feb, 2013, Innsbruck, Austria, ACTA Press, http://www.actapress.com/Abstract.aspx?p...
Abstract:
As mobile learning (mLearning) gains momentum, so does the worry of the parties involved to mLearning activities regarding the security and privacy level of the underlying systems and practices. Indeed, the basically spontaneous nature of mLearning and the variety of out-of-control devices that are used for supporting its activities, makes it prone to a plethora of attacks such as masquerading and man-in-the-middle. Thus, the provision of some sort of post- authentication and non-repudiation service in an effort to deter and repel ill-motivated activities may be of particular value in such realms. Compelled by this fact, in this paper, we introduce a dynamic signature-based biometric scheme to enable the offering of both of the aforementioned services in mLearning domains. We argue that our solution is both practical and lightweight. Its feasibility is also demonstrated through the use of machine learning techniques.
As mobile learning (mLearning) gains momentum, so does the worry of the parties involved to mLearning activities regarding the security and privacy level of the underlying systems and practices. Indeed, the basically spontaneous nature of mLearning and the variety of out-of-control devices that are used for supporting its activities, makes it prone to a plethora of attacks such as masquerading and man-in-the-middle. Thus, the provision of some sort of post- authentication and non-repudiation service in an effort to deter and repel ill-motivated activities may be of particular value in such realms. Compelled by this fact, in this paper, we introduce a dynamic signature-based biometric scheme to enable the offering of both of the aforementioned services in mLearning domains. We argue that our solution is both practical and lightweight. Its feasibility is also demonstrated through the use of machine learning techniques.
C. Kalyvas, E. Konstantinou, G. Kambourakis, Modeling Multiple Modes of Operation with Alloy, International Conference on Security Technology (SecTech 2012), T.H. Kim et al., (eds), pp. 78-85, Nov, 2012, Jeju, Korea, CCIS 339, Springer, http://link.springer.com/chapter/10.1007...
Abstract:
Speci fication (or modeling) languages can be very handy in describing certain aspects of a system and check properties of interest about it. Also, once a model is constructed, one is able to use the associated analyzer to create examples and/or counterexamples to explore hypotheses posed about the system. In the context of cryptography this veri fication process is of great importance as it can contribute towards finding weaknesses and assessing system's robustness. This paper capitalizes on the well-known Alloy language to model and analyze attacks on DES triple modes namely ECB|ECB|CBC^-1 and ECB|OFB|OFB. We model attacks described in [9] and show that they can be fruitful in the general case. This work can serve as a framework in modeling similar cryptosystems and assessing certain attacks on them.
Speci fication (or modeling) languages can be very handy in describing certain aspects of a system and check properties of interest about it. Also, once a model is constructed, one is able to use the associated analyzer to create examples and/or counterexamples to explore hypotheses posed about the system. In the context of cryptography this veri fication process is of great importance as it can contribute towards finding weaknesses and assessing system's robustness. This paper capitalizes on the well-known Alloy language to model and analyze attacks on DES triple modes namely ECB|ECB|CBC^-1 and ECB|OFB|OFB. We model attacks described in [9] and show that they can be fruitful in the general case. This work can serve as a framework in modeling similar cryptosystems and assessing certain attacks on them.
D. Damopoulos, G. Kambourakis, S. Gritzalis, Sang Oh Park, Lifting the veil on mobile malware: A complete dynamic solution for iOS, The 2012 Summer FTRA International Symposium on Advances in Cryptography, Security and Applications for Future Computing (ACSA-Summer), Jun, 2012, Vancouver, Canada, FTRA, http://www.icsd.aegean.gr/publication_fi...
Abstract:
It is without a doubt that malware especially designed for modern mobile platforms is rapidly becoming a serious threat. So far, research for dealing with this risk has concentrated on the Android platform and mainly considered static solutions rather than dynamic ones. Compelled by this fact, in this paper, we contribute a fully-fledged tool able to dynamically analyze any iOS software in terms of method invocation (i.e., which API methods the application invokes and under what order), and produce exploitable results that can be used to manually or automatically trace its behavior to decide if it contains malicious code or not. By employing real life malware we assessed our tool both manually as well as via heuristic techniques and the results we obtained are highly accurate in detecting malicious code.
It is without a doubt that malware especially designed for modern mobile platforms is rapidly becoming a serious threat. So far, research for dealing with this risk has concentrated on the Android platform and mainly considered static solutions rather than dynamic ones. Compelled by this fact, in this paper, we contribute a fully-fledged tool able to dynamically analyze any iOS software in terms of method invocation (i.e., which API methods the application invokes and under what order), and produce exploitable results that can be used to manually or automatically trace its behavior to decide if it contains malicious code or not. By employing real life malware we assessed our tool both manually as well as via heuristic techniques and the results we obtained are highly accurate in detecting malicious code.
D. Damopoulos, G. Kambourakis, M. Anagnostopoulos, S. Gritzalis, J. H. Park, User-privacy and modern smartphones: A Siri(ous) dilemma, FTRA AIM 2012 International Conference on Advanced IT, Engineering and Management, S. Rho, N. Chilamkurti, W.-E. Chen, S.-O. Park, (eds), Feb, 2012, Seoul, FTRA, http://download.springer.com/static/pdf/...
Abstract:
The focus of this paper is on iPhone platform security and especially on user’s data privacy. We are designing and implementing a new malware that takes over the iOS mDNS protocol and exposes user's privacy information by capitalizing on the new Siri facility. The attack architecture also includes a proxy server which acts as man-in-themiddle between the device and the Apple's original Siri server.
The focus of this paper is on iPhone platform security and especially on user’s data privacy. We are designing and implementing a new malware that takes over the iOS mDNS protocol and exposes user's privacy information by capitalizing on the new Siri facility. The attack architecture also includes a proxy server which acts as man-in-themiddle between the device and the Apple's original Siri server.
D. Damopoulos, G. Kambourakis, S. Gritzalis, iSAM: An iPhone Stealth Airborne Malware, IFIP SEC 2011 26th IFIP TC-11 International Information Security Conference, J. Camenisch, S. Fischer-Huebner, Y. SJ Murayama, (eds), pp. 17-28, Jun, 2011, Lucerne, Switzerland, IFIP Advances in Information and Communication Technology, Vol. 354, Springer, http://link.springer.com/content/pdf/10....
Abstract:
Modern and powerful mobile devices comprise an attractive target for any potential intruder or malicious code. The usual goal of an attack is to acquire user’s sensitive data or compromise the device so as to use it as a stepping stone (or bot) to unleash a number of attacks to other targets. In this paper, we focus on the popular iPhone device. We create a new stealth and airborne malware namely iSAM able to wirelessly infect and self-propagate to iPhone devices. iSAM incorporates six different malware mechanisms, and is able to connect back to the iSAM bot master server to update its programming logic or to obey commands and unleash a synchronized attack. Our analysis unveils the internal mechanics of iSAM and discusses the way all iSAM components contribute towards achieving its goals. Although iSAM has been specifically designed for iPhone it can be easily modified to attack any iOS-based device.
Modern and powerful mobile devices comprise an attractive target for any potential intruder or malicious code. The usual goal of an attack is to acquire user’s sensitive data or compromise the device so as to use it as a stepping stone (or bot) to unleash a number of attacks to other targets. In this paper, we focus on the popular iPhone device. We create a new stealth and airborne malware namely iSAM able to wirelessly infect and self-propagate to iPhone devices. iSAM incorporates six different malware mechanisms, and is able to connect back to the iSAM bot master server to update its programming logic or to obey commands and unleash a synchronized attack. Our analysis unveils the internal mechanics of iSAM and discusses the way all iSAM components contribute towards achieving its goals. Although iSAM has been specifically designed for iPhone it can be easily modified to attack any iOS-based device.
G. Kambourakis, E. Konstantinou, S. Gritzalis, Revisiting WiMAX MBS Security, FTRG ACSA 2009 International Workshop on Advances in Cryptography, Security and Applications for Future Computing, Y. Mu, J. H. Park, (eds), pp. 181-190, Dec, 2009, Deju, Korea, IEEE Press, http://www.sciencedirect.com/science/art...
Abstract:
IEEE 802.16 technology also well known as WiMax is poised to deliver the next step in the wireless evolution. This is further fostered by the 802.16e specification which, amongst other things, introduces support for mobility. The Multicast/Broadcast Service (MBS) is also an integral part of 802.16e destined to deliver next generation services to subscribers. In this paper we concentrate on the Multicast and Broadcast Rekeying Algorithm (MBRA) of 802.16e. This algorithm has been recently criticized for various vulnerabilities and security inefficiencies, as its designers are trying to balance wisely between performance and security. After surveying related work, we extensively discuss MBRA security issues and propose the use of a novel asymmetric group key agreement protocol based on the work in Wu et al. (2009) [3]. Our scheme guarantees secure delivery of keys to all the members of a given group and mandates rekeying upon join and leave events. It can prevent insider attacks since only the Base Station possesses a secret encryption key while all other members in the network acquire the transmitted data by using their secret decryption keys. We compare our scheme with related work and demonstrate that although heavier in terms of computing costs, it compensates when scalability and security come to the foreground.
IEEE 802.16 technology also well known as WiMax is poised to deliver the next step in the wireless evolution. This is further fostered by the 802.16e specification which, amongst other things, introduces support for mobility. The Multicast/Broadcast Service (MBS) is also an integral part of 802.16e destined to deliver next generation services to subscribers. In this paper we concentrate on the Multicast and Broadcast Rekeying Algorithm (MBRA) of 802.16e. This algorithm has been recently criticized for various vulnerabilities and security inefficiencies, as its designers are trying to balance wisely between performance and security. After surveying related work, we extensively discuss MBRA security issues and propose the use of a novel asymmetric group key agreement protocol based on the work in Wu et al. (2009) [3]. Our scheme guarantees secure delivery of keys to all the members of a given group and mandates rekeying upon join and leave events. It can prevent insider attacks since only the Base Station possesses a secret encryption key while all other members in the network acquire the transmitted data by using their secret decryption keys. We compare our scheme with related work and demonstrate that although heavier in terms of computing costs, it compensates when scalability and security come to the foreground.
C. Kolias, V. Kolias, G. Kambourakis, A Secure and Efficient Authentication Protocol for Passive RFID Tags, Sixth International Symposium on Wireless Communication Systems 2009 (ISWCS’09), pp. 36-40, Sep, 2009, Siena, Italy, IEEE Press
Abstract:
At the onset of the ubiquitous computing era, systems need to respond to a variety of challenges, in order to capitalize on the benefits of pervasiveness. One of the pivotal enablers of pervasive computing is the RFID technology which can be successfully applied in numerous applications. However, the interaction of such applications with sensitive personal data renders the need for assuring confidentiality a sine qua non. The native limitations in computing resources, i.e., computational power, memory etc, that characterize nearly all classes of RFID tags make the development of custom-tailored RFID security protocols a troublesome yet challenging task. In this paper we propose a mutual authentication protocol for low cost RFID tags and readers. We also demonstrate that our scheme is more efficient in terms of resource utilization on the backend server, and under identical conditions, more secure when compared with existing congruent protocols.
At the onset of the ubiquitous computing era, systems need to respond to a variety of challenges, in order to capitalize on the benefits of pervasiveness. One of the pivotal enablers of pervasive computing is the RFID technology which can be successfully applied in numerous applications. However, the interaction of such applications with sensitive personal data renders the need for assuring confidentiality a sine qua non. The native limitations in computing resources, i.e., computational power, memory etc, that characterize nearly all classes of RFID tags make the development of custom-tailored RFID security protocols a troublesome yet challenging task. In this paper we propose a mutual authentication protocol for low cost RFID tags and readers. We also demonstrate that our scheme is more efficient in terms of resource utilization on the backend server, and under identical conditions, more secure when compared with existing congruent protocols.
E. Klaoudatou, E. Konstantinou, G. Kambourakis, S. Gritzalis, A Cluster-based Framework for the Security of Medical Sensor Environments, TrustBus’09 6th International Conference on Trust, Privacy and Security in Digital Business, S. Fischer-Huebner, C. Labrinoudakis, (eds), Sep, 2009, Linz, Austria, Lecture Notes in Computer Science LNCS, Springer, http://link.springer.com/content/pdf/10....
Abstract:
The adoption of Wireless Sensor Networks (WSNs) in the healthcare sector poses many security issues, mainly because medical information is considered particularly sensitive. The security mechanisms employed are expected to be more efficient in terms of energy consumption and scalability in order to cope with the constrained capabilities of WSNs and patients’ mobility. Towards this goal, cluster-based medical WSNs can substantially improve efficiency and scalability. In this context, we have proposed a general framework for cluster-based medical environments on top of which security mechanisms can rely. This framework fully covers the varying needs of both in-hospital environments and environments formed ad hoc for medical emergencies. In this paper, we further elaborate on the security of our proposed solution. We specifically focus on key establishment mechanisms and investigate the group key agreement protocols that can best fit in our framework.
The adoption of Wireless Sensor Networks (WSNs) in the healthcare sector poses many security issues, mainly because medical information is considered particularly sensitive. The security mechanisms employed are expected to be more efficient in terms of energy consumption and scalability in order to cope with the constrained capabilities of WSNs and patients’ mobility. Towards this goal, cluster-based medical WSNs can substantially improve efficiency and scalability. In this context, we have proposed a general framework for cluster-based medical environments on top of which security mechanisms can rely. This framework fully covers the varying needs of both in-hospital environments and environments formed ad hoc for medical emergencies. In this paper, we further elaborate on the security of our proposed solution. We specifically focus on key establishment mechanisms and investigate the group key agreement protocols that can best fit in our framework.
D. Geneiatakis, C. Lambrinoudakis, G. Kambourakis, A. Kafkalas, S. Ehlert, A First Order Logic Security Verification Model for SIP, IEEE International Conference on Communications (ICC 2009), Jun, 2009, Dresden, Germany, IEEE Press, http://ieeexplore.ieee.org/xpl/login.jsp...
Abstract:
It is well known that no security mechanism can provide full protection against a potential attack. There is always a possibility that a security incident may happen, mainly as a result of a new or modified attack that the employed countermeasures cannot handle or identify. It is therefore useful to perform a deferred analysis of logged network data, in an attempt to identify abnormal behavior/traffic that flags some type of security incident that has not been detected by the security countermeasures. Such an analysis of logged data for critical real time applications, like VoIP services, is certainly a valuable tool for enhancing the security level of the provided service. In this paper we introduce a practical tool that can be employed for the analysis of logged VoIP data and thus validate the effectiveness of the security mechanisms and the conformance with the corresponding security policy rules. For the analysis of the data we capitalize on our security model for VoIP services [25] that is based on First Order Logic concepts, while the Protégé API and the Semantic Web Rule Language (SWRL) are also exploited. The proposed tool has been evaluated in terms of an experimental environment, while the results obtained confirm the validity of its operation and demonstrate its effectiveness.
It is well known that no security mechanism can provide full protection against a potential attack. There is always a possibility that a security incident may happen, mainly as a result of a new or modified attack that the employed countermeasures cannot handle or identify. It is therefore useful to perform a deferred analysis of logged network data, in an attempt to identify abnormal behavior/traffic that flags some type of security incident that has not been detected by the security countermeasures. Such an analysis of logged data for critical real time applications, like VoIP services, is certainly a valuable tool for enhancing the security level of the provided service. In this paper we introduce a practical tool that can be employed for the analysis of logged VoIP data and thus validate the effectiveness of the security mechanisms and the conformance with the corresponding security policy rules. For the analysis of the data we capitalize on our security model for VoIP services [25] that is based on First Order Logic concepts, while the Protégé API and the Semantic Web Rule Language (SWRL) are also exploited. The proposed tool has been evaluated in terms of an experimental environment, while the results obtained confirm the validity of its operation and demonstrate its effectiveness.
G. Kambourakis, C. Kolias, S. Gritzalis, J. H. Park, Signaling-oriented DoS Attacks in UMTS Networks, ISA 2009 3rd International Conference on Information Security and Assurance, J. Zhan et al., (eds), pp. 280-289, Jun, 2009, Seoul, Korea, Lecture Notes in Computer Science LNCS, Springer, http://link.springer.com/content/pdf/10....
Abstract:
The Universal Mobile Telecommunication Standard (UMTS) is the Third Generation (3G) mobile technology with the widest public acceptance. Although, enhanced in matters of security, comparing to its predecessor i.e., the GSM, it still has vulnerabilities that can lead to security breach. In this paper we investigate the vulnerabilities of the UMTS architecture that can be exploited by a malicious entity to launch Denial of Service (DoS) attacks. We examine the methodologies that an attacker would possibly follow, as well as the possible outcome of such class of attacks. We also give some suggestions that would provide greater tolerance to the system against DoS attacks.
The Universal Mobile Telecommunication Standard (UMTS) is the Third Generation (3G) mobile technology with the widest public acceptance. Although, enhanced in matters of security, comparing to its predecessor i.e., the GSM, it still has vulnerabilities that can lead to security breach. In this paper we investigate the vulnerabilities of the UMTS architecture that can be exploited by a malicious entity to launch Denial of Service (DoS) attacks. We examine the methodologies that an attacker would possibly follow, as well as the possible outcome of such class of attacks. We also give some suggestions that would provide greater tolerance to the system against DoS attacks.
C. Kolias, V. Kolias, J. Anagnostopoulos, G. Kambourakis, E. Kayafas, A Speech-Enabled Assistive Collaborative Platform for Educational Purposes with User Personalization, 3rd International Workshop on Semantic Media Adaptation and Personalization (SMAP 2008), pp. 157-163, Dec, 2008, Prague, Czech Republic, IEEE Computer Society Press, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
With the proliferation of Web 2.0 applications, collaborative learning has gathered a lot of attention due its potentiality in the e-learning field. Forums, Wikis and Blogs for example are only some of the applications that exploit the collaborative nature of e-learning. However, these applications are originally designed for access from desktop systems and access to them when on the move can prove a challenging task. This paper elaborates on the design and implementation of an assistive collaborative platform for educational purposes that can be accessed by heterogeneous hardware platforms such as PCs, PDAs, mobile or traditional phones due to its capability of representing data in vocal manner. Its main purpose is to provide a platform for collaboration between university students and teachers in a way that enhances students’ access to educational resources and their overall learning experience. This is achieved by personalizing its content at least to some degree. Furthermore, its acoustic/vocal characteristics may also prove valuable for learners with visual or kinetic impairments.
With the proliferation of Web 2.0 applications, collaborative learning has gathered a lot of attention due its potentiality in the e-learning field. Forums, Wikis and Blogs for example are only some of the applications that exploit the collaborative nature of e-learning. However, these applications are originally designed for access from desktop systems and access to them when on the move can prove a challenging task. This paper elaborates on the design and implementation of an assistive collaborative platform for educational purposes that can be accessed by heterogeneous hardware platforms such as PCs, PDAs, mobile or traditional phones due to its capability of representing data in vocal manner. Its main purpose is to provide a platform for collaboration between university students and teachers in a way that enhances students’ access to educational resources and their overall learning experience. This is achieved by personalizing its content at least to some degree. Furthermore, its acoustic/vocal characteristics may also prove valuable for learners with visual or kinetic impairments.
C. Kolias, V. Kolias, J. Anagnostopoulos, G. Kambourakis, E. Kayafas, Enhancing User Privacy in Adaptive Web Sites with Client-Side User Profiles, 3rd International Workshop on Semantic Media Adaptation and Personalization (SMAP 2008) , Dec, 2008, Prague, Czech Republic, IEEE Computer Society Press, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
Web personalization is an elegant and flexible process of making a web site responsive to the unique needs of each individual user. Data that reflects user preferences and likings, comprising therefore a user profile, are gathered to an adaptive web site in a non transparent manner. This situation however raises serious privacy concerns to the end user. When browsing a web site, users are not aware of several important privacy parameters i.e., which behavior will be monitored and logged, how it will be processed, how long it will be kept, and with whom it will be shared in the long run. In this paper we propose an abstract architecture that enhances user privacy during interaction with adaptive web sites. This architecture enables users to create and update their personal privacy preferences for the adaptive web sites they visit by holding their (user) profiles in the client side instead of the server side. By doing so users will be able to self-confine the personalization experience the adaptive sites offer, thus enhancing privacy.
Web personalization is an elegant and flexible process of making a web site responsive to the unique needs of each individual user. Data that reflects user preferences and likings, comprising therefore a user profile, are gathered to an adaptive web site in a non transparent manner. This situation however raises serious privacy concerns to the end user. When browsing a web site, users are not aware of several important privacy parameters i.e., which behavior will be monitored and logged, how it will be processed, how long it will be kept, and with whom it will be shared in the long run. In this paper we propose an abstract architecture that enhances user privacy during interaction with adaptive web sites. This architecture enables users to create and update their personal privacy preferences for the adaptive web sites they visit by holding their (user) profiles in the client side instead of the server side. By doing so users will be able to self-confine the personalization experience the adaptive sites offer, thus enhancing privacy.
G. Kambourakis, E. Konstantinou, S. Gritzalis, Binary Tree Based Public-Key Management for Mobile Ad Hoc Networks, ISWCS, K. Gudmundsson, B. S. Yeo, (eds), pp. 687-692, Oct, 2008, Reykjavik, Iceland, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
The establishment of a public key infrastructure (PKI) in mobile ad hoc networks (MANETs) is considered a difficult task because of the intrinsic characteristics of these networks. The absence of centralized services and the possible network partitions make traditional security solutions not straightforwardly applicable in MANETs. In this paper, we propose a public key management scheme based on a binary tree formation of the network¿s nodes. Using the binary tree structure, certificate chains are easily built between communicating nodes that are multi-hops away and the cumbersome problem of certificate chain discovery is avoided. We argue that our mechanism has several advantages over similar solutions, especially when a fair balancing between security and performance is terminus.
The establishment of a public key infrastructure (PKI) in mobile ad hoc networks (MANETs) is considered a difficult task because of the intrinsic characteristics of these networks. The absence of centralized services and the possible network partitions make traditional security solutions not straightforwardly applicable in MANETs. In this paper, we propose a public key management scheme based on a binary tree formation of the network¿s nodes. Using the binary tree structure, certificate chains are easily built between communicating nodes that are multi-hops away and the cumbersome problem of certificate chain discovery is avoided. We argue that our mechanism has several advantages over similar solutions, especially when a fair balancing between security and performance is terminus.
D. Geneiatakis, G. Kambourakis, C. Lambrinoudakis, A Mechanism for Ensuring the Validity and Accuracy of the Billing Services in IP Telephony, 5th International Conference on Trust, Privacy and Security in Digital Business (TrustBus 2008), S. Furnell, S. Katsikas, A. Lioy, (eds), pp. 59-68, Sep, 2008, Turin, Italy, Lecture Notes in Computer Science LNCS 5185, Springer, http://link.springer.com/chapter/10.1007...
Abstract:
The current penetration, but also the huge potential, of Voice over IP (VoIP) telephony services in the market, boosts the competition among telecommunication service providers who promote new services through many different types of offers. However, this transition from the closed Public Switched Telephone Network (PSTN) architecture to the internet based VoIP services, has resulted in the introduction of several threats both intrinsic i.e. VoIP specific, and Internet oriented. In the framework of this paper, we are considering threats that may affect the accuracy and validity of the records of the billing system that the service provider is using for charging the users. We are proposing a simple, practical and effective mechanism for protecting telecommunication service providers and end users from malicious activities originated from the end users and telecommunication service providers respectively. In both cases the malicious activity concerns fraud through the billing system. The proposed mechanism focuses on VoIP services that are based on the Session Initiation Protocol (SIP). However, it can be easily amended to cover other VoIP signaling protocols, as it takes advantage of the underlying AAA network infrastructure to deliver robust time stamping services to SIP network entities.
The current penetration, but also the huge potential, of Voice over IP (VoIP) telephony services in the market, boosts the competition among telecommunication service providers who promote new services through many different types of offers. However, this transition from the closed Public Switched Telephone Network (PSTN) architecture to the internet based VoIP services, has resulted in the introduction of several threats both intrinsic i.e. VoIP specific, and Internet oriented. In the framework of this paper, we are considering threats that may affect the accuracy and validity of the records of the billing system that the service provider is using for charging the users. We are proposing a simple, practical and effective mechanism for protecting telecommunication service providers and end users from malicious activities originated from the end users and telecommunication service providers respectively. In both cases the malicious activity concerns fraud through the billing system. The proposed mechanism focuses on VoIP services that are based on the Session Initiation Protocol (SIP). However, it can be easily amended to cover other VoIP signaling protocols, as it takes advantage of the underlying AAA network infrastructure to deliver robust time stamping services to SIP network entities.
A. Tsakountakis, G. Kambourakis, S. Gritzalis, A new Accounting Mechanism for Modern and Future AAA Services, IFIP SEC 2008 23rd International Information Security Conference , S. Jajodia, P. Samarati, (eds), pp. 693-697, Sep, 2008, Milan, Italy, Springer, http://link.springer.com/content/pdf/10....
Abstract:
Accounting along with Authentication and Authorization comprise the concept of AAA provided by IETF (Internet Engineering Task Force). In heterogeneous environments, where different administrative domains and different wired and wireless technologies are utilized, those principles are often hard and complex to correctly implement and evaluate. Specifically, accounting which is our topic of interest, is in many cases a complicated procedure since many aspects need to be taken into consideration. In this respect, a distributed, flexible, robust, secure and generic accounting system needs to be implemented in order to provide the ability to determine which user has acquired which services and for how long at each operator domain. This work examines different scenarios applicable to such 3G/4G hybrid mobile environments and suggests a novel, generic mechanism to support accounting.
Accounting along with Authentication and Authorization comprise the concept of AAA provided by IETF (Internet Engineering Task Force). In heterogeneous environments, where different administrative domains and different wired and wireless technologies are utilized, those principles are often hard and complex to correctly implement and evaluate. Specifically, accounting which is our topic of interest, is in many cases a complicated procedure since many aspects need to be taken into consideration. In this respect, a distributed, flexible, robust, secure and generic accounting system needs to be implemented in order to provide the ability to determine which user has acquired which services and for how long at each operator domain. This work examines different scenarios applicable to such 3G/4G hybrid mobile environments and suggests a novel, generic mechanism to support accounting.
C. Kolias, V. Kolias, J. Anagnostopoulos, G. Kambourakis, E. Kayafas, A pervasive Wiki application based on VoiceXML, 1st International Conference on Pervasive Technologies in e/m-Learning and Internet-based Experiments (PTLIE , Jul, 2008, Athens, Greece, ACM press
Abstract:
In this paper, we describe the design and implementation of an audio wiki application accessible via the Public Switched Telephone Network (PSTN) and the Internet for educational purposes. The application exploits mature World Wide Web Consortium standards such as VoiceXML, Speech Synthesis Markup Language (SSML) and Speech Recognition Grammar Specification (SRGS). The purpose of such an application is to assist visually impaired, technologically uneducated, and underprivileged people in accessing information originally intended to be accessed visually via a Personal Computer. Users may access wiki content via wired or mobile phones, or via a Personal Computer using a Web Browser or a Voice over IP service. This feature promotes pervasiveness to educational material to an extremely large population, i.e. those who simply own a telephone line.
In this paper, we describe the design and implementation of an audio wiki application accessible via the Public Switched Telephone Network (PSTN) and the Internet for educational purposes. The application exploits mature World Wide Web Consortium standards such as VoiceXML, Speech Synthesis Markup Language (SSML) and Speech Recognition Grammar Specification (SRGS). The purpose of such an application is to assist visually impaired, technologically uneducated, and underprivileged people in accessing information originally intended to be accessed visually via a Personal Computer. Users may access wiki content via wired or mobile phones, or via a Personal Computer using a Web Browser or a Voice over IP service. This feature promotes pervasiveness to educational material to an extremely large population, i.e. those who simply own a telephone line.
G. Karopoulos, G. Kambourakis, S. Gritzalis, Caller Identity Privacy in SIP heterogeneous realms: A practical solution, MediaWin 2008 3rd Workshop on Multimedia Applications over Wireless Networks (in conjunction with ISCC 2008 13th IEEE Symposium on Computers and Communications), A. Zanella et al., (eds), pp. 37 - 43, Jul, 2008, Marakkech, Morocco, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
The growing demand for voice services and multimedia delivery over the Internet has raised SIPpsilas popularity making it a subject of extensive research. SIP is an application layer control signaling protocol, whose main purpose is to create, modify and terminate multimedia sessions. Research has shown that SIP has a number of security issues that must be solved in order to increase its trustworthiness and supersede or coexist with PSTN. In this paper our purpose is to address such a weakness, namely the caller identity privacy issue. While some solutions to this problem do exist, we will show that they are inadequate in a number of situations. Furthermore, we will propose a novel scheme for the protection of callerpsilas identity which can also support roaming between different administrative domains. Finally, we provide some performance results, which demonstrate that the proposed solution is efficient even in low-end mobile devices.
The growing demand for voice services and multimedia delivery over the Internet has raised SIPpsilas popularity making it a subject of extensive research. SIP is an application layer control signaling protocol, whose main purpose is to create, modify and terminate multimedia sessions. Research has shown that SIP has a number of security issues that must be solved in order to increase its trustworthiness and supersede or coexist with PSTN. In this paper our purpose is to address such a weakness, namely the caller identity privacy issue. While some solutions to this problem do exist, we will show that they are inadequate in a number of situations. Furthermore, we will propose a novel scheme for the protection of callerpsilas identity which can also support roaming between different administrative domains. Finally, we provide some performance results, which demonstrate that the proposed solution is efficient even in low-end mobile devices.
C. Kolias, S. Demertzis, G. Kambourakis, Design and Implementation of a Secure Mobile Wiki System, Seventh IASTED International Conference on Web-based Education (WBE 2008), Uskov V., (ed), pp. 212-217, Mar, 2008, Innsbruck, Austria, ACTA press
Abstract:
During the last few years wikis have emerged as one of the most popular tool shells. Wikipedia has boosted their popularity, but they also keep a significant share in elearning, intranet-based applications such as defect tracking, requirements management, test-case management, and project portals. However, existing wiki systems cannot fully support mobile clients due to several incompatibilities that exist. On the top of that, an effective secure mobile wiki system must be lightweight enough to support low-end mobile devices having several limitations. In this paper we analyze the requirements for a novel multiplatform secure wiki implementation. XML Encryption and Signature specifications are employed to realize endto- end confidentiality and integrity services. Our scheme can be applied selectively and only to sensitive wiki content, thus diminishing by far computational resources needed at both ends; the server and the client. To address authentication of wiki clients a simple one-way authentication and session key agreement protocol is also introduced. The proposed solution can be easily applied to both centralized and forthcoming P2P wiki implementations.
During the last few years wikis have emerged as one of the most popular tool shells. Wikipedia has boosted their popularity, but they also keep a significant share in elearning, intranet-based applications such as defect tracking, requirements management, test-case management, and project portals. However, existing wiki systems cannot fully support mobile clients due to several incompatibilities that exist. On the top of that, an effective secure mobile wiki system must be lightweight enough to support low-end mobile devices having several limitations. In this paper we analyze the requirements for a novel multiplatform secure wiki implementation. XML Encryption and Signature specifications are employed to realize endto- end confidentiality and integrity services. Our scheme can be applied selectively and only to sensitive wiki content, thus diminishing by far computational resources needed at both ends; the server and the client. To address authentication of wiki clients a simple one-way authentication and session key agreement protocol is also introduced. The proposed solution can be easily applied to both centralized and forthcoming P2P wiki implementations.
E. Klaoudatou, E. Konstantinou, G. Kambourakis, S. Gritzalis, Clustering Oriented Architectures in Medical Sensor Environments, WSPE 2008 International Workshop on Security and Privacy in e-Health (in conjunction with ARES 2008 3rd International Conference on Availability, Reliability, and Security), T. Muck, (ed), pp. 929-934, Mar, 2008, Barcelona, Spain, IEEE CPS, http://ieeexplore.ieee.org/xpl/login.jsp...
Abstract:
Wireless sensor networks are expected to make a significant contribution in the healthcare sector by enabling continuous patient monitoring. Since medical services and the associated to them information are considered particularly sensitive, the employment of wireless sensors in medical environments poses many security issues and challenges. However, security services and the underlying key management mechanisms cannot be seen separately from the efficiency and scalability requirements. Network clustering used in both routing and group key management mechanisms can improve the efficiency and scalability and therefore can also be envisioned in medical environments. This paper introduces a general framework for cluster-based wireless sensor medical environments on the top of which efficient security mechanisms can rely. We describe two different scenarios for infrastructure and infrastructure- less application environments, covering this way a wide area of medical applications (in-hospital and medical emergencies). We also examine the existing group-key management schemes for cluster-based wireless networks and discuss which protocols fit best for each proposed scenario.
Wireless sensor networks are expected to make a significant contribution in the healthcare sector by enabling continuous patient monitoring. Since medical services and the associated to them information are considered particularly sensitive, the employment of wireless sensors in medical environments poses many security issues and challenges. However, security services and the underlying key management mechanisms cannot be seen separately from the efficiency and scalability requirements. Network clustering used in both routing and group key management mechanisms can improve the efficiency and scalability and therefore can also be envisioned in medical environments. This paper introduces a general framework for cluster-based wireless sensor medical environments on the top of which efficient security mechanisms can rely. We describe two different scenarios for infrastructure and infrastructure- less application environments, covering this way a wide area of medical applications (in-hospital and medical emergencies). We also examine the existing group-key management schemes for cluster-based wireless networks and discuss which protocols fit best for each proposed scenario.
G. Karopoulos, G. Kambourakis, S. Gritzalis, Privacy Protection in Context Transfer Protocol, PDP 2008 16th Euromicro International Conference on Parallel, Distributed and Network based Processing – Special Session on Security in Networked and Distributed Systems, D. El Baz, J. Bourgeois, F. Spies, (eds), pp. 590-596, Feb, 2008, Toulouse, France, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
In the future 4G wireless networks will span across different administrative domains. In order to provide secure seamless handovers in such an environment the context transfer protocol is an attractive solution. However, the aforementioned protocol arises some privacy issues concerning the location and movement of users roaming between administrative domains. The purpose of this paper is to present and analyze these privacy issues and propose two privacy enhanced context transfer schemes that alleviate these problems. In the first scheme the Mobile Node (MN) is responsible for the transmission of the context to the new domain. In the second scheme the Home Domain (HD) of the user forwards the context acting as a proxy between the old and the new domain. While the second scheme is expected to be more useful towards realizing seamless handovers, the first one poses less signaling load to the HD. In addition, assuming that the most appropriate form of user identity for the context is the Network Access Identifier (NAI), we show how the employment of temporary NAIs can further increase the privacy of our schemes.
In the future 4G wireless networks will span across different administrative domains. In order to provide secure seamless handovers in such an environment the context transfer protocol is an attractive solution. However, the aforementioned protocol arises some privacy issues concerning the location and movement of users roaming between administrative domains. The purpose of this paper is to present and analyze these privacy issues and propose two privacy enhanced context transfer schemes that alleviate these problems. In the first scheme the Mobile Node (MN) is responsible for the transmission of the context to the new domain. In the second scheme the Home Domain (HD) of the user forwards the context acting as a proxy between the old and the new domain. While the second scheme is expected to be more useful towards realizing seamless handovers, the first one poses less signaling load to the HD. In addition, assuming that the most appropriate form of user identity for the context is the Network Access Identifier (NAI), we show how the employment of temporary NAIs can further increase the privacy of our schemes.
A. Tsakountakis, G. Kambourakis, S. Gritzalis, On RSN-oriented Wireless Intrusion Detection, 2nd OTM International Symposium on Information Security (IS), M. Freire, S. M. de Sousa, V. Santos, H. J. Park, (eds), pp. 1601-1615, Dec, 2007, Algarve, Portugal, Lecture Notes in Computer Science LNCS, Springer, http://link.springer.com/content/pdf/10....
Abstract:
Robust Security Network (RSN) epitomised by IEEE 802.11i substandard is promising what it stands for; robust and effective protection for mission critical Wireless Local Area Networks (WLAN). However, despite the fact that 802.11i overhauls the IEEE’s 802.11 security standard several weaknesses still remain. In this context, the complementary assistance of Wireless Intrusion Detection Systems (WIDS) to deal with existing and new threats is greatly appreciated. In this paper we focus on 802.11i intrusion detection, discuss what is missing, what the possibilities are, and experimentally explore ways to make them intertwine and co-work. Our experiments employing well known open source attack tools and custom made software reveal that most 802.11i specific attacks can be effectively recognised, either directly or indirectly. We also consider and discuss Distributed Wireless Intrusion Detection (DIDS), which seems to fit best in RSN networks.
Robust Security Network (RSN) epitomised by IEEE 802.11i substandard is promising what it stands for; robust and effective protection for mission critical Wireless Local Area Networks (WLAN). However, despite the fact that 802.11i overhauls the IEEE’s 802.11 security standard several weaknesses still remain. In this context, the complementary assistance of Wireless Intrusion Detection Systems (WIDS) to deal with existing and new threats is greatly appreciated. In this paper we focus on 802.11i intrusion detection, discuss what is missing, what the possibilities are, and experimentally explore ways to make them intertwine and co-work. Our experiments employing well known open source attack tools and custom made software reveal that most 802.11i specific attacks can be effectively recognised, either directly or indirectly. We also consider and discuss Distributed Wireless Intrusion Detection (DIDS), which seems to fit best in RSN networks.
G. Kambourakis, T. Moschos, D. Geneiatakis, S. Gritzalis, Detecting DNS Amplifications Attacks, IFIP IEEE CRITIS’07 2nd International Workshop on Critical Information Infrastructures Security, J. Lopez, B. Hammerli, (eds), pp. 185-196, Oct, 2007, Malaga, Spain, Lecture Notes in Computer Science LNCS 5141, Springer, http://link.springer.com/content/pdf/10....
Abstract:
DNS amplification attacks massively exploit open recursive DNS servers mainly for performing bandwidth consumption DDoS attacks. The amplification effect lies in the fact that DNS response messages may be substantially larger than DNS query messages. In this paper, we present and evaluate a novel and practical method that is able to distinguish between authentic and bogus DNS replies. The proposed scheme can effectively protect local DNS servers acting both proactively and reactively. Our analysis and the corresponding real-usage experimental results demonstrate that the proposed scheme offers a flexible, robust and effective solution.
DNS amplification attacks massively exploit open recursive DNS servers mainly for performing bandwidth consumption DDoS attacks. The amplification effect lies in the fact that DNS response messages may be substantially larger than DNS query messages. In this paper, we present and evaluate a novel and practical method that is able to distinguish between authentic and bogus DNS replies. The proposed scheme can effectively protect local DNS servers acting both proactively and reactively. Our analysis and the corresponding real-usage experimental results demonstrate that the proposed scheme offers a flexible, robust and effective solution.
G. Karopoulos, G. Kambourakis, S. Gritzalis, Two privacy-enhanced context transfer schemes, ACM Q2SWinet 2007 3rd ACM International Workshop on Quality of Service and Security for Wireless and Mobile Networks (in conjunction with the 10th ACM/IEEE International Symposium on Modeling, Analysis and Simulation of Wireless and Mobile Systems), L. Bononi, (ed), pp. 172-175, Oct, 2007, Chania, Greece, ACM Press, http://dl.acm.org/ft_gateway.cfm?id=1298...
Abstract:
Foreseeable 4G environments will extensively take advantage of the concept of context transfer to provide seamless secure handovers between different administrative domains. However, the utilization of context transfer comes with a cost in the users' privacy. The purpose of this paper is to elaborate on these privacy issues and propose two privacy enhanced context transfer schemes that alleviate these problems. In the first scheme the Mobile Node (MN) is responsible for the transmission of the context to the new domain. In the second scheme the Home Domain (HD) of the user forwards the context acting as a proxy between the old and the new domain. In addition, assuming that the most appropriate form of user identity for the context is the Network Access Identifier (NAI), we show how the employment of temporary NAIs can further increase the privacy of our schemes.
Foreseeable 4G environments will extensively take advantage of the concept of context transfer to provide seamless secure handovers between different administrative domains. However, the utilization of context transfer comes with a cost in the users' privacy. The purpose of this paper is to elaborate on these privacy issues and propose two privacy enhanced context transfer schemes that alleviate these problems. In the first scheme the Mobile Node (MN) is responsible for the transmission of the context to the new domain. In the second scheme the Home Domain (HD) of the user forwards the context acting as a proxy between the old and the new domain. In addition, assuming that the most appropriate form of user identity for the context is the Network Access Identifier (NAI), we show how the employment of temporary NAIs can further increase the privacy of our schemes.
G. Karopoulos, G. Kambourakis, S. Gritzalis, Privacy Preserving Context Transfer in All-IP Networks, MMM-ACNS-07 International Conference Mathematical Methods, Models and Architectures, I. Kotenko et al., (eds), pp. 390-395, Sep, 2007, St. Petersburg, Russia, CCIS Communications in Computer and Information Science, Springer, http://link.springer.com/content/pdf/10....
Abstract:
In an all-IP environment, the concept of context transfer is used to provide seamless secure handovers between different administrative domains. However, the utilization of context transfer arises some privacy issues concerning the location and movement of users roaming between domains. In this paper we elaborate on these privacy issues and propose an alternative context transfer protocol that protects user’ location privacy as well. In addition, assuming that the context carries a user identity in the form of a Network Access Identifier (NAI), we show how the employment of temporary NAIs can further increase the privacy of our scheme.
In an all-IP environment, the concept of context transfer is used to provide seamless secure handovers between different administrative domains. However, the utilization of context transfer arises some privacy issues concerning the location and movement of users roaming between domains. In this paper we elaborate on these privacy issues and propose an alternative context transfer protocol that protects user’ location privacy as well. In addition, assuming that the context carries a user identity in the form of a Network Access Identifier (NAI), we show how the employment of temporary NAIs can further increase the privacy of our scheme.
G. Kambourakis, S. Gritzalis, On Device Authentication in Wireless Networks: Present issues and future challenges, TrustBus’07 4th International Conference on Trust, Privacy and Security in Digital Business, G. Pernul, C. Lambrinoudakis, M. Tjoa, (eds), pp. 135-144, Sep, 2007, Regensburg, Germany, Lecture Notes in Computer Science LNCS, Springer, http://link.springer.com/content/pdf/10....
Abstract:
Whilst device authentication must be considered as a cardinal security issue, complementary and of equal importance to user authentication, in today’s wireless networks, only a few papers address it patchily. This paper identifies and analyses possible major solutions towards solving the device authentication problem. We discuss key issues and future challenges that characterize each solution examining its pros and cons. We also offer a short qualitative comparative analysis for the device authentication schemes in question, examining its applicability for both infrastructure and ad-hoc deployments.
Whilst device authentication must be considered as a cardinal security issue, complementary and of equal importance to user authentication, in today’s wireless networks, only a few papers address it patchily. This paper identifies and analyses possible major solutions towards solving the device authentication problem. We discuss key issues and future challenges that characterize each solution examining its pros and cons. We also offer a short qualitative comparative analysis for the device authentication schemes in question, examining its applicability for both infrastructure and ad-hoc deployments.
G. Kambourakis, T. Moschos, D. Geneiatakis, S. Gritzalis, A Fair Solution to DNS Amplification Attacks, WDFIA, S. Kokolakis, T. Tryfonas, (eds), pp. 38-47, Aug, 2007, Samos, Greece, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
Recent serious security incidents reported several attackers employing IP spoofing to massively exploit recursive name servers to amplify DDoS attacks against numerous networks. DNS amplification attack scenarios utilize DNS servers mainly for performing bandwidth consumption DoS attacks. This kind of attack takes advantage of the fact that DNS response messages may be substantially larger than DNS query messages. In this paper we present a novel, simple and practical scheme that enable administrators to distinguish between genuine and falsified DNS replies. The proposed scheme, acts proactively by monitoring in real time DNS traffic and alerting security supervisors when necessary. It also acts reactively in co-operation with the firewalls by automatically updating rules to ban bogus packets. Our analysis and the corresponding experimental results show that the proposed scheme offers an effective solution, when the specific attack unfolds.
Recent serious security incidents reported several attackers employing IP spoofing to massively exploit recursive name servers to amplify DDoS attacks against numerous networks. DNS amplification attack scenarios utilize DNS servers mainly for performing bandwidth consumption DoS attacks. This kind of attack takes advantage of the fact that DNS response messages may be substantially larger than DNS query messages. In this paper we present a novel, simple and practical scheme that enable administrators to distinguish between genuine and falsified DNS replies. The proposed scheme, acts proactively by monitoring in real time DNS traffic and alerting security supervisors when necessary. It also acts reactively in co-operation with the firewalls by automatically updating rules to ban bogus packets. Our analysis and the corresponding experimental results show that the proposed scheme offers an effective solution, when the specific attack unfolds.
A. Tsakountakis, G. Kambourakis, S. Gritzalis, Towards Effective Wireless Intrusion Detection in IEEE 802.11i, 3rd International Workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing (in conjunction with the IEEE ICPS, P. Georgiadis, J. Lopez, S. Gritzalis, G.Marias, (eds), pp. 37-42, Jul, 2007, Istanbul, Turkey, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
The proliferation of wireless devices and the availability of wireless applications and services constantly raise new security concerns. Towards this direction, wireless intrusion detection systems (WIDS) can assist a great deal to proactively and reactively protect wireless networks, thus discouraging or repealing potential adversaries. In this paper we discuss the major wireless attack categories concerning IEEE 802.11 family networks and in particular the latest 802.11i security standard. We elaborate on 802.11 specific attacks and experimentally explore how these outbreaks can be effectively mitigated or thwarted by a properly designed WIDS. Among specially crafted software for both WIDS's modules as well as for attack generators, our test-bed embraces the majority of well known open source attack tools. Test results show that the proposed WIDS modules are able to effectively detect, either directly or indirectly, most attacks.
The proliferation of wireless devices and the availability of wireless applications and services constantly raise new security concerns. Towards this direction, wireless intrusion detection systems (WIDS) can assist a great deal to proactively and reactively protect wireless networks, thus discouraging or repealing potential adversaries. In this paper we discuss the major wireless attack categories concerning IEEE 802.11 family networks and in particular the latest 802.11i security standard. We elaborate on 802.11 specific attacks and experimentally explore how these outbreaks can be effectively mitigated or thwarted by a properly designed WIDS. Among specially crafted software for both WIDS's modules as well as for attack generators, our test-bed embraces the majority of well known open source attack tools. Test results show that the proposed WIDS modules are able to effectively detect, either directly or indirectly, most attacks.
G. Kambourakis, A. Andreadis, C. Paganos, A. Rouskas, S. Gritzalis, Bluetooth Security Mechanisms for Handheld Devices: A Performance Evaluation Study, EW 2007 13th European Wireless Conference, M. Terre, (ed), Apr, 2007, Paris, France, VDE, http://www.icsd.aegean.gr/publication_fi...
Abstract:
Bluetooth standard has been long criticized for various vulnerabilities and security inefficiencies, as its designers are trying to balance wisely between performance and complementary services including security. On the other hand, well respected security protocols like IP secure (IPsec) and Secure Shell (SSH) provide robust, low cost and easy to implement solutions for exchanging data over insecure communication links. Although, the deployment of these mechanisms is a well established and accustomed practice in the wireline world, more research effort is needed for wireless links, due to several limitations of the radio-based connections especially for handheld devices e.g. link unreliability, bandwidth, low processing power and battery consumption. This paper focuses on performance rather than on security, evaluating the efficiency of these de-facto security protocols over Bluetooth connections when low-end handheld devices are utilized. Several Personal Area Network (PAN) parameters, including absolute transfer times, link capacity and throughput, are evaluated. Our experiments employ both Bluetooth native security mechanisms as well as the two aforementioned protocols. Through a plethora of scenarios we offer a comprehensive in-depth comparative analysis of each of the aforementioned security mechanisms when deployed over Bluetooth links.
Bluetooth standard has been long criticized for various vulnerabilities and security inefficiencies, as its designers are trying to balance wisely between performance and complementary services including security. On the other hand, well respected security protocols like IP secure (IPsec) and Secure Shell (SSH) provide robust, low cost and easy to implement solutions for exchanging data over insecure communication links. Although, the deployment of these mechanisms is a well established and accustomed practice in the wireline world, more research effort is needed for wireless links, due to several limitations of the radio-based connections especially for handheld devices e.g. link unreliability, bandwidth, low processing power and battery consumption. This paper focuses on performance rather than on security, evaluating the efficiency of these de-facto security protocols over Bluetooth connections when low-end handheld devices are utilized. Several Personal Area Network (PAN) parameters, including absolute transfer times, link capacity and throughput, are evaluated. Our experiments employ both Bluetooth native security mechanisms as well as the two aforementioned protocols. Through a plethora of scenarios we offer a comprehensive in-depth comparative analysis of each of the aforementioned security mechanisms when deployed over Bluetooth links.
G. Kambourakis, E. Klaoudatou, S. Gritzalis, Securing Medical Sensor Environments: The Codeblue framework case, ARES 2007 The 2nd International Conference on Availability, Reliability, and Security - FARES 2007 1st International Symposium on Frontiers in Availability, Reliability and Security, R. Wagner, A. M. Tjoa et al., (eds), pp. 637-643, Apr, 2007, Vienna, Austria, IEEE CPS, http://ieeexplore.ieee.org/xpl/login.jsp...
Abstract:
Research on wireless sensor networks targeting to medical environments has gathered a great attention. In this context, the most recent and perhaps the most promising complete scheme is the CodeBlue hardware and software combined platform, developed in the context of the self-titled Harvard's University project. CodeBlue relies on miniature wearable sensors to monitor real-time patients' vital activities and collecting data for further processing. Apart from the essential query interface for medical monitoring, CodeBlue offers protocols for hardware discovery and multihop routing. This paper contributes to the CodeBlue security, which until now is considered as pending or left out for future work by its designers. We identify and describe several security issues and attack incidents that can be directly applied on CodeBlue compromising its trustworthiness. We also discuss possible solutions for both internal and external attacks and the key-management mechanisms that these solutions presume.
Research on wireless sensor networks targeting to medical environments has gathered a great attention. In this context, the most recent and perhaps the most promising complete scheme is the CodeBlue hardware and software combined platform, developed in the context of the self-titled Harvard's University project. CodeBlue relies on miniature wearable sensors to monitor real-time patients' vital activities and collecting data for further processing. Apart from the essential query interface for medical monitoring, CodeBlue offers protocols for hardware discovery and multihop routing. This paper contributes to the CodeBlue security, which until now is considered as pending or left out for future work by its designers. We identify and describe several security issues and attack incidents that can be directly applied on CodeBlue compromising its trustworthiness. We also discuss possible solutions for both internal and external attacks and the key-management mechanisms that these solutions presume.
D. Geneiatakis, T. Dagiuklas, C. Lambrinoudakis, G. Kambourakis, S. Gritzalis, Novel Protecting Mechanism for SIP-Based Infrastructure against Malformed Message Attacks: Performance Evaluation Study, CSNDSP , M. Logothetis et al. , (eds), Jul, 2006, Patras, Greece, http://www.wcl.ece.upatras.gr/CSNDSP/con...
Abstract:
This paper presents a novel mechanism to protect Session Initiation Protocol (SIP)-based infrastructure against malformed message attacks. The basic characteristics of this mechanism are the following: lightweight and easy to adapt to various SIP implementations. The proposed mechanism has been evaluated in terms of overhead processing. It is demonstrated that the employment of appropriate IDS against malformed messages impose minimum overhead in terms of events’ processing.
This paper presents a novel mechanism to protect Session Initiation Protocol (SIP)-based infrastructure against malformed message attacks. The basic characteristics of this mechanism are the following: lightweight and easy to adapt to various SIP implementations. The proposed mechanism has been evaluated in terms of overhead processing. It is demonstrated that the employment of appropriate IDS against malformed messages impose minimum overhead in terms of events’ processing.
G. Kambourakis, D. Geneiatakis, T. Dagiuklas, C. Lambrinoudakis, S. Gritzalis, Towards Effective SIP load balancing, 3rd Annual VoIP Security Workshop, D. Sisalem et al., (eds), Jun, 2006, Berlin, Germany, ACM Press, http://www.iptel.org/voipsecurity/doc/14...
Abstract:
Session Initiation Protocol (SIP) high availability, reliability and redundancy are determined by the ability of the core SIP network components to offer high quality SIP services in the event(s) of high call transactions, link outages, device failures, misconfigurations and security attacks. In this context, load balancers can be used to achieve redundancy and active load balancing of SIP transactions. In load balancing schemes, new requests are allocated across available servers using a selection algorithm. Although considerable work has been already done for Web traffic balancing, little research effort is primarily aiming to SIP load balancing. This paper proposes a SIP dedicated load balancing solution, which is currently under development within the EC funded project SNOCER. We describe in detail our balancing scheme, its associated architecture elements and provide implementation details showing that it is simple to realize, effective, flexible, robust and secure.
Session Initiation Protocol (SIP) high availability, reliability and redundancy are determined by the ability of the core SIP network components to offer high quality SIP services in the event(s) of high call transactions, link outages, device failures, misconfigurations and security attacks. In this context, load balancers can be used to achieve redundancy and active load balancing of SIP transactions. In load balancing schemes, new requests are allocated across available servers using a selection algorithm. Although considerable work has been already done for Web traffic balancing, little research effort is primarily aiming to SIP load balancing. This paper proposes a SIP dedicated load balancing solution, which is currently under development within the EC funded project SNOCER. We describe in detail our balancing scheme, its associated architecture elements and provide implementation details showing that it is simple to realize, effective, flexible, robust and secure.
G. Kambourakis, D. Geneiatakis, S. Gritzalis, T. Dagiuklas, C. Lambrinoudakis, Security and Privacy issues towards ENUM Protocol, ISSPIT ‘05 5th IEEE International Symposium on Signal Processing and Information Technology, D. Serpanos et al., (eds), pp. 478-483, Dec, 2005, Athens, Greece, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
Public ENUM is used until now in trials and some "test-bed" or "production" VoIP environments with small volume. Very lately, another application of the ENUM protocol has emerged namely the "Carrier ENUM", becoming popular among VoIP and mobile providers. In this context, a new competitive to public and carrier ENUM, peer-to-peer approach promotes itself, stating to be more reliable and secure, called DUNDi. Although considerable arguing has been generated among various ENUM forums and standardization fora on ENUM implementations, until now, several issues remain obscured and unresolved. In this paper we address security and privacy issues raised by all the aforementioned solutions, presenting implementation details, general concerns, future trends, and possible solution.
Public ENUM is used until now in trials and some "test-bed" or "production" VoIP environments with small volume. Very lately, another application of the ENUM protocol has emerged namely the "Carrier ENUM", becoming popular among VoIP and mobile providers. In this context, a new competitive to public and carrier ENUM, peer-to-peer approach promotes itself, stating to be more reliable and secure, called DUNDi. Although considerable arguing has been generated among various ENUM forums and standardization fora on ENUM implementations, until now, several issues remain obscured and unresolved. In this paper we address security and privacy issues raised by all the aforementioned solutions, presenting implementation details, general concerns, future trends, and possible solution.
G. Kambourakis, D. P. Kontoni, I. Sapounas, Modeling Learners’ Perceptions towards Educational Portals and Collaborative Learning Tools Usage: The Hellenic Open University Case, Third International Conference on Open and Distance Learning: , pp. 209-220, Nov, 2005, Patra, Greece, Propompos publications
Abstract:
The educational collaborative virtual distance learning environment is supposed to promote the active participation of teachers and students, interacting one another, exchanging knowledge and creating new abilities. Consequently, the learning process is anticipated to be promoted on both sides, by exchanging experiences, discussing new ideas and accomplishment of group, thus allowing the creation of knowledge, based on the collective involvement. On the other hand, in the context of eLearning, many standard software platforms, so called portal servers, have appeared on the market integrating various and often advanced synchronous and asynchronous collaborative tools and features. In this paper, we conduct a preliminary analysis measuring the Hellenic Open University’s (HOU) students’ perceptions toward the educational portal’s learning tools focusing mainly on collaborative activities. We make an attempt to identify whether the learners are using the portal, the tools it provides and to what degree. The study takes into account a plethora of variables to estimate whether these variables and at what degree are affecting significantly portal usability. Apart from normal descriptive analysis, we furnish two different linear regression models illustrating the various cross-dependencies among different dependent and independent variables and conducting two disparate Analyses of Variance (one-way ANOVA).
The educational collaborative virtual distance learning environment is supposed to promote the active participation of teachers and students, interacting one another, exchanging knowledge and creating new abilities. Consequently, the learning process is anticipated to be promoted on both sides, by exchanging experiences, discussing new ideas and accomplishment of group, thus allowing the creation of knowledge, based on the collective involvement. On the other hand, in the context of eLearning, many standard software platforms, so called portal servers, have appeared on the market integrating various and often advanced synchronous and asynchronous collaborative tools and features. In this paper, we conduct a preliminary analysis measuring the Hellenic Open University’s (HOU) students’ perceptions toward the educational portal’s learning tools focusing mainly on collaborative activities. We make an attempt to identify whether the learners are using the portal, the tools it provides and to what degree. The study takes into account a plethora of variables to estimate whether these variables and at what degree are affecting significantly portal usability. Apart from normal descriptive analysis, we furnish two different linear regression models illustrating the various cross-dependencies among different dependent and independent variables and conducting two disparate Analyses of Variance (one-way ANOVA).
D. Geneiatakis, G. Kambourakis, T. Dagiuklas, C. Lambrinoudakis, S. Gritzalis, A Framework for Detecting Malformed Messages in SIP Networks, 14th IEEE International Workshop on Local and Metropolitan Area Networks (LANMAN ‘05), Sep, 2005, Chania, Greece, IEEE CPS, http://ieeexplore.ieee.org/xpl/login.jsp...
Abstract:
Internet telephony like any other Internet service suffers from security flaws caused by various implementation errors (e.g. in end-users terminals, protocols, operating systems, hardware, etc). These implementation problems usually lead VoIP subsystems (e.g. SIP servers) to various unstable operations whenever trying to process a message not conforming to the underlying standards. As Internet telephony becomes more and more popular, attackers will attempt to exhaustively "test" implementations' robustness, transmitting various types of malformed messages to them. Since it is almost infeasible to avoid or predict every potential error caused during the developing process of these subsystems, it is necessary to specify an appropriate and robust, from the security point of view, framework that will facilitate the successful detection and handling of any kind of malformed messages aiming to destruct the provided service. In this paper, we adequately present malformed message attacks against SIP network servers and/or SIP end-user terminals and we propose a new detection "framework" of prototyped attacks' signatures that can assist the detection procedure and provide effective defence against this category of attacks
Internet telephony like any other Internet service suffers from security flaws caused by various implementation errors (e.g. in end-users terminals, protocols, operating systems, hardware, etc). These implementation problems usually lead VoIP subsystems (e.g. SIP servers) to various unstable operations whenever trying to process a message not conforming to the underlying standards. As Internet telephony becomes more and more popular, attackers will attempt to exhaustively "test" implementations' robustness, transmitting various types of malformed messages to them. Since it is almost infeasible to avoid or predict every potential error caused during the developing process of these subsystems, it is necessary to specify an appropriate and robust, from the security point of view, framework that will facilitate the successful detection and handling of any kind of malformed messages aiming to destruct the provided service. In this paper, we adequately present malformed message attacks against SIP network servers and/or SIP end-user terminals and we propose a new detection "framework" of prototyped attacks' signatures that can assist the detection procedure and provide effective defence against this category of attacks
D. Geneiatakis, G. Kambourakis, T. Dagiuklas, C. Lambrinoudakis, S. Gritzalis, SIP Message Tampering: THE SQL code INJECTION attack, 13th IEEE International Conference on Software, Telecommunications and Computer Networks (SoftCOM ‘05), N. Rozic et al., (eds), pp. 176-181, Sep, 2005, Split, Croatia, IEEE CPS, http://www.cs.columbia.edu/~dgen/papers/...
Abstract:
As Internet Telephony and Voice over IP (VoIP) are considered advanced Internet applications/services, they are vulnerable to attacks existing in Internet applications/services. For instance HTTP digest authentication attacks, malformed messages, message tampering with malicious code, SQL injection and more, can be launched against any Internet application/service. In this paper, we describe, analyze and demonstrate the inheritance of message tampering attacks, focusing on SQL injection, in the SIP protocol. This type of attack has been successfully launched in Internet environments, with very little cost, effort and specialized knowledge. However, in the context of the SIP protocol, no works or research efforts are reported until now. The paper provides an in-depth analysis of SQL injection in SIP realms, discussing implementation details, constraints and possibilities for the attacker. In addition, we provide some indicative experimental results by triggering this style of attack against a properly designed SIP-based testbed environment. Finally, specific countermeasures, remedies and new signature-oriented framework are suggested for identifying and counter fight against this attack.
As Internet Telephony and Voice over IP (VoIP) are considered advanced Internet applications/services, they are vulnerable to attacks existing in Internet applications/services. For instance HTTP digest authentication attacks, malformed messages, message tampering with malicious code, SQL injection and more, can be launched against any Internet application/service. In this paper, we describe, analyze and demonstrate the inheritance of message tampering attacks, focusing on SQL injection, in the SIP protocol. This type of attack has been successfully launched in Internet environments, with very little cost, effort and specialized knowledge. However, in the context of the SIP protocol, no works or research efforts are reported until now. The paper provides an in-depth analysis of SQL injection in SIP realms, discussing implementation details, constraints and possibilities for the attacker. In addition, we provide some indicative experimental results by triggering this style of attack against a properly designed SIP-based testbed environment. Finally, specific countermeasures, remedies and new signature-oriented framework are suggested for identifying and counter fight against this attack.
N. Doukas, E. Klaoudatou, G. Kambourakis, A. Rouskas, S. Gritzalis, Evaluation of digital certificates acquisition in large-scale 802.11-3GPP Hybrid Environments, 14th IEEE International Workshop on Local and Metropolitan Area Networks (LANMAN ‘05), pp. 176-181, Sep, 2005, Chania, Greece, IEEE CPS, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
This paper evaluates the performance of a hybrid WLAN-3GPP network architecture for delivering subscribers' certificates. Two main categories of simulation scenarios are implemented and evaluated based on the underlying access network technology used; 802.11b and UMTS. Each of the scenarios is categorized further in numerous sub-cases. Results showed that AC acquisition when deployed in large scale between several heterogeneous networks is feasible within acceptable time limits.
This paper evaluates the performance of a hybrid WLAN-3GPP network architecture for delivering subscribers' certificates. Two main categories of simulation scenarios are implemented and evaluated based on the underlying access network technology used; 802.11b and UMTS. Each of the scenarios is categorized further in numerous sub-cases. Results showed that AC acquisition when deployed in large scale between several heterogeneous networks is feasible within acceptable time limits.
D. Geneiatakis, G. Kambourakis, A. Dagiouklas, C. Lambrinoudakis, S. Gritzalis, Session Initiation Protocol Security Mechanisms: A state-of-the-art review, INC, S. Furnell, S. K. Katsikas, (eds), pp. 147-156, Jul, 2005, Samos, Greece, Ziti Pubs, http://startrinity.com/VoIP/Resources/si...
Abstract:
The commercial deployment of VoIP necessitates the employment of security mechanisms that can assure availability, reliability, confidentiality and integrity. The Session Initiation Protocol (SIP) is considered as the dominant signalling protocol for calls over the Internet. SIP, like other Internet protocols, is vulnerable to known Internet attacks, while at the same time it introduces new security problems in the VoIP system. This paper lists the existing security problems in SIP and provides a brief description, followed by a critical analysis, of the security mechanisms it employs.
The commercial deployment of VoIP necessitates the employment of security mechanisms that can assure availability, reliability, confidentiality and integrity. The Session Initiation Protocol (SIP) is considered as the dominant signalling protocol for calls over the Internet. SIP, like other Internet protocols, is vulnerable to known Internet attacks, while at the same time it introduces new security problems in the VoIP system. This paper lists the existing security problems in SIP and provides a brief description, followed by a critical analysis, of the security mechanisms it employs.
G. Kambourakis, A. Rouskas, D. Gritzalis, Performance Evaluation of Certificate Based Authentication in Integrated Emerging 3G and Wi-Fi Networks, 1st European PKI Workshop, pp. 287-296, Jun, 2004, Samos, Greece, LNCS 3093, http://link.springer.com/chapter/10.1007...
Abstract:
Certificate based authentication of parties provides a powerful means for verifying claimed identities, avoiding the necessity of distributing shared secrets beforehand. Whereas Wi-Fi networks present security deficiencies, they manage to highly penetrate into the wireless market in a great degree due to their low cost, easy administration, great capacity, IP-oriented nature, etc. Con-sidering Wi-Fi networking settings, administrated by different operators, as parts of a common core 3G infrastructure, the paper proposes and evaluates the potential application of enhanced TLS-based authentication mechanisms in in-tegrated emerging-3G and Wi-Fi networks. We propose to use EAP-TLS proto-col seconded by Public Key Infrastructure entities, to provide users with robust authentication mechanisms in hybrid WLAN-3G heterogeneous environment. Our alternative solution is discussed against EAP-AKA procedures as they ap-pear in the latest 3G and integrated 3G/Wi-Fi specifications. Finally, the pro-posed mechanism is evaluated through a properly designed experimental test bed setup.
Certificate based authentication of parties provides a powerful means for verifying claimed identities, avoiding the necessity of distributing shared secrets beforehand. Whereas Wi-Fi networks present security deficiencies, they manage to highly penetrate into the wireless market in a great degree due to their low cost, easy administration, great capacity, IP-oriented nature, etc. Con-sidering Wi-Fi networking settings, administrated by different operators, as parts of a common core 3G infrastructure, the paper proposes and evaluates the potential application of enhanced TLS-based authentication mechanisms in in-tegrated emerging-3G and Wi-Fi networks. We propose to use EAP-TLS proto-col seconded by Public Key Infrastructure entities, to provide users with robust authentication mechanisms in hybrid WLAN-3G heterogeneous environment. Our alternative solution is discussed against EAP-AKA procedures as they ap-pear in the latest 3G and integrated 3G/Wi-Fi specifications. Finally, the pro-posed mechanism is evaluated through a properly designed experimental test bed setup.
G. Kambourakis, A. Rouskas, S. Gritzalis, Inter/Intra Core Network Security with PKI for 3G-and-Beyond Systems, 3rd IFIP NETWORKING TC-6 International Conference on Networking, N. Mitrou et al., (eds), pp. 13-24, May, 2004, Athens, Greece, Springer, LNCS 3042, http://link.springer.com/content/pdf/10....
Abstract:
With a large number of different heterogeneous network technologies (e.g. UMTS, WLAN, HIPERLAN) and operators expected in the future mobile communications environment, that should frequently and seamlessly interwork with each other and a constantly increasing population of communication parties, capturing the full benefits of open channel key transfers and scaling public key methods requires Public Key Infrastructure (PKI). In this paper, we discuss and investigate different ways to take advantage of a proposed PKI system. Focusing on UMTS Release 6 IP multimedia subsystem, we analyze the ongoing 3GPP specifications and its limitations and examine how PKI can provide robust security solutions to both 3G-and-beyond inter/intra core network and the mobile user. Public key security mechanisms to protect operator’s core networks seem to gain ground and protocols like IPsec and SSL, seconded by PKI, can support the continuous growth of diverse technologies and solve inter-operator many-to-many modeled trust relationships. From the user’s side we present solutions, which far enhance authentication procedures and end-to-end communication model trust. We argue that PKI can become a promising candidate, which offers the competitive framework to overcome symmetric key based security inefficiencies and provide powerful solutions to protect both network core signalling and user’s data from potential intruders.
With a large number of different heterogeneous network technologies (e.g. UMTS, WLAN, HIPERLAN) and operators expected in the future mobile communications environment, that should frequently and seamlessly interwork with each other and a constantly increasing population of communication parties, capturing the full benefits of open channel key transfers and scaling public key methods requires Public Key Infrastructure (PKI). In this paper, we discuss and investigate different ways to take advantage of a proposed PKI system. Focusing on UMTS Release 6 IP multimedia subsystem, we analyze the ongoing 3GPP specifications and its limitations and examine how PKI can provide robust security solutions to both 3G-and-beyond inter/intra core network and the mobile user. Public key security mechanisms to protect operator’s core networks seem to gain ground and protocols like IPsec and SSL, seconded by PKI, can support the continuous growth of diverse technologies and solve inter-operator many-to-many modeled trust relationships. From the user’s side we present solutions, which far enhance authentication procedures and end-to-end communication model trust. We argue that PKI can become a promising candidate, which offers the competitive framework to overcome symmetric key based security inefficiencies and provide powerful solutions to protect both network core signalling and user’s data from potential intruders.
G. Kambourakis, A. Rouskas, S. Gritzalis, Delivering Attribute Certificates over GPRS, ACM SAC 2004 19th International ACM Symposium on Applied Computing - Mobile Computing and Applications Track, H. V. Leong, A. Chan , (eds), pp. 1166-1170, May, 2004, Nicosia, Cyprus, ACM Press, http://dl.acm.org/ft_gateway.cfm?id=9681...
Abstract:
Attribute Certificates (ACs) have been developed and standardized by the ANSI X9 committee as an alternative and better approach, to X.509 public key certificates, for carrying authorization information. Attribute Authorities (AA) bind the characteristics of an entity (called attributes) to that entity by signing the appropriate AC. Therefore, ACs can be used for controlling access to system resources and employing role-based authorization and access controls policies accordingly. Although ACs are widely used and standardized, to the best of our knowledge, no mobile infrastructure or service currently utilizes them. In this paper, we first examine how basic Public Key Infrastructure (PKI) can be incorporated into mobile networks and especially the Universal Mobile Telecommunications System (UMTS). As a case study, we then experiment with ACs in the GPRS network, using a prototype implementation. In particular, we investigate and measure the performance in terms of service and transfer times when ACs are introduced in the mobile environment. Our measurements show that ACs technology not only is feasible to implement in present and future mobile networks, but at the same time can deliver flexible and relatively fast services to the subscribers, without compromising security.
Attribute Certificates (ACs) have been developed and standardized by the ANSI X9 committee as an alternative and better approach, to X.509 public key certificates, for carrying authorization information. Attribute Authorities (AA) bind the characteristics of an entity (called attributes) to that entity by signing the appropriate AC. Therefore, ACs can be used for controlling access to system resources and employing role-based authorization and access controls policies accordingly. Although ACs are widely used and standardized, to the best of our knowledge, no mobile infrastructure or service currently utilizes them. In this paper, we first examine how basic Public Key Infrastructure (PKI) can be incorporated into mobile networks and especially the Universal Mobile Telecommunications System (UMTS). As a case study, we then experiment with ACs in the GPRS network, using a prototype implementation. In particular, we investigate and measure the performance in terms of service and transfer times when ACs are introduced in the mobile environment. Our measurements show that ACs technology not only is feasible to implement in present and future mobile networks, but at the same time can deliver flexible and relatively fast services to the subscribers, without compromising security.
G. Kambourakis, D. P. Kontoni, I. Sapounas, Introducing Attribute Certificates to Secure Distributed eLearning or mLearning Services, 4th IASTED Web Based Education (WBE , pp. 436-440, Feb, 2004, Innsbruck, Austria, ACTA Press, http://www.actapress.com/Abstract.aspx?p...
Abstract:
Motivating by the fact that public key cryptography is continuously evolving and its installed base is growing singniffically, very recent research works examine the potential use of it in eLearning or mLearning services. Attribute or temporary Certificates (ACs) seconded by Public Key Infrastructure (PKI) can provide the appropriate framework to secure distributed interactive eLearning applications, offering mutual “trust” to both learners and service providers. Considering PKI requirements for eLearning networks, the paper discusses the potential application of ACs in a proposed trust model. In the concept of that model, typical eLearning trusts interactions between eLearners and providers are presented, which demonstrate that robust security mechanisms and effective trust control can be obtained and implemented. The application of ACs to support mLearning are also presented and evaluated through an experimental test bed setup.
Motivating by the fact that public key cryptography is continuously evolving and its installed base is growing singniffically, very recent research works examine the potential use of it in eLearning or mLearning services. Attribute or temporary Certificates (ACs) seconded by Public Key Infrastructure (PKI) can provide the appropriate framework to secure distributed interactive eLearning applications, offering mutual “trust” to both learners and service providers. Considering PKI requirements for eLearning networks, the paper discusses the potential application of ACs in a proposed trust model. In the concept of that model, typical eLearning trusts interactions between eLearners and providers are presented, which demonstrate that robust security mechanisms and effective trust control can be obtained and implemented. The application of ACs to support mLearning are also presented and evaluated through an experimental test bed setup.
G. Kambourakis, A. Rouskas, S. Gritzalis, Introducing PKI to enhance Security in Future Mobile Networks, IFIPSEC’2003 18th IFIP International Information Security Conference, D. Gritzalis P. Samarati, S. K. Katsikas, S. De Capitani di Vimercati, (eds), pp. 109-120, May, 2003, Athens, Greece, Kluwer Academic Publishers, http://link.springer.com/chapter/10.1007...
Abstract:
Current wireless network standards perform user authentication, signaling and data encryption, as well as message integrity protection, by utilizing only symmetric key methods. However, as mobile networks are evolving into full-IP and the communication is envisaged to change from second generation (2G) person-to-person model to fourth generation (4G) machine-to-machine model, there is greater demand to provide more flexible, reconfigurable and scalable security mechanisms that can advance in a many-to-many trust relationship model. Employing public key methods in many-to-many schemes drops the requirement for a secure channel to transfer keys between two communication parties, thus providing the appropriate scalability to the whole system. With a large number of different network technologies and operators, expected in the future mobile communications environment, that should frequently and seamlessly interwork with each other, and a constantly increasing population of communication parties, capturing the full benefits of open channel key transfers and scaling public key methods requires Public Key Infrastructure (PKI). In this paper, we discuss and investigate different ways to take advantage of a proposed PKI system. From the network side, we investigate how PKI can provide future inter/intra mobile core network security, while from the user’s perspective we present solutions that far enhance authentication procedures and end-to-end communication model trust. We show that PKI offers the appropriate framework to overcome symmetric key based security inefficiencies, providing powerful solutions to protect both network core signaling and user’s data from potential intruders.
Current wireless network standards perform user authentication, signaling and data encryption, as well as message integrity protection, by utilizing only symmetric key methods. However, as mobile networks are evolving into full-IP and the communication is envisaged to change from second generation (2G) person-to-person model to fourth generation (4G) machine-to-machine model, there is greater demand to provide more flexible, reconfigurable and scalable security mechanisms that can advance in a many-to-many trust relationship model. Employing public key methods in many-to-many schemes drops the requirement for a secure channel to transfer keys between two communication parties, thus providing the appropriate scalability to the whole system. With a large number of different network technologies and operators, expected in the future mobile communications environment, that should frequently and seamlessly interwork with each other, and a constantly increasing population of communication parties, capturing the full benefits of open channel key transfers and scaling public key methods requires Public Key Infrastructure (PKI). In this paper, we discuss and investigate different ways to take advantage of a proposed PKI system. From the network side, we investigate how PKI can provide future inter/intra mobile core network security, while from the user’s perspective we present solutions that far enhance authentication procedures and end-to-end communication model trust. We show that PKI offers the appropriate framework to overcome symmetric key based security inefficiencies, providing powerful solutions to protect both network core signaling and user’s data from potential intruders.
G. Kambourakis, A. Rouskas, S. Gritzalis, Using SSL/TLS in Authentication and Key Agreement Procedures of Future Mobile Networks, 4th International IEEE Workshop on Mobile and Wireless Communications Networks, pp. 152-156, Sep, 2002, Stockholm, Sweden, IEEE CPS Conference Publishing Services, http://ieeexplore.ieee.org/xpl/articleDe...
Abstract:
Existing security schemes in 2G and 3G systems are inadequate, as there is a greater demand to provide a more flexible, reconfigurable and scalable security mechanism that can advance as fast as mobile hosts are evolving into full-IP enabled devices. Work has already begun on such an "all-IP" end-to-end solution, commonly referred to as 4G systems. Fully-fledged integration between mobile networks and the Internet demands fully compatible, time-tested and reliable mechanisms to depend on. SSL/TLS protocol has proved its effectiveness in wired Internet and it will probably be the most promising candidate for future wireless environments. We discuss existing problems related to authentication and key agreement procedures (AKA), such as compromised authentication vectors attacks, as they appear in 2G and 3G systems, and propose how SSL/TLS can be used to overcome these inefficiencies. Further on, we mark down additional benefits that stem from the introduction of SSL/TLS combined with the appropriate PKI elements in the 4G wireless environment.
Existing security schemes in 2G and 3G systems are inadequate, as there is a greater demand to provide a more flexible, reconfigurable and scalable security mechanism that can advance as fast as mobile hosts are evolving into full-IP enabled devices. Work has already begun on such an "all-IP" end-to-end solution, commonly referred to as 4G systems. Fully-fledged integration between mobile networks and the Internet demands fully compatible, time-tested and reliable mechanisms to depend on. SSL/TLS protocol has proved its effectiveness in wired Internet and it will probably be the most promising candidate for future wireless environments. We discuss existing problems related to authentication and key agreement procedures (AKA), such as compromised authentication vectors attacks, as they appear in 2G and 3G systems, and propose how SSL/TLS can be used to overcome these inefficiencies. Further on, we mark down additional benefits that stem from the introduction of SSL/TLS combined with the appropriate PKI elements in the 4G wireless environment.