Riccardo Lazzeretti

Post-Doc at University of Padova, Italy

Talk title: ODIN: Obfuscation-based privacy preserving consensus algorithm for Decentralized Information fusion in smart device Networks

Abstract: The large spread of sensors and smart devices in urban and rural infrastructures are motivating research in the area of Internet of Thing (IoT), to develop new services and improve citizens’ quality of life. Sensors and smart devices generate large amount of measurement data from sensing the environment, which is used to enable services, such as control power consumption or traffic density. To deal with such a large amount of information, and provide accurate measurements, service providers adopt information fusion, which, given the decentralized nature of urban or rural deployments, can be performed by means of consensus algorithms. These algorithms allow distributed agents to (iteratively) compute linear functions on the exchanged data, and take decisions based on the outcome, without the need for the support of a central entity. However, the use of consensus algorithms raises several security concerns, especially when private or security critical information are involved in the computation.

We introduce ODIN, a novel algorithm that allows information fusion over encrypted data. ODIN is a privacy-preserving extension of the popular consensus gossip algorithm, that prevents distributed agents have direct access to the data while they iteratively reach consensus; furthermore, agents cannot access even the final consensus value, but can only retrieve partial information, e.g., a binary decision. ODIN uses efficient additive obfuscation and proxy re-encryption during the update steps, and Garbled Circuits to take final decisions on the obfuscated consensus. We show its practicability and efficiency on real-world resource constrained devices, developing a prototype implementation for Raspberry Pi devices.

Riccardo Spolaor

PhD candidate at University of Padua, IT

Talk title: AppScanner: Automatic Fingerprinting of Smartphone Apps From Encrypted Network Traffic

Abstract: Automatic fingerprinting and identification of smartphone apps is becoming a very attractive data gathering technique for adversaries, network administrators, investigators and marketing agencies. In fact, the list of apps installed on a device can be used to identify vulnerable apps for an attacker to exploit, uncover a victim's use of sensitive apps, assist network planning, and aid marketing. However, app fingerprinting is complicated by the vast number of apps available for download, the wide range of devices they may be installed on, and the use of payload encryption protocols such as HTTPS/TLS. In this paper, we present a novel methodology and a framework implementing it, called AppScanner, for the automatic fingerprinting and identification of Android apps from their encrypted network traffic. To build app fingerprints, we run apps automatically on a physical device to collect their network traces. We apply various processing strategies to these network traces before extracting the features that are used to train our supervised learning algorithms. Our fingerprint generation methodology is highly scalable and does not rely on inspecting packet payloads; thus our framework works even when HTTPS/TLS is employed. We built and deployed this lightweight framework and ran a thorough set of experiments to assess its performance. We automatically profiled 110 of the most popular apps in the Google Play Store and were later able to re-identify them in real-time with more than 99% accuracy.

Daniele Lain

MSc student at University of Padua, IT

Talk title: Don't Skype & Type! Acoustic Eavesdropping in Voice-Over-IP

Abstract: Acoustic emanations of computer keyboards represent a serious privacy issue. As demonstrated in prior work, spectral and temporal properties of keystroke sounds might reveal what a user is typing. However, previous attacks assumed relatively strong adversary models that are not very practical in many real-world settings. Such strong models assume: (i) adversary's physical proximity to the victim, (ii) precise profiling of the victim's typing style and keyboard, and/or (iii) significant amount of victim's typed information (and its corresponding sounds) available to the adversary.

In this talk, we present a new and practical keyboard acoustic eavesdropping attack, called Skype & Type (S&T), which is based on Voice-over-IP (VoIP). S&T relaxes prior strong adversary assumptions. Our work is motivated by the simple observation that people often engage in secondary activities (including typing) while participating in VoIP calls. VoIP software can acquire acoustic emanations of pressed keystrokes (which might include passwords and other sensitive information) and transmit them to others involved in the call. In fact, we show that very popular VoIP software (Skype) conveys enough audio information to reconstruct the victim's input -- keystrokes typed on the remote keyboard. In particular, our attack is highly accurate with some knowledge on the victim's typing style and the keyboard, and still works with reduced accuracy even if the attacker oblivious to both the typing style and the keyboard.

Moreno Ambrosin

Post-Doc at University of Padova, IT

Talk title: Updaticator: Updating Billions of Devices by an Efficient, Scalable and Secure Software Update Distribution Over Untrusted Cache-enabled Networks

Abstract: Secure and fast distribution of software updates and patches is essential for improving functionality and security of computer systems. Today, each device downloads updates individually from a software provider distribution server. Unfortunately, this approach does not scale to large systems with billions of devices where the network bandwidth of the server and the local Internet gateway become bottlenecks. Cache-enabled Network (CN) services (either proprietary, as Akamai, or open Content-Distribution Networks) can reduce these bottlenecks. However, they do not offer security guarantees against potentially untrusted CN providers that try to threaten the confidentiality of the updates or the privacy of the users. In this paper, we propose Updaticator, the first protocol for software updates over Cache-enabled Networks that is scalable to billions of concurrent device updates while being secure against malicious networks. We evaluate our proposal considering Named-Data Networking, a novel instance of Cache-enabled overlay Networks. Our analysis and experimental evaluation show that Updaticator removes the bottlenecks of individual device-update distribution, by reducing the network load at the distribution server: from linear in the number of devices to a constant, even if billions of devices are requesting updates. Furthermore, when compared to the state-of-the-art individual device-update mechanisms, the download time with Updaticator is negligible, due to local caching.

Chhagan Lal

Post-Doc at University of Padova, Italy

Talk title: TagItSmart! (Smart Tags driven service platform for enabling ecosystems of connected objects)

Abstract: The overall objective of TagItSmart! is to create a set of tools and enabling technologies integrated into a platform with open interfaces enabling users across the value chain to fully exploit the power of condition-dependent FunCodes to connect mass-market products with the digital world across multiple application sectors. The goal is to connect What is still out of reach due to technological limitations and the cost of deployment are mass-market products: a carton of milk, a package of steak, a basket of apples, a book, a CD etc. Today, these products are identified by printed tags (barcodes, QR codes). These codes relate to the product they tag, not to the unique unit/object that holds the tag. Once attached to an object, tags are usually static and the information they provide does not change, regardless of the state or events happening in the immediate environment of that product.

Our main emphasis is leveraging the feature of functional codes to dynamically change according to the context changes of each tagged product together with wide availability of smart phones that can capture/record/transmit these codes we can create context sensors for mass-market products and convert mass-market products into connected mass-market products with unique identity. Functional ink + optical tags + crowd sourced smart phones + cloud = IoT for mass-market domain across application sectors

Alberto Giarretta

MSc student at University of Padova, Italy

Talk title: Bio-NanoThings: There’s Plenty of Weakness at the Bottom

Abstract: Nanotechnology is growing faster than ever, and the advancements in the field of molecular communication, along with the outstanding discoveries in synthetic biology, make possible to build futuristic biologic nanonetworks. Even though deep investigations about bio-nanonetworks have been (and still are) done, very little attention has been paid to the related security issues: this lack of investigations could lead to serious problems, such as new forms of bioterrorism. In this lecture we first provide an overview of nanomachines and molecular communication technologies. Then, we propose two new types of attacks, specific to bio-nanonetworks, which aim to the signalling sub-layer of the physical layer and two countermeasures that rely on a threshold-based decision process and a Bayes’ rule decision process, respectively. We ran a thorough set of simulations, in order to asses the feasibility of our countermeasures and evaluate their potential collateral disruptiveness. Results show that our attacks are feasible and that the countermeasures are capable to effectively mitigate the danger.