grizzly/deneir
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

review

Browse source
This commit is contained in:
Arthur Grisel-Davy 2023-06-26 17:34:28 -04:00
parent e2cc4ecfec
commit 56021ab305
6 changed files with 50 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

12
BPV/qrs/bibli.bib
View file

@ -31,11 +31,11 @@ primaryClass={cs.CR}
@inproceedings {185175, @inproceedings {185175,
author = {Jacob Maskiewicz and Benjamin Ellis and James Mouradian and Hovav Shacham}, author = {Jacob Maskiewicz and Benjamin Ellis and James Mouradian and Hovav Shacham},
title = {Mouse Trap: Exploiting Firmware Updates in {USB} Peripherals}, title = {Mouse Trap: Exploiting Firmware Updates in {USB} Peripherals},
booktitle = {8th {USENIX} Workshop on Offensive Technologies ({WOOT} 14)}, booktitle = {8th USENIX Workshop on Offensive Technologies ({WOOT} 14)},
year = {2014}, year = {2014},
address = {San Diego, CA}, address = {San Diego, CA},
url = {https://www.usenix.org/conference/woot14/workshop-program/presentation/maskiewicz}, url = {https://www.usenix.org/conference/woot14/workshop-program/presentation/maskiewicz},
publisher = {{USENIX} Association}, publisher = {USENIX Association},
month = aug, month = aug,
} }
@ -525,15 +525,11 @@ series = {IoTPTS '16}
@inproceedings{michalevsky2015powerspy, @inproceedings{michalevsky2015powerspy,
title={Powerspy: Location tracking using mobile device power analysis}, title={Powerspy: Location tracking using mobile device power analysis},
author={Michalevsky, Yan and Schulman, Aaron and Veerapandian, Gunaa Arumugam and Boneh, Dan and Nakibly, Gabi}, author={Michalevsky, Yan and Schulman, Aaron and Veerapandian, Gunaa Arumugam and Boneh, Dan and Nakibly, Gabi},
booktitle={24th $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 15)}, booktitle={24th USENIX Security Symposium (USENIX Security 15)},
pages={785--800}, pages={785--800},
year={2015} year={2015}
} }
@INPROCEEDINGS{4531926, @INPROCEEDINGS{4531926,
author={Nilsson, D. K. and Larson, U. E.}, author={Nilsson, D. K. and Larson, U. E.},
@ -588,7 +584,7 @@ series = {IoTPTS '16}
doi={10.1109/ICDIS.2019.00016}} doi={10.1109/ICDIS.2019.00016}}
@inproceedings{pothukuchi2021maya, @inproceedings{pothukuchi2021maya,
title={Maya: Using formal control to obfuscate power side channels}, title={Maya: Using formal control to obfuscate power side channels},
author={Pothukuchi, Raghavendra Pradyumna and Pothukuchi, Sweta Yamini and Voulgaris, Petros G and Schwing, Alexander and Torrellas, Josep}, author={Pothukuchi, Raghavendra Pradyumna and Pothukuchi, Sweta Yamini and Voulgaris, Petros G and Schwing, Alexander and Torrellas, Josep},
booktitle={2021 ACM/IEEE 48th Annual International Symposium on Computer Architecture (ISCA)}, booktitle={2021 ACM/IEEE 48th Annual International Symposium on Computer Architecture (ISCA)},

2
BPV/qrs/glossary.typ
View file

@ -120,4 +120,4 @@
} }
doc doc
} }

19
BPV/qrs/main.typ
View file

@ -2,6 +2,7 @@
#import "tablex.typ": tablex, hlinex, vlinex, colspanx, rowspanx #import "tablex.typ": tablex, hlinex, vlinex, colspanx, rowspanx
#let acronyms = ( #let acronyms = (
"IoT": "Internet of Things",
"BPV": "Boot Process Verifier", "BPV": "Boot Process Verifier",
"IDS": "Intrusion Detection System", "IDS": "Intrusion Detection System",
"SVM": "Support Vector Machine", "SVM": "Support Vector Machine",
@ -93,6 +94,7 @@
email: "sfischme@uwaterloo.ca", email: "sfischme@uwaterloo.ca",
), ),
), ),
anon: true,
index-terms: (), index-terms: (),
bibliography-file: "bibli.bib", bibliography-file: "bibli.bib",
) )
@ -119,7 +121,7 @@
= Introduction = Introduction
The firmware of any embedded system is susceptible to attacks. Since firmware provides many security features, it is always of major interest to attackers. The firmware of any embedded system is susceptible to attacks. Since firmware provides many security features, it is always of major interest to attackers.
Every year, a steady number of new vulnerabilities are discovered. Any device that requires firmware, such as computers @185175, @PLC @BASNIGHT201376, or IoT devices @rieck2016attacks, is vulnerable to these attacks. Every year, a steady number of new vulnerabilities are discovered. Any device that requires firmware, such as computers @185175, @PLC @BASNIGHT201376, or @IoT devices @rieck2016attacks, is vulnerable to these attacks.
There are multiple ways to leverage a firmware attack. Reverting firmware to an older version allows an attacker to reopen discovered and documented flaws. There are multiple ways to leverage a firmware attack. Reverting firmware to an older version allows an attacker to reopen discovered and documented flaws.
Cancelling an update can ensure that previously deployed attacks remain available. Finally, implementing custom firmware enables full access to the machine. Cancelling an update can ensure that previously deployed attacks remain available. Finally, implementing custom firmware enables full access to the machine.
@ -136,7 +138,7 @@ An attacker that could avoid triggering a verification, tamper with the verifica
// This idea of necessary independence between the target and the @IDS can be summarized in the following statement.\ // This idea of necessary independence between the target and the @IDS can be summarized in the following statement.\
// #align(center,text(weight: "bold", [An @IDS is incoherent if its deployment requires the cooperation of the entity it pretends to protect.])) // #align(center,text(weight: "bold", [An @IDS is incoherent if its deployment requires the cooperation of the entity it pretends to protect.]))
@IDS are subjected to a trade-off between having access to relevant and meaningful information and keeping the detection mechanism separated from the target machine. @IDS are subject to a trade-off between having access to relevant and meaningful information and keeping the detection mechanism separated from the target machine.
Our solution addresses this trade-off by leveraging side-channel information. Our solution addresses this trade-off by leveraging side-channel information.
== Contributions == Contributions
@ -156,8 +158,8 @@ Finally, the paper finishes with @discussion that provides more insight on speci
= Related Work = Related Work
Historically, the firmware was written on a @ROM, and it was impossible to change. Historically, the firmware was written on a @ROM, and it impossible to change.
With the growing complexity of embedded systems, manufacturers developed procedures to allow remote firmware upgrades. With the growing complexity of embedded systems, manufacturers developed procedures to enable remote firmware upgrades.
Firmware upgrades can address performances or security flaws or, less frequently, add features. Firmware upgrades can address performances or security flaws or, less frequently, add features.
Unfortunately, attackers can leverage these firmware upgrade mechanisms to implement unauthorized or malicious pieces of software in the machine. Unfortunately, attackers can leverage these firmware upgrade mechanisms to implement unauthorized or malicious pieces of software in the machine.
Almost all embedded systems are vulnerable to firmware attacks. Almost all embedded systems are vulnerable to firmware attacks.
@ -391,7 +393,7 @@ The changes are listed in @tab-machines.
#figure( #figure(
tablex( tablex(
columns: (25%,25%,25%,25%), columns: (25%,25%,25%,25%),
align: horizon, align: (left+horizon,right+horizon,right+horizon,right+horizon),
auto-vlines: false, auto-vlines: false,
repeat-header: false, repeat-header: false,
[*Device*], [*Original*], [*Change 1*], [*Change 2*], [*Device*], [*Original*], [*Change 1*], [*Change 2*],
@ -438,6 +440,7 @@ The results are presented in @tab-results.
tablex( tablex(
columns: (40%,40%), columns: (40%,40%),
auto-vlines: false, auto-vlines: false,
align: (left, right),
[*Machine*], [*BPV*], [*Machine*], [*BPV*],
[TP-Link switch], [0.87], [TP-Link switch], [0.87],
[HP switch], [0.98], [HP switch], [0.98],
@ -494,7 +497,7 @@ The experiment scenarios are:
#figure( #figure(
tablex( tablex(
auto-vlines: false, auto-vlines: false,
align: left, align: (left, right, right),
columns: (40%,auto,auto), columns: (40%,auto,auto),
[*Scenario*],[*Accuracy*], [*Nbr. of Samples*], [*Scenario*],[*Accuracy*], [*Nbr. of Samples*],
[Original],[1],[98], [Original],[1],[98],
@ -614,7 +617,9 @@ The training dataset is composed of 100 training traces and 100 evaluation races
The results are presented in @tab-aim The results are presented in @tab-aim
#figure( #figure(
table( tablex(
auto-vlines: false,
align: (left, right, right),
columns:(33%,33%,33%), columns:(33%,33%,33%),
[*Machine*], [*BPV*], [*AIM*], [*Machine*], [*BPV*], [*AIM*],
[HP-SWITCH],[$0.895 plus.minus 0.094$],[$0.657 plus.minus 0.394$], [HP-SWITCH],[$0.895 plus.minus 0.094$],[$0.657 plus.minus 0.394$],

1
BPV/qrs/tablex.typ
View file

@ -2522,4 +2522,3 @@
#let gridx(..options) = { #let gridx(..options) = {
tablex(auto-lines: false, ..options) tablex(auto-lines: false, ..options)
} }

83
BPV/qrs/template.typ
View file

@ -21,6 +21,7 @@
// department, organization, location, and email. Everything but // department, organization, location, and email. Everything but
// but the name is optional. // but the name is optional.
authors: (), authors: (),
anon: false,
// The paper's abstract. Can be omitted if you don't have one. // The paper's abstract. Can be omitted if you don't have one.
abstract: none, abstract: none,
@ -81,7 +82,7 @@
1 1
} }
set text(10pt, weight: 400) set text(10pt, weight: "regular")
if it.level == 1 [ if it.level == 1 [
#show: smallcaps #show: smallcaps
#v(12pt, weak: true) #v(12pt, weak: true)
@ -107,59 +108,40 @@
// Start with names // Start with names
set align(center) set align(center)
let nbr_authors = authors.len() let nbr_authors = authors.len()
for (i,author) in authors.enumerate(){ if not anon{
if i+1 == nbr_authors{ for (i,author) in authors.enumerate(){
[#author.name\ ] if i+1 == nbr_authors{
}else{ [#author.name\ ]
[#author.name, ] }else{
[#author.name, ]
}
} }
} // Continue with affiliations
// Continue with affiliations for author in authors{
for author in authors{ if author.department+author.organization+author.location != ""{
if author.department+author.organization+author.location != ""{ [#author.department, #author.organization, #author.location\ ]
[#author.department, #author.organization, #author.location\ ] }
} }
} // Continue with the emails, same way as for authors
// Continue with the emails, same way as for authors for (i,author) in authors.enumerate(){
for (i,author) in authors.enumerate(){ if i+1 == nbr_authors{
if i+1 == nbr_authors{ [#author.email\ ]
[#author.email\ ] }else{
}else{ [#author.email, ]
[#author.email, ] }
} }
[\*Corresponding author]
}else{
[
\
\
\
\
]
} }
[\*Corresponding author]
set align(left) set align(left)
// Display the authors list.
//for i in range(calc.ceil(authors.len() / 3)) {
// let end = calc.min((i + 1) * 3, authors.len())
// let is-last = authors.len() == end
// let slice = authors.slice(i * 3, end)
// grid(
// columns: slice.len() * (1fr,),
// gutter: 12pt,
// ..slice.map(author => align(center, {
// text(12pt, author.name)
// if "department" in author [
// \ #emph(author.department)
// ]
// if "organization" in author [
// \ #emph(author.organization)
// ]
// if "location" in author [
// \ #author.location
// ]
// if "email" in author [
// \ #link("mailto:" + author.email)
// ]
// }))
// )
// if not is-last {
// v(16pt, weak: true)
// }
//}
v(40pt, weak: true) v(40pt, weak: true)
// Start two column mode and configure paragraph properties. // Start two column mode and configure paragraph properties.
@ -169,7 +151,7 @@
// Display abstract and index terms. // Display abstract and index terms.
if abstract != none [ if abstract != none [
#set text(weight: "regular") //#set text(weight: "regular")
#h(1em) _Abstract_---#abstract #h(1em) _Abstract_---#abstract
#if index-terms != () [ #if index-terms != () [
@ -187,4 +169,3 @@
bibliography(bibliography-file, title: text(10pt)[References], style: "ieee") bibliography(bibliography-file, title: text(10pt)[References], style: "ieee")
} }
} }

2
BPV/qrs/utils.typ
View file

@ -28,7 +28,7 @@
} }
#let reset-all-acronyms() = { #let reset-all-acronyms() = {
// Reset all acronyms. They will all be expanded on next use. // Reset all acronyms. They will all be expanded on the next use.
for term in acronyms.keys() { for term in acronyms.keys() {
state("acronym-state-" + term, false).update(false) state("acronym-state-" + term, false).update(false)
} }