grizzly/deneir
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

review

Browse source
This commit is contained in:
Arthur Grisel-Davy 2023-06-26 17:34:28 -04:00
parent e2cc4ecfec
commit 56021ab305
6 changed files with 50 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

10
BPV/qrs/bibli.bib
View file

@ -31,11 +31,11 @@ primaryClass={cs.CR}
@inproceedings {185175,
author = {Jacob Maskiewicz and Benjamin Ellis and James Mouradian and Hovav Shacham},
title = {Mouse Trap: Exploiting Firmware Updates in {USB} Peripherals},
booktitle = {8th {USENIX} Workshop on Offensive Technologies ({WOOT} 14)},
booktitle = {8th USENIX Workshop on Offensive Technologies ({WOOT} 14)},
year = {2014},
address = {San Diego, CA},
url = {https://www.usenix.org/conference/woot14/workshop-program/presentation/maskiewicz},
publisher = {{USENIX} Association},
publisher = {USENIX Association},
month = aug,
}
@ -525,15 +525,11 @@ series = {IoTPTS '16}
@inproceedings{michalevsky2015powerspy,
title={Powerspy: Location tracking using mobile device power analysis},
author={Michalevsky, Yan and Schulman, Aaron and Veerapandian, Gunaa Arumugam and Boneh, Dan and Nakibly, Gabi},
booktitle={24th $\{$USENIX$\}$ Security Symposium ($\{$USENIX$\}$ Security 15)},
booktitle={24th USENIX Security Symposium (USENIX Security 15)},
pages={785--800},
year={2015}
}
@INPROCEEDINGS{4531926,
author={Nilsson, D. K. and Larson, U. E.},

19
BPV/qrs/main.typ
View file

@ -2,6 +2,7 @@
#import "tablex.typ": tablex, hlinex, vlinex, colspanx, rowspanx
#let acronyms = (
"IoT": "Internet of Things",
"BPV": "Boot Process Verifier",
"IDS": "Intrusion Detection System",
"SVM": "Support Vector Machine",
@ -93,6 +94,7 @@
email: "sfischme@uwaterloo.ca",
),
),
anon: true,
index-terms: (),
bibliography-file: "bibli.bib",
)
@ -119,7 +121,7 @@
= Introduction
The firmware of any embedded system is susceptible to attacks. Since firmware provides many security features, it is always of major interest to attackers.
Every year, a steady number of new vulnerabilities are discovered. Any device that requires firmware, such as computers @185175, @PLC @BASNIGHT201376, or IoT devices @rieck2016attacks, is vulnerable to these attacks.
Every year, a steady number of new vulnerabilities are discovered. Any device that requires firmware, such as computers @185175, @PLC @BASNIGHT201376, or @IoT devices @rieck2016attacks, is vulnerable to these attacks.
There are multiple ways to leverage a firmware attack. Reverting firmware to an older version allows an attacker to reopen discovered and documented flaws.
Cancelling an update can ensure that previously deployed attacks remain available. Finally, implementing custom firmware enables full access to the machine.
@ -136,7 +138,7 @@ An attacker that could avoid triggering a verification, tamper with the verifica
// This idea of necessary independence between the target and the @IDS can be summarized in the following statement.\
// #align(center,text(weight: "bold", [An @IDS is incoherent if its deployment requires the cooperation of the entity it pretends to protect.]))
@IDS are subjected to a trade-off between having access to relevant and meaningful information and keeping the detection mechanism separated from the target machine.
@IDS are subject to a trade-off between having access to relevant and meaningful information and keeping the detection mechanism separated from the target machine.
Our solution addresses this trade-off by leveraging side-channel information.
== Contributions
@ -156,8 +158,8 @@ Finally, the paper finishes with @discussion that provides more insight on speci
= Related Work
Historically, the firmware was written on a @ROM, and it was impossible to change.
With the growing complexity of embedded systems, manufacturers developed procedures to allow remote firmware upgrades.
Historically, the firmware was written on a @ROM, and it impossible to change.
With the growing complexity of embedded systems, manufacturers developed procedures to enable remote firmware upgrades.
Firmware upgrades can address performances or security flaws or, less frequently, add features.
Unfortunately, attackers can leverage these firmware upgrade mechanisms to implement unauthorized or malicious pieces of software in the machine.
Almost all embedded systems are vulnerable to firmware attacks.
@ -391,7 +393,7 @@ The changes are listed in @tab-machines.
#figure(
tablex(
columns: (25%,25%,25%,25%),
align: horizon,
align: (left+horizon,right+horizon,right+horizon,right+horizon),
auto-vlines: false,
repeat-header: false,
[*Device*], [*Original*], [*Change 1*], [*Change 2*],
@ -438,6 +440,7 @@ The results are presented in @tab-results.
tablex(
columns: (40%,40%),
auto-vlines: false,
align: (left, right),
[*Machine*], [*BPV*],
[TP-Link switch], [0.87],
[HP switch], [0.98],
@ -494,7 +497,7 @@ The experiment scenarios are:
#figure(
tablex(
auto-vlines: false,
align: left,
align: (left, right, right),
columns: (40%,auto,auto),
[*Scenario*],[*Accuracy*], [*Nbr. of Samples*],
[Original],[1],[98],
@ -614,7 +617,9 @@ The training dataset is composed of 100 training traces and 100 evaluation races
The results are presented in @tab-aim
#figure(
table(
tablex(
auto-vlines: false,
align: (left, right, right),
columns:(33%,33%,33%),
[*Machine*], [*BPV*], [*AIM*],
[HP-SWITCH],[$0.895 plus.minus 0.094$],[$0.657 plus.minus 0.394$],

1
BPV/qrs/tablex.typ
View file

@ -2522,4 +2522,3 @@
#let gridx(..options) = {
tablex(auto-lines: false, ..options)
}

47
BPV/qrs/template.typ
View file

@ -21,6 +21,7 @@
// department, organization, location, and email. Everything but
// but the name is optional.
authors: (),
anon: false,
// The paper's abstract. Can be omitted if you don't have one.
abstract: none,
@ -81,7 +82,7 @@
1
}
set text(10pt, weight: 400)
set text(10pt, weight: "regular")
if it.level == 1 [
#show: smallcaps
#v(12pt, weak: true)
@ -107,6 +108,7 @@
// Start with names
set align(center)
let nbr_authors = authors.len()
if not anon{
for (i,author) in authors.enumerate(){
if i+1 == nbr_authors{
[#author.name\ ]
@ -129,37 +131,17 @@
}
}
[\*Corresponding author]
}else{
[
\
\
\
\
]
}
set align(left)
// Display the authors list.
//for i in range(calc.ceil(authors.len() / 3)) {
// let end = calc.min((i + 1) * 3, authors.len())
// let is-last = authors.len() == end
// let slice = authors.slice(i * 3, end)
// grid(
// columns: slice.len() * (1fr,),
// gutter: 12pt,
// ..slice.map(author => align(center, {
// text(12pt, author.name)
// if "department" in author [
// \ #emph(author.department)
// ]
// if "organization" in author [
// \ #emph(author.organization)
// ]
// if "location" in author [
// \ #author.location
// ]
// if "email" in author [
// \ #link("mailto:" + author.email)
// ]
// }))
// )
// if not is-last {
// v(16pt, weak: true)
// }
//}
v(40pt, weak: true)
// Start two column mode and configure paragraph properties.
@ -169,7 +151,7 @@
// Display abstract and index terms.
if abstract != none [
#set text(weight: "regular")
//#set text(weight: "regular")
#h(1em) _Abstract_---#abstract
#if index-terms != () [
@ -187,4 +169,3 @@
bibliography(bibliography-file, title: text(10pt)[References], style: "ieee")
}
}

2
BPV/qrs/utils.typ
View file

@ -28,7 +28,7 @@
}
#let reset-all-acronyms() = {
// Reset all acronyms. They will all be expanded on next use.
// Reset all acronyms. They will all be expanded on the next use.
for term in acronyms.keys() {
state("acronym-state-" + term, false).update(false)
}