Cameras are crucial sensors for autonomous vehicles. They capture images that are essential for many safety-critical tasks. To process these images, a complex pipeline with multiple layers is used. Security attacks on this pipeline can severely affect passenger safety and system performance. However, many attacks presented in scientific literature overlook the fact that there are different layers and, hence, the feasibility and impact of these attacks can vary. While there has been research to improve the quality and robustness of the image processing pipeline, these efforts are often orthogonal to security research without exploiting potential overlap and synergies. In this work, we aim to bridge this gap by combining security and robustness research for the image processing pipeline in autonomous vehicles. We thoroughly investigated the body of literature on the security and robustness of the image processing pipeline and selected 92 papers for deeper discussion in this SoK. For the security domain, we classify the risk of attacks using the automotive security standard ISO 21434, emphasizing the need to consider all layers for overall system security. With our online tool TARA-CAM, we propose an interactive method to perform threat analysis and risk assessment following the ISO standard. We also demonstrate how existing robustness research can help mitigate the impact of attacks, addressing the current research gap. Finally, we present PICT, an embedded open-source testbed that can influence various parameters across all layers, allowing researchers to analyze the effects of different defense strategies and attack impacts. With this SoK, we contribute a comprehensive discussion and systematic analysis of existing approaches to image processing pipeline security and robustness, together with an open-source tool and testbed that jointly facilitates hardening the image processing pipeline against existing and future security attacks.
Due to their large popularity, Android smartphones are often targeted by malware attacks. Several strategies exist to detect malware code. However, we show that they are insufficient when dealing with obfuscation techniques. DroidHunter is our novel method for detecting Android malwares. DroidHunter leverages opcodes and their parameters, transforming those into RGB images and specific encoding techniques. The generated images are then used to train two different classification models based on support vector machines, convolutional neural networks, and a vision-based transformer. We evaluate DroidHunter on several datasets with up to 476,937 APKs from multiple sources. With detection rates from 98.65% to 99.94%, DroidHunter overcomes nine state-of-the-art malware detection techniques, including Drebin, MaMadroid, DexRay. Moreover, DroidHunter demonstrates strong resilience against hidden malware with detection rates up to 98.98%, and shows robustness on newly emerging threats, achieving an AUT of 0.89 on recent malware samples.
Post-Quantum Cryptography (PQC) algorithms should remain secure even in the presence of quantum computers. Although the security of such schemes is guaranteed at the algorithmic level, real-world implementations often suffer from other vulnerabilities like Side-Channel Analysis (SCA) attacks. This Systematization of Knowledge (SoK) paper investigates SCA attacks targeting implementations of PQC algorithms. This work categorizes attacks from an adversarial perspective to identify the most vulnerable components of the algorithms' implementations and highlights unexplored parts in current implementations. In addition, it reviews and analyzes the efficiency and efficacy of existing countermeasures to SCA attacks in current hardware implementations. This approach helps identify countermeasures that provide broader protection and highlights characteristics needed for future secure implementations. Our findings offer guidance in strengthening existing systems and developing more efficient defenses against side-channel attacks.
In response to increasing social engineering attacks, Unified Payments Interface (UPI) apps have implemented a variety of nudges to deter users from responding to fraudulent payment requests. We conducted a scenario-based semi-structured interview study with 46 Indian participants who tested the impact of various user interface nudges to help them discern a mixture of fraudulent and non-fraudulent payment scenarios. Our study revealed a multi-stage decision-making process: participants relied on a digital literacy and security concern-based risk assessment, which is further influenced by their trust in the recipient as well as the perceived need of the financial transaction. Our results demonstrate that while most nudges help to combat fraudulent transactions, participants perceived "badges" (a nudge signaling the trustworthiness of the receiver) to be most effective in combating fraud. We conclude with concrete recommendations for current and future UPI developers.
REST APIs serve as the core interface of modern distributed systems, where operations are highly interconnected and depend on one another. Many severe vulnerabilities arise from hidden dependencies across multiple API operations, making accurate dependency modeling essential for effective testing. Existing approaches rely on basic producer-consumer relationships or simple parameter matching, which introduce false dependencies, cause inefficient exploration, or miss implicit relationships. To address these limitations, we propose a context-aware behavior modeling approach for security testing of RESTful services. Our approach refines dependencies using contextual parameter matching that incorporates path-level and hierarchical semantics prior to exploration, and introduces tentative dependency edges to model and validate uncertain relationships through runtime feedback. Integrated with a multi-agent reinforcement learning-based testing framework, the proposed method generates more relevant and valid and mutated multi-step test sequences, enabling deeper API state exploration and more effective security testing under the same testing budget.
