Sanghyun Ahn, University of Seoul Amir H. Alavi, University of Missouri Ladjel Bellatreche, LIAS/ENSMA Athman Bouguettaya, The University of Sydney Stephane Bressan, National University of Singapore K. Selcuk Candan, Arizona State University Tru Cao, Ho Chi Minh City University of Technology Songcan Chen, Nanjing University of Aeronautics & Astronautics Hong Chen, Renmin University of China Heeryon Cho, Kookmin University Soo-Mi Choi, Sejong University Mi-Jung Choi, Kangwon National University Hoon Choi, Chungnam National University Jaegul Choo, Korea University Soon Ae Chun, City University of New York Shifei Ding, China University of Mining and Technology Gill Dobbie, The University of Auckland Koji Eguchi, Hiroshima University Sameh Elnikety, Microsoft Young Ik Eom, Sungkyunkwan University Sergio Flesca, University of Calabria Zhipeng Gao, Beijing University of Posts and Telecommunications Wei Gao, Nanjing University Hong Gao, Harbin Institute of Technology Xin Geng, Southeast University Chen Gong, Shanghai Jiao Tong University Hyoil Han, Illinois State University Kenji Hatano, Doshisha University Kazumasa Horie, University of Tsukuba Wen Hua, The University of Queensland Seung-Won Hwang, Yonsei University Eenjun Hwang, Korea University Hyeonseung Im, Kangwon National University Md. Saiful Islam, Griffith University Young-Seob Jeong, SoonChunHyang University Seong-Ho Jeong, Hankuk University of Foreign Studies Xiaolong Jin, Chinese Academy of Sciences
Air-gapped computers are hermetically isolated from the Internet to eliminate any means of information leakage. In this paper we present HOTSPOT - a new type of airgap crossing technique. Signals can be sent secretly from air-gapped computers to nearby smartphones and then on to the Internet - in the form of thermal pings. The thermal signals are generated by the CPUs and GPUs and intercepted by a nearby smartphone. We examine this covert channel and discuss other work in the field of air-gap covert communication channels. We present technical background and describe thermal sensing in modern smartphones. We implement a transmitter on the computer side and a receiver Android App on the smartphone side, and discuss the implementation details. We evaluate the covert channel and tested it in a typical work place. Our results show that it possible to send covert signals from air-gapped PCs to the attacker on the Internet through the thermal pings. We also propose countermeasures for this type of covert channel which has thus far been overlooked.
These keynotes discusses the following: Cyber Training Activities of the European Security and Defence College, Understanding Firmware Forensics using the Trusted Platform Module, AI: Trustworthy or Not on Software Security?, A Glimpse of 5G Security: Challenges and Opportunities, Upcoming Global Initiative Report.
The temptation to influence and sway public opinion most certainly increases with the growth of open online forums where anyone anonymously can express their views and opinions. Since online review sites are a popular venue for opinion influencing attacks, there is a need to automatically identify deceptive posts. The main focus of this work is on automatic identification of deceptive reviews, both positive and negative biased. With this objective, we build a deceptive review SVM based classification model and explore the performance impact of using different feature types (TF-IDF, word2vec, PCFG). Moreover, we study the transferability of trained classification models applied to review data sets of other types of products, and, the classifier robustness, i.e., the accuracy impact, against attacks by stylometry obfuscation trough machine translation. Our findings show that i) we achieve an accuracy of over 90% using different feature types, ii) the trained classification models do not perform well when applied on other data sets containing reviews of different products, and iii) machine translation only slightly impacts the results and can not be used as a viable attack method.
Onboarding of new customers is a sensitive task for various services, like Banks who have to follow the Know Your Customer (KYC) rules. Mobile Onboarding Applications or KYC by Streaming are expanding rapidly to provide this capacity at home. Unfortunately, this leaves the authentication tools in the hand of end-users, allowing the attacker to directly tamper the video stream. With the rise of new digital face manipulation technologies, traditional face spoofing attacks such as presentation attacks or replay attacks should not be the only one to be considered. A new kind of face spoofing attacks (i.e. digital face spoofing) needs to be studied carefully. In this paper, we analyze those new kinds of attacks and propose a method to secure identity documents against both the traditional attacks and the new ones.
