The internet has become a primary source of health information for many people. For example, the websites of many medical condition support associations, meant for people suffering from various medical conditions, contain information on different medical conditions, treatments, and general health advice. However, accessing such information can be a serious privacy threat for the end user. In this article, we study the privacy of the websites of 18 Finnish medical condition support associations. The websites were analyzed to find leakages of sensitive personal data to third parties. Our investigation concludes that 88.9% of the websites leaked potentially sensitive personal data to third parties, usually private corporations offering web analytics tools such as Google Analytics. Furthermore, we discovered that users are not adequately informed about these data processing activities. We suggest several measures to alleviate third-party data leaks on websites handling sensitive personal data.
The COVID-19 pandemic has underscored the interconnectedness of critical infrastructure systems and their profound impact on marginalized communities. This study investigates the cascading effects of reduced mobility and infrastructure disruptions caused by COVID-19 response strategies on marginalized households across three diverse urban settings: Dortmund, São Paulo, and Cape Town. Employing a criticality assessment, we examine disruptions in healthcare, food and nutrition, social work, education, and childcare sectors, highlighting interdependencies and their implications for marginalized communities. Our findings reveal that disruptions in one sector, such as public transportation, can trigger adverse consequences across interconnected systems, amplifying vulnerabilities and exacerbating social inequalities. Furthermore, limited digital accessibility compounds these challenges, particularly for marginalized groups who may lack access to necessary technologies or digital literacy skills. Addressing these disparities in digital access is crucial for ensuring equitable access to essential services and support networks, especially in times of crisis. The study underscores the importance of mobility and accessibility in addressing systemic vulnerabilities and advocates for comprehensive resilience strategies that prioritize the needs of marginalized communities. Recommendations for policymakers, urban planners, and community stakeholders are provided to enhance infrastructure resilience and mitigate the indirect effects of disruptions on marginalized groups. The study contributes to a deeper understanding of cascading effects within critical infrastructure networks and informs future research and policy initiatives aimed at building resilient communities in an interconnected world.
With the rapid development of blockchain technology and smart contracts, the security issues of smart contracts have become increasingly serious. To address the significant limitations of traditional detection methods in handling the complexity and scale of smart contracts, a new framework for smart contract vulnerability detection that combines a vector database and a generative pre-trained transformer (GPT) model — VulnScan GPT — has been proposed. This framework comprises three main components: function signature extraction, vector database storage and retrieval, and GPT-based vulnerability detection. The framework uses the solc tool to generate an abstract syntax tree from smart contracts, extract function signatures, and vectorize the code for storage. By integrating the GPT model, the framework can preliminarily analyze and filter key functions based on common vulnerability scenarios and then retrieve relevant implementations from the vector database for in-depth assessment. This method gradually optimizes function analysis through an iterative detection mechanism, leveraging the efficient storage and retrieval capabilities of the vector database, combined with the deep natural language processing abilities of the GPT model, enhancing the accuracy and comprehensiveness of vulnerability detection. In the experimental evaluation, tests were conducted on various datasets to detect automated market maker price manipulation and initial risk deposit vulnerabilities, demonstrating that VulnScan GPT not only improves the accuracy of vulnerability detection, but also significantly reduces operational costs by optimizing token usage, resulting in an efficient and cost-effective detection solution.
With the widespread use of connected surveillance systems using IP cameras, the security of video data has become a critical issue. In response to the potential compromise of sensitive information via covert channels, the United States and the United Kingdom warned against the use of suspicious cameras in critical infrastructure. To mitigate the security concerns, it is indispensable to investigate every component inside IP cameras using evaluation and validation programs such as Common Criteria and Cryptographic Module Validation Program. However, such compliance tests on implementation under test cannot suffice to prevent the products from malicious attacks using a Trojan-horse in a black-box component, particularly inserted in the image-sensing module or the random number generator (RNG). In this paper, we categorize potential vulnerabilities and argue that IP cameras should disclose the components of the modules to mitigate the threats of backdoor. Based on this, we provide a way to construct backdoor-free RNG. To remove the possibility of the backdoor inside the RNG, we extract randomness from optical black pixels of the image sensor and apply two entropy accumulation methods to guarantee the min-entropy of accumulated data under weak assumptions, which means the IP camera already has a hardware entropy source in itself without additional suspicious entropy source. In the experiment using an IP camera with a Cortex-A53 processor, we can harvest entropy at the rate of 7.3kbps. The operating speed of the RNG is sufficient to provide random bits without delay when a symmetric key is updated every minute.
How to securely manage and use private keys of digital signature schemes is a pivotal problem for blockchain-based decentralized applications (DApps), as they determine the ownership of data contents and digital assets. A well-recognized approach for key management is threshold cryptography which distributes private keys to different nodes such that the whole system can tolerate a certain number of failures or corruptions. Motivated by the key management need of DApps, threshold signature has attracted widespread attention, with a number of new constructions being proposed in recent years. However, a practical one for DApps' end users is still lacking, as existing schemes are hard to deploy due to the high cost of communication and distributed features. In this paper, we combine $$ (2, 3) $$ -threshold signature with the widely deployed cloud-edge-end (CEE) paradigm. We first propose the CEE key management framework which involves an end node, an edge node and a cloud node maintaining $$ (2, 3) $$ shares of end users' private keys. Then, following the framework, we construct a $$ (2, 3) $$ -threshold elliptic curve digital signature algorithm (ECDSA) scheme with provable security based on the ECDSA assumption. Compared with representative constructions of generalized threshold ECDSA, the new scheme is easy to deploy in applications developed following the CEE framework. Additionally, it addresses share tampering and requires only three messages for distributively issuing a signature, which is lower than the best practice of $$ (2, 2) $$ -threshold ECDSA (four messages) that cannot tolerate tampering.
