Honeypots aid cyber defense but traditional designs demand heavy manual setup and support few protocols. We introduce OHRA, a modular, extensible LLM-driven honeypot that supports multiple protocols (SSH, Telnet, HTTP, FTP, SMTP, SNMP, IPP) and can integrate different LLM providers. OHRA wraps the model with session memory and prompt control to generate realistic, context-aware responses with less configuration effort. We evaluate OHRA against Cowrie and a recent LLM-based honeypot using curated malware commands and a real-world Internet deployment. OHRA is among the first honeypots to demonstrate a unified LLM-based architecture across several protocols: SSH, Telnet, and HTTP are fully interactive, while FTP, SMTP, IPP, and SNMP are currently implemented in partial form. Results show higher response realism, improved session handling, and greater deceptiveness in comparison to prior systems. This work lays the groundwork for scalable and adaptive multi-protocol deception platforms.
In this paper, we present a methodology for performing thorough analysis of TLS protocol implementations using dynamic symbolic execution. This method explores all possible inputs by treating entire messages as symbolic using KLEE. We are able to analyse the message parsing logic in detail, showing fulfilment of requirements from the protocol specification. This has previously not been performed for whole messages in complex protocols such as TLS. We tackle several problems that cause state space explosion by providing appropriate abstractions of implementation primitives. Additionally, we explore how protocol design choices impact the feasibility of analysis and argue for a strict TLS specification. We have applied our method to the ServerHello message parsing in several versions of the WolfSSL TLS 1.3 implementation. Our analysis revealed two vulnerabilities in the client implementation which were both assigned CVEs, one of them marked as high severity.
The privacy community has invested considerable effort in understanding why motivated individuals do not adopt available solutions. As a result, several factors supporting individuals in adopting Privacy Enhancing Technologies (PETs) have been revealed. However, the adoption rate remains low. To contribute in changing this current state, we adopt an unexplored approach by analysing 69 online websites promoting four selected PETs: Virtual Private Network (VPN), Tor, private browser, and private search engine. In addition to considering the accessibility of these websites, we consider a set of 24 selected criteria grounded in the factors identified in the literature as supporting individuals in adopting PETs. These criteria aim to explore the presentation of PETs to individuals. For example, we consider the presentation of aspects of PET technology, such as coverage, limitations, and speed. Our results show that, on average, only about one-third of our criteria set are fulfilled by the analysed websites. Furthermore, our accessibility audit reveals issues that could create significant obstacles for impaired users. As a result, these websites miss their primary goal of effectively informing individuals about PETs by not utilising the identified supporting factors. These results indicate that individuals are left alone in making privacy choices and do not have sufficient support for adopting PETs. To address this situation, we propose two design templates incorporating supporting factors, offering a foundation for presenting PETs to individuals to assist them in adoption.
In today's digital world, passwords are the keys that unlock our online lives, keeping our social media, financial accounts, and streaming services secure. However, creating strong passwords that are easy to remember is hard. Often an individual's language and cultural background influence password creation, which an attacker can exploit. This paper examines the importance of the User Context Bias (UCB) on Swedish passwords, versus international passwords stemming from multiple languages and cultures. This is done by employing four different password-cracking tools; Probabilistic Context Free Grammar (PCFG), Ordered Markov Enumerator (OMEN), Odinn, and Hashcat. The findings reveal that all the tools are able to crack a higher percentage of passwords when attacking those created by Swedish natives compared to their international counterparts. PCFG, in particular, is nearly twice as effective as the other tools against Swedish passwords after just 10,000 guesses, while OMEN is the best against Swedish passwords after 5 million guesses.
In the past years, Unmanned Aerial Vehicles (UAVs), commonly known as drones, have drawn attention for commercial, military and private use and thus emerged as a significant source of digital evidence. As of today both the research community and commercial software manufacturer focus on UAV mainstream brands such as DJI, which holds a market share of roughly 80% of the civil market. On the other side Do-It-Yourself (DIY) drones are well suited for unconventional and illegal activities due to their technical capabilities and the legal limitations of commercial drones. However, the community currently lacks research of the examination of DIY drones. In this paper we address this research gap by conducting a comprehensive case study of a sample DIY drone. Our case study comprises both the assembly and the digital forensic perspective of DIY drones. Our systematic digital forensic examination within our case study follows the well-known process steps, i.e. preparation, acquisition, analysis. We provide insights into the peculiarities of each step and reveal that the identification of the hardware components and the corresponding examination is the most critical step.
