Virtual machine emulation environments provide ideal testbeds for cybersecurity evaluations because they run real software binaries in a scalable, offline test setting that is suitable for assessing the impacts of software security flaws on the system. Verification of such emulations determines whether the environment is working as intended. Verification can focus on various aspects such as timing realism, traffic realism, and resource realism. In this paper, we study resource realism and issues associated with virtual machine resource utilization. We examine telemetry metrics gathered from a series of structured experiments which involve large numbers of parallel emulations meant to oversubscribe resources at some point. We present an approach to use telemetry metrics for emulation verification, and we demonstrate this approach on two cyber scenarios. Descriptions of the experimental configurations are provided along with a detailed discussion of statistical tests used to compare telemetry metrics. Results demonstrate the potential for a structured experimental framework, combined with statistical analysis of telemetry metrics, to support emulation verification. We conclude with comments on generalizability and potential future work.
In 2016, the Cyber Grand Challenge (CGC) provided key foundations and motivations for navigating towards an autonomous cybersecurity approach. Since that time, novel strides have been made in the areas of static analysis, vulnerability discovery, patching, and exploit generation. However, a majority of these efforts have been focused on enterprise systems, leaving a gap in the Cyber-Physical System (CPS) domain. With the rise of connected infrastructure and the introduction of 5G communications, CPS are becoming more ingrained within present-day society. Due to a large amount of legacy software, and control of safety-critical actuation, CPS are and will continue to be a huge attack vector for our adversaries to remotely deploy devastating attacks against our country with low economic cost and at scale. To combat this threat, we propose the need to apply the most beneficial concepts from the CGC to create more secure and resilient CPS. In this paper, we introduce a CPS security assessment architecture RUCKUS for autonomously identifying and analyzing CPS firmware, identifying vulnerabilities, and developing exploits. Further, our approach considers how to integrate graph analytics to extrapolate findings to firmware at scale, allowing for measuring the potential widespread impact of attacks. Our architecture is demonstrated using an automotive case study, leveraging firmware from the most popular automotive and router manufacturers to assess the real-world potential impact of CPS attacks.
We proposed a novel risk assessment approach for quantifying the security risk of lateral movement attacks, in which the attack propagation is modeled as an uncertain graph and the attack impact is a function of the set of compromised devices. We discussed several risk-based security metrics, including the expected loss, survival function, and conditional expectation - the last two measure the low-probability but high-impact events in the right tail of the loss distribution. The model is illustrated with a simple example and several directions for further research are discussed.
In this paper, we propose a new approach to neutralize attacks that tamper with critical program data. Our technique uses a sequence of instructions as a trap against the illicit modification of the critical data. In a nutshell, we set up a dependency such that the continued execution of the program is contingent upon the successful execution of the instruction sequence and the successful execution of the instruction sequence is contingent upon the integrity of the critical data. In particular, we discuss a specific implementation of our technique focusing on a critical data that is often subject to malicious manipulation: the return address of a function. We show that our technique can be an effective countermeasure to defend against attacks that overwrite the return address to divert control to a malicious code. We further show that our technique offers significant protection without resorting to complementary defenses such as ASLR, DEP or StackGuard.
The time-critical nature of medical emergencies, the requirements for system availability, and for real-time communication all make it exceedingly challenging to consistently enforce least-privilege access during medical emergencies (Break the Glass situations). Strict access control has to be suspended (must fail-open) when an emergency is declared, and only after the emergency has passed can a post-hoc audit be performed to determine the reasons (legitimacy) for overriding access control - standard operating procedure for healthcare facilities. Unfortunately, this does not proactively protect against misuse, but provides for identification and punishment of culprits. It is therefore essentially impossible to limit clinicians access to bare minimum permissions to perform life-saving activities during emergency access, especially in distributed medical systems. In this work we investigate the effectiveness of anomaly detection to ease the human burden of post-hoc audits in the medical Break-the-Glass (BTG) context. We use two different prediction models to perform real-time and post-BTG statistical analysis on time-series session log data for flagging anomalous user sessions and actions. Our approach combines a real-time fast analysis engine working on a partial feature set, as well as a post-hoc, slower analysis tool which works with the complete times series data of everything which occurred during the entire time of the emergency.
