As the Internet evolves, the diversification of information dissemination has led to the growth of various social media platforms and an increase in abandoned blogs. These abandoned blogs, if not properly managed, present a significant security risk. In this study, we introduce “Zombified Blogs,” defined as blogs deserted by their administrators and targeted for continuous submissions of unsolicited malicious content. We explore the causes and effects of this global phenomenon on a large scale, using data from multiple blog services over the past 18 years for the first time. To this end, we propose an innovative method for the continuous identification and collection of Zombified Blogs using a search engine. We analyzed data spanning 18 years, encompassing approximately 1.5 million blog posts, including 258, 547 malicious posts, across 1,141 Zombified Blogs on six different blog services. Our findings show a significant rise in malicious posts, primarily social engineering attacks, over the past four years on previously active blogs. We identify the email posting function as a critical area exploited by attackers, leading to the unintended posting of content. Finally, we provide an overview of the current challenges facing blog services and administrators, and discuss potential content management solutions.

There is an expectation that users of home IoT devices will be able to secure those devices, but they may lack information about what they need to do. In February 2022, we launched a web service that scans users' IoT devices to determine how secure they are. The service aims to diagnose and remediate vulnerabilities and malware infections of IoT devices of Japanese users. This paper reports on findings from operating this service drawn from three studies: (1) the engagement of 114,747 users between February, 2022 - May, 2024; (2) a large-scale evaluation survey among service users (n=4,103), and; (3) an investigation and targeted survey (n=90) around the remediation actions of users of non-secure devices. During the operation, we notified 417 (0.36%) users that one or more of their devices were detected as vulnerable, and 171 (0.15%) users that one of their devices was infected with malware. The service found no issues for 99% of users. Still, 96% of all users evaluated the service positively, most often for it providing reassurance, being free of charge, and short diagnosis time. Of the 171 users with malware infections, 67 returned to the service later for a new check, with 59 showing improvement. Of the 417 users with vulnerable devices, 151 users revisited and re-diagnosed, where 75 showed improvement. We report on lessons learned, including a consideration of the capabilities that non-expert users will assume of a security scan.

Laser fault injection (LFI) is known as the most powerful fault attack due to its high precision and repeatability. Building sensor circuits on IC chips is one of the promising countermeasures to protect assets inside the IC chips from LFI. We focus on digital LFI sensors that can be built using only logic circuits. Digital LFI sensors indirectly monitor analog quantities such as voltage and temperature, which are perturbed by laser irradiation, via the signal delay ftuctuation, and it has the advantage that it's easy to design and calibrate since it's completely composed of digital circuits such as ring oscillators. While sensors are a promising approach to countermeasures, their evaluation against multiple fault injection is still immature. This paper proposes a disturbance concealment attack (DCA) on digital LFI sensors, which prevents digital LFI sensors from detecting attacks using a dual-spot laser. The DCA analogously cancels the signal delay disturbance of one LFI by using the second LFI. We experimentally demonstrated that the proposed attack reduces the laser detection rate of a digital LFI sensor to 26.6% and completely disables the sensor at some irradiation points. We also discuss the generality of the proposed method and its possible countermeasures.

Laser fault injection (LFI) refers to a serious attack that modifies programs and data in embedded systems by introducing specific errors into a device in operation. As a countermeasure, in addition to duplication and optical sensors, the detection of LFIs using a sensor composed of digital circuits has recently been proposed. However, the research on the physical layout of these sensors is limited. In this work, we profile the laser irradiation position and its effect on the surrounding circuits by laser-scanning experiments on field-programmable gate arrays (FPGAs). Studies have shown that digital sensors with conventional designs have low-sensitivity areas with regard to LFIs. To improve LFI detection in FPGAs, we propose a design method for digital sensors and apply it to a ring oscillator (RO)-based digital sensor and a time-to-digital converter-based sensor. Experimental results show that the RO-based sensor based on the proposed method increased the area detecting LFI to about twice that of the conventional method, and detect 99.8% of the effective faults at the target register under protection. Furthermore, we extend the application of the RO-based sensor based on the proposed method to the protection of cryptographic circuits. The results of the laser-scanning experiment show that the proposed sensor detected 98.3% of the LFIs that caused effective faults in the cryptographic circuit.

The increase in phishing attacks through email and short message service (SMS) has shown no signs of deceleration. The first thing we need to do to combat the ever-increasing number of phishing attacks is to collect and characterize more phishing cases that reach end users. Without understanding these characteristics, anti-phishing countermeasures cannot evolve. In this study, we propose an approach using Twitter as a new observation point to immediately collect and characterize phishing cases via e-mail and SMS that evade countermeasures and reach users. Specifically, we propose CrowdCanary, a system capable of structurally and accurately extracting phishing information (e.g., URLs and domains) from tweets about phishing by users who have actually discovered or encountered it. In our three months of live operation, CrowdCanary identified 35,432 phishing URLs out of 38,935 phishing reports. We confirmed that 31,960 (90.2%) of these phishing URLs were later detected by the anti-virus engine, demonstrating that CrowdCanary is superior to existing systems in both accuracy and volume of threat extraction. We also analyzed users who shared phishing threats by utilizing the extracted phishing URLs and categorized them into two distinct groups - namely, experts and non-experts. As a result, we found that CrowdCanary could collect information that is specifically included in non-expert reports, such as information shared only by the company brand name in the tweet, information about phishing attacks that we find only in the image of the tweet, and information about the landing page before the redirect. Furthermore, we conducted a detailed analysis of the collected information on phishing sites and discovered that certain biases exist in the domain names and hosting servers of phishing sites, revealing new characteristics useful for unknown phishing site detection.

In recent years, cyber attacks against infrastructure have become more serious. Unfortunately, infrastructures with vulnerable remote management devices, which allow attackers to control the infrastructure, have been reported. Targeted attacks against infrastructure are conducted manually by human attackers rather than automated scripts. Here, open questions are how often the attacks against such infrastructure happen and what attackers do after intrusions. In this empirical study, we observe the accesses, including attacks and security investigation activities, using the customized infrastructure honeypot. The proposed honeypot comprises (1) a platform that easily deploys real devices as honeypots, (2) a mechanism to increase the number of fictional facilities by changing the displayed facility names on the WebUI for each honeypot instance, (3) an interaction mechanism with visitors to infer their purpose, and (4) tracking mechanisms to identify visitors for long-term activities. We implemented and deployed the honeypot for 31 months. Our honeypot observed critical operations, such as changing configurations of a remote management device. We also observed long-term access to WebUI and Telnet service of the honeypot.

Many studies have discovered internet-facing systems exposing services that are vulnerable to attack. These are often assumed to be misconfigured systems that are not meant to expose these services to the network, especially not in an enterprise network. In this study, we clarify the causes of the presence of IoT devices exposing Telnet and FTP in a university enterprise network. This also helps us to understand who is responsible. We scanned the network and found 185 IoT devices consisting of 30 device models exposing Telnet and 49 models exposing FTP. We sent out a security notification and a survey to device owners. The survey demonstrated that 2 out of 21 and 8 out of 41 owners intentionally enabled Telnet and FTP, respectively, on all their devices. After receiving the notification, 38 out of 47 owners said they were willing to take measures on at least one of their IoT devices. All except one of the devices of these willing owners were successfully remediated. When we investigated the manuals of the devices, we were able to confirm that there was no disclosure whatsoever of the exposed service in 15 out of 30 manuals for models with Telnet and 10 out of 49 manuals for models with FTP. We also confirmed, by combining a survey of the manufacturers with the device manuals, that 22 out of 30 and 29 out of 49 devices enabled Telnet and FTP by default, respectively. From the above results, we conclude that the presence of misconfigured devices was less driven by human errors of the owners and more by the choices of the manufacturers. The majority of owners were motivated to remediate the security risks once made aware of them.

Ransomware attacks targeting Network Attached Storage (NAS) devices have occurred steadily in the threat landscape since 2019. Early research has analyzed the functionality of IoT ransomware binaries but failed to reveal its operation and attack infrastructure. In this paper, we propose an attack observation system named SPOT, which uses popular bare metal NAS devices, QNAP, as the honeypot and the malware sandbox to conduct an in-depth analysis of IoT ransomware attacks. During the six-month observation from September 2021 to March 2022, we observed on average, 130 hosts per day accessing from the Internet to compromise the NAS devices. Moreover, we executed 48 ransomware samples downloaded from VirusTotal in the SPOT sandbox. We identified seven remote Onion proxy servers used for C&C connection and successfully observed three samples infecting the NAS device to connect them to the C&C server behind the TOR network. The ransom notes gave two kinds of contact points; instruction web pages and email addresses. Though the email addresses were not reachable, we could access the instruction website. We kept monitoring the website and observed a “30% discount campaign” for ransom payments. We also interacted with the threat actor via online support chat on the website, but we were banned from the channel because we asked about their organization. We observe that the degree of automation in the attack operation is much higher compared to the carefully tailored and targeted ransomware attacks. While each case of successful ransom payment is limited to 0.03 BTC, the automated nature of the attacks would maximize the frequency of such successful cases.

In this study, we investigate black market job advertisements on social networking services (SNS) through cross-platform observation of popular SNSs. Our findings reveal that black market job recruitment often begins with SNS posts designed to attract victims. Once a victim contacts the attackers via direct message (DM) or their public SNS account, the application process for the black market job is initiated, or they are redirected to fraudulent websites where they may fall victim to money transfer scams. Additionally, our study explores the relationship between accounts that post black-market job advertisements and their activity patterns.

Given the increasing popularity of sandbox analysis, malware authors have adapted sandbox evasion functionalities into modern malware. In addition, attackers can create Customized Malware that hide their malicious payload until the identifier of the target-specific system can be verified. In this paper, we propose an attack scenario in which adversaries can leverage publicly available personally identifiable information present in the target system as specific identifiers. The proposed attack scenario can be used in targeted attacks, especially against hosts that store business email addresses on personal computers (PCs). We investigated a set of desktop applications and specified 18 popular applications that store email addresses in their related files or directories. We also implemented a survey tool to access these applications and record whether email addresses were found. We then asked nine laboratory members and staff if the target-specific email address was found and if we could extract the same email address from each PC with 16 applications. Finally, we implemented a dummy malware sample that searches for the target host's email address from the executing environment and denies unpacking the malicious payload if the mark does not exist. The experiment results demonstrate that two modern mal ware security appliances did not detect the prototype sample. To defend against the proposed attack, we discuss countermeasures from both the sandbox and user perspective. We contacted security vendors to allow them to prepare for such attacks and provided POC programs.

Modern in-vehicle networks may contain tens of Electronic Control Units (ECUs) connected over several Controller Area Network (CAN) buses. To protect vehicles from cyberattacks, researchers have proposed various security countermeasures, including intrusion detection systems (IDS). Because real clock sources are imperfect, ECUs transmit messages with a period slightly different from the ideal period. This difference is referred to as clock skew, and previous research suggests that IDS may detect anomalies when they observe that an ECU transmits periodic CAN messages with a different clock skew than expected. We argue that previously proposed approaches rely on an incomplete model and may yield inaccurate results when applied to a real vehicle. This is problematic for automotive technologies, which must be reliably deployed in millions of safety-critical systems. We propose an improved model for the fluctuations of CAN message timestamps and apply it to a real vehicle, where we are able to improve the accuracy of ECU clock skew estimations.

The menace of malicious websites, such as online scams or phishing, has exhibited a noteworthy surge. While URL-based blocklists are still used as the primary security solution, previous studies show that the range of protection provided by these lists has little overlap, and the demand to have a second opinion is growing. In this paper, we design a system that aggregates information from multiple security engines in VirusTotal and warns users with malicious URLs that a single antivirus product would dismiss. We introduce VT-SOS, a system utilizing VirusTotal to provide a Second Opinion. Using 47 days of web access logs of real users, we implemented VT-SOS and evaluated effectiveness, affordability, and usability. By simulation, we show that VT-SOS could warn more than 100 users/day and provide a second opinion for more than 30 URLs/day even under a tight budget. We compared VT-SOS with three popular security services and confirmed that it could cover a wider range of malicious websites than those services. By investigating the worst-case user with the most access and warning, we demonstrate that VT-SOS will not deeply affect user experience in practice.

This study focuses on the acceleration of cryptographic pairing operations on field-programmable gate arrays (FPGAs) for server-side applications. Previous studies on FPGA pairing implementations focused on area efficiency for embedded devices, trying to achieve maximum performance with minimal circuit resources. However, their architectures are likely to be inefficient for server-side applications, where the primary interest is maximum performance when FPGA resources are finished. Their architectures are inefficient for two reasons: low utilization of the digital signal processor (DSP) and low operation frequency. In this study, we propose a high-throughput pairing processor architecture for server-side FPGAs, taking full advantage of DSPs. First, we propose a loop-unrolled modular multiplication algorithm that is suitable for a server-side FPGA. The algorithm shows the highest throughput and area efficiency compared to algorithms from previous studies. Second, we design a pairing processor architecture that embeds the proposed modular multiplier, thus, maintaining its high throughput by supporting redundant adders and interleaved executions. We evaluate BN254 and BLS12_381 pairings on the proposed processor architecture and the evaluation results show that it achieves good throughput that is approximately two and five times faster than that from previous studies, respectively.

Remote side-channel attacks are emerging attack vectors that allow attackers to perform side-channel attacks (SCAs) without gaining physical access to the target devices. In particular, remote SCAs using analog-to-digital converters (ADCs) pose a major threat to the embedded devices used in sensor networks. In a previous study, ADC-based SCAs were evaluated using a non-profiled attack technique called correlation power analysis (CPA), which recovers only six out of 16 bytes of Advanced Encryption Standard (AES)-128 keys among 10 million ADC traces. However, when the attack target is an embedded device or some other device that is readily available to attackers, more powerful profiled attacks should be evaluated. In this paper, we introduce a profiled analysis to an ADC-based SCA and show the successful recovery of all 16-byte AES-128 keys from approximately 300k ADC traces under the best measurement condition.

We investigate the potential for abuse of recent AI advances by developing seven malware programs and two attack tools using ChatGPT, OpenAI Playground’s "text-davinci-003" model, and Auto-GPT—an open-source AI agent capable of generating automated prompts to accomplish user-defined goals. We confirm that: 1) Under the safety and moderation control of recent AI systems, it is possible to generate the functional malware and attack tools (up to about 400 lines of code) within 90 minutes, including the debugging time. 2) Auto-GPT does not ease the hurdle of generating the right prompts for malware generation, but it evades the safety controls of OpenAI with its automatically generated prompts. When given goals with sufficient details, it writes the code in nine of nine malware and attack tools we tested. 3) There is still room to improve the moderation and safety controls of ChatGPT and text-davinci-003 model, especially for the growing jailbreak prompts. Overall, we find that recent AI advances, including ChatGPT, Auto-GPT, and text-davinci-003, demonstrate the potential for generating malware and attack tools under safety and moderation control, highlighting the need for improved safety measures and enhanced safety controls in AI systems.

Laser fault injection (LFI) refers to a precise attack that introduces specific errors into an operating device. In response to the increasing prevalence of such attacks, recent studies have proposed various countermeasures, primarily including conventional analog circuit-level solutions such as optical sensors and current sensors. In addition, digital sensors can be designed at the digital circuit level. However, the countermeasures proposed using digital sensors have primarily been limited to the schematic level, and their physical layouts have not been thoroughly examined. To this end, this study proposes a novel design methodology focusing on the physical layout of digital sensors to enhance laser detection in field programmable gate arrays. The proposed design methodology was applied to two types of sensors, namely, ring oscillator (RO)-based and time-to-digital converter (TDC)-based sensors. First, we conducted a naive implementation of the RO-based sensor, which did not consider the layout and only provided protection to a limited area of the device. Moreover, we proposed a more detailed design methodology for digital LFI sensors, which was specifically tailored to effectively protect a larger area of the device and was successfully applied to both RO-based and TDC-based sensors. In addition to this design methodology, we conducted comprehensive laser-scanning experiments using an extensive parameter space to evaluate the two types of LFI sensors. These evaluations demonstrated that the improved RO-based sensor can detect up to 80.1% of laser shots and 99.8% of the faults. In comparison, the TDC-based sensor could detect 75.4% of the laser shots and 85.4% of the faults. These result shows the effectiveness of the proposed method.

Cyber attacks are reported daily and have become a major social issue. However, it is still unclear who the attackers are and their background. In this paper, using OSINT-based profiling, we shed light on the identity of individual attackers visiting honeypots of connected infrastructure. Specifically, focusing on unique hostnames and/or usernames of the connecting client machines in the Telnet negotiations, we found SNS accounts, such as LinkedIn, Twitter, Facebook, and GitHub, which we believe belong to eight individual attackers. According to the information from these SNS accounts, seven were with IT and/or security expertise. Four were employed by security, IT consulting, or IT engineering companies. Two publicized open repositories of vulnerability exploits and malware. After logging into the honeypot, three showed aggressive activities such as installing external tools, escalating privilege, and attempting lateral movement. One visitor accessed the honeypot for over six months, exhibiting a special interest in the system. We conclude that it is possible to identify and profile some of the honeypot visitors who publicize themselves.