Final Exam - Improving the Resiliency of IoT Systems

Date: 
May 19, 2021 - 4:00pm
Location: 
This Final Exam will be held remotely.

PhD Candidate: Moosa Yahyazadeh

Abstract

Internet of Things (IoT), as a new emerging technology, has gained a foothold in many different domains such as smart-home, health care, and industrial manufacturing for its customization capability to meet varying application domain needs. Such customization is mostly realized through programmable IoT platforms, where seamless automation tasks are performed using various IoT apps to increase the productivity of the systems. Prior work has shown that there are several vulnerabilities associated with the misbehavior in these IoT apps which expose such IoT platforms to a variety of security, privacy, and safety threats. In the first portion of the dissertation, two techniques, called EXPAT and PATRIoT, are proposed to address such unexpected behavior issues via a runtime monitoring-based approach featuring different policy languages (with different expressiveness powers) to enforce the given expectations.

In the second portion of the dissertation, we investigate a class of vulnerabilities in the implementations of a security mechanism — RSA PKCS#1-v1.5 signature verification — that underlies many security guarantees in the loT systems. These vulnerabilities are variants of Bleichenbacher-style low public exponent RSA signature forgery, which occurs when a signature verification implementation leaves a significant area of the signature’s encoded message unchecked, while the signer’s public key uses a low public exponent. To detect such vulnerabilities, our proposed approach, called MORPHEUS, features a formally verified implementation of RSA PKCS#1-v1.5 signature verification, acting as the oracle to detect bugs in implementation under test. MORPHEUS works in a black-box fashion and thus is a programming language agnostic framework to target various implementations. We have used MORPHEUS to test against 45 diverse PKCS#1-v1.5 signature verification implementations and discovered 6 implementations are susceptible to the variants of the Bleichenbacher-style low public exponent RSA signature forgery, 1 implementation with buffer overflow attack, 33 implementations with incompatibility issue, and 8 implementations with minor leniencies. All our findings have been responsibly disclosed to the affected vendors, and 12 new CVEs have been assigned to the immediately exploitable ones.

Advisor: Omar Chowdhury


Please contact Daniel for further details, if you wish to join his exam.