Search

Message Queuing Telemetry Transport (MQTT) is a standard messaging protocol for the Internet of Things (IoT). Among the various communication protocols used in IoT, MQTT stands unique because of its multiple advantages such as being efficient and light weight, reliability in message delivery and scalability to millions of things. However, the fact that the data privacy of the MQTT messages can be compromised while the data is in transit poses risks to the security mechanism. Attack scenarios related to MQTT have exposed multiple risks and vulnerabilities such as thousands of MQTT brokers being accessible over the default port, data privacy, authentication, data integrity, port obscurity, and botnet over MQTT. These risks and vulnerabilities undermine security mechanism which results in compromised IoT systems. Development Security and Operations (DevSecOps) aims at integrating security at every phase of the IoT lifecycle with enhanced automation, tools, and a process for determining security vulnerabilities at every stage. This results in a rapid and cost-effective IoT system which is enabled by proactive security mechanisms, threat prediction, threat detection, and alerting mechanisms. The aim of this work is to build a DevSecOps pipeline utilizing open source MQTT servers and brokers. A comparative study was performed to identify the risk posture provided by the DevSecOps pipeline across MQTT ports offering different combinations of security mechanisms. Firstly, threat modelling was conducted wherein the IoT system was analyzed at an architectural level from an attacker’s perspective and appropriate risk mitigation and defense mechanisms were accommodated into the design. The IoT system was then subjected to rigorous static and dynamic analysis followed by vulnerability scanning and third component checks. Penetration test cases and controls are automated to check threats and vulnerabilities like escalation of privileges, denial of service, spoofing, information disclosure, and repudiation. An alerting mechanism is also integrated into the system to monitor risks and vulnerabilities. Our proposed DevSecOps models achieves standard maturity in security systems with earlier threat prediction and detection. [ABSTRACT FROM AUTHOR]

In the past decade, the use of mobile smart phones has increased exponentially. The pervasiveness of these devices has motivated criminals to design ways to exploit the mobile technology to obtain confidential information or to execute malicious software. The term used to describe these social engineering attacks using mobile phone technology is Smishing, which is a play on the previously well-known Phishing attack perpetrated over email. Smishing uses Short Message Service or SMS as its attack vector to send malicious Uniform Resource Locators (URLs) along with the text message. Users are more aware of phishing emails and there are a lot of detection mechanisms developed to avoid such attacks. However, SMS is often neglected, and considering the small size of the mobile screen compared to a computer, it is difficult to detect and manually verify a phishing URL which is sent in a text message. When clicked, a smishing URL can either redirect the user to some phishing page or try to install a malicious payload on the mobile phone. Both scenarios are risky and can cause potential loss. The aim of this research is to develop a new application to detect Smishing attacks on Android devices by integrating existing phishing Application Program Interfaces (APIs) in a prototype application. The application is designed to run in the background and verify whether the URL in the text message is phishing or not. Five freely available APIs were tested on a dataset of 1500 URL to compare them in terms of accuracy and latency. Our results show that the Virus Total API gives the most accurate detection rate of 99.27%, but the slowest response time of 12-15 seconds per query; the Safe-Browsing API, gives an 87% accuracy with 0.15ms response time. For time sensitive applications, Safe-Browsing would provide the best solution, however, for security sensitive applications, Virus Total would be a better option. [ABSTRACT FROM AUTHOR]

Domain Name System (DNS) is an integral protocol which makes the resources available on the world wide web accessible. In recent times, there has been significant attention given to the development of different attack vectors against this protocol, out of which, DNS tunnelling is one of the most lethal attacks. Hackers use DNS tunnelling as a covert channel to cover their traces, exfiltrate data, and bypass the security policies enforced by the firewalls. Intrusion detection systems do not generally scan the DNS queries because it produces a lot of data which is not feasible to be analysed with a tool. This research proposes an active approach of detecting DNS tunnelling by capturing all packets in a local network and employing Machine Learning (ML) models to detect tunnelled data. The main aim of this research is to employ ML techniques to classify and separate DNS tunnelling packets from legitimate packets, compare the results generated based on their precision, detection time and computational effort, and determine an ideal solution for the problem. The research uses Ensemble Learning techniques which is a subset of Supervised ML to prepare a classifier that can detect DNS tunnelling. We also focus on the inherited implications of using ML which can be unknowingly faced while employing ML techniques, such as model overfitting, data bias, and complex and unrealistic model creation. The datasets used for this research are created using an emulated real-time network scenario. Our results show that ML classifiers can solve the problem of DNS tunnelling detection. Ensemble learning techniques outperforms decision tree by a large margin. Moreover, boosting models always produced better overall accuracy than bagging models, at the expense of a longer training time. [ABSTRACT FROM AUTHOR]