We present a novel class of content subversion attacks against information-based services, causing documents to appear to humans dissimilar to the underlying content extracted by information-based services. We demonstrate the significant impact of these attacks on real-world systems through five distinct variants. Our first attack allows academic paper writers and reviewers to collude via subverting the automatic reviewer assignment systems in current use by academic conferences including INFOCOM, which we reproduced. Our second attack renders ineffective plagiarism detection software, particularly Turnitin, targeting specific small plagiarism similarity scores to appear natural and evade detection. In our third attack, we place masked content into the indexes for Google, Bing, Yahoo!, and DuckDuckGo, which renders information entirely different from the keywords used to locate it, enabling spam, profane, or possibly illegal content to go unnoticed by these search engines but still returned in unrelated search results. Furthermore, we provide compelling demonstrations of the content subversion attack's efficacy on widely employed QR codes and one-dimensional barcodes. Finally, considering the prevalent avoidance of optical character recognition (OCR) due to computational overhead, we propose a comprehensive and lightweight alternative mitigation method.

Existing research work has identified a new class of attacks that can eavesdrop on the keystrokes in a non-invasive way without infecting the target computer to install malware. The common idea is that pressing a key of a keyboard can cause a unique and subtle environmental change, which can be captured and analyzed by the eavesdropper to learn the keystrokes. For these attacks, however, a training phase must be accomplished to establish the relationship between an observed environmental change and the action of pressing a specific key. This significantly limits the impact and practicality of these attacks. In this paper, we discover that it is possible to design keystroke eavesdropping attacks without requiring the training phase. We create this attack based on the channel state information extracted from the wireless signal. To eavesdrop on keystrokes, we establish a mapping between typing each letter and its respective environmental change by exploiting the correlation among observed changes and known structures of dictionary words. To defend against this attack, we propose a reactive jamming mechanism that launches the jamming only during the typing period. Experimental results on software-defined radio platforms validate the impact of the attack and the performance of the defense.

Wireless communication is easily eavesdropped due to the broadcast nature of the wireless medium. This has spurred extensive research into secret key establishment using physical layer characteristics of wireless channels. In all these schemes, the secret keys directly originate from the physical features of the real wireless channel, which is highly dependent on the communication environment nearby. Also, previous schemes require performing information reconciliation, which increases both the costs and the risk of key leakage. In this paper, we exhibit a novel wireless key establishment method allowing the transmitter to specify arbitrary content as the key and cause the receiver to obtain the same key leveraging a channel manipulation technique. We furthermore enable the transmitter to apply error-correction code to the key, so that the receiver can automatically correct any mismatched bits without sending key-related information back to the transmitter over the public channel. Experimental results demonstrate that our key establishment method reaches a success rate as high as 91.0 percent for establishing a 168-bit key between the transmitter and the receiver, and meanwhile the chance that the eavesdropper can infer the key in meter-order range of the receiver is subdued into the range of 0~0.10 percent.

The prevalence and monetary value of mobile devices, coupled with their compact and, indeed, mobile nature, lead to frequent theft due to a lack of proper anti-theft mechanisms. Currently, there only exist damage control efforts such as remote wiping the device's memory or GPS tracking, but nothing to notify users of theft while it takes place. We propose such a mechanism which utilizes the unique walking patterns inherent to humans and differentiate our work from other walking behavior studies by using it as first-order authentication and developing matching methods fast enough to act as an actual anti-theft system. We test our system with the aid of 45 volunteers and demonstrate detection of unauthorized movement within 10 to 20 steps with an accuracy of 96.4 to 98.4 percent, while simultaneously distinguishing owners as themselves with 97.8 percent accuracy.

Traditional methods to eavesdrop keystrokes leverage some malware installed in a target computer to record the keystrokes for an adversary. Existing research work has identified a new class of attacks that can eavesdrop the keystrokes in a non-invasive way without infecting the target computer to install a malware. The common idea is that pressing a key of a keyboard can cause a unique and subtle environmental change, which can be captured and analyzed by the eavesdropper to learn the keystrokes. For these attacks, however, a training phase must be accomplished to establish the relationship between an observed environmental change and the action of pressing a specific key. This significantly limits the impact and practicality of these attacks. In this paper, we discover that it is possible to design keystroke eavesdropping attacks without requiring the training phase. We create this attack based on the channel state information extracted from wireless signal. To eavesdrop keystrokes, we establish a mapping between typing each letter and its respective environmental change by exploiting the correlation among observed changes and known structures of dictionary words. We implement this attack on software-defined radio platforms and conduct a suite of experiments to validate the impact of this attack. We point out that this paper does not propose to use wireless signal for inferring keystrokes, since such work already exists. Instead, the main goal of this paper is to propose new techniques to remove the training process, which can make existing work unpractical.

Recently, people have witnessed a remarkable growth in the number of smart wearable devices. Accompanied with the development of a contactless data transmission technique, the lack of effective secret key establishment between lightweight wearable devices which support contactless data transmission technique becomes a security bottleneck. In this paper, we propose a novel wireless key establishment method by moving or shaking the wearable wireless devices. Instead of received signal strength (RSS) itself, we denote the RSS trajectories of two moving wireless devices as the materials of secret key. Moreover, inspired by channel reciprocity in a channel feature-based key establishment technique, we propose the concept of reciprocity of RSS trajectory that guarantees that even when the RSSs of two devices are the same, the identical RSS trajectories of two devices can successfully generate the secret key. In addition, to effectively utilize the RSS trajectories, we design a novel quantization scheme by considering the entropy and efficiency of key generation. Furthermore, we analyze the security of this key establishment procedure in an eavesdropped and monitored environment. We also perform an evaluation of 64-, 128-, 192-, and 256-b key generation in indoor/outdoor environment, and the results indicate that the times are 0.22/0.33, 0.61/0.74, 0.95/1.02, and 1.28/1.46 s, respectively. In addition, the ranges of efficiency and entropy are 0.654-0.795 and 0.968-0.993.

In the above paper, the following acknowledgment of financial support was not included, due to a publication error.

The power flow model for DC power grids has been used theoretically to launch false data injection attacks (FDIAs) against state estimation. We recognize FDIAs are just one possible attack using the power flow model and that the grid topology information within the model implies its discovery may also facilitate topology-based attacks. We show attackers can derive the power flow model, and thus the topology also. Indeed, with incomplete data, attackers can accurately reconstruct regions of the model, or topology, all that is necessary to launch an attack. We also illustrate how to cause such attackers to derive instead a convincing fake model by camouflaging the real model. Consequently, no sensitive information will leak, so attacks based on this fake model will be ineffective, rather alerting grid administrators to the attacker's efforts. Using five test cases included in the MATLAB power flow analysis tool MATPOWER, ranging from 9 to 300 buses, an average 67.0% of the topology may be derived with a 69.1% model accuracy. Lastly, we find reconstructions of small portions of the model sufficient for performing FDIAs with 75% success, and that camouflage prevents 93% of them in all but the 9-bus case.

Motor vehicles are widely used, quite valuable, and often targeted for theft. Preventive measures include car alarms, proximity control, and physical locks, which can be bypassed if the car is left unlocked, or if the thief obtains the keys. Reactive strategies like cameras, motion detectors, human patrolling, and GPS tracking can monitor a vehicle, but may not detect car thefts in a timely manner. We propose a fast automatic driver recognition system that identifies unauthorized drivers while overcoming the drawbacks of previous approaches. We factor drivers' trips into elemental driving events, from which we extract their driving preference features that cannot be exactly reproduced by a thief driving away in the stolen car. We performed real world evaluation using the driving data collected from 31 volunteers. Experiment results show we can distinguish the current driver as the owner with 97% accuracy, while preventing impersonation 91% of the time.