Summary The increasing convergence of wearable technologies and cloud services in applications, such as health care, could result in new attack vectors for the ‘Cloud of Things’, which could in turn be exploited to exfiltrate sensitive user data. In this paper, we analyze the types of sensitive user data that may be present on a wearable device and develop a method to demonstrate that they can be exfiltrated by an adversary. To undertake this study, we select the Android Wear smartwatch operating system as a case study and, specifically, the Samsung Gear Live smartwatch. We present a technique that allows an adversary to exfiltrate data from smartwatches. Using this technique, we determine that the smartwatch stores a relatively large amount of sensitive user data, including SMS messages, contact information, and biomedical data, and does not effectively protect this user data from physical exfiltration. Copyright © 2016 John Wiley & Sons, Ltd.

With the increased popularity of 3D printers in homes, and industry sectors, such as biomedical and manufacturing, the potential for cybersecurity risks must be carefully considered. Risks may arise from factors such as printer manufacturers not having the requisite levels of security awareness, and not fully understanding the need for security measures to protect intellectual property, and other sensitive data that are stored, accessed, and transmitted from such devices. This paper examines the security features of two different models of MakerBot Industries' consumer-oriented 3D printers and proposes an attack technique that is able to, not only, exfiltrate sensitive data, but also allow for remote manipulation of these devices. The attack steps are discretely modeled using a threat model to enable formal representation of the attack. Specifically, we found that the printers stored the previously printed and currently printing objects on an unauthenticated web server. We also ascertain that the transport layer security implementation on these devices was flawed, which severely affected the security of these devices and allowed for remote exploitation. Countermeasures to the attack that are implementable by both the manufacturer and the user of the printer are presented.

Mobile devices are fast becoming critical information management tools often storing a range of personal and corporate confidential data often synced from online and cloud based storage services. Mobile device operating system designers are increasing the security available to users, not only from traditional security risk vectors, but also to protect their privacy from the various apps (with potential malicious intent) installed on their device. In this paper, we developed a process for enforcing file system permissions on Android external storage (with minimal modifications to the operating system). Our process makes use of the application sandboxing supported on this platform to restrict parts of the external file system to a particular app or multiple apps holding a particular permission. We present an Android File system Permissions (AFP) prototype demonstrating the applicability of this work and demonstrate its utility using the own Cloud app for Android. We then highlight a number of limitations with the current permission enforcement capabilities for external storage on the platform.

It is well known that people movement exhibits a high degree of repetition since people visit regular places and make regular contacts for their daily activities. This paper presents a novel framework named Jyotish, which constructs a predictive model by exploiting the regular pattern of people movement found in real joint Wifi/Bluetooth trace. The constructed model is able to answer three fundamental questions: (1) where the person will stay, (2) how long she will stay at the location, and (3) who she will meet. In order to construct the predictive model, Jyotish includes an efficient clustering algorithm to exploit regularity of people movement and cluster Wifi access point information in Wifi trace into locations. Then, we construct a Naive Bayesian classifier to assign these locations to records in Bluetooth trace. Next, the Bluetooth trace with assigned locations is used to construct predictive model including location predictor, stay duration predictor, and contact predictor to provide answers for three questions above. Finally, we evaluate the constructed predictors over real Wifi/Bluetooth trace collected by 50 participants in University of Illinois campus from March to August 2010. Evaluation results show that Jyotish successfully constructs a predictive model, which provides a considerably high prediction accuracy of people movement.

In this paper1, we first characterize the fine-grained encounter pattern among mobile users found in a large-scale Bluetooth trace collected by 123 participants at University of Illinois campus from March to August 2010. Our characterization results show that the fine-grained encounter pattern is regular and predictable. We then design 3R routing protocol, which leverages the regularity of fine-grained encounter pattern among mobile nodes to maximize message delivery probability while preserving message delivery deadline. We evaluate and compare 3R with Prophet and Epidemic routing protocols over the collected trace. Evaluation results show that 3R outperforms other alternatives considerably by improving message delivery while reducing message overhead.