DARPA | The Contracting Education Academy

August 17, 2018 By cs

Georgia Tech researchers help close security hole in popular encryption software

Cybersecurity researchers at the Georgia Institute of Technology have helped close a security vulnerability that could have allowed hackers to steal encryption keys from a popular security package by briefly listening in on unintended “side channel” signals from smartphones.

The attack, which was reported to software developers before it was publicized, took advantage of programming that was, ironically, designed to provide better security. The attack used intercepted electromagnetic signals from the phones that could have been analyzed using a small portable device costing less than a thousand dollars. Unlike earlier intercept attempts that required analyzing many logins, the “One & Done” attack was carried out by eavesdropping on just one decryption cycle.

“This is something that could be done at an airport to steal people’s information without arousing suspicion and makes the so-called ‘coffee shop attack’ much more realistic,” said Milos Prvulovic, associate chair of Georgia Tech’s School of Computer Science. “The designers of encryption software now have another issue that they need to take into account because continuous snooping over long periods of time would no longer be required to steal this information.”

The side channel attack is believed to be the first to retrieve the secret exponent of an encryption key in a modern version of OpenSSL without relying on the cache organization and/or timing. OpenSSL is a popular encryption program used for secure interactions on websites and for signature authentication. The attack showed that a single recording of a cryptography key trace was sufficient to break 2048 bits of a private RSA key.

Results of the research, which was supported in part by the National Science Foundation, the Defense Advanced Research Projects Agency (DARPA), and the Air Force Research Laboratory (AFRL) will be presented at the 27th USENIX Security Symposium August 16th in Baltimore.

After successfully attacking the phones and an embedded system board – which all used ARM processors – the researchers proposed a fix for the vulnerability, which was adopted in versions of the software made available in May.

Side channel attacks extract sensitive information from signals created by electronic activity within computing devices during normal operation. The signals include electromagnetic emanations created by current flows within the devices computational and power-delivery circuitry, variation in power consumption, and also sound, temperature and chassis potential variation. These emanations are very different from communications signals the devices are designed to produce.

In their demonstration, Prvulovic and collaborator Alenka Zajic listened in on two different Android phones using probes located near, but not touching the devices. In a real attack, signals could be received from phones or other mobile devices by antennas located beneath tables or hidden in nearby furniture.

The “One & Done” attack analyzed signals in a relatively narrow (40 MHz wide) band around the phones’ processor clock frequencies, which are close to 1 GHz (1,000 MHz). The researchers took advantage of a uniformity in programming that had been designed to overcome earlier vulnerabilities involving variations in how the programs operate.

“Any variation is essentially leaking information about what the program is doing, but the constancy allowed us to pinpoint where we needed to look,” said Prvulovic. “Once we got the attack to work, we were able to suggest a fix for it fairly quickly. Programmers need to understand that portions of the code that are working on secret bits need to be written in a very particular way to avoid having them leak.”

The researchers are now looking at other software that may have similar vulnerabilities, and expect to develop a program that would allow automated analysis of security vulnerabilities.

“Our goal is to automate this process so it can be used on any code,” said Zajic, an associate professor in Georgia Tech’s School of Electrical and Computer Engineering. “We’d like to be able to identify portions of code that could be leaky and require a fix. Right now, finding these portions requires considerable expertise and manual examination.”

Side channel attacks are still relatively rare, but Prvulovic says the success of “One & Done” demonstrates an unexpected vulnerability. The availability of low-cost signal processing devices small enough to use in coffee shops or airports could make the attacks more practical.

“We now have relatively cheap and compact devices – smaller than a USB drive – that are capable of analyzing these signals,” said Prvulovic. “Ten years ago, the analysis of this signal would have taken days. Now it takes just seconds, and can be done anywhere – not just in a lab setting.”

Producers of mobile devices are becoming more aware of the need to protect electromagnetic signals of phones, tablets and laptops from interception by shielding their side channel emissions. Improving the software running on the devices is also important, but Prvulovic suggests that users of mobile devices must also play a security role.

“This is something that needs to be addressed at all levels,” he said. “A combination of factors – better hardware, better software and cautious computer hygiene – make you safer. You should not be paranoid about using your devices in public locations, but you should be cautious about accessing banking systems or plugging your device into unprotected USB chargers.”

In addition to those already mentioned, the research involved Monjur M. Alam, Haider A. Khan, Moumita Dey, Nishith Sinha and Robert Callen, all of Georgia Tech.

This work has been supported, in part, by the National Science Foundation under grant 1563991 and by the Air Force Research Laboratory and DARPA LADS under contract FA8650-16-C-7620. The views and findings in this paper are those of the authors and do not necessarily reflect the official views of NSF, DARPA or the AFRL.

Source: https://www.news.gatech.edu/2018/08/09/researchers-help-close-security-hole-popular-encryption-software

July 9, 2018 By cs

Georgia Tech team receives DARPA grant to apply neuroscience to machine learning

Siri knows where you live, but she couldn’t drive you there.

Despite their name, artificial neural networks are very different from the brain. Yet machine learning performance could be improved if informed by state-of-the-art neuroscience.

A team of researchers from Georgia Tech and other local universities would study this problem with a grant up to $2 million, dependent on successful completion of milestones, from the Defense Advanced Research Projects Agency’s (DARPA) Lifelong Learning Machines (L2M) program managed by Dr. Hava Siegelmann. DARPA’s goal would be to develop new machine learning approaches that enable systems to learn continually while they operate and apply prior knowledge to new situations.

School of Computer Science Professor Constantine Dovrolis, Georgia Tech Research Institute Senior Research Scientist Zsolt Kira, Georgia State University neuroscience Professor Sarah Pallas, and Emory biology Associate Professor Astrid Prinz are collaborating on the two-year project.

Bringing Neural Networks to the 21st Century

The concept of modeling a computational neural network based on the brain first arose in the 1950s, but it hasn’t evolved much since.

“Obviously, since the ‘50s there’s been a lot of progress in neuroscience, but not a lot of it has translated to machine learning,” Kira said. “Supervised machine learning through neural networks is fundamentally a computer scientist’s translation of a high-level understanding of the brain from the past. But I think there’s a lot we can learn from contemporary neuroscience.”

One of the fundamental problems of machine learning that neuroscience could alleviate is what Dovrolis calls “catastrophic forgetting.” When the artificial neural network learns a new task, it often forgets the previous one.

“Deep learning networks are very different from the brain, both in terms of structure (architecture) and function (dynamics),” Dovrolis said.

Take the brain of a baby. Within the first few years of life, it not only has the ability to learn but also to generalize with very little supervision. Dovrolis believes that machine learning can achieve the same goal but only through a major departure from the currently established machine learning paradigms.

“The brain is really the only example of general intelligence we have,” Dovrolis said. “It makes sense to take that example, identify its fundamental principles, and transfer them to the computational domain.”

Bridging the Gap between Neuro and Computer Science

It may make sense, but it’s also controversial. Many computer scientists see the brain as mere hardware, and they prefer to focus instead on more statistical machine learning approaches. This is why this project is so unique: It brings together different ideas from network science, machine learning, evolutionary computing, computational neuroscience, and systems neuroscience — fields that should’ve been working together from the start.

“It’s easier for each field to work by themselves because it’s very comfortable,” Kira said. “But there’s a lot of potential if you actually make the effort to bring people together.”

Yet working with neuroscientists doesn’t just benefit computer scientists. Many neuroscientists believe computing could help with better modeling of biological networks, and ultimately, a deeper understanding of how the brain works.

“Neuroscience can, in turn, be guided by results from machine learning research that can inform new experiments to deepen our understanding of the brain,” Prinz said.

One of these examples is the flexibility of the brain.

“Neural circuits in the developing brain are highly flexible and adaptable to environmental changes, which endows them with an ability to learn rapidly and to self-repair after damage,” Pallas said.

Adult brains are much less plastic, so one of the neuroscientists’ goals is to uncover the neuronal mechanism that regulates the level of plasticity versus stability in brain circuits. With this, they can harness the mechanism for medical purposes and design machines that can continue learning without forgetting.

Approaching the Research

The project should attempt to address five goals of the L2M program:

• Continual learning: The building block of the cortex is a largely invariant structure referred to as a “cortical column.” The function of cortical columns is not known yet, but it seems that they act as associative memories and predictors. The structure of cortical columns suggests that recurrent neural networks could learn incrementally and in an unsupervised manner simply by interacting with the environment.

• Adaptation to new tasks/environments: These cortical columns could interconnect through deep brain-wide hierarchies and nested feedback loops that interact and inform each other, enabling the brain to adapt to different environments with minimal need for retraining.

• Goal-driven perception: At any time, the brain is receiving data from many sensory sources. Hierarchical neural networks could use task-driven inputs to adjust low-level sensory processing and integration dynamically, depending on top-down goal-related signals.

• Selective plasticity: The project should be investigating how the connections and weights between (artificial) neurons could be adjusted when a new task is encountered, without catastrophically forgetting previous tasks. Neuromodulator-driven plasticity and homeostatic plasticity are two biological mechanisms that could be transferred in machine learning to address this problem.

• Monitoring and safety: Researchers would also investigate how to ensure stability and safety, based on the organization of the brain’s autonomic nervous system. Additionally, the safety concern could be further addressed through an “artificial impulse control” system, operating on the same prediction principles as the corresponding cortical system.

This research could allow machine learning to become increasingly adaptive and continually learn, which could have vast applications. A self-driving car could be programmed in the summer, but with these principles, it could learn how to drive in previously untested winter conditions. Siri could be next.

Source: https://www.gtri.gatech.edu/newsroom/georgia-tech-team-receives-darpa-grant-apply-neuroscience-machine-learning

April 24, 2018 By cs

Military will award $10 million to the company that can launch satellites on short notice

U.S. military leaders are bullish about small satellites as tools to spy on adversaries and provide secure communications, but there’s just one problem: There isn’t a good way to get them into space, on demand.

Inspired by NASA’s partnerships with rocket makers like SpaceX, the Pentagon is turning to private industry, as half a dozen companies, most backed by venture capitalists, are working to launch small satellites more cheaply than ever to meet the demands of a growing number of small-satellite startups.

“There’s already a lot of commercial money going into development for these boosters,” Todd Master, a program manager at the U.S. Defense Advanced Research Projects Agency told Quartz at the Space Symposium, a conference bringing together space companies and government officials in Colorado Springs, Colorado. “But nobody is asking them to be much more responsive. Our discussions with them are: Could you go faster? Could you go from anywhere? And they’re like, ‘Yeah, but nobody is asking us to do that.’”

Keep reading this article at: https://www.defenseone.com/technology/2018/04/us-military-will-award-10-million-company-can-launch-satellites-short-notice/147588

August 3, 2017 By cs

This is the Pentagon’s new acquisition structure

The Pentagon’s new acquisition plan creates almost a dozen new offices, in what the department hopes will be a streamlined organization better able to manage the needs of today while developing the technologies of tomorrow.

On Aug. 1, 2017 the department delivered to Congress its plan for devolving the undersecretary of defense for acquisition, sustainment and technology, or AT&L, into two smaller organizations — the undersecretary of defense for research and engineering, or USDR&E, and the undersecretary of defense for acquisition and sustainment, or USDA&S.

Those changes are required to be implemented by Feb. 1, 2018.

Among the notable changes, three quasi-independent offices — the Strategic Capabilities Office, the Defense Innovation Unit Experimental and the Defense Advanced Research Projects Agency — will be folded two levels under the USDR&E, while a new analysis cell will be set up to drive how the Pentagon invests its money for the future.

The Missile Defense Agency will also be rolled under the USDR&E, at a time when the Trump administration has made missile defense a priority for the department.

Keep reading this article at: https://www.defensenews.com/breaking-news/2017/08/02/this-is-the-pentagons-new-acquisition-structure

See DoD’s complete restructuring plan at: https://www.scribd.com/document/355353372/Section-901-FY2017-NDAA-Report

August 10, 2016 By cs

Georgia Tech pursues new technique for wireless malware monitoring of Internet devices

A $9.4 million grant from the Defense Advanced Research Projects Agency (DARPA) could lead to development of a new technique for wirelessly monitoring Internet of Things (IoT) devices for malicious software – without affecting the operation of the ubiquitous but low-power equipment.

The technique will rely on receiving and analyzing side-channel signals, electromagnetic emissions that are produced unintentionally by the electronic devices as they execute programs. These signals are produced by semiconductors, capacitors, power supplies and other components, and can currently be measured up to a half-meter away from operating IoT devices.

By comparing these unintended side-channel emissions to a database of what the devices should be doing when they are operating normally, researchers can tell if malicious software has been installed.

“We will be looking at how the program is changing its behavior,” explained Alenka Zajic, the project’s principal investigator and an assistant professor in the School of Electrical and Computer Engineering at the Georgia Institute of Technology. “If an Internet of Things device is attacked, the insertion of malware will affect the program that is running, and we can detect that remotely.”

The four-year project will also include two faculty members from Georgia Tech’s School of Computer Science: Professors Milos Prvulovic and Alessandro Orso. Also part of the project will be a research team from Northrop-Grumman, headed by Matthew Welborn. Details of an early prototype of the side-channel technique, called “Zero-Overhead Profiling” because the monitoring doesn’t affect the system being observed, were presented July 20th at the International Symposium on Software Testing and Analysis (ISSTA).

Within the next four years, an estimated 30 billion IoT devices will be in operation, doing everything from controlling home heating and air conditioning to sensing and managing critical infrastructure. The devices are usually small with limited processor power and memory. Their limited computing capabilities means they can’t run the kinds of malware protection software found on laptop computers, and they cannot use virtualization and other technology to protect the system software even when an application is taken over by an attacker. This means that once attackers compromise the internet-connected application, they typically “own” the entire IoT device and can even make it falsely respond to traditional queries about its own security status.

“The main challenge from a security perspective is to make these devices secure so somebody can’t take them over,” explained Zajic. “There will be a lot of processing power out there that needs to be monitored, but you can’t just put traditional security software on that processor because is doesn’t have enough power for both the security software and the tasks the device is supposed to be doing.”

Zajic and Prvulovic pioneered research on measuring side-channel signals emitted from devices. These emissions differ from the signals the devices were intended to produce for communicating information across the Internet to other devices. The researchers have already shown that they can pick up the signals close to the devices using specially designed antennas, and one project goal is to extend the range to as much as three meters.

“When a processor executes instructions, values are represented as ones and zeroes, which creates a fluctuation in the current,” Zajic said. “That creates changes in the electromagnetic field we are measuring, providing a pattern for what each part of the program looks like on a spectrum analyzer.”

Key to detecting changes in the signals is getting a “before” recording of what these signals should look like to draw a comparison with an “after” set of signals for each combination of device and software. The researchers plan to evaluate each IoT device, sampling and recording its typical operation to create a database. To avoid recording overwhelming amounts of data, the system will take periodic samples from different stages of program loops.

“If somebody inserts something into the program loop, the peaks in the spectrum will shift and we can detect that,” Zajic said. “This is something that we can monitor in real time using advanced pattern-matching technology that uses machine learning to improve its performance.”

Detecting malware, however, is more of a challenge.

“The technique is currently 95 percent accurate at profiling – pinpointing the exact point in the IoT program code that is currently executing,” explained Prvulovic. “However, detection of malware is a much more difficult problem. Profiling is about identifying which part of the program is the best match for the signal, whereas malware detection is about detecting, with sufficient confidence, that the signal does not match any part of the original program, even when the malware is designed to resemble the original code of the application.”

Zajic and Prvulovic have been studying a wide range of devices to determine the emissions produced.

“We have more than one source on a circuit board, so we have been trying to localize the sources so we can build an antenna to give us the best possible signal,” said Zajic. “There are multiple places on the board where you connect to the same information, though it may be modulated at different frequencies.”

Ultimately, researchers expect the project – dubbed Computational Activity Monitoring by Externally Leveraging Involuntary Analog Signals (CAMELIA) – to be capable of monitoring several IoT devices simultaneously. That will require development of advanced processing techniques able to differentiate signals from each device, and new antennas able to pick up the signals from a greater distance.

CAMELIA is part of a DARPA program called Leveraging the Analog Domain for Security (LADS), which is investing in six different initiatives to address IoT security. The Georgia Tech-Northrop Grumman project is the only one of the projects led by an academic institution.

The research is supported by the DARPA LADS program under contract FA8650-16-C-7620. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the sponsoring agency.

Source: http://www.news.gatech.edu/2016/07/31/monitoring-side-channel-signals-could-detect-malicious-software-iot-devices