IEEE 802.1CB provides a standard for reliable packet delivery within Time-Sensitive Networking (TSN). As this standard is envisioned to be used in mission-critical networks in the near future, it has to be protected against security threats. The integrity of the network communication should be the biggest focus as guaranteed delivery is essential. However, IEEE 802.1CB does not come with security guarantees. Indeed, as we show in this paper, an attacker may be able to exploit different threat vectors to impair the correctness of communication, impacting on the safety of users. Due to TSN strict delay and reliability requirements, classical security solutions can not be easily applied without significant efforts. Therefore, researchers proposed multiple solutions to guarantee secure communication. However, the current state-of-the-art is not able to guarantee both security and timing guarantees. In this paper, we provide a detailed analysis of the security of IEEE 802.1CB exploiting the STRIDE methodology. Compared to the existing state-of-the art on the subject, we provide a deeper analysis of the possible threats and their effect. We then analyze available solutions for security in IEEE 802.1CB, and compare their performance in terms of time, reliability, and security guarantees. Based on our analysis, we show that, although there exist promising solutions trying to provide security to 802.1CB, there is still a gap to be filled both in terms of security and latency guarantees.@en

Fifth-generation (5G) cellular communication networks are being deployed on applications beyond mobile devices, including vehicular networks and industry automation. Despite their increasing popularity, 5G networks, as defined by the Third Generation Partnership Project (3GPP), have been shown to be vulnerable against fake base station (FBS) attacks. An adversary carrying out an FBS attack emulates a legitimate base station by setting up a rogue base station. This enables the adversary to control the connection of any user equipment that (inadvertently) connects with the rogue base station. Such an adversary can gather sensitive information belonging to the user. While there is a large body of work focused on the development of tools to detect FBSs, the user equipment will continue to remain vulnerable to an FBS attack. In this paper, we propose BARON, a defense methodology to enable user equipment to determine whether a target base station that it is connecting to is legitimate or rogue. BARON accomplishes this by ensuring that the user receives an authentication token from the target base station which can be computed only by a legitimate and trusted entity. As a consequence, receiving such an authentication token from a base station ensures legitimacy of the base station. We evaluate BARON through extensive experiments on the handover process between base stations in 5G networks. Our experimental results show that BARON introduces an overhead of less than 1% during handover completion, which is 10000× lower than the overhead reported by a state-of-the-art method. BARON is also effective in thwarting an FBS attack and quickly recovering connection to a legitimate base station. @en

Internet of Drones (IoD) is a framework to set up drones networks that may serve multiple purposes, e.g., data collection. New IoD applications (such as drone assisted internet of vehicles) envision the simultaneous collection of multiple data types. Although authentication may prevent unauthorized users to access the collected data, existing authentication solutions do not distinguish between the different types of data collected by drones. Therefore, authenticated users may receive sensitive data regarding another user incurring hence in a privacy leakage. In this paper, we propose SETCAP, a novel Service-Based Energy-Efficient Temporal Credential Authentication Protocol for IoD. SETCAP exploits the distinction between data types to prevent information leakage. We formally test SETCAP against the Real-Or-Random (ROR) model and implemented SETCAP in Automated Validation of Internet Security Protocols and Applications (AVISPA) simulation tool. Moreover, we validated SETCAP via non-mathematical security analysis to show its security against many attacks. We assessed the superiority of SETCAP in terms of functionality and security characteristics as well as computation, communication, and energy costs. The communication cost of creating a session in SETCAP is approximately 20% smaller than that of creating a session in the closest state-of-the-art protocol. Furthermore, the framework that we propose requires the creation of a number of sessions that are additive in terms of the number of drones and users, whereas the existing solutions are multiplicative. SETCAP is therefore a secure and scalable solution for resource-constrained devices such as drones.@en

The Fifth Generation of Communication Networks (5G) envisions a broader range of services compared to previous generations, supporting an increased number of use cases and applications. The broader application domain leads to increase in consumer use and, in turn, increased hacker activity. Due to this chain of events, strong and efficient security measures are required to create a secure and trusted environment for users. In this paper, we provide an objective overview of 5G security issues and the existing and newly proposed technologies designed to secure the 5G environment. We categorize security technologies using Open Systems Interconnection (OSI) layers and, for each layer, we discuss vulnerabilities, threats, security solutions, challenges, gaps and open research issues. While we discuss all seven OSI layers, the most interesting findings are in layer one, the physical layer. In fact, compared to other layers, the physical layer between the base stations and users' device presents increased opportunities for attacks such as eavesdropping and data fabrication. However, no single OSI layer can stand on its own to provide proper security. All layers in the 5G must work together, providing their own unique technology in an effort to ensure security and integrity for 5G data.@en

The Fifth Generation of Communication Networks (5G) envisions a broader range of services compared to previous generations, supporting an increased number of use cases and applications. The broader application domain leads to increase in consumer use and, in turn, increased hacker activity. Due to this chain of events, strong and efficient security measures are required to create a secure and trusted environment for users. In this paper, we provide an objective overview of 5G security issues and the existing and newly proposed technologies designed to secure the 5G environment. We categorize security technologies using Open Systems Interconnection (OSI) layers and, for each layer, we discuss vulnerabilities, threats, security solutions, challenges, gaps and open research issues. While we discuss all seven OSI layers, the most interesting findings are in layer one, the physical layer. In fact, compared to other layers, the physical layer between the base stations and users' device presents increased opportunities for attacks such as eavesdropping and data fabrication. However, no single OSI layer can stand on its own to provide proper security. All layers in the 5G must work together, providing their own unique technology in an effort to ensure security and integrity for 5G data.@en

Channel hopping provides a defense mechanism against jamming attacks in large scale Internet of Things (IoT) networks. However, a sufficiently powerful attacker may be able to learn the channel hopping pattern and efficiently predict the channel to jam. In this paper, we present FOLPETTI, a Multi-Armed Bandit (MAB)-based attack to dynamically follow the victim's channel selection in real-time. Compared to previous attacks implemented via Deep Reinforcement Learning (DRL), FOLPETTI does not require recurrent training phases to capture the victim's behavior, allowing hence a continuous attack. We assess the validity of FOLPETTI by implementing it to launch a jamming attack. We evaluate its performance against a victim performing random channel selection and a victim implementing a MAB defence strategy. We assume that the victim detects an attack when more than 20% of the transmitted packets are not received, therefore this represents the limit for the attack to be stealthy. In this scenario, FOLPETTI achieves a 15% success rate for the victim's random channel selection strategy, close to the 17.5% obtained with a genie-aided approach. Conversely, the DRL-based approach reaches a success rate of 12.5%, which is 5.5% less than FOLPETTI. We also confirm the results by confronting FOLPETTI with a MAB based channel hopping method. Finally, we show that FOLPETTI creates an additional energy demand independently from its success rate, therefore decreasing the lifetime of IoT devices. @en

Channel hopping provides a defense mechanism against jamming attacks in large scale Internet of Things (IoT) networks. However, a sufficiently powerful attacker may be able to learn the channel hopping pattern and efficiently predict the channel to jam. In this paper, we present FOLPETTI, a Multi-Armed Bandit (MAB)-based attack to dynamically follow the victim's channel selection in real-time. Compared to previous attacks implemented via Deep Reinforcement Learning (DRL), FOLPETTI does not require recurrent training phases to capture the victim's behavior, allowing hence a continuous attack. We assess the validity of FOLPETTI by implementing it to launch a jamming attack. We evaluate its performance against a victim performing random channel selection and a victim implementing a MAB defence strategy. We assume that the victim detects an attack when more than 20% of the transmitted packets are not received, therefore this represents the limit for the attack to be stealthy. In this scenario, FOLPETTI achieves a 15% success rate for the victim's random channel selection strategy, close to the 17.5% obtained with a genie-aided approach. Conversely, the DRL-based approach reaches a success rate of 12.5%, which is 5.5% less than FOLPETTI. We also confirm the results by confronting FOLPETTI with a MAB based channel hopping method. Finally, we show that FOLPETTI creates an additional energy demand independently from its success rate, therefore decreasing the lifetime of IoT devices. @en

Due to the frequent unauthorized invasions by commercial drones to Critical Infrastructures (CIs), the US-based Federal Avionics Administration (FAA) recently published a new specification, namely RemoteID. Such a rule requires all drones to broadcast information about their identity and location, to allow for immediate invasion attribution and counter-actions. However, the enforcement of such a rule poses severe concerns on drones' operators, especially in terms of location privacy and tracking threats. Indeed, by simply receiving wireless signals, an adversary could know the precise drone location, track it, and infer sensitive information. In this paper, we demonstrate that CI operators can detect timely and efficiently drones invading no-fly zones, without sacrificing drones location privacy. Specifically, we provide two major contributions. First, we propose DiPrID, the first RemoteID-compliant solution enhancing drones location privacy via Differential Privacy. Second, we introduce and evaluate ICARUS, an effective area invasion detection technique capable of identifying invasions by unauthorized drones, even when equipped with DiPrID, with remarkable accuracy and negligible detection delays. Our experiments showed that when drones obfuscate their location by an average distance as large as 31.914 km, ICARUS can detect up to 94.2% of invasions, while false-positives can be mitigated through the help of the FAA. @en

The Internet of Things (IoT) is a pervasive phenomenon in our everyday life, binding and enabling communication between heterogeneous physical devices and the internet. The applications of this technology range from industrial control to medical devices, hence interconnecting a huge number of devices collecting sensitive information. Although this provides a highly dynamic network with extensive capabilities, its widespread adoption and sensitive nature of the collected data open a large number of challenges from a cybersecurity perspective. In this paper, we offer a fresh perspective on the IoT security landscape by providing a full list of reported vulnerabilites. By organizing protocols and vulnerabilities according to the TCP/IP stack, we guide both novice and expert users and developers in gaining a clear overview of the state-of-the-art IoT and its security issues. Furthermore, by discussing open problems and future directions, we think our paper will be helpful to the research community in designing the next generation of secure IoT.@en

The Internet of Things (IoT) is a pervasive phenomenon in our everyday life, binding and enabling communication between heterogeneous physical devices and the internet. The applications of this technology range from industrial control to medical devices, hence interconnecting a huge number of devices collecting sensitive information. Although this provides a highly dynamic network with extensive capabilities, its widespread adoption and sensitive nature of the collected data open a large number of challenges from a cybersecurity perspective. In this paper, we offer a fresh perspective on the IoT security landscape by providing a full list of reported vulnerabilites. By organizing protocols and vulnerabilities according to the TCP/IP stack, we guide both novice and expert users and developers in gaining a clear overview of the state-of-the-art IoT and its security issues. Furthermore, by discussing open problems and future directions, we think our paper will be helpful to the research community in designing the next generation of secure IoT.@en

The Internet of Things (IoT) is a pervasive phenomenon in our everyday life, binding and enabling communication between heterogeneous physical devices and the internet. The applications of this technology range from industrial control to medical devices, hence interconnecting a huge number of devices collecting sensitive information. Although this provides a highly dynamic network with extensive capabilities, its widespread adoption and sensitive nature of the collected data open a large number of challenges from a cybersecurity perspective. In this paper, we offer a fresh perspective on the IoT security landscape by providing a full list of reported vulnerabilites. By organizing protocols and vulnerabilities according to the TCP/IP stack, we guide both novice and expert users and developers in gaining a clear overview of the state-of-the-art IoT and its security issues. Furthermore, by discussing open problems and future directions, we think our paper will be helpful to the research community in designing the next generation of secure IoT.@en

The Internet of Things (IoT) is a pervasive phenomenon in our everyday life, binding and enabling communication between heterogeneous physical devices and the internet. The applications of this technology range from industrial control to medical devices, hence interconnecting a huge number of devices collecting sensitive information. Although this provides a highly dynamic network with extensive capabilities, its widespread adoption and sensitive nature of the collected data open a large number of challenges from a cybersecurity perspective. In this paper, we offer a fresh perspective on the IoT security landscape by providing a full list of reported vulnerabilites. By organizing protocols and vulnerabilities according to the TCP/IP stack, we guide both novice and expert users and developers in gaining a clear overview of the state-of-the-art IoT and its security issues. Furthermore, by discussing open problems and future directions, we think our paper will be helpful to the research community in designing the next generation of secure IoT.@en

The Internet of Things (IoT) is a pervasive phenomenon in our everyday life, binding and enabling communication between heterogeneous physical devices and the internet. The applications of this technology range from industrial control to medical devices, hence interconnecting a huge number of devices collecting sensitive information. Although this provides a highly dynamic network with extensive capabilities, its widespread adoption and sensitive nature of the collected data open a large number of challenges from a cybersecurity perspective. In this paper, we offer a fresh perspective on the IoT security landscape by providing a full list of reported vulnerabilites. By organizing protocols and vulnerabilities according to the TCP/IP stack, we guide both novice and expert users and developers in gaining a clear overview of the state-of-the-art IoT and its security issues. Furthermore, by discussing open problems and future directions, we think our paper will be helpful to the research community in designing the next generation of secure IoT.@en

Charging an EV (Electric Vehicle) comprises two phases: a) resource negotiation, and b) actual charging. While the former phase runs over secure communication protocols, the latter is usually assumed not to be a threat to security and privacy. However, we believe that the physical signals exchanged between the EV and the EVSE (Electric Vehicle Supply Equipment) represent information that a malicious user could exploit for profiling. Furthermore, as a large number of EVSEs has been deployed in public places to ease out-of-home EV charging, an attacker might easily have physical access to unsecured data. In this paper, we propose EVScout, a novel attack to profile EVs during the charging process. By exploiting the physical signals exchanged by the EV and the EVSE as a side-channel to extract information, EVScout builds a set of features peculiar for each EV. As an EVScout component, we also propose a novel feature extraction framework, based on the intrinsic characteristics of EV batteries, to identify features from the exchanged electric current. We implemented and tested EVScout over a set of real-world measurements (considering 100 charging sessions of 22 EVs). Numerical results show that EVScout could profile EVs, attaining a maximum of 0.9 recall and 0.85 precision. To the best of authors’ knowledge, these results set a benchmark for upcoming privacy research for EVs.@en

Charging an EV (Electric Vehicle) comprises two phases: a) resource negotiation, and b) actual charging. While the former phase runs over secure communication protocols, the latter is usually assumed not to be a threat to security and privacy. However, we believe that the physical signals exchanged between the EV and the EVSE (Electric Vehicle Supply Equipment) represent information that a malicious user could exploit for profiling. Furthermore, as a large number of EVSEs has been deployed in public places to ease out-of-home EV charging, an attacker might easily have physical access to unsecured data. In this paper, we propose EVScout, a novel attack to profile EVs during the charging process. By exploiting the physical signals exchanged by the EV and the EVSE as a side-channel to extract information, EVScout builds a set of features peculiar for each EV. As an EVScout component, we also propose a novel feature extraction framework, based on the intrinsic characteristics of EV batteries, to identify features from the exchanged electric current. We implemented and tested EVScout over a set of real-world measurements (considering 100 charging sessions of 22 EVs). Numerical results show that EVScout could profile EVs, attaining a maximum of 0.9 recall and 0.85 precision. To the best of authors’ knowledge, these results set a benchmark for upcoming privacy research for EVs.@en

Charging an EV (Electric Vehicle) comprises two phases: a) resource negotiation, and b) actual charging. While the former phase runs over secure communication protocols, the latter is usually assumed not to be a threat to security and privacy. However, we believe that the physical signals exchanged between the EV and the EVSE (Electric Vehicle Supply Equipment) represent information that a malicious user could exploit for profiling. Furthermore, as a large number of EVSEs has been deployed in public places to ease out-of-home EV charging, an attacker might easily have physical access to unsecured data. In this paper, we propose EVScout, a novel attack to profile EVs during the charging process. By exploiting the physical signals exchanged by the EV and the EVSE as a side-channel to extract information, EVScout builds a set of features peculiar for each EV. As an EVScout component, we also propose a novel feature extraction framework, based on the intrinsic characteristics of EV batteries, to identify features from the exchanged electric current. We implemented and tested EVScout over a set of real-world measurements (considering 100 charging sessions of 22 EVs). Numerical results show that EVScout could profile EVs, attaining a maximum of 0.9 recall and 0.85 precision. To the best of authors’ knowledge, these results set a benchmark for upcoming privacy research for EVs.@en

Blockchains are currently deployed in a large number of different scenarios, such as cryptocurrencies, communications, factory automation, and vehicular networks. Both academia's and industry's interest in this technology is motivated by its distributed nature and its inherent security in managing information. However, traditional blockchains are limited in terms of the transaction rate they can approve. To overcome this limitation, IOTA proposed a novel blockchain based on a Directed Acyclic Graph (DAG) structure (the Tangle). It handles a larger number of transactions to target high-traffic scenarios such as Internet of Things (IoT). However, the security of the IOTA's blockchain depends on the design of its underlying communication protocols. In this paper, we analyze the security of the IOTA Tangle from a transport layer perspective. In particular, we show that well-known port-based attacks can jeopardize the integrity and availability of the IOTA services. We focus on the IOTA's TCP-based ports, and provide a discussion of all the possible attacks and their effects. We assess their validity via experimental evaluation showing their effect on the network operations. Results show that SYN flooding affects the gossip protocol by fully disrupting the service. We also find that 16% of the nodes are unable to create a neighbours list, leading to a disruption of the information exchange process. On the other side, we also show that some components are not affected by these attacks. To the best of our knowledge, we are the first to identify and validate these vulnerabilities in IOTA. Lastly, we discuss some possible countermeasures.@en

Blockchains are currently deployed in a large number of different scenarios, such as cryptocurrencies, communications, factory automation, and vehicular networks. Both academia's and industry's interest in this technology is motivated by its distributed nature and its inherent security in managing information. However, traditional blockchains are limited in terms of the transaction rate they can approve. To overcome this limitation, IOTA proposed a novel blockchain based on a Directed Acyclic Graph (DAG) structure (the Tangle). It handles a larger number of transactions to target high-traffic scenarios such as Internet of Things (IoT). However, the security of the IOTA's blockchain depends on the design of its underlying communication protocols. In this paper, we analyze the security of the IOTA Tangle from a transport layer perspective. In particular, we show that well-known port-based attacks can jeopardize the integrity and availability of the IOTA services. We focus on the IOTA's TCP-based ports, and provide a discussion of all the possible attacks and their effects. We assess their validity via experimental evaluation showing their effect on the network operations. Results show that SYN flooding affects the gossip protocol by fully disrupting the service. We also find that 16% of the nodes are unable to create a neighbours list, leading to a disruption of the information exchange process. On the other side, we also show that some components are not affected by these attacks. To the best of our knowledge, we are the first to identify and validate these vulnerabilities in IOTA. Lastly, we discuss some possible countermeasures.@en

Blockchains are currently deployed in a large number of different scenarios, such as cryptocurrencies, communications, factory automation, and vehicular networks. Both academia's and industry's interest in this technology is motivated by its distributed nature and its inherent security in managing information. However, traditional blockchains are limited in terms of the transaction rate they can approve. To overcome this limitation, IOTA proposed a novel blockchain based on a Directed Acyclic Graph (DAG) structure (the Tangle). It handles a larger number of transactions to target high-traffic scenarios such as Internet of Things (IoT). However, the security of the IOTA's blockchain depends on the design of its underlying communication protocols. In this paper, we analyze the security of the IOTA Tangle from a transport layer perspective. In particular, we show that well-known port-based attacks can jeopardize the integrity and availability of the IOTA services. We focus on the IOTA's TCP-based ports, and provide a discussion of all the possible attacks and their effects. We assess their validity via experimental evaluation showing their effect on the network operations. Results show that SYN flooding affects the gossip protocol by fully disrupting the service. We also find that 16% of the nodes are unable to create a neighbours list, leading to a disruption of the information exchange process. On the other side, we also show that some components are not affected by these attacks. To the best of our knowledge, we are the first to identify and validate these vulnerabilities in IOTA. Lastly, we discuss some possible countermeasures.@en

Blockchains are currently deployed in a large number of different scenarios, such as cryptocurrencies, communications, factory automation, and vehicular networks. Both academia's and industry's interest in this technology is motivated by its distributed nature and its inherent security in managing information. However, traditional blockchains are limited in terms of the transaction rate they can approve. To overcome this limitation, IOTA proposed a novel blockchain based on a Directed Acyclic Graph (DAG) structure (the Tangle). It handles a larger number of transactions to target high-traffic scenarios such as Internet of Things (IoT). However, the security of the IOTA's blockchain depends on the design of its underlying communication protocols. In this paper, we analyze the security of the IOTA Tangle from a transport layer perspective. In particular, we show that well-known port-based attacks can jeopardize the integrity and availability of the IOTA services. We focus on the IOTA's TCP-based ports, and provide a discussion of all the possible attacks and their effects. We assess their validity via experimental evaluation showing their effect on the network operations. Results show that SYN flooding affects the gossip protocol by fully disrupting the service. We also find that 16% of the nodes are unable to create a neighbours list, leading to a disruption of the information exchange process. On the other side, we also show that some components are not affected by these attacks. To the best of our knowledge, we are the first to identify and validate these vulnerabilities in IOTA. Lastly, we discuss some possible countermeasures.@en