The Open Web Application Security Project (OWASP), released the “OWASP Top 10 Internet of Things 2018” list of the high-priority security vulnerabilities for IoT systems. The diversity of these vulnerabilities poses a great challenge toward development of a robust solution for their detection and mitigation. In this paper, we discuss the relationship between these vulnerabilities and the ones listed by OWASP Top 10 (focused on Web applications rather than IoT systems), how these vulnerabilities can actually be exploited, and in which cases static analysis can help in preventing them. Then, we present an extension of an industrial analyzer (Julia) that already covers five out of the top seven vulnerabilities of OWASP Top 10, and we discuss which IoT Top 10 vulnerabilities might be detected by the existing analyses or their extension. The experimental results present the application of some existing Julia’s analyses and their extension to IoT systems, showing its effectiveness of the analysis of some representative case studies.
We introduce a version of the Minority Game where the total number of available choices is , but the agents only have two available choices to switch. For all agents at an instant in any given choice, therefore, the other choice is distributed between the remaining options. This brings in the added complexity in reaching a state with the maximum resource utilization, in the sense that the game is essentially a set of MG that are coupled and played in parallel. We show that a stochastic strategy, used in the MG, works well here too. We discuss the limits in which the model reduces to other known models. Finally, we study an application of the model in the context of population movement between various states within a country during an ongoing epidemic. we show that the total infected population in the country could be as low as that achieved with a complete stoppage of inter-region movements for a prolonged period, provided that the agents instead follow the above mentioned stochastic strategy for their movement decisions between their two choices. The objective for an agent is to stay in the lower infected state between their two choices. We further show that it is the agents moving once between any two states, following the stochastic strategy, who are less likely to be infected than those not having (or not opting for) such a movement choice, when the risk of getting infected during the travel is not considered. This shows the incentive for the moving agents to follow the stochastic strategy.
Summary Smartphone and automotive technologies are rapidly converging, letting drivers enjoy communication and infotainment facilities and monitor in‐vehicle functionalities, via on‐board diagnostics (OBD) technology. Among the various automotive apps available in playstores, Android Auto infotainment and OBD‐II apps are widely used and are the most popular choice for smartphone to car interaction. Automotive apps have the potential of turning cars into smartphones on wheels but can be also the gateway of attacks. This paper defines a static analysis that identifies potential security risks in Android infotainment and OBD‐II apps. It identifies a set of potential security threats and presents an actual static analyzer for such apps. It has been applied to most of the highly rated infotainment apps available in the Google Play store, as well as on the available open‐source OBD‐II apps, against a set of possible exposure scenarios. Results show that almost 60% of such apps are potentially vulnerable and that 25% pose security threats related to the execution of JavaScript. The analysis of the OBD‐II apps shows possibilities of severe controller area network injections and privacy violations, because of leaks of sensitive information.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.