2023 INTERSCT. Conference

Attackers continuously scan the internet for vulnerable systems. Like opportunistic vultures they will flock around newly discovered vulnerabilities on exposed endpoints. At least, that is what we are led to believe. But is this really true? Is your attack surface solely defined by which network services you offer publicly, or is there more? In this talk Ralph Moonen will provide new insights in what the concept ‘attack surface’ can mean in the context of modern internet infrastructures. Many vendors offering solutions for Attack Surface Management are focused on discovery, while there are also some research topics that need attention that Ralph will address, such as risk ratings, completeness, IPv6 and others.

● Sezen Acur (TNO) on “SOS! Ensuring Safety And Security In An Expanding System of Systems Landscape”

Security and safety are often buzzwords used in complex environments to raise awareness of a system vulnerabilities as well as possible risks. Ensuring safety and security are difficult as there are multiple parties across the globe working on the same systems, there are many uncertainties and no specific set of standards one can follow for a guarantee. Therefore, how can we safeguard a system or deal with uncertainties? What if there is a lack of knowledge or ignorance towards safety and security? This presentation provides an overview of how safety and security shall be addressed within changing system landscapes and in a system of systems environment.

● Arina Kudriavtseva (UL) on “Secure Software Development Methodologies: A Multivocal Literature Review”

A recognized way to improve security is through the adoption of methodologies that implement security practices at each step of the software development lifecycle (SDLC). While different methodologies have been proposed to address software security, and new ones continue to emerge regularly, we continue to observe many new software vulnerabilities and data breaches. This talk will provide an overview of security practices involved in 28 secure software development methodologies from industry, government, and academia. We will talk about security practices and auxiliary (non-technical) practices these methodologies use. Furthermore, we will talk about the methods used to provide evidence of the effectiveness of the methodologies.

● Cristian Daniele, Seyed Andarzian and Erik Poll (RU) on “Stateful security testing”

Fuzzing is a successful testing technique to find vulnerabilities, but still mostly used at testing stateless systems.  In this talk we will discuss efficient fuzzing strategies for network protocols and the challenges to fuzzing stateful systems.  For the latter we present AFL*, an AFL-based fuzzer that leverages AFL’s persistent mode to efficiently fuzz stateful systems,  three orders of magnitude faster AFLNet, an earlier stateful variant of AFL.

● Ting-Han Chen (UT) on “Challenges of responsible disclosure at scale”

To improve the safety of ICT infrastructure, security experts have teamed up with stakeholders with the principle of coordinated vulnerability disclosure. However, the involved parties and scale have increased with the addition of IoT networks. How can we adopt new strategies for IoT vulnerability disclosure? Let’s look at the challenges and opportunities together!

● Cristoffer Leite (TU/e) on “Actionable Cyber Threat Intelligence for Automated Incident Response”

Applying Cyber Threat Intelligence (CTI) for active cyber defense, while potentially very beneficial, is currently limited to predominantly manual use. We propose an automated `actionable’ approach that creates network detectable attack patterns from Tactics, Techniques and Procedures (TTPs) from intelligence reports. The CTI related to matching patterns provides essential context to interpreting network incidents. We evaluate our approach with publicly available samples of different malware families, showing it can reliably match network incidents with intelligence reports.
By increasing automation, our approach addresses one of the major limiting factors of effective use of CTI.

● Martin Rosso (TU/e) on “The OTCAD attack database; highlights and uses”

This talk will focus on how we use OTCAD, a structured database of industrial IoT cyberattacks, to characterize attacks against industrial IoT systems. OTCAD reveals how cyberattacks against IoT change over time and how attacks differ across industrial domains. We briefly explore how ‘context factors’ of industrial IoT networks may influence the type of cyberattacks these systems face. By analyzing the IoT threat landscape, we can improve threat models with real-world observations and eventually help to build effective solutions.

● Richard Clayton (University of Cambridge) on “A sophisticated attack?”
Almost every cybercrime is reported to be a “sophisticated attack”. This talk examines how incentives align to misrepresent very run-of-the-mill events in this manner — with some illustrations drawn from many years experience in monitoring attempts by “Mirai”-like IoT malware to infect IoT devices.

● Harm Griffoen (TUD) on “Scan, Test, Execute. Identifying Adversarial Tactics in Amplification Attacks”
Amplification attacks generate an enormous flood of unwanted traffic towards a victim and are generated with the help of open, unsecured services, to which an adversary sends spoofed service requests that trigger large answer volumes to a victim. However, the actual execution of the packet flood is only one of the activities necessary for a successful attack. Adversaries need, for example, to develop attack tools, select open services to abuse, test them, and adapt the attacks if necessary, each of which can be implemented in myriad ways. Thus, to understand the entire ecosystem and how adversaries work, we need to look at the entire chain of activities. In this talk, we analyzes these adversarial techniques, tactics, and procedures (TTPs) based on 549 honeypots deployed in 5 clouds that were rallied to participate in 13,479 attacks.

● Asier Moneva (NWO-i NSCR) on “Stolen Data Markets on Telegram: Crime Script and Situational Crime Prevention Measures”
Illicit data markets have emerged on Telegram, an online instant messaging application. Thousands of users participate in these markets where vendors offer large volumes of sensitive data and customers bid for them. This presentation describes how Telegram data markets operate and argues what interventions could be used to disrupt them. Using crime script analysis, we observed sixteen Telegram meeting places (i.e., channels and groups) and studied how they operate. We obtained information about how the different meeting places function, what are their inside rules, and how users advertise and trade data. Based on the crime script, we then suggest four feasible situational crime prevention measures to disrupt these markets: takedowns, reporting, spamming and flooding, and warning banners.

● Lorenz Kustosch (TUD) on “Consumer expectations of IoT security and privacy: Reasonable and normative perspectives and their role in product liability law”
Consumer Internet-of-Things (IoT) devices and their users repeatedly face security and privacy incidents, and it is unclear who is responsible to respond and in what way. For safety-related incidents, product liability and conformity regulations protect users in case of product defects and ensure that manufacturers comply with minimal requirements. Such mechanisms do not exist for security or privacy ‘defects’ yet. In this talk, we will present work we did on empirically measuring consumer expectations about IoT devices’ security and privacy, and how such expectations of consumers can play a role in product liability and conformity law and regulation for IoT devices.

● Mattis van ‘t Schip (RU) on “Supply Chain Cybersecurity and the NIS2 Directive: A New Pathway for IoT Cybersecurity?”
The recently adopted NIS2 Directive from the European Union contains rules for the cybersecurity risk management of “network and information systems” used in the most critical sectors (e.g., energy, health). Among the rules, the Directive requires “supply chain security” measures in these sectors. In this presentation, I delve into the meaning of this particular set of rules for the cybersecurity of Internet of Things devices in critical sectors.

• Leon Klomp (NWO)
• Claire Selbeck (RVO)
• René Kamphuis  (dcypher)

• professor Ross Anderson (University of Cambridge and University of Edinburgh)
• professor Eleni Kosta (Tilburg University)
• Nelly Ghaoui (Ministry of Economic Affairs and Climate Policy, Digital Economy)
• Petra Oldengarm (Cyberveilig Nederland)