Presentation on theme: "Emergent Vulnerabilities And Attacks: A complex threat landscape"— Presentation transcript:
1 Emergent Vulnerabilities And Attacks: A complex threat landscape Nathaniel HustedIndiana University
2 Personal Introduction PhD Candidate at Indiana UniversityFocus in “Security Informatics” from the School of Informatics and ComputingPrimarily interested in the intersection between Complex Systems and Information SecurityOther work includes applied cryptography and GPU programmingYou can find other work by me at:Involved in the Midwest Hacker Scene via Derbycon (
3 Evolutions in devices and the Internet are changing threats. “Smart” Mobile devices are ubiquitousSmartphones are now the dominant phone device in most developed nations.Their market share is growing rapidly in developing nations.Our Internet usage behavior has changed.No longer primarily “consumption” orientedFar more “production” orientedOur Internet usage has gone from reading news articles, papers, and various informational pages to content creation via social networks and community media distribution sites (like Youtube).
4 Evolutions in devices and the Internet are changing threats. We now generate far more personal and sensitive information.We now carry all this sensitive information with us in a small box that has a high-speed always-on Internet connection.This small box is (generally) always on our person.Our digital social interactions reflect our physical social interactions far more then they used to.The combination of social interaction, the physical world, and the digital world, create a new threat landscape that involves Emergent Vulnerabilities and Emergent Attacks.Before discussing the new threat landscape I need to clarify what I mean by complexity
5 Discussing Emergent Vulnerabilities and Attacks I’ll start with definitions.I’ll explain the domain specific vocabulary from the definitions.We’ll return to the definitions after an understanding of the vocabulary.We’ll talk about how emergent vulnerabilities and attacks effect privacy.
6 Emergent Vulnerabilities An emergent vulnerability is a property of a complex system that causes one or more elements of that complex system, whether they be software, hardware, or individuals, to enter in to a vulnerable state if and only if that complex system is in an appropriate macro- emergent state.This is a modification of Bishop’s original definition of vulnerability 
7 Emergent Attacks An emergent attack is one, or both, of the following: An attack whose outcomes exhibit emergent or self-organizing properties.An attack that relies on self-organized collusion between attackers.This is a modification of Bishop’s original definition of attack .
8 Required background vocabulary. Complex SystemEmergence and Macro-EmergentSelf-Organization
9 What is a Complex System? The focus of the discipline called Complex Systems.It’s not the same as a “complicated” system.Is known by many names:Complex Adaptive Systems Complex NetworksOrganized Complexity My focus on defining organized complexity will go from less formal to more formal
10 Organized Complexity according to Warren Weaver. “What makes an evening primrose open when it does? Why does salt fail to satisfy thirst? Why can one particular genetic strain of microorganisms synthesize within its minute body a certain organic compounds that another strain of the same organism cannot manufacture?”
11 Situating the definition of Organized Complexity. Best understood when situated between its sibling problem spaces:Organized SimplicitySolutions: Discrete mathematical analysis.Organized Complexity???Disorganized ComplexitySolutions: Statistical mechanics.
12 A limited working definition for Complex Systems. Systems have the following:Many agents each with a set of descriptive propertiesThe agents interact with one anotherIt exists in some environmentA Complex System is a system that exhibits the properties of Organized Complexity in that it displays one or both of the following:EmergenceSelf-OrganizationI’m currently working on a more formal definition of system and complex system and anyone interesting can discuss the work definitions with me offline as they’re a tough out of scope for this talk given time.
13 Examples of Complex Systems An Ant ColonyA Social Network
14 EmergenceA phenomenon where the dynamic behavior of a system’s elements allow the system as a whole to exhibit a different and novel behavior.Four rules can create very interesting emergent behaviors.
15 Emergence De Wolf and Holvoet  provide 8 characteristics: The system must exhibit the micro-macro effect.The macro level behavior must be radically novel.The macro-emergent must exhibit coherence.The elements of a system must be able to interact.The system must change over timeThe system must not be centrally controlledThere must be a two-way link between micro and macro behavior.The system must be robust and flexible.
16 Emergence: The Game Of Life From four simple rules, novel behaviors emerge.Four rules can create very interesting emergent behaviors.
17 Self-OrganizationA phenomenon where the dynamic behavior of a system’s elements allow the system to organize itself with no exterior control.
18 Self-Organization Self-Organization must meet five characteristics: There must be no external control.There must be some “measurable” increase in order over a period of time.The system must be robust to changes.The elements must interact.There must be no global synchronization of signal passing.
19 Self-Organization: A School of Fish Fish organize based on the position of the nearest fish and potential environment cues.
20 Dissecting the definition of Emergent Vulnerability An emergent vulnerability is a property of a complex system that causes one or more elements of that complex system, whether they be software, hardware, or individuals, to enter in to a vulnerable state if and only if that complex system is in an appropriate macro- emergent state.
21 Dissecting the definition of Emergent Vulnerability: An Example Example: A Wireless Tracking Network The Complex System: Individuals and their mobile devicesThe Environment: A metropolitan areaThe Interaction:General human mobility ( Commutes, Shopping, etc.)Detecting wireless signals when in rangeThe Vulnerable State: Given enough detectors in an area, individuals can have their movements tracked a majority of the time.
22 Dissecting the definition of Emergent Vulnerability: An Example
23 Dissecting the definition of Emergent Vulnerability: An Example
24 Dissecting the definition of Emergent Attack An emergent attack is one, or both, of the following:An attack whose outcomes exhibit emergent or self-organizing properties.An attack that relies on self-organized collusion between attackers.
25 Dissecting the definition of Emergent Attack: An Example Example: The SoundComber prototype malware .Complex System: A set of malicious application each having a very simple behaviorEnvironment: Software ecosystem on a smartphoneThe Interaction:First application collects and processes audio dataSecond application exfiltrates the data.The Self-Organizing Behavior:Malware split in to many autonomous parts that organize to exfiltrate private data.
26 Dissecting the definition of Emergent Attack: An Example MalloryAlice’s SmartphoneAndroid’s Audio InterfaceInternet AccessSend out resultsAnalyze DTFM TonesSide Channel
27 Emergent Vulnerabilities and Attacks as threats to privacy. The naïve reason: Most modern attacks focus on stealing your PIITheir existences relies on social norms and interactions, thus tying them to personal information and actions.
28 Why should we care about Emergent Vulnerabilities and Attacks? I’m aware of no work done to formalize them.Some work as been done that demonstrates examples, but does not use the terminology.Sound ComberMobile EpidemiologyThey are bound to show as mobile devices and constant networked activity become the norm.
29 Conclusion This work is expanded on in my dissertation Follow my dissertation work in progressI recommend dissertating in the open!Emergent Vulnerabilities and Attacks provide a foundational paradigm in which to discuss threats that we will face in the future.We must work on formalizing a set of techniques to analyze the threat they pose.Agent Based ModelingEpidemiologyProvenance
31 Citations Bishop, Matt. "Introduction to Computer Security." (2004). Holland, John H. "Complex adaptive systems." Daedalus (1992):Weaver, Warren. "Science and complexity." American scientist (1948):De Wolf, Tom, and Tom Holvoet. "Emergence versus self-organisation: Different concepts but promising when combined." Engineering self- organising systems. Springer Berlin Heidelberg,Schlegel, Roman, et al. "Soundcomber: A Stealthy and Context-Aware Sound Trojan for Smartphones." NDSS. VolHusted, Nathaniel, and Steven Myers. "Mobile location tracking in metro areas: malnets and others." Proceedings of the 17th ACM conference on Computer and communications security. ACM, 2010.