Invisible QR codes tackle counterfeit bank notes

Sep. 12, 2012 — An invisible quick response (QR) code has been created by researchers in an attempt to increase security on printed documents and reduce the possibility of counterfeiting, a problem which costs governments and private industries billions of pounds each year.

Publishing their research today, 12 September, in IOP Publishing's journal Nanotechnology, the researchers from the University of South Dakota and South Dakota School of Mines and Technology believe the new style of QR code could also be used to authenticate virtually any solid object.

The QR code is made of tiny nanoparticles that have been combined with blue and green fluorescence ink, which is invisible until illuminated with laser light. It is generated using computer-aided design (CAD) and printed onto a surface using an aerosol jet printer. The development process can be viewed in this video http://www.youtube.com/watch?v=5eqtQq1Ol14

According to the researchers, the QR code will add an increased level of security over existing counterfeiting methods as the complexity of the production process makes it very difficult to replicate.

The combination of the blue and green inks also enabled the researchers to experiment with a variety of characters and symbols in different colours and sizes, varying from microscopic to macroscopic. Embedding these into the QR code further increases the level of security.

Under normal lighting conditions the QR code is invisible but becomes visible when near infra-red light is passed over it. This process, known as upconversion, involves the absorption of photons by the nanoparticles at a certain wavelength and the subsequent emission of photons at a shorter wavelength.

Once illuminated by the near infra-red light, the QR code can be read by a smartphone in the conventional manner.

QR codes can hold one hundred times more information than conventional barcodes and have traditionally been used in advertising and marketing. For example, simply scanning a QR code on a commercial product with a smartphone will take the user to a company's website, giving them more information about the product they are scanning.

The nanoparticles that were used to print the QR code are both chemically and mechanically stable meaning they could withstand the stresses and strains of being placed on paper. To prove this, the researchers printed the QR code onto a piece of paper and then randomly folded it fifty times; the code was still readable.

In addition to being printed on paper, the QR code has also been printed on glass and a flexible plastic film, demonstrating its applicability to a wide variety of solid commercial goods. The fact that the QR code is invisible is also beneficial as it would not interfere with the physical appearance of the goods.

The whole procedure took one-and-a-half hours, from the CAD process to the printing and then the scanning; however, the researchers are confident that once the QR file has been created, the printing en masse for commercial use would take around 10-15 minutes.

Lead author of the study, Jeevan Meruga, said: "The QR code is tough to counterfeit. We can also change our parameters to make it even more difficult to counterfeit, such as controlling the intensity of the upconverting light or using inks with a higher weight percentage of nanoparticles.

"We can take the level of security from covert to forensic by simply adding a microscopic message in the QR code, in a different coloured upconverting ink, which then requires a microscope to read the upconverted QR code."

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by Institute of Physics (IOP), via AlphaGalileo.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Journal Reference:

Jeevan M Meruga, William M Cross, P Stanley May, QuocAnh Luu, Grant A Crawford, Jon J Kellar. Security printing of covert quick response codes using upconverting nanoparticle inks. Nanotechnology, 2012; 23 (39): 395201 DOI: 10.1088/0957-4484/23/39/395201

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Cell network security holes revealed, with an app to test your carrier

May 21, 2012 — Popular firewall technology designed to boost security on cellular networks can backfire, unwittingly revealing data that could help a hacker break into Facebook and Twitter accounts, a new study from the University of Michigan shows.

The researchers also developed an Android app that tells phone users when they're on a vulnerable network. They will present their work May 22 at the IEEE Symposium on Security and Privacy in San Francisco.

Using Android smartphones, computer science associate professor Z. Morley Mao and doctoral student Zhiyun Qian revealed how an attacker could hijack a TCP Internet connection by taking advantage of publicly available information on smartphones; users' willingness to download untrusted apps; and network firewall middleboxes, which block data bundles that don't appear to be part of the flow of information traffic.

The researchers detected these middleboxes on 32 percent of the nearly 150 networks they tested worldwide.

"Firewall middleboxes are supposed to protect against this kind of attack, but it turns out they do the opposite," Qian said. "Most vendors and carriers that deploy such firewall middleboxes still believe they are safe and we want them to be aware of this design flaw."

Middleboxes monitor the "sequence numbers" of data packets on their way to mobile devices. When you snap and share a photo with a friend, for example, it gets chopped into numerous packets before it's sent across the network. Your friend's smartphone looks to the sequence numbers to put the picture back together. Middleboxes could help hackers use the process of elimination to home in on a number in the right range.

"An attacker can try to guess at sequence numbers. It's usually hard to get feedback on whether a guessed number is correct, but the firewall middlebox makes this possible," Qian said. "The attacker can try a range of sequence numbers. The firewall will only allow one through if it is in the valid range."

In their test, the researchers used a binary search process that can rule out half of the possible numbers at a time. In 32 rounds, which take just seconds to complete, this process guarantees that they'll arrive at a valid number and get a packet through.

How does the attacker know he has succeeded? That's where the Android spyware comes in (smartphone malware is already very popular, the researchers say, and it wouldn't be hard for an attacker to add this capability into an existing program). The intelligence the spyware needs is not privileged information. It doesn't need special administrator or root access. It would just read a couple of the phone's publicly available incoming packet counters and let the attacker know when the counters advanced.

Armed with a valid sequence number, the hacker could spoof Facebook or Twitter's HTTP (as opposed to the more secure HTTPS) web login page and gain the user's passwords.

The attack Qian and Mao propose illustrates a susceptibility in the so-called sandboxing safety mechanism that smartphone platforms utilize. Sandboxing isolates an app to a certain piece of memory, with the intention of protecting the rest of the phone from any tampering.

"What's surprising here is that this shows how malware can, in a sense, reach out of its sandbox and tamper with other legitimate apps such as your browser," Qian said.

Qian's app, Firewall Middlebox Detection, is available free of charge at https://play.google.com/store/apps/details?id=edu.umich.eecs.firewall

The paper is called "Off-Path TCP Sequence Number Inference Attack, How Firewall Middleboxes Reduce Security."

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by University of Michigan.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Risk-based passenger screening could make air travel safer

Jan. 31, 2012 — Anyone who has flown on a commercial airline since 2001 is well aware of increasingly strict measures at airport security checkpoints. A study by Illinois researchers demonstrates that intensive screening of all passengers actually makes the system less secure by overtaxing security resources.

University of Illinois computer science and mathematics professor Sheldon H. Jacobson, in collaboration with Adrian J. Lee at the Central Illinois Technology and Education Research Institute, explored the benefit of matching passenger risk with security assets. The pair detailed their work in the journal Transportation Science.

"A natural tendency, when limited information is available about from where the next threat will come, is to overestimate the overall risk in the system," Jacobson said. "This actually makes the system less secure by over-allocating security resources to those in the system that are low on the risk scale relative to others in the system."

When overestimating the population risk, a larger proportion of high-risk passengers are designated for too little screening while a larger proportion of low-risk passengers are subjected to too much screening. With security resources devoted to the many low-risk passengers, those resources are less able to identify or address high-risk passengers. Nevertheless, current policies favor broad screening.

"One hundred percent checked baggage screening and full-body scanning of all passengers is the antithesis of a risk-based system," Jacobson said. "It treats all passengers and their baggage as high-risk threats. The cost of such a system is prohibitive, and it makes the air system more vulnerable to successful attacks by sub-optimally allocating security assets."

In an effort to address this problem, the Transportation Security Administration (TSA) introduced a pre-screening program in 2011, available to select passengers on a trial basis. Jacobson's previous work has indicated that resources could be more effectively invested if the lowest-risk segments of the population -- frequent travelers, for instance -- could pass through security with less scrutiny since they are "known" to the system.

A challenge with implementing such a system is accurately assessing the risk of each passenger and using such information appropriately. In the new study, Jacobson and Lee developed three algorithms dealing with risk uncertainty in the passenger population. Then, they ran simulations to demonstrate how their algorithms, applied to a risk-based screening method, could estimate risk in the overall passenger population -- instead of focusing on each individual passenger -- and how errors in this estimation procedure can be mitigated to reduce the risk to the overall system.

They found that risk-based screening, such as the TSA's new Pre-Check program, increases the overall expected security. Rating a passenger's risk relative to the entire flying population allows more resources to be devoted to passengers with a high risk relative to the passenger population.

The paper also discusses scenarios of how terrorists may attempt to thwart the security system -- for example, blending in with a high-risk crowd so as not to stand out -- and provides insights into how risk-based systems can be designed to mitigate the impact of such activities. "The TSA's move toward a risk-based system is designed to more accurately match security assets with threats to the air system," Jacobson said. "The ideal situation is to create a system that screens passengers commensurate with their risk. Since we know that very few people are a threat to the system, relative risk rather than absolute risk provides valuable information."

The National Science Foundation and the U.S. Air Force Office of Scientific Research supported this work.

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by University of Illinois at Urbana-Champaign.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Journal Reference:

A. J. Lee, S. H. Jacobson. Addressing Passenger Risk Uncertainty for Aviation Security Screening. Transportation Science, 2011; DOI: 10.1287/trsc.1110.0384

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Data storage: Going with the grain

Oct. 25, 2012 — Reducing information stored in magnetic thin films to the physical size of single grains could improve computer hard drives.

Despite the increasing competition from alternative technologies such as solid-state drives, magnetic disks remain an important data-storage technology. They are not only reliable and inexpensive, but their storage density has potential for even further improvement. One method under current investigation is storing each data bit in a single magnetic grain of the thin film of the recording medium, rather than in several grains as in conventional hard drives. Storage in single grains only would increase stability and reduce the magnetic fields required to write bits.

By modeling write processes in hard disks, Melissa Chua and her co-workers at the A*STAR Data Storage Institute, Singapore, have demonstrated how this is possible in practice. "The hope is that such a grain-based magnetic recording can extend storage densities by an order of magnitude, to achieve ten terabits per square inch," she says.

Thin magnetic films for data storage coat the top layer of plastic films in hard-disk drives and consist of many neighboring nanometer-sized grains. As storage density of magnetic films has increased over the years, the surface area used for storage per bit is now comparable to the size of these grains.

Achieving single-grain storage requires a solid understanding of the write processes. Two theoretical models are available to describe these processes. One is an analytical model that uses a simplified description of the magnetic fields within the grains and within the write head of the hard disk. This model achieves fast and easy-to-implement modeling of the recording process, Chua notes.

The second model is a statistical approach that uses tabulated values of parameters that detail the magnetic orientation switching process when information is written to the hard disk. These parameters are derived from detailed simulations of the magnetic fields in the grains and from the computer hard drive write head. From these, the researchers produced a probability for a grain to switch under given circumstances. This detailed approach is more accurate, but also more time intensive than the analytical approach.

Chua and her co-workers successfully applied both models to the grain-based storage process. They simulated the switching of single grains with both methods and then compared their individual performance. By adjusting relevant process parameters for both models, they achieved good agreement between them. Having shown the suitability of both models, choosing which model to use depends on specifics, such as the desired accuracy. Either way, Chua says, "Both models enable the system-level testing of future magnetic recording technologies."

The A*STAR-affiliated researchers contributing to this research are from the Data Storage Institute.

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by The Agency for Science, Technology and Research (A*STAR), via ResearchSEA.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Frankenstein programmers test a cybersecurity monster

Aug. 27, 2012 — In order to catch a thief, you have to think like one.

UT Dallas computer scientists are trying to stay one step ahead of cyber attackers by creating their own monster. Their monster can cloak itself as it steals and reconfigures information in a computer program.

In part because of the potentially destructive nature of their technology, creators have named this software system Frankenstein, after the monster-creating scientist in author Mary Shelley's novel, Frankenstein; or The Modern Prometheus.

"Shelley's story is an example of a horror that can result from science, and similarly, we intend our creation as a warning that we need better detections for these types of intrusions," said Dr. Kevin Hamlen, associate professor of computer science at UT Dallas who created the software, along with his doctoral student Vishwath Mohan. "Criminals may already know how to create this kind of software, so we examined the science behind the danger this represents, in hopes of creating counter measures."

Frankenstein is not a computer virus, which is a program that can multiply and take over other machines. But, it could be used in cyber warfare to provide cover for a virus or another type of malware, or malicious software.

In order to avoid antivirus software, malware typically mutates every time it copies itself onto another machine. Antivirus software figures out the pattern of change and continues to scan for sequences of code that are known to be suspicious.

Frankenstein evades this scanning mechanism. It takes code from programs already on a computer and repurposes it, stringing it together to accomplish the malware's malicious task with new instructions.

"We wanted to build something that learns as it propagates," Hamlen said. "Frankenstein takes from what is already there and reinvents itself."

"Just as Shelley's monster was stitched from body parts, our Frankenstein also stitches software from original program parts, so no red flags are raised," he said. "It looks completely different, but its code is consistent with something normal."

Hamlen said Frankenstein could be used to aid government counter terrorism efforts by providing cover for infiltration of terrorist computer networks. Hamlen is part of the Cyber Security Research and Education Center in the Erik Jonsson School of Engineering and Computer Science.

The UT Dallas research is the first published example describing this type of stealth technology, Hamlen said.

"As a proof-of-concept, we tested Frankenstein on some simple algorithms that are completely benign," Hamlen said. "We did not create damage to anyone's systems."

The next step, Hamlen said, is to create more complex versions of the software.

Frankenstein was described in a paper published online (https://www.usenix.org/conference/woot12/frankenstein-stitching-malware-benign-binaries) in conjunction with a presentation at a recent USENIX Workshop on Offensive Technologies.

The research was supported by the National Science Foundation and Air Force Office of Scientific Research.

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by University of Texas, Dallas.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Major step taken towards 'unbreakable' message exchange

Aug. 3, 2012 — Single particles of light, also known as photons, have been produced and implemented into a quantum key distribution (QKD) link, paving the way for unbreakable communication networks.

The results of the experiment, undertaken by a close collaboration of researchers based in Wuerzburg, Munich and Stuttgart, have been published August 2, in the Institute of Physics and German Physical Society's New Journal of Physics.

The single photons were produced using two devices made of semiconductor nanostructures that emitted a photon each time they were excited by an electrical pulse. The two devices were made up of different semiconductor materials so they emitted photons with different colours.

QKD is not a new phenomenon and has been in commercial use for several years; one of its first uses was to encode the national election ballot results in Switzerland in 2007. The techniques currently being used on a commercial scale rely on lasers to create the source of photons; however, researchers hope to further increase the efficiency of QKD by returning to the original concept of using single photons for generating a secure key.

One of the project coordinators, Dr Sven Hoefling, said: "The nature of light emitted by lasers is very different from light emitted by single photon sources. Whereas the emission events in lasers occur completely random in time, an ideal single photon source emits exactly one photon upon a trigger event, which in our case is an electrical pulse.

"The random nature of emission events from strongly attenuated lasers sometimes results in the emission of two photons very close to each other. Such multiple photon events can be utilized by an eavesdropper to extract information.

"Single photon sources, such as the ones used in our study, are predestined for use in the secure communication systems using quantum communication protocols."

QKD is a process that enables two parties, 'Alice' and 'Bob', to share a secret key that can then be used to protect data they want to send to each other. The secret key is made up of a stream of photons that 'spin' in different directions -- vertically, horizontally or diagonally -- according to the sender's preferences.

The laws of physics state that it is not possible to measure the state, or 'spin', of a particle like a photon without altering it, so if 'Eve' attempted to intercept the key that was sent between 'Alice' and 'Bob', it would become instantly noticeable.

In their experiment, the single photons were produced with high efficiency, then made into a key and successfully transmitted from the sender to the receiver across 40 cm of free space in the laboratory.

The researchers are aware that to make this experiment more practical and commercially viable, it needs to be scaled up so that quantum keys can be sent over larger distances. To do this, quantum repeater stations need to be incorporated into the network to 'amplify' the message.

"Meanwhile, quantum keys have been sent over 500 metres of free space on top of the roofs in the centre of Munich, Germany. Several projects have also been funded to develop this technology further," continued Hoefling.

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by Institute of Physics (IOP), via AlphaGalileo.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Journal Reference:

Tobias Heindel, Christian A Kessler, Markus Rau, Christian Schneider, Martin Fürst, Fabian Hargart, Wolfgang-Michael Schulz, Marcus Eichfelder, Robert Roßbach, Sebastian Nauerth, Matthias Lermer, Henning Weier, Michael Jetter, Martin Kamp, Stephan Reitzenstein, Sven Höfling, Peter Michler, Harald Weinfurter, Alfred Forchel. Quantum key distribution using quantum dot single-photon emitting diodes in the red and near infrared spectral range. New Journal of Physics, 2012; 14 (8): 083001 DOI: 10.1088/1367-2630/14/8/083001

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here

Self-adapting computer network that defends itself against hackers?

May 10, 2012 — In the online struggle for network security, Kansas State University cybersecurity experts are adding an ally to the security force: the computer network itself.

Scott DeLoach, professor of computing and information sciences, and Xinming "Simon" Ou, associate professor of computing and information sciences, are researching the feasibility of building a computer network that could protect itself against online attackers by automatically changing its setup and configuration.

DeLoach and Ou were recently awarded a five-year grant of more than $1 million from the Air Force Office of Scientific Research to fund the study "Understanding and quantifying the impact of moving target defenses on computer networks." The study, which began in April, will be the first to document whether this type of adaptive cybersecurity, called moving-target defense, can be effective. If it can work, researchers will determine if the benefits of creating a moving-target defense system outweigh the overhead and resources needed to build it.

Helping Ou and DeLoach in their investigation and research are Kansas State University students Rui Zhuang and Su Zhang, both doctoral candidates in computing and information sciences from China, and Alexandru Bardas, doctoral student in computing and information sciences from Romania.

As the study progresses the computer scientists will develop a set of analytical models to determine the effectiveness of a moving-target defense system. They will also create a proof-of-concept system as a way to experiment with the idea in a concrete setting.

"It's important to investigate any scientific evidence that shows that this approach does work so it can be fully researched and developed," DeLoach said. He started collaborating with Ou to apply intelligent adaptive techniques to cybersecurity several years ago after a conversation at a university open house.

The term moving-target defense -- a subarea of adaptive security in the cybersecurity field -- was first coined around 2008, although similar concepts have been proposed and studied since the early 2000s. The idea behind moving-target defense in the context of computer networks is to create a computer network that is no longer static in its configuration. Instead, as a way to thwart cyber attackers, the network automatically and periodically randomizes its configuration through various methods -- such as changing the addresses of software applications on the network; switching between instances of the applications; and changing the location of critical system data.

Ou and DeLoach said the key is to make the network appear to an attacker that it is changing chaotically while to an authorized user the system operates normally.

"If you have a Web server, pretty much anybody in the world can figure out where you are and what software you're running," DeLoach said. "If they know that, they can figure out what vulnerabilities you have. In a typical scenario, attackers scan your system and find out everything they can about your server configuration and what security holes it has. Then they select the best time for them to attack and exploit those security holes in order to do the most damage. This could change that."

Creating a computer network that could automatically detect and defend itself against cyber attacks would substantially increase the security of online data for universities, government departments, corporations and businesses -- all of which have been the targets of large-scale cyber attacks.

In February 2011 it was discovered that the Nasdaq Stock Market's computer network had been infiltrated by hackers. Although federal investigators concluded that it was unlikely the hackers stole any information, the network's security had been left vulnerable for more than a year while the hackers visited it numerous times.

According to Ou, creating a moving-target defense system would shift the power imbalance that currently resides with hackers -- who need only find a single security hole to exploit -- back to the network administrators -- who would have a system that frequently removes whatever security privileges attackers may gain with a new clean slate.

"This is a game-changing idea in cybersecurity," Ou said. "People feel that we are currently losing against online attackers. In order to fundamentally change the cybersecurity landscape and reduce that high risk we need some big, fundamental changes to the way computers and networks are constructed and organized."

Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by Kansas State University.

Note: Materials may be edited for content and length. For further information, please contact the source cited above.

Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.

View the original article here