Timo Kiravuo - Academia.edu (original) (raw)

Papers by Timo Kiravuo

IGI Global eBooks, 2020

The developed society depends on many critical infrastructure processes, such as power generation... more The developed society depends on many critical infrastructure processes, such as power generation, water treatment, many types of manufacturing, and smart buildings. These processes need control and the automation industry has embraced the Internet to connect all these controls. However, the controlling devices thus opened to the world do not always have adequate safeguards to withstand malicious users. Many automation systems have default passwords or known and unknown backdoors. Also, often those systems are not updated to close security weaknesses found after original installation. The authors argue that while the industry is familiar with the notion of safety of equipment and processes, it has not focused enough on IT security. Several years ago the Shodan search engine showed how easy it is to find these control devices on the Internet. The authors followed this research line further by targeting one…

This chapter illustrates how the Internet changes human cognition and practices and skill demands... more This chapter illustrates how the Internet changes human cognition and practices and skill demands at work. It contrasts these phenomena with the current goals and methods of education and advocates its resulting need to change. We first show that there have been many cultural and technological developments in human history that have strongly altered the way humans think and behave. We then explain how the Internet has changed cognition, much like mass media have in the past. We then describe how the Internet has transformed work environments and required skill sets in the information society. On the basis of Bloom’s taxonomy of learning objectives, we then illustrate the incongruity between current educational goals and methods and the new and ever-changing demands at work. We conclude that the pressure on education to adapt to these developments has been increasing. We propose that the priorities in learning objectives need to be adjusted. We introduce three key aspects of future e...

IEE Mobility Conference 2005. The Second International Conference on Mobile Technology, Applications and Systems, 2005

ABSTRACT Packet switched cellular networks offer significant cost and capacity utilization benefi... more ABSTRACT Packet switched cellular networks offer significant cost and capacity utilization benefits for machine to machine (M2M) communications. However, the current cellular systems facilitate that communications must be initiated by the mobile station, as the architecture lacks needed monitoring and controlling functions. This study presents an architecture that offers an operator based solution for the management of M2M communications in an operator network. The management interface of this system is implemented by using the SIP protocol and its messaging and presence extensions. The prototype implementation is tested and found to be functional but limited in terms of scalability and denial of service vulnerability. Suggestions are presented in order to rectify these issues

Työssä tutkittiin mikrokernelikäyttöjärjestelmien ja verkonhallintaprotokollien soveltuvuutta aut... more Työssä tutkittiin mikrokernelikäyttöjärjestelmien ja verkonhallintaprotokollien soveltuvuutta automaatiokäyttöön, erityisesti tutkittiin Mach-käyttöjärjestelmää ja SNMPv1-protokollaa. Työ sisälsi sekä kirjallisuustutkimuksen että prototyyppilaitteiston suunnittelun ja toteutuksen. Mikrokernelikäyttöjärjestelmät ovat käyttöjärjestelmiä, joissa perinteisen käyttöjärjestelmän ytimen eli kernelin toiminnoista on mahdollisimman suuri osa siirretty ytimen ulkopuolelle. Tämä mahdollistaa ytimen koon pienentämisen ja järjestelmän luotettavuuden kasvattamisen. Mach on akateemisessa maailmassa tutkimuskäyttöön kehitetty suosittu mikrokerneli. Verkonhallintaprotokollat ovat tietoverkkojen hallintaan kehitettyjä määrämuotoista dataa siirtäviä protokollia, jotka tarjoavat hallittavan laitteen teknisestä toteutuksesta riippumattoman abstraktiokerroksen, mikä mahdollistaa tekniseltä toteutukseltaan erilaisten järjestelmien hallinnan yleiskäyttöisillä työkaluilla. Simple Network Management Protocol...

Digitalization is a megatrend that spreads information technology to all sectors of society. Netw... more Digitalization is a megatrend that spreads information technology to all sectors of society. Networking information systems, especially through the Internet, is a key factor in digitalization. In addition to information processing, these systems increasingly control physical processes and, in particular, the critical infrastructure of the society. While digital control systems, as a rule, increase efficiency and reliability, they also provide a broad reachable interface that provides opportunities for malicious actions that threaten the safety and security of society. This doctoral dissertation studies the vulnerabilities and weaknesses of the digitalized society. The research area is wide and has been approached by examining several smaller topics. Key findings include mapping known vulnerabilities in Ethernet, and that intrusion protection systems are vulnerable to evasion techniques, even well known old attacks can pass the protection. Scanning the Finnish Internet networks revea...

A method for providing a content service to a subscriber terminal (MS) from a first server, i.e. ... more A method for providing a content service to a subscriber terminal (MS) from a first server, i.e. content server (CS). The provision of the content service from the content server to the subscriber terminal is controlled by a second server, i.e. proxy (CBP). The control comprises the following steps: 1) determining (5-4 to 5-10, 706) a billing address for the content service by means of the proxy (CBP); 2) under the control of the content billing proxy, providing (5-48) a content service corresponding to a service request from the content server (CS) to the subscriber terminal (MS); and 3) generating (5-46) billing information (CDR) related to the content service.

International Journal of Communication Systems, 2017

Summary Intrusion prevention systems have become a common security measure in the past 20 years. ... more Summary Intrusion prevention systems have become a common security measure in the past 20 years. Their promise is the possibility to prevent known attacks against vulnerable, unpatched devices inside enterprise networks. However, evasion techniques that enable the attacker to evade the eye of the intrusion prevention system are a potential problem for this capability. These techniques take advantage of the robustness principle that has guided designers to create systems that will try to recreate protocol content from any input they receive. In this work, we evaluated the effectiveness of 35 well-known evasions against 9 commercial and 1 free, state-of-the-art, intrusion prevention systems. We conducted 4 experiments with one million attacks against each device. Each system lets a significant amount (0.1%-45%) of attacks pass through unrecognized. Our results show that most existing intrusion prevention systems are vulnerable against evasions.

The Police Journal, 2016

In this paper we study how the cyber-physical space of a small nation is policed. Our qualitative... more In this paper we study how the cyber-physical space of a small nation is policed. Our qualitative study is based on content analysis of expert interviews. We found that the country is protected and daily incidents solved by a network of government agencies and private companies, forming a loose public–private partnership network. However, at the time of the study (Winter 2013), we were able to detect two problems. First, it was not clear that sufficient focus would be available to resolve several simultaneous large incidents. Second, cybercrimes are still under-reported, which may hinder the police in building investigation capacity.

International Journal of Cyber Warfare and Terrorism, 2016

The developed society depends on many critical infrastructure processes, such as power generation... more The developed society depends on many critical infrastructure processes, such as power generation, water treatment, many types of manufacturing, and smart buildings. These processes need control and the automation industry has embraced the Internet to connect all these controls. However, the controlling devices thus opened to the world do not always have adequate safeguards to withstand malicious users. Many automation systems have default passwords or known and unknown backdoors. Also, often those systems are not updated to close security weaknesses found after original installation. The authors argue that while the industry is familiar with the notion of safety of equipment and processes, it has not focused enough on IT security. Several years ago the Shodan search engine showed how easy it is to find these control devices on the Internet. The authors followed this research line further by targeting one nation's IP address space with Shodan and found thousands of control syste...

Ethernet is built on the implicit assumption that all data packets are true and all participants ... more Ethernet is built on the implicit assumption that all data packets are true and all participants honest, which leaves room for security vulnerabilities. Trust and reputation based systems could be used to increase the level of security on unmanaged Ethernet. By having the switches evaluate their neighbors' actions and propagating the information a collective analysis can be used to prevent suspected malicious nodes from taking over the network, while allowing limited network functionality to them.

Contents 1 Introduction 1 1.1 The scope and organization of this thesis . . . . . . . . . . 3 2 O... more Contents 1 Introduction 1 1.1 The scope and organization of this thesis . . . . . . . . . . 3 2 On test generation 5 2.1 Test purpose . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.1.1 Action-driven test generation . . . . . . . . . . . . 7 2.1.2 Data-driven test generation . . . . . . . . . . . . . 10 2.1.3 Logic-driven test generation . . . . . . . . . . . . . 11 2.1.4 Event-driven test generation . . . . . . . . . . . . . 11 2.1.5 State-driven test generation . . . . . . . . . . . . . 12 2.1.6 Combining test purposes . . . . . . . . . . . . . . . 12 2.1.7 Left-over code . . . . . . . . . . . . . . . . . . . . . 13 2.2 Test execution . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.3 Test evaluation . . . . . . . . . . . . . . . . . . . . . . . . 15 2.4 Test adequacy criterias . . . . . . . . . . . . . . . . . . . . 16 2.4.1 Empirical evaluation . . . . . . . . . . . . . . . . . 16 2.4.2 Coverage criteria . . . . . . . . . . . . . . . . .

International Journal of Security and Networks, 2015

ABSTRACT Authorisation certificate based access control relies on delegation as a means of distri... more ABSTRACT Authorisation certificate based access control relies on delegation as a means of distributing the access rights. The resulting certificate chains can cause performance issues at the time of using the rights and reveal information about the parties involved in the granting process. Certificate chain reduction is a proposed solution to improve performance and privacy by replacing a chain of certificates with a single certificate of equal functionality. However, the easiness of chain reduction and the resulting benefits have been assumed without detailed study. In this paper we analyse chain reduction and find a number of issues in implementing the reduction. We evaluate the performance improvements and find reduction an effective tool. We also evaluate the suitability of certificates for embedded platforms by implementing a prototype. We propose that a number of use cases exhibits an hourglass-shaped chain structure that allows for a consistent performance of verifying just one certificate using reduction. Privacy, on the other hand, is more difficult to improve and for the general case all the assumed goals cannot be achieved with chain reduction. However, if system policy allows for adjustments in the certificate contents while creating the reductions, we can successfully reach the goals in many use cases. We use SPKI certificates for our analysis.

2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, 2013

ABSTRACT Modern cyberweapons and malware are targeted bespoke software packages that bypass firew... more ABSTRACT Modern cyberweapons and malware are targeted bespoke software packages that bypass firewalls, virus checkers and intrusion prevention systems by appearing legitimate. Recent incidents have shown that these tools present a real threat from nation states and criminal organizations. In this paper, we present a systematic model for the structure and operations of these software. Their modular structure enables efficient development of malware and tailoring of mission packages for various operations. In-house development of unique software thwarts scanners. Targeting the malware to selected persons bypasses firewalls and bridges air-gaps. This rises sophistication of the malware threat to a new level and has serious implications for the protection of cyber-physical systems.

IGI Global eBooks, 2020

The developed society depends on many critical infrastructure processes, such as power generation... more The developed society depends on many critical infrastructure processes, such as power generation, water treatment, many types of manufacturing, and smart buildings. These processes need control and the automation industry has embraced the Internet to connect all these controls. However, the controlling devices thus opened to the world do not always have adequate safeguards to withstand malicious users. Many automation systems have default passwords or known and unknown backdoors. Also, often those systems are not updated to close security weaknesses found after original installation. The authors argue that while the industry is familiar with the notion of safety of equipment and processes, it has not focused enough on IT security. Several years ago the Shodan search engine showed how easy it is to find these control devices on the Internet. The authors followed this research line further by targeting one…

This chapter illustrates how the Internet changes human cognition and practices and skill demands... more This chapter illustrates how the Internet changes human cognition and practices and skill demands at work. It contrasts these phenomena with the current goals and methods of education and advocates its resulting need to change. We first show that there have been many cultural and technological developments in human history that have strongly altered the way humans think and behave. We then explain how the Internet has changed cognition, much like mass media have in the past. We then describe how the Internet has transformed work environments and required skill sets in the information society. On the basis of Bloom’s taxonomy of learning objectives, we then illustrate the incongruity between current educational goals and methods and the new and ever-changing demands at work. We conclude that the pressure on education to adapt to these developments has been increasing. We propose that the priorities in learning objectives need to be adjusted. We introduce three key aspects of future e...

IEE Mobility Conference 2005. The Second International Conference on Mobile Technology, Applications and Systems, 2005

ABSTRACT Packet switched cellular networks offer significant cost and capacity utilization benefi... more ABSTRACT Packet switched cellular networks offer significant cost and capacity utilization benefits for machine to machine (M2M) communications. However, the current cellular systems facilitate that communications must be initiated by the mobile station, as the architecture lacks needed monitoring and controlling functions. This study presents an architecture that offers an operator based solution for the management of M2M communications in an operator network. The management interface of this system is implemented by using the SIP protocol and its messaging and presence extensions. The prototype implementation is tested and found to be functional but limited in terms of scalability and denial of service vulnerability. Suggestions are presented in order to rectify these issues

Työssä tutkittiin mikrokernelikäyttöjärjestelmien ja verkonhallintaprotokollien soveltuvuutta aut... more Työssä tutkittiin mikrokernelikäyttöjärjestelmien ja verkonhallintaprotokollien soveltuvuutta automaatiokäyttöön, erityisesti tutkittiin Mach-käyttöjärjestelmää ja SNMPv1-protokollaa. Työ sisälsi sekä kirjallisuustutkimuksen että prototyyppilaitteiston suunnittelun ja toteutuksen. Mikrokernelikäyttöjärjestelmät ovat käyttöjärjestelmiä, joissa perinteisen käyttöjärjestelmän ytimen eli kernelin toiminnoista on mahdollisimman suuri osa siirretty ytimen ulkopuolelle. Tämä mahdollistaa ytimen koon pienentämisen ja järjestelmän luotettavuuden kasvattamisen. Mach on akateemisessa maailmassa tutkimuskäyttöön kehitetty suosittu mikrokerneli. Verkonhallintaprotokollat ovat tietoverkkojen hallintaan kehitettyjä määrämuotoista dataa siirtäviä protokollia, jotka tarjoavat hallittavan laitteen teknisestä toteutuksesta riippumattoman abstraktiokerroksen, mikä mahdollistaa tekniseltä toteutukseltaan erilaisten järjestelmien hallinnan yleiskäyttöisillä työkaluilla. Simple Network Management Protocol...

Digitalization is a megatrend that spreads information technology to all sectors of society. Netw... more Digitalization is a megatrend that spreads information technology to all sectors of society. Networking information systems, especially through the Internet, is a key factor in digitalization. In addition to information processing, these systems increasingly control physical processes and, in particular, the critical infrastructure of the society. While digital control systems, as a rule, increase efficiency and reliability, they also provide a broad reachable interface that provides opportunities for malicious actions that threaten the safety and security of society. This doctoral dissertation studies the vulnerabilities and weaknesses of the digitalized society. The research area is wide and has been approached by examining several smaller topics. Key findings include mapping known vulnerabilities in Ethernet, and that intrusion protection systems are vulnerable to evasion techniques, even well known old attacks can pass the protection. Scanning the Finnish Internet networks revea...

A method for providing a content service to a subscriber terminal (MS) from a first server, i.e. ... more A method for providing a content service to a subscriber terminal (MS) from a first server, i.e. content server (CS). The provision of the content service from the content server to the subscriber terminal is controlled by a second server, i.e. proxy (CBP). The control comprises the following steps: 1) determining (5-4 to 5-10, 706) a billing address for the content service by means of the proxy (CBP); 2) under the control of the content billing proxy, providing (5-48) a content service corresponding to a service request from the content server (CS) to the subscriber terminal (MS); and 3) generating (5-46) billing information (CDR) related to the content service.

International Journal of Communication Systems, 2017

Summary Intrusion prevention systems have become a common security measure in the past 20 years. ... more Summary Intrusion prevention systems have become a common security measure in the past 20 years. Their promise is the possibility to prevent known attacks against vulnerable, unpatched devices inside enterprise networks. However, evasion techniques that enable the attacker to evade the eye of the intrusion prevention system are a potential problem for this capability. These techniques take advantage of the robustness principle that has guided designers to create systems that will try to recreate protocol content from any input they receive. In this work, we evaluated the effectiveness of 35 well-known evasions against 9 commercial and 1 free, state-of-the-art, intrusion prevention systems. We conducted 4 experiments with one million attacks against each device. Each system lets a significant amount (0.1%-45%) of attacks pass through unrecognized. Our results show that most existing intrusion prevention systems are vulnerable against evasions.

The Police Journal, 2016

In this paper we study how the cyber-physical space of a small nation is policed. Our qualitative... more In this paper we study how the cyber-physical space of a small nation is policed. Our qualitative study is based on content analysis of expert interviews. We found that the country is protected and daily incidents solved by a network of government agencies and private companies, forming a loose public–private partnership network. However, at the time of the study (Winter 2013), we were able to detect two problems. First, it was not clear that sufficient focus would be available to resolve several simultaneous large incidents. Second, cybercrimes are still under-reported, which may hinder the police in building investigation capacity.

International Journal of Cyber Warfare and Terrorism, 2016

The developed society depends on many critical infrastructure processes, such as power generation... more The developed society depends on many critical infrastructure processes, such as power generation, water treatment, many types of manufacturing, and smart buildings. These processes need control and the automation industry has embraced the Internet to connect all these controls. However, the controlling devices thus opened to the world do not always have adequate safeguards to withstand malicious users. Many automation systems have default passwords or known and unknown backdoors. Also, often those systems are not updated to close security weaknesses found after original installation. The authors argue that while the industry is familiar with the notion of safety of equipment and processes, it has not focused enough on IT security. Several years ago the Shodan search engine showed how easy it is to find these control devices on the Internet. The authors followed this research line further by targeting one nation's IP address space with Shodan and found thousands of control syste...

Ethernet is built on the implicit assumption that all data packets are true and all participants ... more Ethernet is built on the implicit assumption that all data packets are true and all participants honest, which leaves room for security vulnerabilities. Trust and reputation based systems could be used to increase the level of security on unmanaged Ethernet. By having the switches evaluate their neighbors' actions and propagating the information a collective analysis can be used to prevent suspected malicious nodes from taking over the network, while allowing limited network functionality to them.

Contents 1 Introduction 1 1.1 The scope and organization of this thesis . . . . . . . . . . 3 2 O... more Contents 1 Introduction 1 1.1 The scope and organization of this thesis . . . . . . . . . . 3 2 On test generation 5 2.1 Test purpose . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2.1.1 Action-driven test generation . . . . . . . . . . . . 7 2.1.2 Data-driven test generation . . . . . . . . . . . . . 10 2.1.3 Logic-driven test generation . . . . . . . . . . . . . 11 2.1.4 Event-driven test generation . . . . . . . . . . . . . 11 2.1.5 State-driven test generation . . . . . . . . . . . . . 12 2.1.6 Combining test purposes . . . . . . . . . . . . . . . 12 2.1.7 Left-over code . . . . . . . . . . . . . . . . . . . . . 13 2.2 Test execution . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.3 Test evaluation . . . . . . . . . . . . . . . . . . . . . . . . 15 2.4 Test adequacy criterias . . . . . . . . . . . . . . . . . . . . 16 2.4.1 Empirical evaluation . . . . . . . . . . . . . . . . . 16 2.4.2 Coverage criteria . . . . . . . . . . . . . . . . .

International Journal of Security and Networks, 2015

ABSTRACT Authorisation certificate based access control relies on delegation as a means of distri... more ABSTRACT Authorisation certificate based access control relies on delegation as a means of distributing the access rights. The resulting certificate chains can cause performance issues at the time of using the rights and reveal information about the parties involved in the granting process. Certificate chain reduction is a proposed solution to improve performance and privacy by replacing a chain of certificates with a single certificate of equal functionality. However, the easiness of chain reduction and the resulting benefits have been assumed without detailed study. In this paper we analyse chain reduction and find a number of issues in implementing the reduction. We evaluate the performance improvements and find reduction an effective tool. We also evaluate the suitability of certificates for embedded platforms by implementing a prototype. We propose that a number of use cases exhibits an hourglass-shaped chain structure that allows for a consistent performance of verifying just one certificate using reduction. Privacy, on the other hand, is more difficult to improve and for the general case all the assumed goals cannot be achieved with chain reduction. However, if system policy allows for adjustments in the certificate contents while creating the reductions, we can successfully reach the goals in many use cases. We use SPKI certificates for our analysis.

2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, 2013

ABSTRACT Modern cyberweapons and malware are targeted bespoke software packages that bypass firew... more ABSTRACT Modern cyberweapons and malware are targeted bespoke software packages that bypass firewalls, virus checkers and intrusion prevention systems by appearing legitimate. Recent incidents have shown that these tools present a real threat from nation states and criminal organizations. In this paper, we present a systematic model for the structure and operations of these software. Their modular structure enables efficient development of malware and tailoring of mission packages for various operations. In-house development of unique software thwarts scanners. Targeting the malware to selected persons bypasses firewalls and bridges air-gaps. This rises sophistication of the malware threat to a new level and has serious implications for the protection of cyber-physical systems.