Siddharth Prakash Rao

Siddharth Prakash Rao, Silke Holtmanns, Tuomas Aura

Due to the complex nature of mobile communication systems, most of the security efforts in its domain are isolated and scattered across underlying technologies. This has resulted in an obscure view of the overall security. In this work, we attempt to fix this problem by proposing a domain-specific threat modeling framework. By gleaning from a diverse and large body of security literature, we systematically organize the attacks on mobile communications into various tactics and techniques. Our framework is designed to model adversarial behavior in terms of its attack phases and to be used as a common taxonomy matrix. We also provide concrete examples of using the framework for modeling the attacks individually and comparing them with similar ones.

Thanh Bui, Siddharth Prakash Rao, Markku Antikainen et al.

Internet users increasingly rely on commercial virtual private network (VPN) services to protect their security and privacy. The VPN services route the client's traffic over an encrypted tunnel to a VPN gateway in the cloud. Thus, they hide the client's real IP address from online services, and they also shield the user's connections from perceived threats in the access networks. In this paper, we study the security of such commercial VPN services. The focus is on how the client applications set up VPN tunnels, and how the service providers instruct users to configure generic client software. We analyze common VPN protocols and implementations on Windows, macOS and Ubuntu. We find that the VPN clients have various configuration flaws, which an attacker can exploit to strip off traffic encryption or to bypass authentication of the VPN gateway. In some cases, the attacker can also steal the VPN user's username and password. We suggest ways to mitigate each of the discovered vulnerabilities.

Thanh Bui, Siddharth Rao, Markku Antikainen et al.

Cloud-application add-ons are microservices that extend the functionality of the core applications. Many application vendors have opened their APIs for third-party developers and created marketplaces for add-ons (also add-ins or apps). This is a relatively new phenomenon, and its effects on the application security have not been widely studied. It seems likely that some of the add-ons have lower code quality than the core applications themselves and, thus, may bring in security vulnerabilities. We found that many such add-ons are vulnerable to cross-site scripting (XSS). The attacker can take advantage of the document-sharing and messaging features of the cloud applications to send malicious input to them. The vulnerable add-ons then execute client-side JavaScript from the carefully crafted malicious input. In a major analysis effort, we systematically studied 300 add-ons for three popular application suites, namely Microsoft Office Online, G Suite and Shopify, and discovered a significant percentage of vulnerable add-ons in each marketplace. We present the results of this study, as well as analyze the add-on architectures to understand how the XSS vulnerabilities can be exploited and how the threat can be mitigated.

Siddharth Prakash Rao

In this paper we discuss Bitcoin, the leader among the existing cryptocurrencies, to analyse its trends, success factors, current challenges and probable solutions to make it even better. In the introduction section, we discuss the history and working mechanism of Bitcoin. In the background section, we develop the ideas that evolved in the process of making a stable cryptocurrency. We also analyze the survey matrices of the present day cryptocurrencies. This survey clearly shows that Bitcoin is the clear winner among its kind. Section 3 is about the success factors of Bitcoin and the proceeding sections are a discussion about current challenges which pose as hurdles in making Bitcoin a better currency in the digital world. We finally discuss the balance between anonymity and reduced trust in the cryptocurrency world, before concluding the survey.