Marin Bugarić

Timing Attacks on Cognitive Authentication Schemes

Classical password/PIN-based authentication methods have proven to be vulnerable to a broad range of observation attacks (such as key-logging, video-recording or shoulder surfing attacks). In order to mitigate these attacks, a number of solutions have been proposed, most of them being cognitive authentication schemes (challenge-response protocols that require users to perform some kind of cognitive operations). In this paper, we show successful passive side-channel timing attacks on two cognitive authentication schemes, a well-known Hopper-Blum (HB) protocol and a U.S. patent Mod10 method, previously believed to be secure against observation attacks. As we show, the main security weakness of these methods comes from detectable variations in the users cognitive load that results from cognitive operations during the authentication procedure. We carried out theoretical analysis of both Mod10 and HB methods, as well as an experimental user study of Mod10 method with 58 participants to validate the results of our timing attacks. We also propose security enhancements of these schemes aimed to mitigate the timing side-channel attacks. The proposed enhancements show the existence of a strong tradeoff between security and usability, indicating that the security of cognitive authentication schemes comes at a non-negligible usability cost (e.g., increased overall login time). For this reason, the designers of new cognitive authentication schemes should not ignore possible threats induced by side-channel timing attacks.

Adaptive estimation of visual smoke detection parameters based on spatial data and fire risk index

Standard wildfire smoke detection systems detect fires using remote cameras located at observation posts. Images from the cameras are analyzed using standard computer vision techniques, and human intervention is required only in situations in which the system raises an alarm. The number of alarms depends largely on manually set detection sensitivity parameters. One of the primary drawbacks of this approach is the false alarm rate, which impairs the usability of the system. In this paper, we present a novel approach using GIS and augmented reality to include the spatial and fire risk data of the observed scene. This information is used to improve the reliability of the existing systems through automatic parameter adjustment. For evaluation, three smoke detection methods were improved using this approach and compared to the standard versions. The results demonstrated significant improvement in different smoke detection aspects, including detection range, rate of correct detections and decrease in the false alarm rate.

Vision based wildfire and natural risk observers

Wildfires are natural risk phenomena that cause significant economic and environmental damage. In wildfire fighting strategy it is important to detect the wildfire in its initial stage and to apply, as soon as possible, the most appropriate fire fighting action. In both cases wildfire monitoring and surveillance systems are of great importance, so in the last decade the interest for various wildfire monitoring and surveillance systems has increased, both on the research and the implementation level. This paper describes one such system named iForestFire. It is an example of advanced terrestrial vision based wildfire monitoring and surveillance system, today widely used in various Croatian National and Nature Parks and regions, but it is also a system in constant development and improvement, both on theoretical and practical level. This paper describes its last improvements in video detection part that are based on notation of observer, cogent confabulation theory and mechanism of thought. Inclusion of cogent confabulation theory allows us to expend the use of existing wildfire observers to more general natural risk observers.

Fortune cookies and smartphones

Smartphones are being increasingly used to perform financial transactions (through m-banking, virtual wallet or as a smartcard). The latter applications involve contactless technology (e.g., NFC) that is known to be vulnerable to mafia fraud attacks. In this work we show that a secret message inside an appropriately folded piece of paper (fortune cookie) can be used to effectively mitigate the mafia fraud attack. Fortune cookies implement a weakly unrelayable channel that, in combination with smartphones, provides a provable protection against those attacks. Our solution requires minimal or no hardware changes to the existing equipment (especially on the users side) and is suitable for different communication technologies (e.g., intra-body communication, NFC, WiFi, Bluetooth, sound, infrared).

A stereo approach to wildfire smoke detection: the improvement of the existing methods by adding a new dimension

In this paper, we present a novel approach to visual smoke detection based on stereo vision. General smoke detection is usually performed by analyzing the images from remote cameras using various computer vision techniques. The literature on smoke detection shows a variety of approaches, and the focus of this paper is the improvement of the general smoke detection process by introducing stereo vision. Two cameras are used to estimate the distance and size of the detected phenomena based on stereo triangulation. Using this information, the minimum size and overall dynamics of the detected regions are further examined to ensure the elimination of false alarms induced by various phenomena (such as the movement of objects located at short distances from the camera). Such false alarms could easily be detected by the proposed stereo system, allowing the increase of the sensitivity and overall performance of the detection. We analyzed the requirements of such system in terms of precision and robustness to possible error sources, especially when dealing with detection of smoke at various distances from the camera. For evaluation, three existing smoke detection methods were tested and the results were compared to their newly implemented stereo versions. The results demonstrated better overall performance, especially a decrease in false alarm rates for all tested methods.

Active IR System for Projectile Detection and Tracking

Positioning systems based on location fingerprinting have become an area of intense research, mainly with the aim of providing indoor localization. Many challenges arise when trying to ...

Optimizing Decision Tree Attack on CAS Scheme

In this paper we show a successful side-channel timing attack on a well-known high-complexity cognitive authentication (CAS) scheme. We exploit the weakness of CAS scheme that comes from the asymmetry of the virtual interface and graphical layout which results in nonuniform human behavior during the login procedure, leading to detectable variations in user’s response times. We optimized a well- known probabilistic decision tree attack on CAS scheme by introducing this timing information into the attack. We show that the developed classifier could be used to significantly reduce the number of login sessions required to break the CAS scheme.

Computer Vision Based Measurement of Wildfire Smoke Dynamics

This article presents a novel method for measurement of wildfire smoke dynamics based on computer vision and augmented reality techniques. The aspect of smoke dynamics is an important ...

Augmented reality based segmentation of outdoor landscape images

The segmentation and classification of image regions are very important tasks in the field of computer vision, and yet they remain one of its greatest challenges. These challenges arise from the fact that the same objects can come in different colors, shapes and sizes, and can appear in different contexts and under different illumination. In an attempt to overcome these obstacles, in this paper we propose a system for segmentation and classification of image regions on outdoor landscape images based on augmented reality and CORINE land cover (CLC) classification. We compare the results obtained by the proposed system with the results obtained by the k-NN algorithm, and show that the proposed algorithm outperforms the k-NN one, and generally gives favorable segmentation and classification results.