LeftOver projects 2011 - 2012

title
summary

supervisor contact

students

1
/
2

1
SN

Virtualization vs. Security Boundaries.

Traditionally, security defenses are built upon a classification of the sensitivity and criticality of data and services. This leads to a logical layering into zones, with an emphasis on command and control at the point of inter-zone traffic. The classical "defense in depth" approach applies a series of defensive measures applied to network traffic as it traverses the various layers.

Virtualization erodes the natural edges, and this affects guarding system and network boundaries. In turn, additional technology is developed to add instruments to virtual infrastructure. The question that arises is the validity of this approach in terms of fitness for purpose, maintainability, scalability and practical viability.

Jeroen Scheerder <Jeroen.Scheerder=>on2it.net>

2
SN

DNS security revisited.

The crucial DNS remains a liability today. In the past, several attempts - and huge government impulses - have been made towards DNSsec adaptation. Success has been far from evident, meriting a closer look. At this point, there might be actual field data to (dis)prove DNSsec skepticism. DNSsec support has been mandatory for several TLDs now for an extensive period. While mandatory, participation has been less than complete. And of the zones for which DNSsec was deployed, it's an open question whether this initial deployment has been followed by proper maintenance (as is necessary for DNSsec zones).

Specific questions are: What adaptation rate has DNSsec seen amongst (for example) .gov zones? What is the trend, and the adaptation timeline? Of the zones offering DNSsec at point in time T, which ones are still valid at point T+n?

Running hypothesis would that DNSsec has been plausibly tried, and has been proven a failure. Let's see this hypothesis disproved! Or… else…?

Jeroen Scheerder <Jeroen.Scheerder=>on2it.net>

3
SN

Traffic Volume vs. Network Inspection.

Traffic volume remains ever-increasing. Peak throughput at AMSIX for example saw a yearly increase from 0.8T to 1.2T roughly (sep 2010 vs. sep 2011). Yet simultaneously growing needs to deal with increasingly evasive network applications, increasingly strenuous compliance regulations, and high-profile malware activity (Mariposa, Conficker, STUXnet, …) has given rise to powerful real-time inspection technology.

An important question is if it is possible, and if so how, to bring and keep inspection capacity close to full network capacity, even in the face of continuous strong growth.

Jeroen Scheerder <Jeroen.Scheerder=>on2it.net>

5
SN

Monitoring the cloud.

The main challenge when migrating services to the cloud is to identify the security issues and the problems which can derive from loss of control. After the services are migrated to a cloud provider, organizations should continue monitoring these services. Most of the cloud providers already have some type of monitoring which allows clients to see the status of their services, but unfortunately sometimes these monitoring tools are not detailed enough or the mapping between the virtual and physical resources isn't visualized correctly.

This project consists of a literature study and the design and implementation of a real-time monitoring tool. The literature study should examine how different virtualization techniques and architecture designs can influence the client's services. This is followed by the implementation of a reliable monitoring tool which shows the mapping of the client's services to the underlying virtualized and physical layers. The status and performance of these services should be monitored near real-time.

Tunde Balint <balint.tunde=>kpmg.nl>

7
S

Tiled video streaming implementation.

P.S. these are way more software engineering, but if someone fabricates a relevant research question for SNE RP1 out of these, please contact me (CdL)

Build a native (C, CUDA) implementation of tiled video streaming. This is an overhaul of the current proof of concept within the European FP7 Fascinate project. The implementation will be used in user pilots. Contact: Omar Niamut <omar.niamut=>tno.nl>

Native tiled video streaming on iPhone, iPad or Android

Summary: Build an app (Objective-C or Java) that can read and play tiled videos on a smartphone or tablet. The main challenge here lies in synchronizing multiple videos on a per-frame level. Contact: Omar Niamut <omar.niamut=>tno.nl>

Second-screen synchronisation

Summary: Build a synchronised solution that lets subtitles run on an iPad simultaneously with a streaming TV broadcast. The synchronization solution should be network-based, e.g. using the RTCP protocol extensions for inter-destination media synchronization, as being developed in the FP7 HBB-Next project.
Contact: Ray van Brandenburg <ray.vanbrandenburg=>tno.nl>

Social TV marking of scenes

Summary: Build a social-TV solution where one person can draw a highlight on a TV broadcast, which can be seen by his friends in real time.
Contact: Oskar van Deventer <oskar.vandeventer=>tno.nl>

Omar Niamut <omar.niamut=>tno.nl>

10
S

Data Integrity in Digital Archives.

Investigate techniques to improve the reliability of the archiving facilities at SARA and tools for implenting and increasing regular data integrity checks.

Context:
SARA operates two multi petabyte digital archive facilities. These facilities are based on a tiering storage model with an online disk tier and a nearline tape based tier. Data is automatically policy based migrated between tiers. The archiving software stack is based on SGI DMF (Data Migration Facillity). DMF uses internally checksums to guard data integrity. These are not available outside the system.

Research:
Investigate techniques for improving integrity of the archive facilities at SARA and develop demonstration tools fo better and regular data integrity checks.

Ans Sullot <Ans=>sara.nl>

11
SF

Security Metrics.

Onsight Solutions delivers network security and application delivery solutions to middle sized and large companies. Onsight believes that offering just the security hardware does not add any security. Managing this hardware in a proper way does. Offering support or full management of those devices is the core business of Onsight.

But how can you measure security (or maybe you measure the change a hacker is able to attack your environment ?) What factors are important when you try to grade the security solution at a company. And can those factors be monitored in an automated way 24x7? What tools are required? Or maybe some human resources? When it becomes possible to define a number, and compare this with a certain level (which might be a standard or a contracted value), it becomes possible to monitor the security solution. In case the security level drops, an engineer gets alarmed to take some action. So the level of security is maintained. Beside this, a number for security is easy to understand for people who have to decide about the budget, but don't know anything about IT security (think about the IT managers/Security officers).

Main question: "How can you assign a number to the quality of a security solution at a company?". Some subquestions: What parameters are important to measure? And what is the importance of each factor? What tools are required to measure this? For example you can think about honeypots, port scans, vulnerability scans, etc. And maybe some external data sources are required, to gather security information?

Roel van der Jagt <roel.van.der.jagt=>onsight.nl>

12
N

OpenNSA.

Currently we are participating in the development of a protocol for inter-domain circuit provisioning. One of the implementations is OpenNSA, an open-source implementation by NorduNet. This research project is to look at both the current capabilities of this software project, compare with other implementations, and examine the applicability of OpenNSA (or others) to the machines in our testbed network.
This will allow us to quickly and automatically make connections across the globe and do network tests, or other resource sharing experiments.

Jeroen van der Ham <vdham=>uva.nl>

15
SF

Security scanner for mobile apps.

The current Apple App Store and Android Market contain thousands of apps, and many more are added every day. More and more companies are creating apps that provide some service to their customers from their mobile phone. The security of these apps is varying and we have seen in the past that all kinds of security issues with the apps come to light. A short selection of these security issues are clear text storing of passwords, insecure data transmission of critical data, (illegal?) harvesting and transmitting of data from different parts of the phone outside the app's domain. As with many other software components, it is becoming clear that apps need to be tested for security issues before going live. We want students to think and create a way to do this security scanning of apps less error prone and more automated. Testing may include black box and white box.

Steps in the research can include:

1. Provide a framework of insecurities that these mobile apps should be checked for (e.g. way of storing credentials, network communication)

2. Create an easy-to-setup testing environment that can be used for the security testing of the mobile apps. This should be usable for apps downloadable from the Store/Market and for apps provided separately.

Research at KPMG IT Advisory can be challenging. We strive for the best results and therefore invest a considerable amount of time in you, to help you achieve the best. But to succeed together we require fully determined students that would like to go the extra mile.

The RP topics as stated on the website are fixed but we are open to changes in the exact research approach if the student prefers. We encouraged students to come up with own ideas and approaches. During the short intake interview your are invited to bring your ideas and approaches to the table. We use the intake to select the students who will get the opportunity to perform their research project at KPMG.

Marc Smeets <smeets.marc=>kpmg.nl>

16
SF

Content Security Protection.

Some time ago Mozilla designed a new web standard called CSP (Content Security Protection, see https://wiki.mozilla.org/Security/CSP). W3C has taken Mozilla's work and has a public working draft at https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html The goal of CSP is to separate data (html) from executable code (JavaScript).

Students are asked to research the CSP standard as it is known now and:

1. Review this standard, try to identify gaps/omissions also looking at Mozilla's implementation and knowing the history of the separation of code and data (compare this development to No Execute bits/DEP);

2. One of the following, or both if time allows:

Research re-writing of existing websites to make use of CSP. Can this be partially automated? If so create proof-of-concept tooling that web administrators can use to rewrite existing web-applications.
Create a browser-helper object or plugin to allow a non Mozilla browser to use CSP.

Research at KPMG IT Advisory can be challenging. We strive for the best results and therefore invest a considerable amount of time in you, to help you achieve the best. But to succeed together we require fully determined students that would like to go the extra mile.

The RP topics as stated on the website are fixed but we are open to changes in the exact research approach if the student prefers. We encouraged students to come up with own ideas and approaches. During the short intake interview your are invited to bring your ideas and approaches to the table. We use the intake to select the students who will get the opportunity to perform their research project at KPMG.

Marc Smeets <smeets.marc=>kpmg.nl>

17
SF

Feasibility of attacks on weak SSL ciphers.

Weak SSL ciphers have been around since many years. In theory many ciphers are cracked. But in current networks we find that the usage of weak ciphers is still very common. In practice only a few attempts have been successful, with EFF’s FPGA attack on DES with COPACOBANA being a noteworthy one. Many other ‘theoretically cracked’ weak ciphers are still not easy to crack in practice.

We would like the students to research the feasibility of cracking weak ciphers used. The research can include the entire process from intercepting communication, extracting the data used for attack, select best way of cracking, perform crack and uncover the secrets. Ideally, the research results in a statement on the feasibility of cracking these weak ciphers. What ciphers exactly to be included will be selected at the start of the research.

Research at KPMG IT Advisory can be challenging. We strive for the best results and therefore invest a considerable amount of time in you, to help you achieve the best. But to succeed together we require fully determined students that would like to go the extra mile.

The RP topics as stated on the website are fixed but we are open to changes in the exact research approach if the student prefers. We encouraged students to come up with own ideas and approaches. During the short intake interview your are invited to bring your ideas and approaches to the table. We use the intake to select the students who will get the opportunity to perform their research project at KPMG.

Marc Smeets <smeets.marc=>kpmg.nl>

27
N

IPV6 risks and vulnerabilities.

Because the world starts to adopt IPv6 more and more we also run into the security problems involved with this migration/adaptation. Of course IPv6 has built-in security, compliance with IPSec is mandatory in IPv6, and IPSec is actually a part of the IPv6 protocol. IPv6 provides header extensions that ease the implementation of encryption, authentication, and Virtual Private Networks (VPNs). IPSec functionality is basically identical in IPv6 and IPv4, but one benefit of IPv6 is that IPSec can be utilized along the entire route, from source to destination. But it can be assumed that only enforcing the use of IPSec within IPv6 isn't solving all security problems and therefore there is a need to research to see what the vulnerabilities and risks are during the use of IPv6. For this research project the focus is on the vulnerabilities that exist because of the lack of using secure techniques and protocols in combination with IPv6.

R.F.Visser <rene.visser=>govcert.nl>

28
F

Determining camera model from JPEG quantization tables.

Acceleration methods for searching image databases, for example through optimizing search through quantization tables in JPEG. Some investigation has been done on how this JPEG characteristic can be used by such methods, but further investigation should give a better view on its feasibility. Other JPEG characteristics not yet exploited by any search method in current use may be investigated as well. These methods are used to search for images that have, for example, deviant or specific values for these characteristics. Certain values may indicate the use of a camera of some kind, or that it has been altered (or recreated) by specific image editing software. A proof-of-concept that shows the use of such characteristics in search methods will probably be implemented.

Netherlands Forensics Institute.

Marcel Worring <m.worring=>uva.nl>
Zeno Geradts <zeno=>holmes.nl>

31
SN

Moving SNE to the Cloud.

The cloud is these days often considered as a valuable resource to gain competitive advantage to businesses. It's clear advantages like improved scalability, agility and cost efficiency can make it an obvious choice for certain businesses to move to such an environment. Although there might be some issues concerning bandwidth, security and regulations, it is also becoming a more and more considered (and sometimes already used) option for educational environments. Although these migrations mostly concern commodity services like e-mail and storage, in some universities virtualized applications and desktops are also offered.
For this research we would like to make an evaluation of running not the commodity services but the more advanced services provided by the "System and Network Engineering" (SNE) education on a cloud infrastructure. This is mainly composed of providing the students with an environment which enables them to:

Set up their own (virtual) machines
Set up their own (virtual) networks
Delegate IP-space
Run Internet services like DNS and e-mail.
Secure and administer these environments

Since the setup will mainly be focused towards educational purposes, most issues when implementing cloud environments do not affect this setup. Students are responsible for securing their own servers and since the education is connected by 10Gb uplink[8], bandwidth should not be a problem. Currently the education provides all students with their own physical server to run the required experiments on. Unfortunately this solution is not very flexible and besides limits the number of students being able to participate in the education.

Jaap van Ginkel <J.A.vanGinkel=>uva.nl>

32
F

Search strategy recognition.

The NFI developed a forensic analysis system (XIRAF) that supports investigators in finding traces in digital material. During the last year, we collected the queries executed by investigators. We ask the student to:

Determine search strategies (based on literature, query history, types of cases, etcetera);
Design (and implement) a method that supports investigators in applying good search strategies.