Tag: UWE Bristol research

Transatlantic cyber contest sees success for UWE Falcons students

Author Anna Jones | Posted on

ROWE CTF 11th May 2024:

The inaugural Rowan University and UWE Bristol (ROWE) Catch the Flag (CTF) saw students from both UWE Bristol and Rowan University, Delaware, New Jersey partake in a series of CTF challenges. From exploiting vulnerable service, solving cryptographic conundrums, analysing pcaps, digital forensics images to an open-source intelligence challenge where students were tasked with finding out as much information as they could from a single image.

UWE Bristol have established a strong collaborative partnership with Rowan University. Professor Fred Stinchcombe is Head of Cyber Security at Rowan University and UWE Bristol alumni from the 1990’s, who has worked with Professor Phil Legg and student representative Ian Caple to develop collaborative programme of events, and a shared online Discord community.

To this end UWE Bristol CTF Falcons challenged their counterparts on the other side of the pond to a CTF, designed by UWE’s technical team on this occasion (Alan Mills, Jon White and Ian Caple).

The event saw students beavering away tackling what was a considerable array of challenges in a race to capture as many flags as possible. UWE CTF Falcons student Mohamed Almarri (MSc Cyber Security) was successful in capturing the most number of flags on this occasion.

We look forward to many more international challenges with the students at Rowan University, as well as other universities throughout the UK.

UWE Bristol Capture The Flag Falcons take flight

Author Anna Jones | Posted on

By Ian Caple, MSc Cyber Security student (September 2023 cohort)

Saturday 24th of Febuary saw the birth of a new student-led cyber security initiative, UWE Bristol Capture The Flag Falcons (CTF). Students from across the school of computer science came together to take part in a CTF competition. Undergrads and Postgrads alike took part in a series of cyber security related challenges from Web exploration, cryptography, digital forensic challenges such as hacking veracrypt containers.

In teams of 2 or 3, students battled their way through a series of challenges, hacking their way in ir exploiting vulnerabilities to gain access to areas they shouldn’t be to find the flags.

17 students in all took part giving UWE CTF Falcons a great starting point for the future of the Falcons. After 8 eventful hours that saw every team overcome multiple challenges the CTF challenge was won by The Phishermen – 3rd year BSc Cyber Security and Digital Forensics students Harvey Keane, Callum Duncan and Ash Floyd, who captured a staggering 13 of 15 flags.

But the real winners was everyone who took part and can say they were they when UWE CTF Falcons took flight.

A huge thank you and honourable mention needs to go to our teaching staff Alan Mills and Jon White for helping us set up the challenges and making the day as much fun as it was!

UWE Bristol researchers conduct first longitudinal study on evolving vulnerabilities in cloud and application security 

Author Anna Jones | Posted on

A team of UWE Bristol researchers have conducted a major new study into the evolving security landscape of modern cloud infrastructures. The study, recently published in the Computers and Security journal, investigates container security for over 400 applications and services over a 9-month period, to assess what the security vulnerabilities of these services are, and the frequency of when these vulnerabilities are resolved. The findings show many cases where vulnerabilities remain persistent even when updated versions of the application are released. However, we also investigate the real-world nature of these vulnerabilities, to assess the true risk of utilising these services in both local and remote settings, recognising that whilst some security scans may highlight a vulnerability, the vulnerability can not actually be exploited given the use case of the application. 

Alan Mills, lead author of the study says “Container security is a growing area of concern, with the increasing use of micro-services we need to ensure that cyber security keeps pace, while avoiding common pit falls around vulnerability assessment. By assessing container security over an extended time-period and analysing our results from multiple areas, all with a focus on real world risk, we present findings which inform further academic studies and industry-based decision making.”

The study was conducted in collaboration with Jonathan White and Professor Phil Legg. Alan is currently a Lecturer in Cyber Security studying for a part-time DPhil on the topic of container and cloud security.

The paper, Longitudinal risk-based security assessment of docker software container images, is now available as Open Access from the Computers and Security journal.

Cyber Security in Connected Places: Attack Detection in RPL-based Internet of Things

Author Anna Jones | Posted on

By Sarfraz Brohi, Senior Lecturer Cyber Security

Connected places such as smart cities have enabled urban planners to improve citizens’ quality of life by collecting, storing, processing and analysing data. Internet of Things (IoT) is one of the driving technologies of connected places. It integrates different city functions such as parking systems, mobility services, waste management, healthcare and emergency services. Unfortunately, IoT has vulnerabilities that attackers could exploit due to the massive processing of sensitive data. Cyber security breaches in IoT-powered connected places could violate citizens’ privacy, endanger life and cause economic disaster.

IoT security encompasses a massive area of research with a wide array of open challenges. Dr Sarfraz Brohi (Senior Lecturer in Cyber Security at CSCT-UWE, Bristol) collaborated with the researchers from Taylor’s University, Malaysia (Dr Noor Zaman: Cluster head for cyber security research, Ms Fatima Zahra and Dr Navid Khan) and Taif University, Saudi Arabia (Dr Mehedi Masud and Dr Mohammed A. AlZain) to address crucial IoT-specific rank and wormhole attacks by creating a machine learning model.

The fundamental components of an IoT-enabled infrastructure usually include sensors, RFIDs, microcontrollers and digital devices. These components are low power and lossy due to their small size and simple architecture. Therefore, they use lightweight routing standards and protocols for data transmission. RPL is one such protocol used in IoT networks. RPL-based IoT networks are vulnerable to two types of attacks: WSN-inherited attacks and RPL-specific attacks. Rank and wormhole attacks are examples of high-impact attacks from these categories where attackers target the protocol and sensor network vulnerabilities to disrupt network functionalities and compromise resources.

F. Zahra, NZ. Jhanjhi, SN. Brohi, NA. Khan, M. Masud, and MA. AlZain, generated a dataset and developed a model for detecting RPL-specific and WSN-inherited attacks in RPL-based IoT: LIoTN-RPL dataset and MC-MLGBM model. The LIoTN-RPL data pool consists of network traffic data extracted from various network models. These network models have been designed considering three scenarios – one benign and two attack scenarios – and simulated based on the number of IoT nodes and state of nodes. The MC-MLGBM classifies three target classes and addresses two attacks. In this research, they have used accuracy, precision and recall to evaluate the proposed model. To avoid accuracy bias, they have also used cross entropy, Cohen’s Kappa, and MCC as performance evaluation metrics. The existing models usually focus on one category of attacks. The proposed model provides a conceptual framework for aggregately addressing both in RPL-based IoT networks.

The results of this research are discussed in the paper “Rank and Wormhole Attack Detection Model for RPL-based Internet of Things using Machine Learning”, published in the MDPI Sensors special issue on Advances in IoT Privacy, Security and Applications. Authors have reviewed recent methodologies for addressing security issues in IoT and techniques used to detect the attacks. Furthermore, they have analysed the data collection methods in the research domain. This research observed the scarcity of publicly available RPL attack datasets and the prevalence of self-generated datasets using simulators like Cooja. The future direction of this research focuses on more experiments by designing and simulating other RPL-specific and WSN-inherited attack models. LIoTN-RPL will be released as an open-source dataset to the research community to facilitate the development of ML models for attack detection in RPL-based IoT networks.

Read the full article.

UWE Bristol research to help uncover and mitigate against hundreds of online public software supply chain vulnerabilities

Author Anna Jones | Posted on

Many software and cloud platforms rely on the use of containerisation, a modern technique of deploying multiple software services quickly, securely and efficiently on large-scale cloud computing resources such as Microsoft Azure and Amazon Web Services (AWS). Platforms such as DockerHub provide an online repository of over 100,000 ready-to-deploy containers that are used widely in many of today’s modern software platforms. Whilst this offers great convenience for development teams, many of these containers may exhibit vulnerabilities, which if not managed, can introduce vulnerabilities into a company software stack. Recent security issues such as the log4j vulnerability and the Solarwinds Orion attack highlight the growing concern around software supply chain security, the dependencies that are made by development teams on third party software, and the implications of identifying and remediating such vulnerabilities later down the line.

As part of our CSC3 research, Alan Mills, Jonathan White and Phil Legg, have developed a suite of docker security visualisation and remediation tools: OGMA and BORVO. The suite of tools enable developer and security teams to quickly identify vulnerabilities against a variety of container security scanning platforms. Results from existing scanning tools can often differ or conflict, and so our aggregated approach helps provide a unified analysis to address conflicts and provide a visual means for thorough examination the results. Our approach also provides a more intuitive risk assessment that considers the true impact of vulnerabilities, such as how easily the vulnerability could actually be exploited by external or internal actors. Furthermore, the suite also provides developers with informed assessment of how to remediate the security issues whilst preserving the intended software functionality that is dependent on the container.

Our research paper “OGMA: Visualisation for Software Container Security Analysis and Automated Remediation” has been peer-reviewed and accepted for the IEEE Conference on Cyber Security and Resilience where the work will be presented and published at the end of July. We will also be sharing our insights in our related presentation on “Securing the Supply Chain – Practicality v Paranoia” at the upcoming BSides Cheltenham conference this weekend, which is a community-organised event for the regional cyber security industry and enthusiasts, and follows our lightning talk on software supply chain security delivered at CYBERUK 2022 earlier this year. OGMA and BORVO are both released as open-source applications that we have made available to the wider research community, to facilitate the examination and remediation of software vulnerabilities in containerised applications. For more details, including how to download and use the tools, please visit our GitHub page.

UWE Bristol hosts one of region’s largest cyber security events to attract future talent

Author Anna Jones | Posted on

Last month UWE Bristol hosted the Unlock Cyber Taster Day at Frenchay campus, which was attended by over 300 young people.

Students aged 12 to 14 participated in hands-on activities including manipulating a Scalextric track to improve the performance of model racing cars.

The event was run by Unlock Cyber, an employer-led initiative established by UWE Bristol to build a community of young cyber security enthusiasts with the right skills to follow a career into the sector.

Industry and cyber representatives from across the West of England region attended the event yesterday in the School of Engineering building to deliver the cyber activities for schoolchildren.

UWE Bristol Cyber Schools Outreach Manager Elaine Brown, who manages the Unlock Cyber project, said: “Young people often think that employers need you to have a lot of technical expertise when in fact this is not the case. They are looking for applicants with good communication skills and enquiring minds, who enjoy problem solving and can work under pressure. We’re trying to engage with and excite more young people, especially girls, who probably think cyber is not for them, to ensure that cyber is more diverse and inclusive. Our biggest challenge moving forwards is how we can cope with the level of demand from schools.”

Kevin Milwood, Cyber Risk Manager from Hargreaves Lansdown, said: “Unlock Cyber stands for what I believe in – giving young people the opportunity to learn about careers in cyber. It’s such an important area for business and I’m passionate about doing what I can in the local area to develop the UK’s skills supply chain to meet the ever-increasing demand for cyber experts. The national curriculum is currently quite limited, so it’s great that Hargreaves Lansdown can get involved with a programme like this that lets us share our expertise.”

Ben Waring, HR and Resourcing Advisor at Leonardo Cyber Security Division in Bristol, said: “Cyber threats are a reality for all of us, so we want to respond to these long-term threats in a positive manner by generating future career opportunities for young people. For the Unlock Cyber taster day, our apprentices have designed a Cyber Crime scene, testing the students’ knowledge of how cyber criminals might target them and use any available information against them. This activity also helps students think about how they can better protect themselves and their family from cyber crime.”

UWE Bristol has worked with the National Cyber Security Centre (NCSC) and regional partners to develop the Unlock Cyber programme. The university has been recognised by NCSC for its excellence in cyber security education, across its outreach activities through Unlock Cyber, its taught programme at UWE Bristol, and its work across the region and the wider UK to improve cyber security education.

Back to top