More Like this

1. Hey Alexa, is this Skill Safe?: Taking a Closer Look at the Alexa Skill Ecosystem

   https://doi.org/10.14722/ndss.2021.23111  

   Lentzsch, Christopher ; Shah, Sheel Jayesh ; Andow, Benjamin ; Degeling, Martin ; Das, Anupam ; Enck, William ( February 2021 , Network and Distributed Systems Security (NDSS) Symposium2021)

   null (Ed.)

   Amazon's voice-based assistant, Alexa, enables users to directly interact with various web services through natural language dialogues. It provides developers with the option to create third-party applications (known as Skills) to run on top of Alexa. While such applications ease users' interaction with smart devices and bolster a number of additional services, they also raise security and privacy concerns due to the personal setting they operate in. This paper aims to perform a systematic analysis of the Alexa skill ecosystem. We perform the first large-scale analysis of Alexa skills, obtained from seven different skill stores totaling to 90,194 unique skills. Our analysis reveals several limitations that exist in the current skill vetting process. We show that not only can a malicious user publish a skill under any arbitrary developer/company name, but she can also make backend code changes after approval to coax users into revealing unwanted information. We, next, formalize the different skill-squatting techniques and evaluate the efficacy of such techniques. We find that while certain approaches are more favorable than others, there is no substantial abuse of skill squatting in the real world. Lastly, we study the prevalence of privacy policies across different categories of skill, and more importantly the policy content of skills that use the Alexa permission model to access sensitive user data. We find that around 23.3% of such skills do not fully disclose the data types associated with the permissions requested. We conclude by providing some suggestions for strengthening the overall ecosystem, and thereby enhance transparency for end-users. 

   more » « less
2. PMsec 2.0: A Security-By-Design Solution for Doctor’s Dilemma Problem in Smart Healthcare

   https://doi.org/10.1109/OCIT59427.2023.10430808  

   Bathalapalli, Venkata K. ; Mohanty, Saraju P. ; Kougianos, Elias ; Iyer, Vasanth ; Rout, Bibhudutta ( December 2023 , Proceedings of the OITS International Conference on Information Technology (OCIT))

   The rapid adoption of Internet-of-Medical-Things (IoMT) has revolutionized e-health systems, particularly in remote patient monitoring. With the growing adoption of Internet-of-Medical-Things (IoMT) in delivering technologically advanced health services, the security of Medtronic devices is pivotal as the security and privacy of data from these devices are directly related to patient safety. PUF has been the most widely adopted hardware security primitive which has been successfully integrated with various Internet-of-Things (IoT) based applications, particularly in smart healthcare for facilitating device security. To facilitate security and access control to IoMT devices, this work proposes a novel cybersecurity solution using PUF for facilitating global access to IoMT devices. The proposed framework presents an approach that enables the patient’s body area network devices supported by PUF to be securely accessible and controllable globally. The proposed cybersecurity solution has been experimentally validated using state-of-the-art SRAM PUF, a delay based PUF, and a trusted platform module (TPM) primitive. 

   more » « less
3. Contested Care: COVID-19 Surveillance and Health Data in the Workplace

   https://doi.org/10.24908/ss.v21i2.15819  

   Metcalf, Kathryne ; Irani, Lilly ; Uribe del Águila, Verónica ( July 2023 , Surveillance & Society)

   Within the ongoing disruption of the COVID-19 pandemic, technologically mediated health surveillance programs have vastly intensified and expanded to new spaces. Popular understandings of medical and health data protections came into question as a variety of institutions introduced new tools for symptom tracking, contact tracing, and the management of related data. These systems have raised complex questions about who should have access to health information, under what circumstances, and how people and institutions negotiate relationships between privacy, public safety, and care during times of crisis. In this paper, we take up the case of a large public university working to keep campus productive during COVID-19 through practices of placemaking, symptom screeners, and vaccine mandate compliance databases. Drawing on a multi-methods study including thirty-eight interviews, organizational documents, and discursive analysis, we show where and for whom administrative care infrastructures either misrecognized or torqued (Bowker and Star 1999) the care relationships that made life possible for people in the university community. We argue that an analysis of care—including the social relations that enable it and those that attempt to hegemonically define it—opens important questions for how people relate to data they produce about their bodies as well as to the institutions that manage them. Furthermore, we argue that privacy frameworks that rely on individual rights, essential categories of “sensitive information,” or the normative legitimacy of institutional practices are not equipped to reveal how people negotiate privacy and care in times of crisis. 

   more » « less
4. New passive and active attacks on deep neural networks in medical applications

   https://doi.org/10.1145/3400302.3418782  

   Gongye, Cheng ; Li, Hongjia ; Zhang, Xiang ; Sabbagh, Majid ; Yuan, Geng ; Lin, Xue ; Wahl, Thomas ; Fei, Yunsi ( November 2020 , Proceedings of the 39th International Conference on Computer-Aided Design)

   null (Ed.)

   Security of deep neural network (DNN) inference engines, i.e., trained DNN models on various platforms, has become one of the biggest challenges in deploying artificial intelligence in domains where privacy, safety, and reliability are of paramount importance, such as in medical applications. In addition to classic software attacks such as model inversion and evasion attacks, recently a new attack surface---implementation attacks which include both passive side-channel attacks and active fault injection and adversarial attacks---is arising, targeting implementation peculiarities of DNN to breach their confidentiality and integrity. This paper presents several novel passive and active attacks on DNN we have developed and tested over medical datasets. Our new attacks reveal a largely under-explored attack surface of DNN inference engines. Insights gained during attack exploration will provide valuable guidance for effectively protecting DNN execution against reverse-engineering and integrity violations. 

   more » « less
5. ADQuaTe2: A Data Quality Test Approach for Automated Constraint Discovery and Fault Detection

   Homayouni, Hajar ; Ghosh, Sudipto ; Ray, Indrakshi ; Kahn, Michael G. ( January 2019 , ACM TAPIA)

   The quality of data is extremely important for data analytics. Data quality tests typically involve checking constraints specified by domain experts. Existing approaches detect trivial constraint violations and identify outliers without explaining the constraints that were violated. Moreover, domain experts may specify constraints in an ad hoc manner and miss important ones. We describe an automated data quality test approach, ADQuaTe2, which uses an autoencoder to (1) discover constraints that may have been missed by experts, (2) label as suspicious those records that violate the constraints, and (3) provide explanations about the violations. An interactive learning technique incorporates expert feedback, which improves the accuracy. We evaluate the effectiveness of ADQuaTe2 on real-world datasets from health and plant domains. We also use datasets from the UCI repository to evaluate the improvement in the accuracy after incorporating ground truth knowledge. 

   more » « less