Abstract

The openness of Android platform has attracted users, developers and attackers. Android offers bunch of capabilities and flexibilities, for instance, developers can write their own keyboard service-similar to Android soft keyboards-using the KeyboardView class. This class is available since api level 3.0 and can be part of the layout of an activity. Users prefer to download and install third-party keyboards that offer better experience and capabilities. However, there are security risks related to users installing and using these custom keyboards. Attackers can build or take advantage of existing third-party keyboards to create keyloggers to spy on smartphones users. Third-party keyboard once activated would substitute the Android standard keyboard, so all keys events pass this app. As results, many attacks can be launched identified by the permissions granted to these apps. The …

Authors : Fadi Mohsen, Mohammed Shehab

Conference : Collaborative Computing: Networking, Applications and Worksharing (Collaboratecom), 2013 9th International Conference Conference

Pages : 545-552

Publication date : 2013/10/20

Publisher : IEEE

Abstract

With the roaring growth and wide adoption of smart mobile devices, users are continuously integrating with culture of the mobile applications (apps). These apps are not only gaining access to information on the smartphone but they are also able gain users' authorization to access remote servers on their behalf. The Open standard for Authorization (OAuth) is widely used in mobile apps for gaining access to user's resources on remote service providers. In this work, we analyze the different OAuth implementations adopted by some SDKs of the popular resource providers on smartphones and identify possible attacks on most OAuth implementations. We give some statistics on the trends followed by the service providers and by mobile applications developers. In addition, we propose an application-based OAuth Manager framework, that provides a secure OAuth flow in …

Authors : Mohamed Shehab, Fadi Mohsen

Conference : Proceedings of the 4th ACM conference on Data and application security and privacy

Pages : 167-170

Publication date : 2014/3/3

Publisher : ACM

Abstract

Cloud storage systems have received extensive attention in recent years. Many individuals and business organizations are beginning to move their data to cloud environments. It becomes increasingly important to investigate secure file storage in cloud environments. In this paper, we present a secure distributed file distribution system in which the customers can directly choose appropriate design parameters and service providers. In our scheme, we use novel coding techniques that almost achieve the Shannon information bound with very efficient coding and decoding process. Our evaluations show the correctness and efficiency of the coding scheme. We show that the problem to find the satisfying file distribution under certain cost and security constraints is NP-hard, and present the Satisfiability Modulo Theories (SMT) formalization to find the satisfying data share …

Authors : Qi Duan, Yongge Wang, Fadi Mohsen, Ehab Al-Shaer

Conference : Services Computing (SCC), 2013 IEEE International Conference

Pages : 264-271

Publication date : 2013/6/28

Publisher : IEEE

Abstract

Mobile applications have become an integral component of modern mobile operating systems. The usage pattern for these apps have increased tremendously the last ten years. At the same time, the security and privacy risks of these apps have also expanded in number and severity. In this paper, we spot the light on a critical component of Android mobile applications called Broadcast receivers. We focus on these receivers that are deliberately developed to listen to system's actions and events. The number of these actions has increased tremendously since the initial release of Android operating system. We showed that how such a component can pose serious privacy risks on users without their knowledge and awareness. We first illustrate a prototype of an attack that was possible due to the use of Broadcast receivers. We then show the results of analyzing a large dataset of malicious …

Authors : Fadi Mohsen, Mohamed Shehab

Conference : Collaboration and Internet Computing (CIC), 2016 IEEE 2nd International Conference

Pages : 546-553

Publication date : 2016/11/1

Publisher : IEEE

Abstract

Today, the Open Standard for Authorization (OAuth) is widely used by many service providers such as Google, Github, and Facebook. The OAuth-WebView implementation is the most widely used approach despite explicit warnings to the developers of its security and privacy risks. Previous researches have discussed these risks and proposed solutions that mandate numerous implementation's changes and/or do not assume strong attacking assumptions. In this work, we introduce SecureOAuth, a whitelist access control protection framework for the Android platform. SecureOAuth is composed of: Android library modifications, service creation, and system app creation. We have implemented a prototype of the SecureOAuth framework and evaluated it on performance and memory overhead. We also showcase examples of security threats that this framework counters. The framework …

Authors : Fadi Mohsen, Mohamed Shehab

Conference : Collaboration and Internet Computing (CIC), 2016 IEEE 2nd International Conference

Pages : 196-205

Publication date : 2016/11/1

Publisher : IEEE

Abstract

With the roaring growth and wide adoption of smart mobile devices, users are continuously integrating with culture of the mobile applications (apps). These apps are not only gaining access to information on the smartphone but they are also able gain users' authorization to access remote servers on their behalf. The Open standard for Authorization (OAuth) is widely used in mobile apps for gaining access to user's resources on remote service providers. In this paper, we analyze the different OAuth implementations adopted by the SDKs of the popular resource providers on smartphones and demonstrate possible attacks on most OAuth implementations. By analyzing source code of more than 430 popular Android apps we summarized the trends followed by the service providers and by the OAuth development choices made by application developers.

Authors : Fadi Mohsen, Mohamed Shehab, Emmanuel Bello-Ogunu, Abeer Al Jarrah

Conference : Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security

Pages : 39-46

Publication date : 2014/11/3

Publisher : ACM

Abstract

Android has a large share in the mobile apps market which makes it attractive for both malicious and good developers. Online apps markets, despite their vetting procedures, still admit malicious apps that could be downloaded mistakenly by mobile users. Detecting Android malwares has been studied by many researchers using different approaches and techniques. The vast majority of them though were focused on using the requested permissions that are declared in the AndroidManifest. xml files. A number of researchers have considered other components of the Android applications besides the permissions such as package info, activities, and process name. Some researchers pointed out Android Broadcast receivers' component but it was not discussed thoroughly like other components. In this paper, we are conducting an empirical study to investigate the usage patterns of …

Authors : Fadi Mohsen, Halil Bisgin, Zachary Scott, Kyle Strait

Conference : Collaboration and Internet Computing (CIC), 2017 IEEE 3rd International Conference

Pages : 67-76

Publication date : 2017/10/15

Publisher : IEEE

Authors : Fadi Mohsen, Mohamed Shehab

Conference : 2017 IEEE 3rd International Conference on Collaboration and Internet Computing (CIC)

Pages : 443-448

Publication date : 2017/10/1

Publisher : IEEE

Abstract

Keylogging threats have been reasonably studied in computer systems but poorly covered in the domain of mobile operating systems. Android took the lead among the other mobile operating systems in allowing developers to build custom third-party keyboards to replace the stock Android on-screen keyboard. This opened the door for malicious developers to create keyloggers for the purpose of spying and/or phishing for users' sensitive data. A malicious developer may build a keylogger from scratch or utilize an existing keyboard. Furthermore, users may unknowingly install keyloggers from the online app markets or may use a keylogger that a malicious user with physical access has installed on their devices. In this paper, we discuss users' and keyboard developers' roles in increasing/decreasing the chance of successful keylogger attacks. We developed an Android app, KBsChecker, and …

Authors : Fadi Mohsen, Emmanuel Bello-Ogunu, Mohamed Shehab

Conference : 2016 Second International Conference on Mobile and Secure Services (MobiSecServ)

Pages : 1-5

Publication date : 2016/2/26

Publisher : IEEE

Abstract

The Vehicle-To-Grid (V2G) technology allows plug-in electric vehicles (PEVs) to act like an energy provider besides being a consumer. A PEV, being connected to the smart grid, can either charge its battery by consuming electricity from the grid or discharge the stored electricity from the battery to the grid. It can also participate in the frequency regulation service of the grid. Executing the aforementioned operations in a non-controlled fashion may come with problems on the grid functionality. For safe and sustainable functioning of the grid, controlling the operations is very crucial. In this paper, we are offering an approach for vehicle-to-grid management using constraint-based formal modeling. The approach is centered around an aggregator that collects all the involved parties' constraints and preferences. The aggregator then finds a management plan, ie, a schedule of V2G …

Authors : Mohammad Ashiqur Rahman, Fadi Mohsen, Ehab Al-Shaer

Conference : Proceedings of the first ACM workshop on Smart energy grid security

Pages : 81-92

Publication date : 2013/11/8

Publisher : ACM

Abstract

The increasing demand on the internet, and the fact that the Local, State and hospitals share the Internet bandwidth with the public put the critical healthinformation sharing at risk. In the last ten years, we have suffered from different kinds of flu (eg Avian flu, Swine flu (H1N1)); scientists are expecting more to come. In these kinds of situations, all the health organizations need to exchange the information to increase their situation awareness and then to publish information to the public in the form of instructions, latest news, and statistics. This thesis started by studying the Colorado Health Emergency Response systems and procedures, plus investigating the actions that need to be taken in case of an emergency like that of the pandemic flu. The focus was on the importance of information flow and the utilization of the Internet. An Ontology framework for the US Air Force Academy …

Authors : Fadi F Mohsen

Institution : University of Colorado at Colorado Springs

Publication date : 2010

Abstract

The main purpose of this paper is to detect insider attacks before they happen, or at least to mitigate attack consequences and loss, by monitoring users access and actions. First, we collect users normal actions, then using the learning classifier and genetic algorithm application, we can solidify a set of rules that represent a normal working environment. After the rules are set in place, the system will continue to learn and analyze the new user's actions and compare them to the stored rules. Any user action that contradicts the rules will be considered abnormal, and thereby initiating notifications to be sent to predefined administrators for further investigation.

Authors : Jeff Hinson, Fadi Mohsen, Joe Taylor

Publication date : 2009/5/4