AIDRC Seminar Series - Dr. Tiago Cruz

Title:

The enemy within: (Ab)using Building Automation and Control Systems (BACS) for covert data exfiltration.

Abstract:

When it comes to protecting confidential and/or sensitive information, organizations have a plethora of recommendations, standards, policies and security controls at their disposal, conceived to deal with a wide variety of threats. However, most of them share the same fundamental premise: that weaknesses are inline by nature, as a consequence of infrastructure, social and/or technological gaps that can be controlled, mitigated or constrained.

Side channel threats are a different matter, though. Stemming from unconventional intrusion or attack vectors whose existence was inconceivable, deemed unfeasible, or even completely unexpected, their successful exploitation may provide attackers with the means to bypass and render most security controls ineffective or even useless. In this presentation we will address one such case - the (ab)use of building automation and control systems to exfiltrate data from an air-gapped infrastructure, exploring some use cases as well as specific techniques and eventual countermeasures.

Bio:

Tiago Cruz is Auxiliary Professor at the Department of Informatics Engineering of the University of Coimbra, since December 2013, where he obtained his PhD in Computer Science in 2012. He is a Senior Researcher at the Center for Informatics and Systems of UC, having started his research activity in 2001. His research interests cover areas such as management systems for communications infrastructure and services (operator and data center environments), embedded computing, critical infrastructure security, broadband access network device and service management. He has been involved in various European- and industry-funded research projects related with cyber-security, autonomous management, content delivery infrastructures or wireless WAN technologies (CockpitCI FP7, WEIRD FP7, ACROSS COST, CONTENT FP6), as well as several national projects, in partnership with telecommunications operators and research agencies, with both technical and management activities.