Miguel Correia

Unmanned Aerial Vehicle (UAV)s, also known as drones, are increasingly used in several applications and a variety of cyber attacks can be performed on them using several tools. Some examples of these attacks include breaking the connection between the drone and the controller with deauthentication attacks, discovering a password or cryptographic key used in a communication protocol, gaining control of the drone through command/code injection, and Man-in-the-Middle (MitM) attacks. This paper covers drone attacks by analyzing different components of the drone, including the remote controller and communication protocols. The main purpose is to provide an overview of the possible ways in which cyber attacks can be executed. This analysis concludes that drones, designed for diverse purposes, are vulnerable to a range of cyber attacks. The paper also reviews existing penetration testing methodologies for UAVs, which provide a logical framework for their realization. This review covers the different cyber attack methods and tools used against a UAV, intending to improve defense mechanisms.

This paper explores the problem of the security of unmanned aerial vehicles (UAV) by introducing the drone security scoring system (D3S). D3S is a security assessment method that analyzes the security of a UAV model by analyzing its components. Penetration tests were carried out to support D3S and identify potential vulnerabilities in UAVs. Specific cyber-attacks, such as deauthentication, flooding, and replay, were executed in an effort to take full control of the UAVs. Eight different UAV models were assessed using D3S, revealing notable variations in performance, both in control communications and video transmission. Security scores ranging from 0.9 to 4.5 out of 5 were obtained, showing significantly divergent security levels.

The use of remote storage has become prevalent both by organizations and individuals. By relying on third-party storage, such as cloud or peer-to-peer storage services, availability, fault tolerance, and low access latency can be attained in a cost-efficient manner. Unfortunately, storage providers may misbehave and violate Service-Level Agreements (SLAs). In this article, we propose a new Proof of Timely-Retrievability (PoTR) that aims at assessing whether a provider is able to retrieve data objects with a latency lower than some SLA-specific threshold δ. We have implemented the PoTR and evaluated two distinct configurations of the proof, one tailored to estimate the average latency experience by clients and the other tailored to assess its variance. We leverage Trusted Execution Environments (e.g., Intel SGX) to ensure that the proof is produced by the node being audited and to reduce the communication between the auditor and the audited node. We have experimentally evaluated our prototypes considering a challenging edge computing setting, where storage services are provided by resource-constrained fog nodes, and the distance between the auditor and the audited node can be large. Despite the noise introduced by edge network delays, we show that the auditor is able to effectively detect SLA violations.

Blockchain aggregators play an instrumental role in the evolution of blockchain technology, serving as pivotal enablers of interoperability, efficiency, and user accessibility in an increasingly decentralized digital world. However, the literature on this emerging technology is scarce and is not systematized, making it harder for practitioners and researchers to understand the field. In this paper, we systematize bridge aggregators, a type of blockchain aggregators. We present an exhaustive analysis of a diverse array of token and message aggregators, each distinguished by its unique architecture. Our research delves into critical aspects of these aggregators, encompassing their functionality, security measures, pricing models, and latency. This research aims to provide readers, users, and developers with insightful and actionable information, facilitating informed navigation through the complex landscape of blockchain aggregators. We explore our findings and compare them with our intuitive expectations. We show that there is a value in centralizing token aggregators. Message aggregators are found to be more powerful but less efficient in transaction cost and latency. Finally, we propose a set of future research directions for practitioners.

Recent years have witnessed significant advancements in cross-chain technology. However, the field faces two pressing challenges. On the one hand, hacks on cross-chain bridges have led to monetary losses of around 3.1 billion USD, highlighting flaws in security models governing interoperability mechanisms and the ineffectiveness of incident response frameworks. On the other hand, users and bridge operators experience restricted privacy, which broadens the potential attack surface. In this paper, we present the most comprehensive study to date on the security and privacy of blockchain interoperability. We employ a systematic literature review, yielding a corpus of 212 relevant documents, including 58 academic papers and 154 gray literature documents, out of a pool of 531 results. We systematically categorize 57 interoperability solutions based on a novel security and privacy taxonomy. Our dataset, comprising academic research, disclosures from bug bounty programs, and audit reports, exposes 45 cross-chain vulnerabilities, 25 theoretical attacks, and 93 mitigation strategies. Leveraging this data, we analyze 14 notable bridge hacks accounting for over 2.9 billion USD in losses, mapping them to the identified vulnerabilities. Our findings reveal that a substantial portion (65.8%) of stolen funds originates from projects secured by intermediary permissioned networks with unsecured cryptographic key operations. Privacy-wise, we demonstrate that achieving unlinkability in cross-chain transactions is contingent on the underlying ledgers providing some form of confidentiality. Our study offers critical insights into the security and privacy of cross-chain systems. We pinpoint promising future research directions, underscoring the urgency of enhancing security and privacy efforts in cross-chain technology. The identified improvements can mitigate the financial risks associated with bridge hacks, fostering user trust in the blockchain ecosystem and, consequently, wider adoption.