Posts by: All posts by Daniele

PhD Studentship in IoT Threat Modelling

Applications are invited for a PhD studentship on threat modelling of IoT devices starting in October 2018, supervised by Daniele Sgandurra.  The focus of the PhD studentship is on threat modelling of Internet of Things (IoT) devices, and the successful candidate will join the Smart Card and IoT Security Center of the Information Security Group. Please note that only British applicants can apply for this position.

More information can be found at this link.

SCC Joins FutureTPM Project

Academics from the Smart Card Center at the Information Security Group  (ISG) at Royal Holloway, University of London, are part of an international consortium focusing on developing the next generation TPM (Trusted Platform Module) – which is embedded into computing systems to make its host computer platform trustworthy and secure.

TPMs are currently incorporated into over a billion computers worldwide but the team working on the new H2020 Project ‘FutureTPM‘ will be focusing on developing next generation security solutions to mitigate against quantum computers. These computers are anticipated to be able to  break some of the cryptographic algorithms currently used in existing TPMs.

Royal Holloway’s project activities will be led by Dr Daniele Sgandurra, who has received a grant of €375,065 from the European Commission to carry out the work alongside Professor Konstantinos Markantonakis, Professor Chris Mitchell, and Dr Elizabeth Quaglia, also from the ISG.

Dr Sgandurra said: “We are thrilled to be part of this project that will combine the expertise of high calibre industrial and academic partners from across Europe to develop quantum-resistant algorithms suitable for inclusion in future TPMs. We hope this project will positively affect people’s everyday lives, in terms of building their trust in securely using online services, such as online banking and Cloud storage.”

The FutureTPM project partners are:

  • Royal Holloway, University of London, United Kingdom
  • Huawei Technologies Düsseldorf GmbH, Germany
  • IBM Research GmbH, Switzerland
  • INESC-ID – Instituto de Engenhariade Sistemas e Computadores, Investigacao e Desenvolvimento em Lisboa, Portugal
  • Infineon Technologies AG, Germany
  • Infineon Technologies Austria AG, Austria
  • Suite5 Data Intelligence Solutions Limited, Ireland
  • TECHNIKON Forschungs- und Planungsgesellschaft mbH, Austria
  • UBITECH Limited, Cyprus
  • University of Birmingham, United Kingdom
  • Université du Luxembourg, Luxembourg
  • University of Piraeus Research Center, Greece
  • University of Surrey, United Kingdom
  • VIVA Payment Services SA, Greece

Responsible Disclosure: Firmware Vulnerabilities in iSmartAlarm CubeOne

As part of the final MSc project, one of our MSc students, Yee Ching Tok, supervised by Daniele Sangdurra, investigated the firmware of a popular smart home security device – the iSmartAlarm CubeOne. Two vulnerabilities (CVE-2017-13663 and CVE-2017-13664) were found and disclosed responsibly to the vendor. A detailed explanation of the vulnerabilities and of disclosure timeline is available here: https://poppopretn.com/2017/11/30/public-disclosure-firmware-vulnerabilities-in-ismartalarm-cubeone/