Dimitris Geneiatakis

Aristotle University of Thessaloniki | AUTH · Department of Electronics and Computer Engineering

Android Intent redirection, malicious activity launch and intent hijacking attacks can highly impact users’ data confidentiality and integrity. More specifically, malicious applications launch this type of attacks in order to manipulate the provided services and gain access to sensitive data. Though such attacks are not yet common, we argue that th...

HTTP security-focused response headers can be of great aid to web applications towards augmenting their overall security level. That is, if set at the server side, these headers define whether certain security countermeasures are in place for protecting end-users. By utilising the curated Tranco list, this work conducts a wide-scale internet measur...

Android task and hijacking attacks can have a high impact on end users’ data confidentiality, since malicious applications exploiting such a threat can deceive end users and gain access to sensitive data silently. We believe that these threats are of high importance and thus in this paper we study them thoroughly through a tool capable to identify...

Although various security mechanisms have been introduced in Android operating system in order to enhance its robustness, sheer protection remains an open issue: malicious applications (named as malware) usually find ways to bypass the security processes, whereas users are not aware a priori whether an application can operate as malware. To elimina...

This work proposes a scalable, blockchain-based platform for the secure sharing of COVID-19 or other disease vaccination certificates. As an indicative use case, we simulate a large-scale deployment by considering the countries of the European Union. The proposed platform is evaluated through extensive simulations in terms of computing resource usa...

The openness of the Android operating system and its immense penetration into the market makes it a hot target for malware writers. This work introduces Androtomist, a novel tool capable of symmetrically applying static and dynamic analysis of applications on the Android platform. Unlike similar hybrid solutions, Androtomist capitalizes on a wealth...

With the continuous development of distributed ledger and blockchain technologies, new use cases apart from cryptocurrencies have come into the spotlight. In this article, we evaluate whether an e-government service could be a suitable candidate for a blockchain transformation. We selected as a reference test system an existing cross-border e-gover...

Internet-connected toys (IoToys), embedded with microphones, cameras and other sensors, bring technology more than ever closer to children. This new generation of toys poses several questions, e.g. “What data can IoToys exchange? With whom? What are the possible threats?”, and raises concerns regarding the security and privacy of children. These is...

VoIP services in general, and Session Initiation Protocol (SIP) ones in particular, continue to grow at a fast pace and have already become a key component of Next Generation Networks (NGN). Despite this proliferation, SIP-based services expose a large attack surface for perpetrators and especially those who seek to cause Denial of Service (DoS). W...

The Android architecture introduces to the application layer a permission based access control model for restricting access to sensitive phone resources. In this model the access to Application Programming Interfaces (APIs) is protected through permissions defined by the Android OS. The developers in order to utilize protected API methods must decl...

Several policies initiatives around the digital economy stress on one side the centrality of smartphones and mobile applications, and on the other call for attention on the threats to which this ecosystem is exposed to. Lately, a plethora of related works rely on machine learning algorithms to classify whether an application is malware or not, usin...

In the Internet era, users’ fundamental privacy and anonymity rights have received significant research and regulatory attention. This is not only a result of the exponential growth of data that users generate when accomplishing their daily task by means of computing devices with advanced capabilities, but also because of inherent data properties t...

Micro-generation promises to greatly contribute to the energy balance of the energy grid; however, so far, its market penetration is going slow due to the few, or not-existing, direct economic benefits end-users would enjoy by deploying an in-house micro-generation system. In this paper, taking advantage of the potentialities of blockchain technolo...

Internet of Things (IoT) can support numerous applications and services in various domains, such as smart cities and smart homes. IoT smart objects interact with other components e.g., proxies, mobile devices, and data collectors, for management, data sharing and other activities in the context of the provided service. Though such components contri...

Mobile platforms, such as Android, iOS, Windows and others, are more and more gaining relevance within end-users' applications, thanks to their usability, flexibility and low cost. As a result, mobile Internet traffic is about to overwhelm the land-line one. Mobile platforms do not only provide end-users with services similar to legacy computers, b...

Over the last decade, VoIP services and more especially the SIP-based ones, have gained much attention due to the low-cost and simple models they offer. Nevertheless, their inherently insecure design make them prone to a plethora of attacks. This work concentrates on the detection of resource consumption attacks targeting SIP ecosystems. While this...

The widespread adoption of the Android operating system in a variety type of devices ranging from smart phones to smart TVs, makes it an interesting target for developers of malevolent applications. In the current security model of Android, applications are granted several permissions during their installation. Users do not have means to easily und...

Lately, end-users and database administrators face continuously personal data exposures. Among different type of vulnerabilities an adversary might exploit, to gain access to this data, SQL injections are considered one of the most serious vulnerabilities, which remain at the top twenty most known vulnerabilities more than a decade. Though various...

Covert channels pose a significant threat for networking systems. In this paper, we examine the exploitation of Session Description Protocol (SDP) information residing in Session Initiation Protocol (SIP) requests with the aim to hide data in plain sight. While a significant mass of works in the literature cope with covert communication channels, o...

The Android OS environment is today increasingly targeted by malwares. Traditional signature based detection algorithms are not able to provide complete protection especially against ad-hoc created malwares. In this paper, we present a feasibility analysis for enhancing the detection accuracy on Android malware for approaches relying on machine lea...

Recently there is a trend to use cloud computing on service deployment, enjoying various advantages that it offers with emphasis on the economy which is achieved in the era of the financial crisis. However, along with the transformation of technology, several security issues are raised and especially the threat of malicious insiders. For instance,...

This paper focuses on network anomaly-detection and especially the effectiveness of Machine Learning (ML) techniques in detecting Denial of Service (DoS) in SIP-based VoIP ecosystems. It is true that until now several works in the literature have been devoted to this topic, but only a small fraction of them have done so in an elaborate way. Even mo...

Attackers always find ways to elude the employed security mechanisms of a system, no matter how strong they are. Nevertheless, audit trails-which as a rule of thumb are kept by any service provider-store all the events pertaining to the service of interest. Therefore, audit trail data can be a valuable ally when it comes to the certification of the...

Many times in the past, critical infrastructures like e-health and e-government services have become a target of cyber-attacks resulting to manipulation of sensitive information. Meanwhile, there are several approaches applying security and privacy protection measures on cloud-based databases. Simultaneously, many steganographic algorithms have bee...

Voice over IP (VoIP) architecture and services consist of different software and hardware components that may be susceptible to a plethora of attacks. Among them, Denial of Service (DoS) is perhaps the most powerful one, as it aims to drain the underlying resources of a service and make it inaccessible to the legitimate users. So far, various detec...

Mobile applications build part of their security and privacy on a declarative permission model. In this approach mobile applications, to get access to sensitive resources, have to define the corresponding permissions in a manifest. However, mobile applications may request access to permissions that they do not require for their execution (over-priv...

Next Generation Networks bring together wired and wireless architectures, under the umbrella of an all IP architecture. Architectures such as the IP Multimedia Subsystem (IMS) offer advanced services at very low cost but also inherit IP infrastructure’s security and privacy issues. The utilized signaling protocol (i.e. Session Initiation Protocol)...

Cloud usage has become a reality in users’ everyday habits (even if sometimes unconsciously), and security and privacy issues in this context have already been subject of consideration by scientific, business and policy-makers communities. However, the increasing use of mobile phones, and, generally speaking mobile smart devices, to access the Clou...

Network audit trails, especially those composed of application layer data, can be a valuable source of information regarding the investigation of attack incidents. Nevertheless, the analysis of log files of large volume is usually both complex (slow) and privacy-neglecting. Especially, when it comes to VoIP, the literature on how audit trails can b...

Session Initiation Protocol (SIP) is a widely used protocol for voice and video communication in Internet archi-tecture. Due to its open nature and the lack of robust security mechanisms, SIP is vulnerable to several attacks similar to those existing in Internet infrastructure, such as the flooding attack. An attacker can use any SIP request to lau...

Session Initiation Protocol (SIP) is a widely used protocol for voice and video communication in Internet architecture. Due to its open nature and the lack of robust security mechanisms, SIP is vulnerable to several attacks similar to those existing in Internet infrastructure, such as the flooding attack. An attacker can use any SIP request to laun...

Several steganographic algorithms have been proposed for protecting message secrecy against unauthorized "reads". The most used method for hiding a message relies on embedding the secret message in Least Significant Bit (LSB) on the cover object. Though various digital formats have been proposed in literature to be used as cover objects, little att...

While navigating on the Internet, the citizen is creating a steadily increasing trail of more or less personal data projected and archived in the digital world. Cloud applications are more and more becoming state of the art from various points of view when it comes to outsource any type of (softwarerelated) service or the externalisation of data re...

Applications can be logically separated to parts that face different types of threats, or suffer dissimilar exposure to a particular threat because of external events or innate properties of the software. Based on this observation, we propose the virtual partitioning of applications that will allow the selective and targeted application of those pr...

In complex environments like the IP multimedia Subsystem (IMS), state of the art security solutions cannot always provide satisfactory protection against any type of attack. This paper addresses the security mechanisms utilized by IMS with respect to their susceptibility to SIP based attacks that have been described in the literature. This analysis...

Protection against Denial of Service (DoS) attacks is a challenging and ongoing problem. Current overlay-based solutions can transparently filter unauthorized traffic based on user authentication. Such solutions require either pre-established trust or explicit user interaction to operate, which can be circumvented by determined attackers and is not...

No matter how robust the employed security mechanisms are malicious users or attackers will always find a way to bypass them. In addition, National Institute of Security and Technology mentionsIn conjunction with appropri ate tools & procedures, audit trail can assist in detecting security violation and flaws in applications � . Until now, in Multi...

In this paper we assess the open IP Multimedia Subsystem (IMS) robustness against malformed message attacks. We employ an IMS test-bed architecture using two different testing suites; the PROTOS which is publicly available, and a proprietary one, that has been develop for the purpose of this specific work. Results have highlighted that although IMS...

The IP Multimedia Subsystem (IMS) infrastructure is currently considered to be the main core of Next Generation Networks (NGNs), integrating IP and other network types under one common infrastructure. Consequently, IMS inherits security flaws and vulnerabilities residing in all those technologies. Besides, the protection against unauthorized access...

Session Initiation Protocol is a core protocol for coming real time communication networks, including VoIP, IMS and IPTV networks. Based on the open IP stack, it is similarly susceptible to Denial-of-Service Attacks launched against SIP servers. More than 20 different research works have been published to address SIP-related DoS problems. In this s...

SIP is rapidly becoming a standard for service integration within a variety of wireless and wireline networks. In this regard high availability, reliability and redundancy are key factors for any SIP based infrastructure. In an adverse environment, especially the Internet and foreseeable 3GPP IMS, high availability solutions are of major importance...

Any application or service utilizing the Internet is exposed to both general Internet attacks and other specific ones. Most of the times the latter are exploiting a vulnerability or misconfiguration in the provided service and/or in the utilized protocol itself. Consequently, the employment of critical services, like Voice over IP (VoIP) services,...

The Internet based telephony services (IPTel) are mainly exposed to set of vulnerabilities that inherited from the employed protocols such as TCP/IP and proprietary VoIP protocols. One of the most critical threats in this sensitive environments is considered the denial of service (DoS) attacks. The main concern of a mechanism that focuses on detect...

It is well known that no security mechanism can provide full protection against a potential attack. There is always a possibility that a security incident may happen, mainly as a result of a new or modified attack that the employed countermeasures cannot handle or identify. It is therefore useful to perform a deferred analysis of logged network dat...

Common practice for healthcare organizations is to maintain locally their own files, thus causing a geographic distribution of healthcare records. On the other hand, healthcare personnel treating a patient needs access to previous diagnosis and treatment data, maintained by various institutions in many different locations. Currently, the lack of a...

Voice services over Internet Protocol (VoIP) are nowadays much promoted by telecommunication and Internet service providers. However, the utilization of open networks, like the Internet, raises several security issues that must be accounted for. On top of that, there are new sophisticated attacks against VoIP infrastructures that capitalize on vuln...

The current penetration, but also the huge potential, of Voice over IP (VoIP) telephony services in the market, boosts the competition among telecommunication service providers who promote new services through many different types of offers. However, this transition from the closed Public Switched Telephone Network (PSTN) architecture to the intern...

The emergence of Voice over IP (VoIP) has offered numerous advantages for end users and providers alike, but simultaneously has introduced security threats, vulnerabilities and attacks not previously encountered in networks with a closed architecture like the Public Switch Telephone Network (PSTN). In this paper we propose a two layer architecture...

It is widely accepted that electronic Government environments have caused a complete transformation of the way individuals, businesses and governmental agencies interact with central government. However, the acceptance and success of e-Government services largely depend on the level of trust and confidence developed by the users to the provided ser...

Internet Telephony services offer several new business opportunities to telecommunication providers. However, they also introduce several security flaws that can be exploited by various attacks, thus raising the need for the employment of suitable security measures during the provision of the service. Signaling attacks, a type of Denial of Service...

The advent of Voice over IP (VoIP) has offered numerous advantages but, at the same time, it has introduced security threats not previously encountered in networks with a closed architecture like the Public Switch Telephone Networks (PSTN). One of these threats is that of signaling attacks. This paper examines the signaling attacks in VoIP environm...

DNS amplification attacks massively exploit open recursive DNS servers mainly for performing bandwidth consumption DDoS attacks. The amplification effect lies in the fact that DNS response messages may be substantially larger than DNS query messages. In this paper, we present and evaluate a novel and practical method that is able to distinguish bet...

Recent serious security incidents reported several attackers employing IP spoofing to massively exploit recursive name servers to amplify DDoS attacks against numerous networks. DNS amplification attack scenarios utilize DNS servers mainly for performing bandwidth consumption DoS attacks. This kind of attack takes advantage of the fact that DNS res...

This paper presents a framework that can be utilized for the protection of session initiation protocol (SIP)-based infrastructures from malformed message attacks. Its main characteristic is that it is lightweight and that it can be easily adapted to heterogeneous SIP implementations. The paper analyzes several real-life attacks on VoIP services and...

Voice over IP (VoIP) services based on the Session Initiation Protocol (SIP) gain ground as compared to other protocols like MGCP or H.323. However, the open SIP architecture constitutes the provided services vulnerable to various attacks, similar to those currently existing in Internet. The lack of a formal way to describe VoIP vulnerabilities hin...

Although privacy is often seen as an essential right for inter- net users, the provision of anonymity can also provide the ultimate cover for malicious users. Privacy Enhancing Technologies (PETs) should not only hide the identity of legitimate users but also provide means by which evidence of malicious activity can be gathered. This paper proposes...

Third Generation Partnership Project (3GPP) has recently provided a cellular-WLAN interworking architecture as an add-on to 3GPP system specifications. This architecture can offer IP-based services, compatible with those obtainable by 3G packet switched domain, to a 3G subscriber who is connected via a WLAN. Following this approach, in this paper w...

The open architecture of the Internet and the use of open standards like Session Initiation Protocol (SIP) constitute the provisioning of services (e.g., Internet telephony, instant messaging, presence, etc.) vulnerable to known Internet attacks, while at the same time introducing new security problems based on these standards that cannot been tack...

Public ENUM is used until now in trials and some "test-bed" or "production" VoIP environments with small volume. Very lately, another application of the ENUM protocol has emerged namely the "Carrier ENUM", becoming popular among VoIP and mobile providers. In this context, a new competitive to public and carrier ENUM, peer-to-peer approach promotes...

Internet telephony like any other Internet service suffers from security flaws caused by various implementation errors (e.g. in end-users terminals, protocols, operating systems, hardware, etc). These implementation problems usually lead VoIP subsystems (e.g. SIP servers) to various unstable operations whenever trying to process a message not confo...

This document provides an overview of state of the art in intrusion and denial of service detection as well as reliability approaches for VoIP infrastructures. In this context we provide a brief overview of a general architecture of VoIP infrastructures and possible attack scenarios on the different components of such an infrastructure. Here we con...

The commercial deployment of VoIP necessitates the employment of security mechanisms that can assure availability, reliability, confidentiality and integrity. The Session Initiation Protocol (SIP) is considered as the dominant signalling protocol for calls over the Internet. SIP, like other Internet protocols, is vulnerable to known Internet attack...