Researchers at ETH Zurich have formalized models of the EMV payment protocol using the Tamarin model checker. They discovered flaws allowing attackers to bypass PIN requirements for high-value purchases on EMV cards like Mastercard and Visa. The team also collaborated with an EMV consortium member to verify the improved EMV Kernel C-8 protocol. Why it matters: This research highlights the importance of formal methods in identifying critical vulnerabilities in widely used payment systems, potentially impacting financial security for consumers in the GCC region and worldwide.
A study compared the vulnerability of C programs generated by nine state-of-the-art Large Language Models (LLMs) using a zero-shot prompt. The researchers introduced FormAI-v2, a dataset of 331,000 C programs generated by these LLMs, and found that at least 62.07% of the generated programs contained vulnerabilities, detected via formal verification. The research highlights the need for risk assessment and validation when deploying LLM-generated code in production environments.
This paper introduces a minimalistic autonomous racing stack designed for high-speed time-trial racing, emphasizing rapid deployment and efficient system integration with minimal on-track testing. Validated on real speedways, the stack achieved a top speed of 206 km/h within just 11 hours of practice, covering 325 km. The system performance analysis includes tracking accuracy, vehicle dynamics, and safety considerations. Why it matters: This research offers insights for teams aiming to quickly develop and deploy autonomous racing stacks with limited track access, potentially accelerating innovation in autonomous vehicle technology within the A2RL and similar racing initiatives.
TII's Secure Systems Research Center (SSRC) has joined Dronecode, a Linux Foundation non-profit, to enhance UAV security. SSRC will contribute to Dronecode's Security SIG, focusing on cryptography, memory protection, and code analysis for the Pixhawk autopilot hardware and PX4 software. SSRC aims to develop and share security and resilience capabilities for the open UAV platform. Why it matters: This partnership enhances the security of drone systems, addressing potential privacy, cybersecurity, and safety threats in line with the UAE's focus on secure autonomous systems.
Researchers at TII, in cooperation with University Paderborn and Ruhr University Bochum, have discovered a vulnerability called the Opossum Attack in Transport Layer Security (TLS) impacting protocols like HTTP(S), FTP(S), POP3(S), and SMTP(S). The vulnerability exposes a risk of desynchronization between client and server communications, potentially leading to exploits like session fixation and content confusion. Scans revealed over 2.9 million potentially affected servers, including over 1.4 million IMAP servers and 1.1 million POP3 servers. Why it matters: This discovery highlights the importance of ongoing cybersecurity research in the UAE and internationally to identify and address vulnerabilities in fundamental internet protocols, especially as it led to immediate action by Apache and Cyrus IMAPd.