Enhancing security of linux-based android devices

Our daily lives become more and more dependent upon smartphones due to their increased capabilities. Smartphones are used in various ways from payment systems to assisting the lives of elderly or disabled people. Security threats for these devices become increasingly dangerous since there is still a lack of proper security tools for protection. Android emerges as an open smartphone platform which allows modification even on operating system level. Therefore, third-party developers have the opportunity to develop kernel-based low-level security tools which is not normal for smartphone platforms. Android quickly gained its popularity among smartphone developers and even beyond since it bases on Java on top of "open" Linux in comparison to former proprietary platforms which have very restrictive SDKs and corresponding APIs. Symbian OS for example, holding the greatest market share among all smartphone OSs, was closing critical APIs to common developers and introduced application certification. This was done since this OS was the main target for smartphone malwares in the past. In fact, more than 290 malwares designed for Symbian OS appeared from July 2004 to July 2008. Android, in turn, promises to be completely open source. Together with the Linux-based smartphone OS OpenMoko, open smartphone platforms may attract malware writers for creating malicious applications endangering the critical smartphone applications and owners� privacy. In this work, we present our current results in analyzing the security of Android smartphones with a focus on its Linux side. Our results are not limited to Android, they are also applicable to Linux-based smartphones such as OpenMoko Neo FreeRunner. Our contribution in this work is three-fold. First, we analyze android framework and the Linux-kernel to check security functionalities. We survey wellaccepted security mechanisms and tools which can increase device security. We provide descriptions on how to adopt these security tools on Android kernel, and provide their overhead analysis in terms of resource usage. As open smartphones are released and may increase their market share similar to Symbian, they may attract attention of malware writers. Therefore, our second contribution focuses on malware detection techniques at the kernel level. We test applicability of existing signature and intrusion detection methods in Android environment. We focus on monitoring events on the kernel; that is, identifying critical kernel, log file, file system and network activity events, and devising efficient mechanisms to monitor them in a resource limited environment. Our third contribution involves initial results of our malware detection mechanism basing on static function call analysis. We identified approximately 105 Executable and Linking Format (ELF) executables installed to the Linux side of Android. We perform a statistical analysis on the function calls used by these applications. The results of the analysis can be compared to newly installed applications for detecting significant differences. Additionally, certain function calls indicate malicious activity. Therefore, we present a simple decision tree for deciding the suspiciousness of the corresponding application. Our results present a first step towards detecting malicious applications on Android-based devices.

Developing and benchmarking native Linux applications on Android

Smartphones get increasingly popular where more and more smartphone platforms emerge. Special attention was gained by the open source platform Android which was presented by the Open Handset Alliance (OHA) hosting members like Google, Motorola, and HTC. Android uses a Linux kernel and a stripped-down userland with a custom Java VM set on top. The resulting system joins the advantages of both environments, while third-parties are intended to develop only Java applications at the moment. In this work, we present the benefit of using native applications in Android. Android includes a fully functional Linux, and using it for heavy computational tasks when developing applications can bring in substantional performance increase. We present how to develop native applications and software components, as well as how to let Linux applications and components communicate with Java programs. Additionally, we present performance measurements of native and Java applications executing identical tasks. The results show that native C applications can be up to 30 times as fast as an identical algorithm running in Dalvik VM. Java applications can become a speed-up of up to 10 times if utilizing JNI.

Monitoring android for collaborative anomaly detection : a first architectural draft

Our daily lives become more and more dependent upon smartphones due to their increased capabilities. Smartphones are used in various ways, e.g. for payment systems or assisting the lives of elderly or disabled people. Security threats for these devices become more and more dangerous since there is still a lack of proper security tools for protection. Android emerges as an open smartphone platform which allows modification even on operating system level and where third-party developers first time have the opportunity to develop kernel-based low-level security tools. Android quickly gained its popularity among smartphone developers and even beyond since it bases on Java on top of "open" Linux in comparison to former proprietary platforms which have very restrictive SDKs and corresponding APIs. Symbian OS, holding the greatest market share among all smartphone OSs, was even closing critical APIs to common developers and introduced application certification. This was done since this OS was the main target for smartphone malwares in the past. In fact, more than 290 malwares designed for Symbian OS appeared from July 2004 to July 2008. Android, in turn, promises to be completely open source. Together with the Linux-based smartphone OS OpenMoko, open smartphone platforms may attract malware writers for creating malicious applications endangering the critical smartphone applications and owners privacy. Since signature-based approaches mainly detect known malwares, anomaly-based approaches can be a valuable addition to these systems. They base on mathematical algorithms processing data that describe the state of a certain device. For gaining this data, a monitoring client is needed that has to extract usable information (features) from the monitored system. Our approach follows a dual system for analyzing these features. On the one hand, functionality for on-device light-weight detection is provided. But since most algorithms are resource exhaustive, remote feature analysis is provided on the other hand. Having this dual system enables event-based detection that can react to the current detection need. In our ongoing research we aim to investigates the feasibility of light-weight on-device detection for certain occasions. On other occasions, whenever significant changes are detected on the device, the system can trigger remote detection with heavy-weight algorithms for better detection results. In the absence of the server respectively as a supplementary approach, we also consider a collaborative scenario. Here, mobile devices sharing a common objective are enabled by a collaboration module to share information, such as intrusion detection data and results. This is based on an ad-hoc network mode that can be provided by a WiFi or Bluetooth adapter nearly every smartphone possesses.

Google Android : a comprehensive introduction

Google Android, Google's new product and its first attempt to enter the mobile market, might have an equal impact on mobile users like Apple's hyped product, the iPhone. In this Technical report we are going to present the Google Android platform, what Android is, describe why it might be considered as a worthy rival to Apple's iPhone. We will describe parts of its internals, take a look "under the hood" while explaining components of the underlying operating system. We will show how to develop applications for this platform, which difficulties a developer might have to face, and how developers can possibly use other programming languages to develop for Android than the propagated language Java.

The development of Monte Carlo techniques for the verification of radiotherapy treatments

Introduction: Recent advances in the planning and delivery of radiotherapy treatments have resulted in improvements in the accuracy and precision with which therapeutic radiation can be administered. As the complexity of the treatments increases it becomes more difficult to predict the dose distribution in the patient accurately. Monte Carlo (MC) methods have the potential to improve the accuracy of the dose calculations and are increasingly being recognised as the ‘gold standard’ for predicting dose deposition in the patient [1]. This project has three main aims: 1. To develop tools that enable the transfer of treatment plan information from the treatment planning system (TPS) to a MC dose calculation engine. 2. To develop tools for comparing the 3D dose distributions calculated by the TPS and the MC dose engine. 3. To investigate the radiobiological significance of any errors between the TPS patient dose distribution and the MC dose distribution in terms of Tumour Control Probability (TCP) and Normal Tissue Complication Probabilities (NTCP). The work presented here addresses the first two aims. Methods: (1a) Plan Importing: A database of commissioned accelerator models (Elekta Precise and Varian 2100CD) has been developed for treatment simulations in the MC system (EGSnrc/BEAMnrc). Beam descriptions can be exported from the TPS using the widespread DICOM framework, and the resultant files are parsed with the assistance of a software library (PixelMed Java DICOM Toolkit). The information in these files (such as the monitor units, the jaw positions and gantry orientation) is used to construct a plan-specific accelerator model which allows an accurate simulation of the patient treatment field. (1b) Dose Simulation: The calculation of a dose distribution requires patient CT images which are prepared for the MC simulation using a tool (CTCREATE) packaged with the system. Beam simulation results are converted to absolute dose per- MU using calibration factors recorded during the commissioning process and treatment simulation. These distributions are combined according to the MU meter settings stored in the exported plan to produce an accurate description of the prescribed dose to the patient. (2) Dose Comparison: TPS dose calculations can be obtained using either a DICOM export or by direct retrieval of binary dose files from the file system. Dose difference, gamma evaluation and normalised dose difference algorithms [2] were employed for the comparison of the TPS dose distribution and the MC dose distribution. These implementations are spatial resolution independent and able to interpolate for comparisons. Results and Discussion: The tools successfully produced Monte Carlo input files for a variety of plans exported from the Eclipse (Varian Medical Systems) and Pinnacle (Philips Medical Systems) planning systems: ranging in complexity from a single uniform square field to a five-field step and shoot IMRT treatment. The simulation of collimated beams has been verified geometrically, and validation of dose distributions in a simple body phantom (QUASAR) will follow. The developed dose comparison algorithms have also been tested with controlled dose distribution changes. Conclusion: The capability of the developed code to independently process treatment plans has been demonstrated. A number of limitations exist: only static fields are currently supported (dynamic wedges and dynamic IMRT will require further development), and the process has not been tested for planning systems other than Eclipse and Pinnacle. The tools will be used to independently assess the accuracy of the current treatment planning system dose calculation algorithms for complex treatment deliveries such as IMRT in treatment sites where patient inhomogeneities are expected to be significant. Acknowledgements: Computational resources and services used in this work were provided by the HPC and Research Support Group, Queensland University of Technology, Brisbane, Australia. Pinnacle dose parsing made possible with the help of Paul Reich, North Coast Cancer Institute, North Coast, New South Wales.

Community response to disasters in Indonesia : Gotong Royong; a double edged-sword

Indonesia is a country spread across wide-ranging archipelago, located in South East Asia between two oceans, the Indian and the Pacific. Indonesia is well known as an active tectonic region because it lies on top of three major active tectonic plates: the Eurasian in the North, the Indian Ocean-Australian in the South, and the Pacific plate in the East. The southern and eastern part of the country features a range of volcanic arcs, volcanic mountains, and lowlands with 500 young volcanoes, of which 128 are active and thus representing 15% of the world’s active volcanoes. In the period 2002-2007, approximately 1782 disasters occurred, with hundreds of thousands of lives lost and billions of rupiah in losses incurred: (Floods - 1183 instances, cyclones - 272 instances, and landslides - 252 instances). Of these, the 2004 Aceh tsunami and the 2006 central Java earthquake (impacting predominantly city and suburbs of Yogyakarta) were the most significant. Even so, disaster management experts believe lessons learnt from the two major natural disasters needs to be formalised into laws and institutions before another disaster occurs, regardless of the type of natural disaster – i.e. Volcano eruption or landslide; as opposed to tsunami or earthquake. Following in the wake of disasters occurring in Yogyakarta, many of its community members responded by banding together as one, with the determination of rebuilding its villages and cities through the spirit of ‘gotong royong’. The idea of social interaction; in particular as a collective, consensual, and cooperative nation; has predominantly formed the ideological basis of Indonesia’s societal nature. Many Indonesian terms cohere to this ideology, such as: ‘koperasi” (cooperatives as the basis of economic interactions), ‘musyawarah’ (consensual nature in decision making), and ‘gotong royong’ (mutual assistance). ‘Gotong royong’ has become a key cultural operator in Indonesia, in particular In Jogjakarta. Appropriately so as ‘gotong royong’ is depicted from the traditional Javanese village, where labour is accomplished through reciprocal exchange and the villagers are motivated by a general ethos of selfishness and concern for the common good. The culture of ‘gotong royong’ promotes positive values such as social harmony and mutual reciprocation in disaster-affected areas provides the necessary spirit needed to endure the hardships and for all involved. While gotong royong emphasises the positive notions of mutual family support and deep community level activity there is a potential for contrast against government lead disaster response and recovery management activities especially in settings where sporadic governance mechanisms exist and transparency and accountability in the recovery process of public infrastructure assets have been questioned. This paper thus questions whether Gotong Royong is a double-edged sword, and explores the potential marriage of community values and governance mechanisms for future disaster management planning and practice.

A marine reservoir correction for the Houtman-Abrolhos Archipelago, East Indian Ocean, Western Australia

High-precision analysis using accelerator mass spectrometry (AMS) was performed upon known-age Holocene and modern, pre-bomb coral samples to generate a marine reservoir age correction value (ΔR) for the Houtman-Abrolhos Archipelago (28.7°S, 113.8°E) off the Western Australian coast. The mean ΔR value calculated for the Abrolhos Islands, 54 ± 30 yr (1σ) agrees well with regional ΔR values for Leeuwin Current source waters (N-NW Australia-Java) of 60 ± 38. The Abrolhos Islands show little variation with ΔR values of the northwestern and north Australian coast, underlining the dominance of the more equilibrated western Pacific-derived waters of the Leeuwin Current over local upwelling. The Abrolhos Islands ΔR values have remained stable over the last 2896 yr cal BP, being also attributed to the Leeuwin Current and the El Niño Southern Oscillation (ENSO) signal during this period. Expected future trends will be a strengthening of the teleconnection of the Abrolhos Islands to the climatic patterns of the equatorial Pacific via enhanced ENSO and global warming activity strengthening the Leeuwin Current. The possible effect upon the trend of future ΔR values may be to maintain similar values and an increase in stability. However, warming trends of global climate change may cause increasing dissimilarity of ΔR values due to the effects of increasing heat stress upon lower-latitude coral communities.

It's just an old apron : aprons, artefacts and art - representations of personal and private 'her-stories', as public histories

This paper examines art and artefact in the representation and recollection of deeply personal WWII women’s experiences as POW’s under the Japanese. This kind of treatment of internees in the Tjideng Women and Children’s internment camp (and others) in Batavia under the Japanese in WWII, stands in stark and brutal contrast to the idyllic life lived by many families up to that time in what was then known as the Dutch East Indies (Indonesia). The deprivation and brutality of the Japanese incarceration of these women and children evoked responses - not military, but certainly militant, if muted. Representations of those responses – as both art and artefact - may be found in the most unlikely places and unexpected forms - and are still being unearthed to this day. However close we might personally be to these artists and artisans, can we, as observers from a distance, ever truly comprehend through spoken or written words alone, the day-today realities of those extraordinary times?

Impacts of climatic factors on evolution of molecular diversity and the natural distribution of wild stocks of the giant freshwater prawn (Macrobrachium rosenbergii)

Natural distributions of most freshwater taxa are restricted geographically, a pattern that reflects dispersal limitation. Macrobrachium rosenbergii is unusual because it occurs naturally in rivers from near Pakistan in the west, across India and Bangladesh to the Malay Peninsula, and across the Sunda Shelf and Indonesian archipelago to western Java. Individuals cannot tolerate full marine conditions, so dispersal between river drainage basins must occur at limited geographical scales when ecological or climatic factors are favorable. We examined molecular diversity in wild populations of M. rosenbergii across its complete natural range to document patterns of diversity and to relate them to factors that have driven evolution of diversity in this species. We found 3 clades in the mitochondrial deoxyribonucleic acid (mtDNA) data set that corresponded geographically with eastern, central, and western sets of haplotypes that last shared a common ancestor 1 × 106 y ago. The eastern clade was closest to the common ancestor of all 3 clades and to the common ancestor with its congener, Macrobrachium spinipes, distributed east of Huxley's Line. Macrobrachium rosenbergii could have evolved in the western Indonesian archipelago and spread westward during the early to mid-Pleistocene to India and Sri Lanka. Additional groups identified in the nuclear DNA data set in the central and western clades probably indicate secondary contact via dispersal between regions and modern introductions that have mixed nuclear and mtDNA genes. Pleistocene sea-level fluctuations can explain dispersal across the Indonesian archipelago and parts of mainland southeastern Asia via changing river drainage connections in shallow seas on wide continental shelves. At the western end of the modern distribution where continental shelves are smaller, intermittent freshwater plumes from large rivers probably permitted larval dispersal across inshore areas of lowered salinity.

Copyright Protection of object-oriented software

language (such as C++ and Java). The model used allows to insert watermarks on three “orthogonal” levels. For the first level, watermarks are injected into objects. The second level watermarking is used to select proper variants of the source code. The third level uses transition function that can be used to generate copies with different functionalities. Generic watermarking schemes were presented and their security discussed.

A dynamic Web agent for verifying the security and integrity of a Web site's contents

To harness safe operation of Web-based systems in Web environments, we propose an SSPA (Server-based SHA-1 Page-digest Algorithm) to verify the integrity of Web contents before the server issues an HTTP response to a user request. In addition to standard security measures, our Java implementation of the SSPA, which is called the Dynamic Security Surveillance Agent (DSSA), provides further security in terms of content integrity to Web-based systems. Its function is to prevent the display of Web contents that have been altered through the malicious acts of attackers and intruders on client machines. This is to protect the reputation of organisations from cyber-attacks and to ensure the safe operation of Web systems by dynamically monitoring the integrity of a Web site's content on demand. We discuss our findings in terms of the applicability and practicality of the proposed system. We also discuss its time metrics, specifically in relation to its computational overhead at the Web server, as well as the overall latency from the clients' point of view, using different Internet access methods. The SSPA, our DSSA implementation, some experimental results and related work are all discussed

Multimedia copyright protection

Internet and its widespread usage for multimedia document distribution put the copyright issue in a complete new setting. Multimedia documents, specifically those installed on a web page, are no longer passive as they typically include active applets. Copyright protection safeguards the intellectual property (IP) of multimedia documents, which are either sold or distributed free of charge. In this Chapter, the basic tools for copyright protection are discussed. First, general concepts and the vocabulary used in copyright protection of multimedia documents are discussed. Later, taxonomy of watermarking and fingerprinting techniques are studied. This part is concluded by a review of the literature dealing with IP security. The main part of the chapter discusses the generic watermarking scheme and illustrates it on three specific examples: collusion-free watermarking, spread spectrum watermarking, and software fingerprinting. Future trends and conclusions close the chapter.

J-Circos : an interactive Circos plotter

Circos plots are graphical outputs that display three dimensional chromosomal interactions and fusion transcripts. However, the Circos plot tool is not an interactive visualization tool, but rather a figure generator. For example, it does not enable data to be added dynamically, nor does it provide information for specific data points interactively. Recently, an R-based Circos tool (RCircos) has been developed to integrate Circos to R, but similarly, Rcircos can only be used to generate plots. Thus, we have developed a Circos plot tool (J-Circos) that is an interactive visualization tool that can plot Circos figures, as well as being able to dynamically add data to the figure, and providing information for specific data points using mouse hover display and zoom in/out functions. J-Circos uses the Java computer language to enable it to be used on most operating systems (Windows, MacOS, Linux). Users can input data into JCircos using flat data formats, as well as from the GUI. J-Circos will enable biologists to better study more complex chromosomal interactions and fusion transcripts that are otherwise difficult to visualize from next-generation sequencing data.

Substation Automation Systems – Future possibilities for commissioning

Substation Automation Systems have undergone many transformational changes triggered by improvements in technologies. Prior to the digital era, it made sense to confirm that the physical wiring matched the schematic design by meticulous and laborious point to point testing. In this way, human errors in either the design or the construction could be identified and fixed prior to entry into service. However, even though modern secondary systems today are largely computerised, we are still undertaking commissioning testing using the same philosophy as if each signal were hard wired. This is slow and tedious and doesn’t do justice to modern computer systems and software automation. One of the major architectural advantages of the IEC 61850 standard is that it “abstracts” the definition of data and services independently of any protocol allowing the mapping of them to any protocol that can meet the modelling and performance requirements. On this basis, any substation element can be defined using these common building blocks and are made available at the design, configuration and operational stages of the system. The primary advantage of accessing data using this methodology rather than the traditional position method (such as DNP 3.0) is that generic tools can be created to manipulate data. Self-describing data contains the information that these tools need to manipulate different data types correctly. More importantly, self-describing data makes the interface between programs robust and flexible. This paper proposes that the improved data definitions and methods for dealing with this data within a tightly bound and compliant IEC 61850 Substation Automation System could completely revolutionise the need to test systems when compared to traditional point to point methods. Using the outcomes of an undergraduate thesis project, we can demonstrate with some certainty that it is possible to automatically test the configuration of a protection relay by comparing the IEC 61850 configuration extracted from the relay against its SCL file for multiple relay vendors. The software tool provides a quick and automatic check that the data sets on a particular relay are correct according to its CID file, thus ensuring that no unexpected modifications are made at any stage of the commissioning process. This tool has been implemented in a Java programming environment using an open source IEC 61850 library to facilitate the server-client association with the relay.

EVpedia: A community web portal for extracellular vesicles research

Motivation Extracellular vesicles (EVs) are spherical bilayered proteolipids, harboring various bioactive molecules. Due to the complexity of the vesicular nomenclatures and components, online searches for EV-related publications and vesicular components are currently challenging. Results We present an improved version of EVpedia, a public database for EVs research. This community web portal contains a database of publications and vesicular components, identification of orthologous vesicular components, bioinformatic tools and a personalized function. EVpedia includes 6879 publications, 172 080 vesicular components from 263 high-throughput datasets, and has been accessed more than 65 000 times from more than 750 cities. In addition, about 350 members from 73 international research groups have participated in developing EVpedia. This free web-based database might serve as a useful resource to stimulate the emerging field of EV research. Availability and implementation The web site was implemented in PHP, Java, MySQL and Apache, and is freely available at http://evpedia.info.