publications

1. IEEES&P

   Not Yet Another Digital ID: Privacy-Preserving Humanitarian Aid Distribution

   Wang, Boya, Lueks, Wouter, Sukaitis, Justinas, Narbel, Vincent Graf, and Troncoso, Carmela

   IEEE S&P’23 May 2023

   Abs Bib PDF

   Humanitarian aid-distribution programs help bring physical goods to people in need. Traditional paper-based solutions to support aid distribution do not scale to large populations and are hard to secure. Existing digital solutions solve these issues, at the cost of collecting large amount of personal information. This lack of privacy can endanger recipients’ safety and harm their dignity. In collaboration with the International Committee of the Red Cross, we build a safe digital aid-distribution system. We first systematize the requirements such a system should satisfy. We then propose a decentralized solution based on the use of tokens that fulfills the needs of humanitarian organizations. It provides scalability and strong accountability, and, by design, guarantees the recipients’ privacy. We provide two instantiations of our design, on a smart card and on a smartphone. We formally prove the security and privacy properties of these solutions, and empirically show that they can operate at scale.

   @article{ieeesp23icrc,
     abbr = {IEEES&P},
     bibtex_show = {true},
     title = {Not Yet Another Digital ID: Privacy-Preserving Humanitarian Aid Distribution},
     author = {Wang, Boya and Lueks, Wouter and Sukaitis, Justinas and Narbel, Vincent Graf and Troncoso, Carmela},
     year = {2023},
     journal = {IEEE S&P'23},
     month = may,
     publisher = {Proceedings of the 2023 IEEE Symposium on Security and Privacy},
     doi = {10.48550/arXiv.2303.17343},
     pdf = {icrc-paper.pdf},
     selected = {true}
   }

2. ASIACCS

   On the Security of the FLARM Collision Warning System

   Wang, Boya, Tresoldi, Giorgio, Strohmeier, Martin, and Lenders, Vincent

   ASIA CCS’22 May 2022

   Abs Bib PDF

   In the past decade, the vulnerability of aircraft communications against low-resourced attackers has received significant attention both in the information security community and from aviation industry and regulators. Until now, research on attacks against such communications technologies has focused on larger aircraft, neglecting the technologies used in light aircraft and unmanned aerial vehicles (UAV). As such lighter aircraft make up a large and growing majority of both airspace users and casualties, this is a glaring oversight from a security and safety perspective. To alleviate this problem, we conduct a first comprehensive security analysis of the FLARM ecosystem, a collision avoidance system focusing on light aircraft and UAV with a large and increasing distribution in many countries. Besides being used in more than 40,000 aircraft, several large providers of air traffic data capture the unauthenticated FLARM data using ground receivers in order to feed crucial downstream applications. To show the vulnerability of this ecosystem, we design, implement and evaluate a practical spoofing attack, which is capable of interacting with FLARM receivers in the air and on the ground. The demonstrated attack uses low-cost hardware and open-source software and is as such accessible to a wide range of threat actors, resulting in a significant potential impact on the safety of all airspace users. Finally, in order to counter such attacks, we propose a first anomaly detection approach based on physical-layer characteristics and validate it with real-world aircraft data.

   @article{asiaccs22flarm,
     abbr = {ASIACCS},
     bibtex_show = {true},
     title = {On the Security of the FLARM Collision Warning System},
     author = {Wang, Boya and Tresoldi, Giorgio and Strohmeier, Martin and Lenders, Vincent},
     year = {2022},
     journal = {ASIA CCS'22},
     month = may,
     publisher = {Proceedings of the 2022 ACM Asia Conference on Computer and Communications Security},
     doi = {10.1145/3488932.3517409},
     pdf = {Flarm_ASIACCS_camera_ready.pdf},
     selected = {true}
   }