Hello
I'm Aarti Kashyap, a first year grad student from UBC, Vancouver. My research interests are embedded systems and security. In my recent research I've found attacks on the Pi.
As a fun project, I was interested in exploring the BBB or the pocket beagle ( interested in both actually ), to do a proper security analysis for the system.
One eg. I would like to give is something similar to the CamFlow data provenance project. Using LSM ( Linux security modules ), we can incorporate hooks at the right places to conduct a proper data flow analysis for the kernel. This is one of my interests for doing a security analysis of the system and finding anamolies in soft real-time.
I would like to discuss the project in more details, if it's even required in terms of security? Also, if any mentor is interested in mentoring me.
Thank you.
A short edit. Last time I had checked the security and privacy column was empty. However, three new projects have been posted under the section. Penetration service, self-hosting services, and car hacking.
I am interested in exploring the penetration aspect by using Kali Linux for testing the system. It is slightly similar to what I proposed above. However, using Kali to do penetration testing sounds interesting. I can do complete penetration testing for this system. I can do this for PocketBeagle and BeagleBone Black. I will use penetration testing to obtain the vulnerable areas of BBB or PocketBeagle.
Based on the results that I obtain I will try to propose security patches in order to mitigate them by proposing security patches. If I obtain any interesting results.
Hello
I’m Aarti Kashyap, a first year grad student from UBC, Vancouver. My research interests are embedded systems and security. In my recent research I’ve found attacks on the Pi.
Can you please elaborate on what kind of attacks?
As a fun project, I was interested in exploring the BBB or the pocket beagle ( interested in both actually ), to do a proper security analysis for the system.
One eg. I would like to give is something similar to the CamFlow data provenance project. Using LSM ( Linux security modules ), we can incorporate hooks at the right places to conduct a proper data flow analysis for the kernel. This is one of my interests for doing a security analysis of the system and finding anamolies in soft real-time.
Are you planning to make something similar to CamFlow? If yes, how it’ll be better for BBB than CamFlow itself.
Or do you plan to do security research by making tools focused on embedded systems around CamFlow?
I would like to discuss the project in more details, if it’s even required in terms of security? Also, if any mentor is interested in mentoring me.
I’d suggest you to join IRC channel #beagle-gsoc to discuss more about this with potential mentors.
Thank you.
–
Aarti Kashyap
Regards
Ravi
Hello
I’m Aarti Kashyap, a first year grad student from UBC, Vancouver. My research interests are embedded systems and security. In my recent research I’ve found attacks on the Pi.
Can you please elaborate on what kind of attacks?
Attack through physical access. Rpi allows us to live boot through a USB now. It has no bios password. When you live boot into the system, like any other system, it gives you access to all the partitions of the other OS on Pi and allows you to tamper and delete data.
As a fun project, I was interested in exploring the BBB or the pocket beagle ( interested in both actually ), to do a proper security analysis for the system.
One eg. I would like to give is something similar to the CamFlow data provenance project. Using LSM ( Linux security modules ), we can incorporate hooks at the right places to conduct a proper data flow analysis for the kernel. This is one of my interests for doing a security analysis of the system and finding anamolies in soft real-time.
Are you planning to make something similar to CamFlow? If yes, how it’ll be better for BBB than CamFlow itself.
Or do you plan to do security research by making tools focused on embedded systems around CamFlow?
I am interested in a fun project rather than doing research for GSoC’19. I posted a reply after I posted this note.
- My first idea was using Camflow with BBB and finding the anomalies in execution paths when different ( I haven’t decided that yet, but can look further ) applications are running. So if someone is trying to attack the system or exploit some vulnerability, I want to see if it shows up in the provenance graph. If it shows up, we can set up a proper integration of these two in BBB. If it does not, we can make patches to fix it up.
- I saw the BBB page for project ideas. I liked the idea of doing penetration testing using Kali on BBB. I saw that after I posted this note (my bad). So I am also interested in doing penetration testing using Kali. I am more interested in systems-level security stuff.
I would like to discuss the project in more details, if it’s even required in terms of security? Also, if any mentor is interested in mentoring me.
I’d suggest you to join IRC channel #beagle-gsoc to discuss more about this with potential mentors.
Alright, I will do that. Are you interested in mentoring me?
Hello
I’m Aarti Kashyap, a first year grad student from UBC, Vancouver. My research interests are embedded systems and security. In my recent research I’ve found attacks on the Pi.
Can you please elaborate on what kind of attacks?
Attack through physical access. Rpi allows us to live boot through a USB now. It has no bios password. When you live boot into the system, like any other system, it gives you access to all the partitions of the other OS on Pi and allows you to tamper and delete data.
As a fun project, I was interested in exploring the BBB or the pocket beagle ( interested in both actually ), to do a proper security analysis for the system.
One eg. I would like to give is something similar to the CamFlow data provenance project. Using LSM ( Linux security modules ), we can incorporate hooks at the right places to conduct a proper data flow analysis for the kernel. This is one of my interests for doing a security analysis of the system and finding anamolies in soft real-time.
Are you planning to make something similar to CamFlow? If yes, how it’ll be better for BBB than CamFlow itself.
Or do you plan to do security research by making tools focused on embedded systems around CamFlow?
I am interested in a fun project rather than doing research for GSoC’19. I posted a reply after I posted this note.
- My first idea was using Camflow with BBB and finding the anomalies in execution paths when different ( I haven’t decided that yet, but can look further ) applications are running. So if someone is trying to attack the system or exploit some vulnerability, I want to see if it shows up in the provenance graph. If it shows up, we can set up a proper integration of these two in BBB. If it does not, we can make patches to fix it up.
You’d have to be specific about what kind of attacks or vulnerabilities you’re focusing on. I didn’t get it “set up proper integration of these two in BBB”. It’d be nice if you can properly structure your project idea (maybe as a problem/solution).
- I saw the BBB page for project ideas. I liked the idea of doing penetration testing using Kali on BBB. I saw that after I posted this note (my bad). So I am also interested in doing penetration testing using Kali. I am more interested in systems-level security stuff.
Please look further into it and list tasks that you’d like to work on.
I would like to discuss the project in more details, if it’s even required in terms of security? Also, if any mentor is interested in mentoring me.
I’d suggest you to join IRC channel #beagle-gsoc to discuss more about this with potential mentors.
Alright, I will do that. Are you interested in mentoring me?
I’m also interested in security. But, I’m not much experienced with Kernel and security. So, I think I may not be the best person to guide you on this.
If you can come up with a proper project idea for the summer, you’ll definitely find potential mentors. And I’d be happy to co-mentor 
Alright. So just a very basic question. Before suggesting the list of things I would like to do, and giving an in-depth proposal, I should first successfully get a mentor interested right?
Since the general idea on the BB gsoc proposal page under security and privacy was Kali and two others. I want to discuss if some one is even interested in this area. I will ask on the IRC though. Thanks.
It will be great to have a co-mentor.
Boot security really requires an “HS” device from an AMx/Beagle perspective. Focusing on penetration testing using PocketBeagle or even BeagleBone AI would be more ideal.
Phil, are there things you’d like to advance regarding “The Deck” as a GSoC project?