Ultra-wideband (UWB) communication is an emerging technology that enables secure ranging and localization. Since UWB communication enables measuring an exact distance, enhanced security would be expected based on it. Recently, however, it has been demonstrated that a distance measured by IEEE 802.15.4z high-rate pulse repetition frequency (HRP) UWB ranging system can be maliciously reduced. The HRP UWB ranging system is widely adopted by smartphone manufacturers such as Samsung and Apple. In this paper, we present UWB with sub-template verification (UWB-SV), which is the first method that prevents a practical distance reduction attack on the current HRP UWB ranging system. UWB-SV is designed to act as a verification method, in which the scrambled timestamp sequence (STS) field of a UWB frame is divided into multiple sub-fields. By analyzing the consistency of the cross-correlation results between the sub-fields and their corresponding local templates, UWB-SV is able to detect a distance reduction attack on the HRP UWB ranging system. Since a long bit sequence is not required for a consistency analysis, UWB-SV can be applied to most commercial off-the-shelf devices that are designed with a 4,096-bit length of the STS field. We comprehensively evaluate UWB-SV under 16 different channel conditions between the victim and attacker, through which we show that UWB-SV has an attack detection rate of 96.24% in outdoor environment conditions with a false positive rate of 0.32%.

Ultra-wideband (UWB) communication is emerging as a prominent technology to enhance the security of proximity verification systems (e.g., passive keyless entry and start systems, financial payment, and user authentication) against signal-relaying attacks. Leveraging the short-duration pulse (1–2 ns) in the physical-layer pulse, UWB communication enables a precise Time-of-Arrival (ToA) measurement for the received frame, which in turn leads to precise distance measurement. The current UWB communication is based on the IEEE 802.15.4z standard, which defines a scrambled timestamp sequence (STS) field that provides a secure ranging capability. However, exploiting the lack of integrity checks in the STS field, recent studies showed that an attacker could maliciously reduce the distance measurement between UWB devices. In this article, we present a distance reduction attack detection method for high-rate pulse repetition frequency (HRP) UWB ranging system. The proposed method analyzes the distribution of the channel impulse response (CIR) computed at the receiver for a ToA measurement. Since IEEE standard-compliant devices measure the ToA based on the CIR, our method can be widely implemented for commercial-off-the-shelf (COTS) devices. Through simulation and real-world experiments, we show that our method can effectively detect distance reduction attacks with a false alarm rate of 1%.

Vishing, a blend of “voice” and “phishing”, has evolved to include techniques like Call Redirection and Display Overlay Attacks, causing significant financial losses. Existing research has largely focused on user behavior and awareness, leaving gaps in addressing attacks originating from vishing applications. In this work, we present Ventinel, an Android-based defense system designed to detect these attacks without requiring OS modifications. Ventinel employs Optical Character Recognition (OCR) to compare phone numbers during calls, effectively preventing Call Redirection and Display Overlay Attacks. Additionally, it safeguards against Duplicated Contacts Attacks by cross-referencing call logs and SMS records. Ventinel achieves 100% detection accuracy, surpassing commercial applications, and operates with minimal data collection to ensure user privacy. We also describe malicious API behavior and demonstrate that the same behavior is possible for API levels 29 and higher. Furthermore, we analyze the limitations of existing solutions and propose new attack and defense strategies.

For autonomous driving systems, cameras and LiDAR sensors are necessary devices that provide precise depth information by which positions and sizes of objects can be identified. Moreover, recent advances in deep learning have extended their capabilities to include monocular camera setup for depth estimation. Compared with the conventional devices like LiDAR or stereo cameras for the depth estimation, the monocular camera enables to estimate depths with a low cost. It is known that the depth estimation models for the monocular camera are vulnerable to adversarial examples. However, most adversarial attacks against the monocular depth estimation have been conducted with targeted patches that are placed on a target object. It is known that the targeted patch outperforms the adjacent and remote patch that is placed beyond the target object, when it comes to an attack success rate. However, the adjacent and remote patch would provide high flexibility in patch placement, as it can be placed beyond the target object's scope. In this paper, we experimentally confirm that the patch placement significantly affects the attack success rates, particularly in specific regions.

Vishing, a blend of "voice" and "phishing", has evolved to include techniques like Call Redirection and Display Overlay Attacks, causing significant financial losses. Existing research has largely focused on user behavior and awareness, leaving gaps in addressing attacks originating from vishing applications. In this work, we present Ventinel, an Android-based defense system designed to detect these attacks without requiring OS modifications. Ventinel employs Optical Character Recognition (OCR) to compare phone numbers during calls, effectively preventing Call Redirection and Display Overlay Attacks. Additionally, it safeguards against Duplicated Contacts Attacks by cross-referencing call logs and SMS records. Ventinel achieves 100\% detection accuracy, surpassing commercial applications, and operates with minimal data collection to ensure user privacy. We also describe malicious API behavior and demonstrate that the same behavior is possible for API levels 29 and higher. Furthermore, we analyze the limitations of existing solutions and propose new attack and defense strategies.