One of the most promising technologies that will be used for charging Electric Vehicles (EVs) is wireless charging. By employing this technology, an EV is able to charge its battery without the need to stop. The charging stations should authenticate the EVs before allowing them to charge their batteries. Traditional digital signature reveals the real identity of the driver and degrades the location privacy. In this paper, we propose an efficient privacy-preserving authentication scheme for EVs wireless charging scenario. Our objective is not only to enable the EVs and the charging station to perform mutual authentication but to protect the privacy of the drivers without the need of a Third Trusted Party (TTP). The EVs use blind signature for authentication with the charging station to protect their privacy. Then, they use hash chains to authenticate themselves to the charging pads which are limited constraint devices. The verification of a hash chain requires performing simple hash operations which is computationally cheap and light-weight. The communication between the EVs and the charging station is secured by establishing an encrypted session. Our extensive evaluations demonstrate that our scheme preserves the drivers' privacy while mutually authenticate the EVs and the charging pads with low communication and computation overhead.

We debut the Warmonger attack , a novel attack vector that can cause denial-of-service between a serverless computing platform and an external content server . The Warmonger attack exploits the fact that a serverless computing platform shares the same set of egress IPs among all serverless functions, which belong to different users, to access an external content server. As a result, a malicious user on this platform can purposefully misbehave and cause these egress IPs to be blocked by the content server, resulting in a platform-wide denial of service. To validate the effectiveness of the Warmonger attack, we conducted extensive experiments over several months, collecting and analyzing the egress IP usage patterns of five prominent serverless service providers (SSPs): Amazon Web Service (AWS) Lambda , Google App Engine , Microsoft Azure Functions , Cloudflare Workers , and Alibaba Function Compute . Additionally, we conducted a thorough evaluation of the attacker’s potential actions to compromise an external server and trigger IP blocking. Our findings revealed that certain SSPs employ surprisingly small sets of egress IPs, sometimes as few as four, which are shared among their user base. Furthermore, our research demonstrates that the serverless platform offers ample opportunities for malicious users to engage in well-known disruptive behaviors, ultimately resulting in IP blocking. Our study uncovers a significant security threat within the burgeoning serverless computing platform and sheds light on potential mitigation strategies, such as the detection of malicious serverless functions and the isolation of such entities.

Location spoofing attack deceiving a Wi-Fi positioning system has been studied for over a decade. However, it has been challenging to construct a practical spoofing attack in urban areas with dense coverage of legitimate Wi-Fi APs. This paper identifies the vulnerability of the Google Geolocation API, which returns the location of a mobile device based on the information of the Wi-Fi access points that the device can detect. We show that this vulnerability can be exploited by the attacker to reveal the black-box localization algorithms adopted by the Google Wi-Fi positioning system and easily launch the location spoofing attack in dense urban areas with a high success rate. Furthermore, we find that this vulnerability can also lead to severe consequences that hurt user privacy, including the leakage of sensitive information like precise locations, daily activities, and demographics. Ultimately, we discuss the potential countermeasures that may be used to mitigate this vulnerability and location spoofing attack.

Although the smart gird is expected to eliminate cascading failures with the help of real-time system monitoring and control, it is yet unknown whether its underlying communication network is fast and reliable enough to achieve this goal. In this paper, we take an in-depth study on this issue by addressing three specific questions: 1) what is the evolution process of information dissemination and fault propagation in the smart grid?; 2) how to quantify the impact of cascading failures?; and 3) what are the conditions that information dissemination becomes either a booster or an adversary in mitigating cascading failures? To answer these questions, we build an innovative framework, the cascading failure with communications framework, to consolidate both communication networks and power grids, and provide quantitative evaluation on the impact of cascading failures. By studying and observing the progress of cascading failures in two city-wide power grids, we find that information dissemination is not always the winner in the race against fault propagation. Particularly, while fast and reliable communications can help in mitigating the consequences of cascading failures, anomalies such as massage delays may weaken its capability. Moreover, severely under-achieved communications, counter-intuitively, can even exacerbate the consequence of cascading failures.