# ICT Systems Security and Privacy Protection

Lech Jan Janczewski, Miroslaw Kutylowski

► To cite this version:

Lech Jan Janczewski, Miroslaw Kutylowski. ICT Systems Security and Privacy Protection: 33rd IFIP TC 11 International Conference, SEC 2018, Held at the 24th IFIP World Computer Congress, WCC 2018, Poznan, Poland, September 18-20, 2018, Proceedings. Springer International Publishing, AICT-529, 2018, IFIP Advances in Information and Communication Technology, 978-3-319-99827-5. 10.1007/978-3-319-99828-2. hal-02023737

HAL Id: hal-02023737

https://inria.hal.science/hal-02023737

Submitted on 21 Feb 2019

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Editor-in-Chief

Kai Rannenberg, Goethe University Frankfurt, Germany

Editorial Board

TC 1 – Foundations of Computer Science

Jacques Sakarovitch, Télécom ParisTech, France

TC 2 – Software: Theory and Practice

Michael Goedicke, University of Duisburg-Essen, Germany

TC 3 – Education

Arthur Tatnall, Victoria University, Melbourne, Australia

TC 5 – Information Technology Applications

Erich J. Neuhold, University of Vienna, Austria

TC 6 – Communication Systems

Aiko Pras, University of Twente, Enschede, The Netherlands

TC 7 – System Modeling and Optimization

Fredi Tröltzsch, TU Berlin, Germany

TC 8 – Information Systems

Jan Pries-Heje, Roskilde University, Denmark

TC 9 – ICT and Society

David Kreps, University of Salford, Greater Manchester, UK

TC 10 – Computer Systems Technology

Ricardo Reis, Federal University of Rio Grande do Sul, Porto Alegre, Brazil

TC 11 – Security and Privacy Protection in Information Processing Systems

Steven Furnell, Plymouth University, UK

TC 12 – Artificial Intelligence

Ulrich Furbach, University of Koblenz-Landau, Germany

TC 13 – Human-Computer Interaction

Marco Winckler, University Paul Sabatier, Toulouse, France

TC 14 – Entertainment Computing

Matthias Rauterberg, Eindhoven University of Technology, The Netherlands
IFIP – The International Federation for Information Processing

IFIP was founded in 1960 under the auspices of UNESCO, following the first World Computer Congress held in Paris the previous year. A federation for societies working in information processing, IFIP's aim is two-fold: to support information processing in the countries of its members and to encourage technology transfer to developing nations. As its mission statement clearly states:

> IFIP is the global non-profit federation of societies of ICT professionals that aims at achieving a worldwide professional and socially responsible development and application of information and communication technologies.

IFIP is a non-profit-making organization, run almost solely by 2500 volunteers. It operates through a number of technical committees and working groups, which organize events and publications. IFIP's events range from large international open conferences to working conferences and local seminars.

The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.

As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed.

The working conferences are structured differently. They are usually run by a working group and attendance is generally smaller and occasionally by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is also rigorous and papers are subjected to extensive group discussion.

Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers.

IFIP distinguishes three types of institutional membership: Country Representative Members, Members at Large, and Associate Members. The type of organization that can apply for membership is a wide variety and includes national or international societies of individual computer scientists/ICT professionals, associations or federations of such societies, government institutions/government related organizations, national or international research institutes or consortia, universities, academies of sciences, companies, national or international associations or federations of companies.

More information about this series at http://www.springer.com/series/6102
Lech Jan Janczewski · Mirosław Kutyłowski (Eds.)

ICT Systems Security
and Privacy Protection

33rd IFIP TC 11 International Conference, SEC 2018

Held at the 24th IFIP World Computer Congress, WCC 2018

Poznan, Poland, September 18–20, 2018

Proceedings

<figure><img src="image_2.png" /></figure>

Springer
Editors

Lech Jan Janczewski
University of Auckland
Auckland
New Zealand

Mirosław Kutyłowski
Wrocław University of Technology
Wroclaw
Poland

ISSN 1868-4238
ISSN 1868-422X (electronic)
IFIP Advances in Information and Communication Technology
ISBN 978-3-319-99827-5
ISBN 978-3-319-99828-2 (eBook)
https://doi.org/10.1007/978-3-319-99828-2

Library of Congress Control Number: 2018952247

© IFIP International Federation for Information Processing 2018

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, express or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface

This year, the annual IFIP TC-11 (International Federation for Information Processing Technical Committee) Sec 2018 conference was the 33rd in the series. This conference is part of the World Computer Congress (WCC) organized by the IFIP. Major IFIP partners in the Congress are: the Committee on Informatics of the Polish Academy of Sciences, the Polish Information Processing Society Wielkopolska Branch, Poznan University of Technology, The Polish Ministry of Digital Affairs, and the Polish Ministry of Science and Higher Education; the Mayor of Poznan provided WCC Honorary Patronage. The conference was held in the Lecture and Conference Centre of the Poznan University of Technology in the city of Poznan, Poland.

The Program Committee, consisting of 100 members, considered 89 papers. These proceedings include the revised versions of the 27 papers presented at the conference. Therefore, the overall acceptance rate for this conference is 30%. These papers were selected on the basis of originality, quality, and relevance to security and privacy. As a result, they give an accurate picture of how the field is evolving.

The selection of papers was a difficult and challenging task. Each submission was refereed usually by at least four reviewers. We used the single-blind review principle. We wish to thank the Program Committee members for their great effort. In addition, we gratefully acknowledge the help of a large number of external reviewers. All reviewers are listed in the section following this preface. We apologize for any inadvertent omission.

Many thanks to the creators of EasyChair without which the management of submissions for this conference would have been a nightmare. It would be difficult to imagine organizing and administering a conference without this valuable tool. Special thanks to Prof. Jacek Cichoń and the Department of Computer Science of Wrocław University of Science and Technology for technical support in Web communication.

Finally, we wish to thank all the authors who submitted papers for making this conference possible by providing the scientific material, and especially the authors of accepted papers. We would also like to thank the publisher, Springer, for working within a tight schedule to produce these proceedings in due time.

July 2018

Lech Jan Janczewski
Mirosław Kutyłowski
# IFIP TC-11 SEC 2018

September 18–20, 2018, Poznan, Poland

Sponsored by the

International Federation for Information Processing (IFIP)

## General Chairs

Kai Rannenberg

Goethe University, Frankfurt a. Main, Germany

Yuko Murayama

Iwate Prefectural University, Japan

## Program Chairs

Mirosław Kutyłowski

Wrocław University of Science
and Technology – Wrocław, Poland

Lech Janczewski

The University of Auckland, Auckland, New Zealand

## Program Committee

Adnan Ahmad

Government College University Lahore, Pakistan

Vijay Atluri

Rutgers University, USA

Man Ho Au

The Hong Kong Polytechnic University, Hong Kong

Gildas Avoine

IRISA, Rennes, France

Gergei Bana

Inria, France

Amel Bennaceur

The Open University, UK

Jan Camenisch

IBM Research - Zurich, Switzerland

Herve Chabanne

Morpho, France

Michal Choras

ITTI Ltd., Poland

K P Chow

The University of Hong Kong, Hong Kong

Nathan Clarke

Centre for Security, Communication & Network
Research, University of Plymouth, UK

Nora Cuppens

IMT Atlantique, France

Brian Cusack

AUT University, New Zealand

Paolo D'Arco

University of Salerno, Italy

Ed Dawson

Queensland University of Technology, Australia

Sabrina De Capitani di
Vimercati

University of Milan, Italy

Bart De Decker

Katholieke Universiteit Leuven, Belgium

Roberto De Prisco

University of Salerno, Italy

Vesna Dimitrova

Ss. Cyril and Methodius University of Skopje,
Macedonia

Itai Dinur

Ben Gurion University, Israel

Shlomi Dolev

Ben Gurion University of the Negev, Israel
<table>
  <tr>
    <td>Hannes Federrath</td>
    <td>University of Hamburg, Germany</td>
  </tr>
  <tr>
    <td>Simone Fischer-Hübner</td>
    <td>Karlstad University, Sweden</td>
  </tr>
  <tr>
    <td>Sara Foresti</td>
    <td>Politecnico di Milano, Italy</td>
  </tr>
  <tr>
    <td>Felix Freiling</td>
    <td>Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Germany</td>
  </tr>
  <tr>
    <td>Steven Furnell</td>
    <td>Plymouth University, UK</td>
  </tr>
  <tr>
    <td>Chaya Ganesh</td>
    <td>Aarhus University, Denmark</td>
  </tr>
  <tr>
    <td>Niv Gilboa</td>
    <td>Ben Gurion University, Israel</td>
  </tr>
  <tr>
    <td>Lucjan Hanzlik</td>
    <td>CISPA, Poland</td>
  </tr>
  <tr>
    <td>Karin Hedström</td>
    <td>Swedish Buisiness School, Örebro University, Sweden</td>
  </tr>
  <tr>
    <td>Julio Hernandez-Castro</td>
    <td>University of Kent, UK</td>
  </tr>
  <tr>
    <td>Dominik Herrmann</td>
    <td>University of Bamberg, Germany</td>
  </tr>
  <tr>
    <td>Marko Hölbl</td>
    <td>University of Maribor, Faculty of Electrical Engineering and Computer Science, Slovenia</td>
  </tr>
  <tr>
    <td>Xinyi Huang</td>
    <td>Fujian Normal University, China</td>
  </tr>
  <tr>
    <td>Dieter Hutter</td>
    <td>DFKI GmbH, Germany</td>
  </tr>
  <tr>
    <td>Pedro Inácio</td>
    <td>Universidade da Beira Interior, Portugal</td>
  </tr>
  <tr>
    <td>Martin Gilje Jaatun</td>
    <td>SINTEF Digital, Norway</td>
  </tr>
  <tr>
    <td>Wojciech Jamroga</td>
    <td>Polish Academy of Sciences, Poland</td>
  </tr>
  <tr>
    <td>Audun Jøsang</td>
    <td>University of Oslo, Norway</td>
  </tr>
  <tr>
    <td>Jan Jürjens</td>
    <td>Fraunhofer Institute for Software &amp; Systems Engineering ISST and University of Koblenz-Landau, Germany</td>
  </tr>
  <tr>
    <td>Georgios Kambourakis</td>
    <td>University of the Aegean, Greece</td>
  </tr>
  <tr>
    <td>Dogan Kesdogan</td>
    <td>Universität Regensburg, Germany</td>
  </tr>
  <tr>
    <td>Dong Seong Kim</td>
    <td>University of Canterbury, New Zealand</td>
  </tr>
  <tr>
    <td>Kamil Kluczniak</td>
    <td>Hong Kong Polytechnic, Hong Kong</td>
  </tr>
  <tr>
    <td>Zbigniew Kotulski</td>
    <td>Warsaw University of Technology, Poland</td>
  </tr>
  <tr>
    <td>Matthias Krause</td>
    <td>University of Mannheim, Germany</td>
  </tr>
  <tr>
    <td>Lukasz Krzywiecki</td>
    <td>Wroclaw University of Technology, Poland</td>
  </tr>
  <tr>
    <td>Lam For Kwok</td>
    <td>City University of Hong Kong, Hong Kong</td>
  </tr>
  <tr>
    <td>Heejo Lee</td>
    <td>Korea University, South Korea</td>
  </tr>
  <tr>
    <td>Yingjiu Li</td>
    <td>Singapore Management University, Singapore</td>
  </tr>
  <tr>
    <td>Maciej Liskiewicz</td>
    <td>Institut für Theoretische Informatik, University Luebeck, Germany</td>
  </tr>
  <tr>
    <td>Luigi Logrippo</td>
    <td>Université du Québec en Outaouais, Canada</td>
  </tr>
  <tr>
    <td>Javier Lopez</td>
    <td>NICS Lab, Spain</td>
  </tr>
  <tr>
    <td>Marian Margraf</td>
    <td>Freie Universität Berlin, Germany</td>
  </tr>
  <tr>
    <td>Konstantinos Markantonakis</td>
    <td>ISG-Smart Card Centre, Founded by Vodafone, G&amp;D and the Information Security Group of Royal Holloway, University of London, UK</td>
  </tr>
  <tr>
    <td>Vashek Matyas</td>
    <td>Masaryk University, Switzerland</td>
  </tr>
  <tr>
    <td>Gert Læssøe Mikkelsen</td>
    <td>The Alexandra Institute, Denmark</td>
  </tr>
  <tr>
    <td>Pawel Morawiecki</td>
    <td>IPI PAN, Poland</td>
  </tr>
  <tr>
    <td>Yuko Murayama</td>
    <td>Tsuda University, Japan</td>
  </tr>
  <tr>
    <td>Maurizio Naldi</td>
    <td>Università di Roma Tor Vergata, Italy</td>
  </tr>
</table>
Jetzabel Maritza Serna
Olvera

Brajendra Nath Panda

Sebastian Pape

Stefano Paraboschi

Ludovic Perret

Gibert Peterson

Raphael C.-W. Phan

Alexander Pretschner

Rami Puzis

Rui Qiao

Kai Rannenberg

Indrajit Ray

Akram Rn

Juha Röning

Reyhaneh Safavi-Naini

Pierangela Samarati

Ingrid Schaumueller - Bichl

Annikken Seip

Jun Shao

Nicolas Sklavos

Daniel Slamanig

Agusti Solanas

Gene Spafford

Chunhua Su

Shamik Sural

Neeraj Suri

Willy Susilo

Theo Tryfonas

Ding Wang

Jianfeng Wang

Edgar Weippl

Tatjana Welzer Družovec

Henry Wolfe

Qianhong Wu

Filip Zagorski

Yuexin Zhang

Universitat Politècnica de Catalunya, Spain

University of Arkansas, USA

Goethe University Frankfurt, Germany

Università di Bergamo, Italy

UPMC/LIP6 INRIA/SALSA, France

US Air Force Institute of Technology, USA

Loughborough University, UK

Technical University of Munich, Germany

Ben Gurion University of the Negev, Israel

Virginia Polytechnic Institute and State University,
Roanoke, USA

Goethe University Frankfurt, Germany

Colorado State University, USA

ISG-Smart Card Centre, Royal Holloway, University of
London, UK

University of Oulu, Finland

University of Calgary, Canada

University of Milan, Italy

Upper Austrian University of Applied Sciences
Campus Hagenberg, Austria

Finanstilsynet, Norway

Hangzhou Gongshang University, China

University of Patras, Greece

AIT Austrian Institute of Technology, Austria

Universitat Rovira i Virgili, Spain

Purdue University, USA

Osaka University, Japan

IIT, Kharagpur, India

TU Darmstadt, Germany

University of Wollongong, Australia

University of Bristol, UK

Peking University, China

Xidian University, China

SBA Research, Austria

University of Maribor, Slovenia

University of Otago, New Zealand

Beihang University, China

Wroclaw University of Technology, Poland

Deakin University, Australia
Additional Reviewers

Mayank Agarwal

Mohsen Ahmadvand

Marios Anagnostopoulos

Yusuf Baha

Przemysław Blaskiewicz

Haibo Cheng

Anastasia Douma

Jürgen Dürrwang

Maciej Gebala

Amjad Ibrahim

Michał Knapik

Stephan Krenn

Damian Kurpiewski

Laurens Lemaire

Wenting Li

Jens Lindemann

Matthias Marx

Mevludin Memedi

Tilo Müller

Ralph Palutke

Dimitrios Papamartzivanos

Andreas Put

Marcin Slowik

Witold Waligora

Marcin Zawada
# Contents

## Authentication

Design Weaknesses in Recent Ultralightweight RFID Authentication Protocols
P. D'Arco and R. De Prisco
3

CPMap: Design of Click-Points Map-Based Graphical Password Authentication
Weizhi Meng, Fei Fei, Lijun Jiang, Zhe Liu, Chunhua Su, and Jinguang Han
18

The Influence of Native Language on Password Composition and Security: A Socioculture Theoretical View
Pardon Blessings Maoneke, Stephen Flowerday, and Naomi Isabirye
33

A Hypergame Analysis for ErsatzPasswords
Christopher N. Gutierrez, Mohammed H. Almeshekah, Saurabh Bagchi, and Eugene H. Spafford
47

Walking Through the Deep: Gait Analysis for User Authentication Through Deep Learning
Giacomo Giorgi, Fabio Martinelli, Andrea Saracino, and Mina Sheikhalishahi
62

## Failures of Security Management

Practical Cryptographic Data Integrity Protection with Full Disk Encryption
Milan Brož, Mikuláš Patočka, and Vashek Matyáš
79

When Your Browser Becomes the Paper Boy: An Anonymous Browser Network
Juan D. Parra Rodriguez, Eduard Brehm, and Joachim Posegga
94

EMPower: Detecting Malicious Power Line Networks from EM Emissions
Richard Baker and Ivan Martinovic
108

Attacking RO-PUFs with Enhanced Challenge-Response Pairs
Nils Wisiol and Marian Margraf
122
A Security Analysis of FirstCoin. 127
Alexander Marsalek, Christian Kollmann, and Thomas Zefferer

PRETT: Protocol Reverse Engineering Using Binary Tokens
and Network Traces 141
Choongin Lee, Jeonghan Bae, and Heejo Lee

Assessing Privacy Policies of Internet of Things Services. 156
Niklas Paul, Welderufael B. Tesfay, Dennis-Kenji Kipker,
Mattea Stelter, and Sebastian Pape

JonDonym Users' Information Privacy Concerns. 170
David Harborth and Sebastian Pape

## Security Management / Forensic

Optimal Security Configuration for Cyber Insurance 187
Fabio Martinelli, Ganbayar Uuganbayar, and Artsiom Yautsiukhin

The Tweet Advantage: An Empirical Analysis of 0-Day Vulnerability
Information Shared on Twitter 201
Clemens Sauerwein, Christian Sillaber, Michael M. Huber,
Andrea Mussmann, and Ruth Breu

Anti-forensic = Suspicious: Detection of Stealthy Malware that Hides
Its Network Traffic 216
Mayank Agarwal, Rami Puzis, Jawad Haj-Yahya, Polina Zilberman,
and Yuval Elovici

Usability Characteristics of Security and Privacy Tools:
The User's Perspective 231
Ioanna Topa and Maria Karyda

Efficient Identification of Applications in Co-resident VMs via a
Memory Side-Channel. 245
Jens Lindemann and Mathias Fischer

## Software Security / Attacks

Follow the WhiteRabbit: Towards Consolidation of On-the-Fly
Virtualization and Virtual Machine Introspection. 263
Sergej Proskurin, Julian Kirsch, and Apostolis Zarras

Hunting Password Leaks in Android Applications. 278
Johannes Feichtner