SignalCookie: Discovering Guard Relays of Hidden Services in Parallel In this paper, we propose the SignalCookie attack which can reveal guard relays of multiple hidden services in parallel. The key insight of our method is utilizing Rendezvous Cookie and circuit watermark to deliver the hidden servicesxe2x80x99 identifiers to our controlled relays. By conducting the attack in parallel, the speed of our method increases about 11.6 times compared with the previous work, so that we can continually monitor the guard relays of 13604 hidden services for 7 months. And we have an interesting finding by analyzing the distribution of hidden services binding on each guard relays. The distribution is quite uneven, that only 20% of guard relays serve about 89.32% hidden services. These guard relays would bind all hidden services at least one time in about 17 months. At last, we analyze several security problems aggravated by the uneven distribution, and find that just one corrupt guard relay may cause hundreds of hidden services being deanonymized or eclipsed.

Stealthy Rootkits in Smart Grid Controllers This paper presents a stealthy and persistent attack on a CyberPhysical System (CPS), namely the smart grid and a multilayer approach to detect such an attack. The attack on the CPS controller uses a rootkitbased malware. When activated, the rootkit overwrites operator commands to the smart grid relays while evading detection by the operator control station. The rootkit sends valid replies to the operator while corrupting the controller operation through a dynamically loaded library, which is hidden by the rootkit. The attack persists even when the controller stops and restarts since the rootkit automatically restarts the process with the malicious library by using a background daemon, which the rootkit hides from userspace tools. Using a highfidelity simulation of the smart grid CPS, we show that the attack drastically impacts the CPS, especially when the adversary strategically chooses the target relays to attack. We design an ensemble of detectors to detect the attack and uncover its persistence and insertion mechanisms. The detector uses measures such as hardware performance counters (HPCs), change detection in binary signatures, change detection in system calls, and detection of hidden processes and file system entries.