The DNA methyltransferase (DNMT) family comprises a conserved set of DNA-modifying enzymes that have a central role in epigenetic gene regulation. Recent studies have shown that the functions of the canonical DNMT enzymes - DNMT1, DNMT3A and DNMT3B - go beyond their traditional roles of establishing and maintaining DNA methylation patterns. This Review analyses how molecular interactions and changes in gene copy numbers modulate the activity of DNMTs in diverse gene regulatory functions, including transcriptional silencing, transcriptional activation and post-transcriptional regulation by DNMT2-dependent tRNA methylation. This mechanistic diversity enables the DNMT family to function as a versatile toolkit for epigenetic regulation.

The DNA methyltransferase family: a versatile toolkit for epigenetic regulation

Long Term Evolution (LTE) is the latest mobile communication standard and has a pivotal role in our information society: LTE combines performance goals with modern security mechanisms and serves casual use cases as well as critical infrastructure and public safety communications. Both scenarios are demanding towards a resilient and secure specification and implementation of LTE, as outages and open attack vectors potentially lead to severe risks. Previous work on LTE protocol security identified crucial attack vectors for both the physical (layer one) and network (layer three) layers. Data link layer (layer two) protocols, however, remain a blind spot in existing LTE security research. In this paper, we present a comprehensive layer two security analysis and identify three attack vectors. These attacks impair the confidentiality and/or privacy of LTE communication. More specifically, we first present a passive identity mapping attack that matches volatile radio identities to longer lasting network identities, enabling us to identify users within a cell and serving as a stepping stone for follow-up attacks. Second, we demonstrate how a passive attacker can abuse the resource allocation as a side channel to perform website fingerprinting that enables the attacker to learn the websites a user accessed. Finally, we present the A LTE R attack that exploits the fact that LTE user data is encrypted in counter mode (AES-CTR) but not integrity protected, which allows us to modify the message payload. As a proof-of-concept demonstration, we show how an active attacker can redirect DNS requests and then perform a DNS spoofing attack. As a result, the user is redirected to a malicious website. Our experimental analysis demonstrates the real-world applicability of all three attacks and emphasizes the threat of open attack vectors on LTE layer two protocols.

https://www.computer.org/csdl/pds/api/csdl/proceedings/download-article/19skfdGbEFa/pdf

Breaking LTE on Layer Two

This paper presents our extensive investigation of the security aspects of control plane procedures based on dynamic testing of the control components in operational Long Term Evolution (LTE) networks. For dynamic testing in LTE networks, we implemented a semi-automated testing tool, named LTEFuzz, by using open-source LTE software over which the user has full control. We systematically generated test cases by defining three basic security properties by closely analyzing the standards. Based on the security property, LTEFuzz generates and sends the test cases to a target network, and classifies the problematic behavior by only monitoring the device-side logs. Accordingly, we uncovered 36 vulnerabilities, which have not been disclosed previously. These findings are categorized into five types: Improper handling of (1) unprotected initial procedure, (2) crafted plain requests, (3) messages with invalid integrity protection, (4) replayed messages, and (5) security procedure bypass. We confirmed those vulnerabilities by demonstrating proof-of-concept attacks against operational LTE networks. The impact of the attacks is to either deny LTE services to legitimate users, spoof SMS messages, or eavesdrop/manipulate user data traffic. Precise root cause analysis and potential countermeasures to address these problems are presented as well. Cellular carriers were partially involved to maintain ethical standards as well as verify our findings in commercial LTE networks.

/pdf/touching-the-untouchables-dynamic-security-analysis-of-the-e1emy1a8eh.pdf

Touching the Untouchables: Dynamic Security Analysis of the LTE Control Plane

The paper proposes 5GReasoner, a framework for property-guided formal verification of control-plane protocols spanning across multiple layers of the 5G protocol stack. The underlying analysis carried out by 5GReasoner can be viewed as an instance of the model checking problem with respect to an adversarial environment. Due to an effective use of behavior-specific abstraction in our manually extracted 5G protocol, 5GReasoner's analysis generalizes prior analyses of cellular protocols by reasoning about properties not only regarding packet payload but also multi-layer protocol interactions. We instantiated 5GReasoner with two model checkers and a cryptographic protocol verifier, lazily combining them through the use of abstraction-refinement principle. Our analysis of the extracted 5G protocol model covering 6 key control-layer protocols spanning across two layers of the 5G protocol stack with 5GReasoner has identified 11 design weaknesses resulting in attacks having both security and privacy implications. Our analysis also discovered 5 previous design weaknesses that 5G inherits from 4G, and can be exploited to violate its security and privacy guarantees.

/pdf/5greasoner-a-property-directed-security-and-privacy-analysis-lip770mend.pdf

5GReasoner: A Property-Directed Security and Privacy Analysis Framework for 5G Cellular Network Protocol

An emerging trend in many applications is to use resource-constrained wireless devices for machine-to-machine (M2M) communications. The observed proliferation of wireless embedded systems is expected to have a significant impact on future M2M applications if the services provided can be automatically discovered and accessed at runtime. In order to realize the decoupling of M2M applications and services, energy efficient service discovery mechanisms must be designed so as to minimize human intervention during configuration and management phases. However, many traditional service discovery protocols cannot be applied to wireless constrained devices because they introduce too much overhead, fail in a duty-cycled environment or require significant memory resources. To address this, either new protocols are being proposed or existing ones are adapted to meet the requirements of constrained networks. In this article, we provide a comprehensive overview of service discovery protocols that have been recently proposed for constrained M2M communications by the Internet Engineering Task Force (IETF). Advantages, disadvantages, performance and challenges of the existing solutions for different M2M scenarios are also analyzed.

Service Discovery Protocols for Constrained Machine-to-Machine Communications

Many modern IoT applications integrate smartphones in their deployments to capture and interface with various sensors. Fusing across sensing modalities can often result in improved application performance. An essential yet often overlooked requirement in multimodal fusion is the synchronization across input data streams. Given the universality of the smartphone system clock, it is commonly used to timestamp sensing data. Through a systematic study of system clock accuracy on modern smartphones, we show that there are drastic timing errors ranging from milliseconds to multiple seconds. Thus, when fusing data derived from multiple smartphones, input data streams may have significant synchronization errors. Although deep learning classifiers for multimodal fusion can achieve state-of-the-art accuracy, the impact of timing errors has yet to be characterized. In this paper, we quantify the impact of timing errors on a multimodal fusion classifier for human activity recognition. Our results indicate that data sync errors of 600ms can degrade classifier accuracy by 3%, and the clock errors such as those observed in Android can result in accuracy drops of up to 25%. To mitigate these concerns, we suggest an application-level system clock replacement and introduce a novel data augmentation technique that improves the evaluated classifier resilience to timing errors.

Time Awareness in Deep Learning-Based Multimodal Fusion Across Smartphone Platforms

Having a shared and accurate sense of time is critical to distributed Cyber-Physical Systems (CPS) and the Internet of Things (IoT). Thanks to decades of research in clock technologies and synchronization protocols, it is now possible to measure and synchronize time across distributed systems with unprecedented accuracy. However, applications have not benefited to the same extent due to limitations of the system services that help manage time, and hardware-OS and OS-application interfaces through which timing information flows to the application. Due to the importance of time awareness in a broad range of emerging applications, running on commodity platforms and operating systems, it is imperative to rethink how time is handled across the system stack. We advocate the adoption of a holistic notion of Quality of Time (QoT) that captures metrics such as resolution, accuracy, and stability. Building on this notion we propose an architecture in which the local perception of time is a controllable operating system primitive with observable uncertainty, and where time synchronization balances applications' timing demands with system resources such as energy and bandwidth. Our architecture features an expressive application programming interface that is centered around the abstraction of a timeline – a virtual temporal coordinate frame that is defined by an application to provide its components with a shared sense of time, with a desired accuracy and resolution. The timeline abstraction enables developers to easily write applications whose activities are choreographed across time and space. Leveraging open source hardware and software components, we have implemented an initial Linux realization of the proposed timeline-driven QoT stack on a standard embedded computing platform. Results from its evaluation are also presented.

https://www.computer.org/csdl/pds/api/csdl/proceedings/download-article/12OmNvF83ol/pdf

Timeline: An Operating System Abstraction for Time-Aware Applications

Despite security shields to protect user communication with both the radio access network and the core infrastructure, 4G LTE is still susceptible to a number of security threats. The vulnerabilities mainly exist due to its protocol’s inter-layer communication, and the access technologies (2G/3G) inter-radio interaction. We categorize the uncovered vulnerabilities in three dimensions, i.e., authentication, security association and service availability, and verify these vulnerabilities in operational LTE networks. In order to assess practical impact from these security threats, we convert these threats into active attacks, where an adversary can (a) kick the victim device out of the network, (b) hijack the victim’s location, and (c) silently drain the victim’s battery power. Moreover, we have shown that the attacker does not need to communicate with the victim device or reside at the device to launch these attacks (i.e., no Trojan or malware is required). We further propose remedies for the identified attacks.

Exposing LTE Security Weaknesses at Protocol Inter-layer, and Inter-radio Interactions

Service discovery in Ubiquitous Sensor Networks has been targeted mostly for services available within certain proximity, but the service availability only in close vicinity is no longer feasible in the pervasive and ubiquitous era. In order to address the ubiquity in service discovery, we have proposed a framework that makes use of the Electronic Number Mapping (ENUM) protocol. Our network architecture consists of sensor nodes associated with few relatively powerful nodes called master nodes. Only master nodes within IPv6 enabled Low power Personal Area Networks (6LoWPANs) are assigned unique E.164 numbers so that the services offered by the network could be accessed globally. Services destined for sensor nodes first reach the master node to which they are associated to, using the E.164 number of the master node. The gateway of the network performs the task of converting attribute-value pair based human readable queries to E.164 numbers. Also the gateway facilitates its network by running ENUM protocol for service sharing like multimedia, mail, web and many other services. Moreover, a significant improvement in service discovery cost in terms of latency and traffic overhead is observed.

ENUM Based Service Discovery Architecture for 6LoWPAN

Achieving precise time synchronization across a collection of smartphones poses unique challenges due to their limited hardware support, exclusively wireless networking interface, and restricted timing stack control. Given the ubiquity and popularity of smartphones in modern distributed applications, clock discrepancies often lead to degraded application performance. In this paper, we present and evaluate alternative approaches to attain precise time synchronization by leveraging the various peripherals available on modern smartphone devices. Our evaluation across Android smartphones typically attains synchronization accuracy within (i) 200μs using audio, (ii) 3000μs using Bluetooth Low Energy, and (iii) 1000μs using Wi-Fi. Under certain conditions, we show that smartphones synchronized using one peripheral can accurately timestamp and generate synchronous events over other peripherals. The provided guide and accompanying open-source implementations offer developers a means to select the appropriate time synchronization technique when building distributed applications.

Fatima M. Anwar

Papers

Time Awareness in Deep Learning-Based Multimodal Fusion Across Smartphone Platforms

Timeline: An Operating System Abstraction for Time-Aware Applications

Exposing LTE Security Weaknesses at Protocol Inter-layer, and Inter-radio Interactions

ENUM Based Service Discovery Architecture for 6LoWPAN

Exploiting Smartphone Peripherals for Precise Time Synchronization