@article {MUNOZ2023103180, title = {A survey on the (in)security of Trusted Execution Environments}, journal = {Computers \& Security}, year = {2023}, pages = {103-180}, publisher = {Elsevier}, address = {In Press}, abstract = {

As the number of security and privacy attacks continue to grow around the world, there is an ever increasing need to protect our personal devices. As a matter of fact, more and more manufactures are relying on Trusted Execution Environments (TEEs) to shield their devices. In particular, ARM TrustZone (TZ) is being widely used in numerous embedded devices, especially smartphones, and this technology is the basis for secure solutions both in industry and academia. However, as shown in this paper, TEE is not bullet-proof and it has been successfully attacked numerous times and in very different ways. To raise awareness among potential stakeholders interested in this technology, this paper provides an extensive analysis and categorization of existing vulnerabilities in TEEs and highlights the design flaws that led to them. The presented vulnerabilities, which are not only extracted from existing literature but also from publicly available exploits and databases, are accompanied by some effective countermeasures to reduce the likelihood of new attacks. The paper ends with some appealing challenges and open issues.

}, keywords = {Computer security, Hardware attacks, Secure hardware, Side-channel attacks, Software attacks, Trusted Execution Environments}, issn = {0167-4048}, doi = {https://doi.org/10.1016/j.cose.2023.103180}, url = {https://www.sciencedirect.com/science/article/pii/S0167404823000901}, author = {Mu{\~n}oz, Antonio and Ruben Rios and Rodrigo Roman and Javier Lopez} } @inproceedings {2016, title = {AndroCIES: Automatizaci{\'o}n de la certificaci{\'o}n de seguridad para aplicaciones Android}, booktitle = {XVII Reuni{\'o}n Espa{\~n}ola sobre Criptolog{\'\i}a y Seguridad de la Informaci{\'o}n (RECSI 2022)}, volume = {265}, year = {2022}, month = {10/2022}, pages = {192-197}, publisher = {Ediciones Universidad Cantabria}, organization = {Ediciones Universidad Cantabria}, address = {Santander, Spain}, abstract = {

El auge de las plataformas m{\'o}viles est{\'a} impulsando el desarrollo de un gran n{\'u}mero de aplicaciones, muchas de las cuales salen al mercado sin las convenientes comprobaciones de seguridad. Recientemente, Google est{\'a} apostando por hacer este problema m{\'a}s visible y concienciar a los usuarios de la necesidad de instalar aplicaciones verificadas por laboratorios independientes. Sin embargo, la certificaci{\'o}n de aplicaciones suele ser una tarea ardua y no exenta de errores. Por ello, en este trabajo, presentamos la herramienta AndroCIES, que es capaz de automatizar en gran medida las evaluaciones necesarias para la certificaci{\'o}n de aplicaciones m{\'o}viles, reduciendo en torno a un 20\% el tiempo empleado en este proceso.

}, keywords = {an{\'a}lisis est{\'a}tico, aplicaciones, certificaci{\'o}n, seguridad}, author = {Manuel Ruiz and Ruben Rios and Rodrigo Roman and Mu{\~n}oz, Antonio and Juan Manuel Mart{\'\i}nez and Jorge Wallace} } @article {munoz2022, title = {A Test Environment for Wireless Hacking in Domestic IoT Scenarios}, journal = {Mobile Networks and Applications}, year = {2022}, month = {2022/10/14}, publisher = {Springer}, keywords = {Domestic security, Hacking the IoT, IoT security, Network Security}, issn = {1383-469X}, doi = {10.1007/s11036-022-02046-x}, url = {https://doi.org/10.1007/s11036-022-02046-x}, author = {Mu{\~n}oz, Antonio and Carmen Fernandez-Gago and Roberto Lopez-villa} } @article {anto2021, title = {P2ISE: Preserving Project Integrity in CI/CD Based on Secure Elements}, journal = {Information}, volume = {12}, number = {357}, year = {2021}, month = {08/2021}, publisher = {MDPI}, issn = {2078-2489,}, author = {Mu{\~n}oz, Antonio and Farao, Aristeidis and Casas, Ryan and Xenakis, Christos} } @inproceedings {munoz2020icitpm, title = {ICITPM: Integrity validation of software in iterative Continuous Integration through the use of Trusted Platform Module (TPM)}, booktitle = {1st Workshop on Dependability and Safety Emerging Cloud and Fog Systems (DeSECSyS) - Colocated with ESORICS, Guildford (United Kingdom). September 2020.}, year = {2020}, pages = {147{\textendash}165}, publisher = {Springer}, organization = {Springer}, author = {Mu{\~n}oz, Antonio}, editor = {Farao, Aristeidis} } @article {munoz2012, title = {A performance-oriented monitoring system for security properties in cloud computing applications}, journal = {The Computer Journal}, year = {2012}, publisher = {Oxford Academic}, address = {Reino Unido}, issn = {1460-2067}, author = {Mu{\~n}oz, Antonio}, editor = {Gonz{\'a}lez, Javier} } @inproceedings {JavierLopez2006, title = {A Secure and Auto-configurable Environment for Mobile Agents in Ubiquitous Computing Scenarios}, booktitle = {Third International Conference on Ubiquitous Intelligence and Computing}, series = {LNCS}, volume = {4159}, number = {4159}, year = {2006}, month = {August}, pages = {977-987}, publisher = {Springer}, organization = {Springer}, address = {Wuhan, China}, abstract = {
The increased heterogeneity and dynamism of new computing paradigms and especially of ubiquitous computing models is boosting the need for auto-configurable systems. In these new scenarios, heterogeneity and dynamism are inherent properties and applications are built by aggregating distributed information and services that are not under the control of a single entity. Furthermore, the current trend towards distributed computing poses important problems related to the need to transmit large amounts of data between the distributed nodes of the computing system; the control over the information; and the flexibility to adapt to heterogeneous client requirements. These characteristics are difficult to manage by traditional computing models. For these reasons, the mobile agent paradigm is gaining momentum and the interest of researchers and industry in this paradigm is increasing. In this paper we present a solution to provide a secure and auto-configurable environment for mobile agents in ubiquitous computing scenarios. Our approach is based on two main building blocks: trusted platforms and profiles.
}, author = {Javier Lopez and Antonio Mana and Mu{\~n}oz, Antonio} } @inproceedings {Cid2006, title = {Software Engineering Techniqes Applied to AmI: Security Patterns}, booktitle = {First International Conference on Ambient Intelligence Developments (AmID{\textquoteright}06)}, year = {2006}, month = {September}, pages = {108-123}, publisher = {Springer}, organization = {Springer}, address = {Sophia-Antipolis (France)}, abstract = {

The realization of the Ambient Intelligence concept entails many important challenges, but the most important barriers to this realization is the lack of adequate support for security. In this paper we present a conceptual model of our solution for building secure systems for AmI environments, taking as basis the concept of Security and Dependability (S\&D) Pattern as a precise representation of validated S\&D solutions and mechanisms. The main elements embedded in our solution framework (S\&D library, monitoring interface and S\&D Manager) are presented both conceptually, and also using a simple example scenario based on an hospital AmI environment.

}, keywords = {Ambient Intelligence, security}, isbn = {978-3-642-01464-2}, doi = {http://dx.doi.org/10.1007/978-2-287-47610-5_8}, author = {Francisco Sanchez-Cid and Mu{\~n}oz, Antonio and Daniel Serrano and Carmen Fernandez-Gago} } @inproceedings {AntonioMunoz2005a, title = {Perfiles Seguros para Comercio Movil}, booktitle = {III Simposio Espa{\~n}ol de Comercio Electronico (SCE{\textquoteright}05)}, year = {2005}, pages = {235-244}, publisher = {Universitat de les Illes Balears}, organization = {Universitat de les Illes Balears}, abstract = {

Los escenarios de comercio m{\'o}vil existentes en la actualidad presentan muchas deficiencias. La mayor{\'\i}a de estos escenarios, como no podr{\'\i}a ser de otra forma, tienen en cuenta aspectos relativos a la seguridad, prestando especial atenci{\'o}n a las propiedades de Autenticaci{\'o}n y Autorizaci{\'o}n. De entre los elementos esenciales que se utilizan para proporcionar estos servicios de seguridad, los perfiles son un elemento com{\'u}n que permiten la personalizaci{\'o}n de los servicios del usuario m{\'o}vil. Sin embargo, los perfiles tambi{\'e}n precisan de una administraci{\'o}n segura. En este trabajo presentamos unas consideraciones iniciales respecto a los distintos tipos de perfiles, sus niveles de seguridad para cada tipo, as{\'\i} como indicaciones para el almacenamiento de manera segura. Por lo tanto, analizaremos las distintas alternativas como medio de almacenamiento, discuti{\'e}ndolas y prestando especial atenci{\'o}n a las tarjetas inteligentes.

}, author = {Mu{\~n}oz, Antonio and Jose A. Onieva and Javier Lopez} } @inproceedings {AntonioMunoz2005, title = {On Secure Profiling}, booktitle = {1st International Workshop on Secure Ubiquitous Networks (SUN{\textquoteright}05)}, year = {2005}, month = {August}, pages = {214-218}, publisher = {IEEE Press}, organization = {IEEE Press}, abstract = {

Ubiquitous environments have several drawbacks to be solved. Most of them are focused on security, and relevant ones are authorization and authentication. Amongst the essential elements to adequately provide solutions, we can find profiles. A profile can be defined as a repository to store structured data from users, networks, devices, applications, etc. As profiles are needed in ubiquitous environments, and these need of secure management as well, in this paper, we provide some initial guidance on the security storage of profiles and on security levels needed for each type of profile. Additionally, we review different alternatives to bear profiles, concluding that smartcards are the most suitable devices.

}, author = {Mu{\~n}oz, Antonio and Jose A. Onieva and Javier Lopez} }