Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “vulnerability discovery”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

11 records
All sourcesNASA NTRSDOE OSTI
NASA NTRS2014

Scalable Asset Discovery, Vulnerability Scanning, and Penetration Testing for Remote Sites and Wireless Spectrums Utilizing an Embedded Linux Plug - PwniPlug and the Raspberry Pi B+ as a Sample Pen Test

All devices attached to the NASA KSC network are subject to security vulnerability scanning and/or penetration testing. In today's changing environment, vulnerable and/or unprotected systems can easily be overlooked. Systems that are not properly managed can become a potential threat to the operational integrity of our systems and networks. This includes all NASA (internal and external) information systems within NASA KSC Internet Protocol (IP) address space, and NASA KSC facilities. The Office of the Chief Information Officer (OCIO) recommends that all NASA Centers and information systems be subject to penetration testing on a regular interval in accordance with the guidelines identified by the National Institute of Standards and Technology (NIST). (ITS-HBK-2810.04-02A) Protecting information and equipment at NASA is an area of increasing concern. In addition to the CPU's on the network; Supervisory, Control and Data Acquisition (SCADA) systems are especially vulnerable because these systems have lacked standards, use embedded controllers with little computational power and informal software, are connected to physical processes, have few operators, and are increasingly also being connected to corporate networks. The scope of work is comprised of several individual components which together build upon previous work by Drew Branch, NASA KSC Intern. The Pwn Plug is the selected COTS (Commercial-Off-The-Shelf) device chosen to test simplification of mandatory IT Security tasks. The device will be utilized to provide services to NASA KSC and enable an assessment of infrastructure soundness and regulatory compliance in an efficient, economical, and business responsive manner. The Pwn Plug is designed as a pen testing appliance which provides a hardware platform that can support commercial penetration testing efforts at significantly reduced costs. The expected outcomes are: 1) External Penetration Testing, 2) Social Engineering, 3) Procedural Documentation, 4) Recommended Remediation Action Plan, 5) System Retest & Remediation Attestation and 6) Final Reports, out briefing and Presentation. Due to physical and material constraints beyond intern and mentor control, the project was redefined as a working pen-test scenario. Limitations of lab availability and tools dictated an academic exercise. This report was developed within the scenario guidelines suggested by the project mentor. The guidelines were to be creative in developing a Pen Test program for a client.

Penetration Testing↗
NASA NTRS2014

Analyzing Risks and Vulnerabilities of Various Computer Systems and Undergoing Exploitation using Embedded Devices

Security is one of the most if not the most important areas today. After the several attacks on the United States, security everywhere has heightened from airports to communication among the military branches legionnaires. With advanced persistent threats (APTs) on the rise following Stuxnet, government branches and agencies are required, more than ever, to follow several standards, policies and procedures to reduce the likelihood of a breach. Attack vectors today are very advanced and are going to continue to get more and more advanced as security controls advance. This creates a need for networks and systems to be in an updated, patched and secured state in a launch control system environment. Attacks on critical systems are becoming more and more relevant and frequent. Nation states are hacking into critical networks that might control electrical power grids or water dams as well as carrying out advanced persistent threat (APTs) attacks on government entities. NASA, as an organization, must protect its self from attacks from all different types of attackers with different motives. Although the International Space Station was created, there is still competition between the different space programs. With that in mind, NASA might get attacked and breached for various reasons such as espionage or sabotage. My project will provide a way for NASA to complete an in house penetration test which includes: asset discovery, vulnerability scans, exploit vulnerabilities and also provide forensic information to harden systems. Completing penetration testing is a part of the compliance requirements of the Federal Information Security Act (FISMA) and NASA NPR 2810.1 and related NASA Handbooks. This project is to demonstrate how in house penetration testing can be conducted that will satisfy all of the compliance requirements of the National Institute of Standards and Technology (NIST), as outlined in FISMA. By the end of this project, I hope to have carried out the tasks stated above as well as gain an immense knowledge about compliance, security tools, networks and network devices, as well as policies and procedures.

Penetration Testing↗
NASA NTRS2017

Qualitative Future Safety Risk Identification an Update

The purpose of this report is to document the results of a high-level qualitative study that was conducted to identify future aviation safety risks and to assess the potential impacts to the National Airspace System (NAS) of NASA Aviation Safety research on these risks. Multiple external sources (for example, the National Transportation Safety Board, the Flight Safety Foundation, the National Research Council, and the Joint Planning and Development Office) were used to develop a compilation of future safety issues risks, also referred to as future tall poles. The primary criterion used to identify the most critical future safety risk issues was that the issue must be cited in several of these sources as a safety area of concern. The tall poles in future safety risk, in no particular order of importance, are as follows: Runway Safety, Loss of Control In Flight, Icing Ice Detection, Loss of Separation, Near Midair Collision Human Fatigue, Increasing Complexity and Reliance on Automation, Vulnerability Discovery, Data Sharing and Dissemination, and Enhanced Survivability in the Event of an Accident.

future aviation safety risk↗
NASA NTRSDate not supplied

Anomaly Detection in Flight Operational Data Using Deep Learning

In this session, we demonstrate two recently developed deep learning models for anomaly detection in flight operational data by the Data Sciences Group at NASA Ames Research Center. The first model is Convolutional Variational Auto-Encoder (CVAE) [1], which is an unsupervised deep encoder-decoder model, designed specifically for finding anomalies in heterogeneous multivariate time series data. We will demonstrate its application to finding anomalies in streaming data from NASA’s Digital Information Platform’s Fuser source. CVAE identifies data instances that are not representative of expected nominal behavior as anomalous. Since it is an unsupervised approach, the flagged anomalies will need to be reviewed by the subject matter experts (SMEs) for validation and labeling and is designed to assist with vulnerability discovery within Safety Monitoring System programs. The second model is Robust and Explainable Semi-supervised Anomaly Detection (RESAD) model [2], which builds on CVAE to allow learning from both minimally labeled data (previously reviewed by the SMEs) as well as majority unlabeled data. RESAD takes advantage of graph theoretic techniques to propagate the labels from the labeled data to the unlabeled data based on a pre-defined similarity metric and structures the learned feature space from flight time-series so that data of the same class would cluster tightly together. This model characteristic is enabled by training with an augmented loss function and allows learning of a more informative feature space for down-stream tasks such as search and active learning. We demonstrate RESAD using data from the NASA DASHlink project [3].

anomaly detection↗
NASA NTRS2021

The Scientific Legacy of NASA’s Operation IceBridge

The National Aeronautics and Space Administration (NASA)’s Operation IceBridge (OIB) was a 13-year (2009–2021) airborne mission to survey land and sea ice across the Arctic, Antarctic, and Alaska. Here, we review OIB’s goals, instruments, campaigns, key scientific results, and implications for future investigations of the cryosphere. OIB’s primary goal was to use airborne laser altimetry to bridge the gap in fine-resolution elevation measurements of ice from space between the conclusion of NASA’s Ice, Cloud, and land Elevation Satellite (ICESat; 2003–2009) and its follow-on, ICESat-2 (launched 2018). Additional scientific requirements were intended to contextualize observed elevation changes using a multisensor suite of radar sounders, gravimeters, magnetometers, and cameras. Using 15 different aircraft, OIB conducted 968 science flights, of which 42% were repeat surveys of land ice, 42% were surveys of previously unmapped terrain across the Greenland and Antarctic ice sheets, Arctic ice caps, and Alaskan glaciers, and 16% were surveys of sea ice. The combination of an expansive instrument suite and breadth of surveys enabled numerous fundamental advances in our understanding of the Earth’s cryosphere. For land ice, OIB dramatically improved knowledge of interannual outlet-glacier variability, ice-sheet, and outlet-glacier thicknesses, snowfall rates on ice sheets, fjord and sub-ice-shelf bathymetry, and ice-sheet hydrology. Unanticipated discoveries included a reliable method for constraining the thickness within difficult-to-sound incised troughs beneath ice sheets, the extent of the firn aquifer within the Greenland Ice Sheet, the vulnerability of many Greenland and Antarctic outlet glaciers to ocean-driven melting at their grounding zones, and the dominance of surface-melt-driven mass loss of Alaskan glaciers. For sea ice, OIB significantly advanced our understanding of spatiotemporal variability in sea ice freeboard and its snow cover, especially through combined analysis of fine-resolution altimetry, visible imagery, and snow radar measurements of the overlying snow thickness. Such analyses led to the unanticipated discovery of an interdecadal decrease in snow thickness on Arctic sea ice and numerous opportunities to validate sea ice freeboards from satellite radar altimetry. While many of its data sets have yet to be fully explored, OIB’s scientific legacy has already demonstrated the value of sustained investment in reliable airborne platforms, airborne instrument development, interagency and international collaboration, and open and rapid data access to advance our understanding of Earth’s remote polar regions and their role in the Earth system.

Joseph A. MacGregor↗
NASA NTRS2010

Modeling Regular Replacement for String Constraint Solving

Bugs in user input sanitation of software systems often lead to vulnerabilities. Among them many are caused by improper use of regular replacement. This paper presents a precise modeling of various semantics of regular substitution, such as the declarative, finite, greedy, and reluctant, using finite state transducers (FST). By projecting an FST to its input/output tapes, we are able to solve atomic string constraints, which can be applied to both the forward and backward image computation in model checking and symbolic execution of text processing programs. We report several interesting discoveries, e.g., certain fragments of the general problem can be handled using less expressive deterministic FST. A compact representation of FST is implemented in SUSHI, a string constraint solver. It is applied to detecting vulnerabilities in web applications

Fu, Xiang↗
NASA NTRS2006

Monitoring Temperatures of Tires Using Luminescent Materials

A method of noncontact, optical monitoring of the surface temperature of a tire has been devised to enable the use of local temperature rise as an indication of potential or impending failures. The method involves the use of temperature-sensitive paint (or filler): Temperature-sensitive luminescent dye molecules or other luminescent particles are incorporated into a thin, flexible material coating the tire surface of interest. (Alternatively, in principle, the luminescent material could be incorporated directly into the tire rubber, though this approach has not yet been tested.) The coated surface is illuminated with shorter-wavelength light to excite longer-wavelength luminescence, which is observed by use of a charge-coupled-device camera or a photodetector (see Figure 1). If temporally constant illumination is used, then the temperature can be deduced from the known temperature dependence of the intensity response of the luminescence. If pulsed illumination is used, then the temperature can be deduced from the known temperature dependence of the time or frequency response of the luminescence. If sinusoidally varying illumination is used, then the temperature can be deduced from the known temperature dependence of the phase response of the luminescence. Unlike a prior method of monitoring the temperature at a fixed spot on a tire by use of a thermocouple, this method is not restricted to one spot and can, therefore, yield information on the spatial distribution of temperature: in particular, it enables the discovery of newly forming hot spots where damage may be starting. Also unlike in the thermocouple method, the measurements in this method are not vulnerable to breakage of wires in repeated flexing of the tire. Moreover, unlike in another method in which infrared radiation is monitored as an indication of surface temperature, the luminescence measurements in this method are not significantly affected by changes in infrared emissivity. This method has been demonstrated in application to the outside surface of a tire (see Figure 2), using both constant and pulsed light sources for illumination and cooled, slow-scan, gated CCD cameras for detection. For observing the temperature of the inside surface of a tire (this has not yet been done), it would probably be necessary to use fiber optics and/or windows for coupling excitation light into, and coupling luminescence out of, the interior volume.

Bencic, Timothy J↗
NASA NTRS2005

Controlling Force and Depth in Friction Stir Welding

Feedback control of the penetration force applied to a pin tool in friction stir welding has been found to be a robust and reliable means for controlling the depth of penetration of the tool. This discovery has made it possible to simplify depth control and to weld with greater repeatability, even on workpieces with long weld joints. Prior to this discovery, depths of penetration in friction stir welding were controlled by hard-tooled roller assemblies or by depth actuators controlled by feedback from such external sensors as linear variable-differential transformers or laser-based devices. These means of control are limited: A hard-tooled roller assembly confines a pin tool to a preset depth that cannot be changed easily during the welding process. A measurement by an external sensor is only an indirect indicative of the depth of penetration, and computations to correlate such a measurement with a depth of penetration are vulnerable to error. The present force-feedback approach exploits the proportionality between the depth and the force of penetration Unlike a depth measurement taken by an external sensor, a force measurement can be direct because it can be taken by a sensor coupled directly to the pin tool. The reading can be processed through a modern electronic servo control system to control an actuator to keep the applied penetration force at the desired level. In comparison with the older depth-control methods described above, this method offers greater sensitivity to plasticizing of the workpiece metal and is less sensitive to process noise, resulting in a more consistent process. In an experiment, a tapered panel was friction stir welded while controlling the force of penetration according to this method. The figure is a plot of measurements taken during the experiment, showing that force was controlled with a variation of 200 lb (890 N), resulting in control of the depth of penetration with a variation of 0.004 in. (0.1 mm).

Adams, Glynn↗
NASA NTRS2006

Recent Changes in High-Latitude Glaciers, Ice Caps, and Ice Sheets

The glaciers and ice sheets of the world contain enough ice to raise sea level by approximately 70 meters if they were to disappear entirely, and most of this ice is located in the climatically sensitive polar regions. Fortunately changes of this magnitude would probably take many thousands of years to occur, but recent discoveries indicate that these ice masses are responding to changes in today s climate more rapidly than previously thought. These responses are likely to be of great societal significance, primarily in terms of their implications for sea level, but also in terms of how their discharge of freshwater, through melting or calving, may impact ocean circulation. For millions of years, oceans have risen and fallen as the Earth has warmed and cooled, and ice on land has shrunk and grown. Today is no different in that respect, as sea levels have been rising at a rate of nearly 2 m per year during the last century (Miller and Douglas 2004), and 3 mm/yr in the last 12 years (Leuliette et al. 2004). What is different today, however, is that tens - perhaps hundreds - of millions of people live in coastal areas that are vulnerable to changes in sea level. Rising seas erode beaches, increase flood potential, and reduce the ability of barrier islands and coastal wetlands to mitigate the effects of major storms and hurricanes. The costs associated with a one-meter rise in sea level are estimated to be in the hundreds of billions of dollars in the United States alone. The worldwide costs in human terms would be far greater as some vulnerable low-lying coastal regions would become inundated, especially in poorer nations that do not have the resources to deal with such changes. Such considerations are particularly important in light of the fact that a one meter sea level rise is not significantly outside the 0.09 to 0.88 range of predictions for this century (IPCC 2001), and rises of this magnitude have occurred in the past in as little as 20 years (Fairbanks 1989). While the expansion of the warming oceans is estimated to be about a third of recent sea level rise, (Miller and Douglas 2004) the greatest potential for significantly increasing sea level lies in the Greenland and Antarctic ice sheets. For different reasons, each exhibits characteristics that suggest they are potentially unstable. In Antarctica, large portions of the ice cover rest on a soft bed that lies below sea level, making it vulnerable to runaway retreat. The Greenland ice sheet experiences considerable melt, which has the potential to rapidly accelerate the flow of ice toward the sea. While smaller ice masses, such as the Alaskan Glaciers and the Canadian ice caps, do not have anywhere near the same potential to impact sea level as the vast ice sheets do, many are melting rapidly, posing a significant near-term threat.

Abdalati, Waleed↗
NASA NTRS2019

The Sub-Neptune Desert and Its Dependence on Stellar Type: Controlled by Lifetime X-Ray Irradiation

Short-period sub-Neptunes with substantial volatile envelopes are among the most common type of known exoplanets. However, recent studies of the Kepler population have suggested a dearth of sub-Neptunes on highly irradiated orbits, where they are vulnerable to atmospheric photoevaporation. Physically, we expect this "photoevaporation desert" to depend on the total lifetime X-ray and extreme ultraviolet flux, the main drivers of atmospheric escape. In this work, we study the demographics of sub-Neptunes as a function of lifetime exposure to high-energy radiation and host-star mass. We find that for a given present-day insolation, planets orbiting a 0.3 solar mass star experience approximately 100 times more X-ray flux over their lifetimes versus a 1.2 solar mass star. Defining the photoevaporation desert as a region consistent with zero occurrence at 2 sigma, the onset of the desert happens for integrated X-ray fluxes greater than 1.43 times 10 (sup 22) to 8.23 times 10 (sup 20) as a function of planetary radii for 1.8 to 4 Earth radius. We also compare the location of the photoevaporation desert for different stellar types. We find much greater variability in the desert onset in the bolometric flux space compared to the integrated X-ray flux space, suggestive of photoevaporation driven by steady-state stellar X-ray emissions as the dominant control on desert location. Finally, we report tentative evidence for the sub-Neptune valley, first seen around Sun-like stars, for M&K dwarfs. The discovery of additional planets around low-mass stars from surveys such as the Transiting Exoplanet Survey Satellite (TESS) mission will enable detailed exploration of these trends.

Planets and Satellites: Gaseous Planets↗