We present our security analysis of three cyber-physical systems in UMBC’s new smart Interdisciplinary Life Sciences Building (ILSB): the access control system, the surveillance system, and the atrium's electrical system. Supported by reconnaissance and reverse engineering, we identify potential vulnerabilities, attacks, and risks, and make recommendations. Conducting reconnaissance and reverse engineering activities on academic cyber-physical infrastructure is currently an insufficiently researched area, unlike critical infrastructure such as smart power grids and the Industrial Internet of Things (IIoT). This project identifies how susceptible three cyberphysical systems in ILSB are to cyber attacks, and the significance of each attack to the relevant system. Without completing a full analysis and reconnaissance of the building, the DoIT and facilities manager cannot be sure how the online sensor infrastructure interacts with the physical infrastructure. Typically, academic spaces are more physically accessible than are industry equivalents, primarily due to the public nature of universities, which encourages unfettered access to buildings for the sake of collaboration and student freedom. This level of access, however, also expands the potential attack surface by opening up the university to cyber attacks performed via physical methods. Our group discovered multiple attacks on the three cyber-physical systems, produced recommendations to the university, and identified additional analysis that can be performed to secure the cyber-physical infrastructure further. Our group additionally created mappings of target systems that include interface details and connection types. After creating reconnaissance artifacts, we identified vulnerabilities within the target systems and vulnerabilities within the target system configurations.

Vulnerabilities we found include an authenticated command injection attack, and an unauthenticated denial of service on the webserver that hosts the physical access control system. Both vulnerabilities could be conducted by an adversary with a moderate level of effort and would enable the adversary to control the access control system, approving or denying access outside of normal operations. On the camera system, one attack we found is an incomplete client-side validation.  Exploitation of this vulnerability requires more effort and would allow the adversary to inject arbitrary commands, including deleting camera footage.

Student Relaxation Space during the Career & Internship Fair
Retriever Activity Center (RAC) : 106
Need a breather? The Disability Advocate Union welcomes you to the Relaxation Space on the track level of the RAC! Stop by for a reaffirming chat with a club member, light refreshments, or for a quiet moment to yourself.

Get a free professional headshot taken at the Fair from 1:00-3:00 PM on the  upper track level of the RAC. Perfect for your Handshake and LinkedIn profiles!

-ACM Info Booth, 12pm-1pm, ENG Atrium

Learn more about the Association for Computing Machinery and what they're all about!

-Engineers Without Borders Geography Challenge, 11am-12pm, ENG Atrium

Do you know your geography? Come test your knowledge at the Engineers Without Borders Geography Challenge

-IEEE Website Building, 12pm-1pm, ITE 238

Acquire the skill of website building! Taught by the Institute of Electrical and Electronics Engineers 

-Retriever Robotics Robot Showcase, 2pm-3pm, ENG Atrium

Check out the capabilities of the robots build by UMBC's Retriever Robotics

-Men's Basketball Game (vs. UMass Lowell), 6pm, Chesapeake Employers Insurance Arena

Support the men's basketball team and get some Engineering and Computing Week Swag (First Come First Serve)

Thursday (2/23)

Check out the 3D printing booth and test your engineering skills with the egg drop challenge hosted by the National Society of Black Engineers

-SHPE Diversity Panel, 5pm-6pm, ITE 238

Join the Society of Hispanic Professional Engineers in a faculty panel discussion of diversity in STEM

-COEIT 30th Anniversary Alumni Reception, 5:30pm-7:30pm, Guinness Brewery Warehouse E

Alumni from the College of Engineering and Information Technology are invited to attend an alumni reception with Dean Keith Bowman, as well as college faculty and staff

-AIChE Jeopardy Game Night, 7pm-8pm, ENG 022

Play AIChE Jeopardy and test your knowledge with the American Institute for Chemical Engineering!

Friday (2/24)

Start the day off right with FREE delicious coffee and conchas provided by Society of Hispanic Professional Engineers.

-Battle of COEIT, 12pm-1:30pm, ENG Atrium

Prove your major is the best by competing in various games. The winning major takes home the Engineering and Computing Week TROPHY.