Hello, and thank you for joining us today.
My name is Zack mckendrick. I'm a PhD candidate in computational media design at the University of Calgary
With me today is the driving force behind BreachMob, Lior Somin a researcher with the University of Calgary’s Interactions Lab.
We would like to thank our collaborators Dr. Patrick Finn and Dr. Ehud Sharlin from the University of Calgary for their guidance and contributions
Today we will be presenting BreachMob – a tool that detects vulnerabilities in physical environments, using virtual reality.
BreachMob is a VR tool in which an owner can publish and distribute an anonymous 3D digital model of their property to a wide-reaching community of potential online intruders.
VR provides opportunities to create immersive 1:1 building models to test physical security in ways that would be difficult to test by other means.
Our preliminary research identifies two user groups: owners and intruders.
The owner is responsible for supplying the model of the building.
While intruders break into owner-created buildings and complete environment-specific objectives exposing vulnerabilities.
BreachMob is based on the Open Design principle, which states that security should not depend on the secrecy of its design and implementation.
Thus, BreachMob utilizes open design to uncover vulnerabilities through crowdsourcing, providing multiple intruders with an opportunity to test different kinds of vulnerabilities.
BreachMob starts with a 3D model of a building, uploaded by the owner to a central distribution platform, which then publishes the model making it available to potential intruders.
The intruders play through the level and uncover vulnerabilities.
. Every attempt to break into the VR building generates a report for the owner, which they can review via data analytics.
Owners can use this data to revise security measures and republish the virtual environment. The process can repeat as often as the owner wants or until all crucial vulnerabilities are discovered and eliminated.
We developed two intruder-focused prototypes to test BreachMob, designed for the Oculus Quest headset and built using the Unity game engine.
Our first prototype is a home and the second is an airport.
The prototypes are fictional environments injected with vulnerabilities that we controlled and implemented.
Each prototype was designed to be a familiar setting and has its own unique objective for the intruder to complete.
The home is our first prototype, where we present the intruder with the objective of stealing a jewellery box and putting it in the trunk of the gateway car.
In this scenario, the intruder encounters static vulnerabilities, which are vulnerabilities that do not change over time and rely only on fixed interactions, for example opening doors or windows.
The open nature of BreachMob means that intruders are free to use different entry and exit points in the home.
This walkthrough demonstrates the intruder's perspective as they attempt to complete the objective.
Here we see the intruder looking into the house through one of the locked windows, which can be identified by the “lock icon”.
Instead of wasting time casing out the main floor, this intruder has opted to access the second floor via a ladder which they can spawn through a sub-menu.
To make the interaction of objects distinct, objects that are highlighted green are climbable, and those that are highlighted yellow are interactable.
Through the same menu, the intruder is given access to a brick that can be used to break windows.
However, it appears that our intruder has broken one of the entry points rigged with an alarm.
Once the alarm is triggered, the intruder has 60 seconds to retrieve the jewellery box and place it in the trunk before the authorities arrive, as represented by the countdown clock in the upper left corner of the screen.
If they are unable to complete their objective they fail and the scenario start over from the beginning.
Once the jewellery box is placed in the trunk, the scenario is complete.
Our second prototype is the Airport, which primarily focuses on what we refer to as dynamic vulnerabilities.
These are vulnerabilities that may change over time and involve human interaction.
We chose the airport to maintain familiarity while testing BreachMob in a larger, and ever-changing environment.
The dynamic vulnerabilities present in our airport prototype are based on the four major deficiencies in airport security as identified by Horonjeff et al in their book Planning and Design of Airports.
“Deficiencies in planning” - Deals with scenarios where the airport did not account properly for the configuration of certain paths or the placement of security devices and personnel, such as CCTV cameras
“Deficiencies in the coordination with local emergency responders” - Which are the situations when local emergency responders are needed, such as when a fire alarm is pulled,
but there are gaps in the coordination between the airport and the local responders
“Deficiencies in training” - Which are scenarios where the security personnel, such as guards, should have been able to identify a threat but failed to do so
“Deficiencies in physical security” - These are scenarios where security devices such as cameras or gates would have been beneficial to have, but are lacking
To help intruders take advantage of any potential deficiencies we provide them with three tools accessible through a similar sub-menu as seen in the Home prototype.
A forged keycard that could be used to gain access to certain gates.
A tablet mini-map of the airport, which shows where the player is located and where the objective is at.
And a book – which can be used by the intruder to blend in with the crowd, while observing the security checkpoint.
We conducted a design critique with 10 individuals from our lab who had access to an Oculus Quest headset.
Their actions were automatically recorded during their gameplay sessions.
This was done by using REST APIs which were connected to a backend server that automatically logged events onto a MongoDB database system.
After compiling all the results from the sessions, we got the following results, which showcase the total number of events that occurred. For example, how many times the fire alarm was pulled.
These figures are an important result for our design critique and help illustrate the ability to draw statistics from our simulations, which suggests that our proposed tool can find and describe vulnerabilities.
During the design critique, we realized that users could find very creative ways to uncover vulnerabilities.
For example, we had individuals who
Hid their minimap tablet using the book as they were afraid that the guards might notice the map.
Tried to type on one of the computers to print out a ticket
Physically crouched around the ledge when they went outside in an attempt to hide from the guards.
Some even tried to cover their faces with a book to hide their face from guards.
This showcases BreachMob’s ability to leverage the immersive capabilities of VR while promoting creativity and capturing vulnerabilities.
Our biggest challenge, as echoed by the design critique, is the unpredictability of human interactions.
Fully simulating a complex dynamic environment and fully anticipating all possible scenarios is difficult.
For BreachMob to work, we want to avoid owners omitting information about their security as limited or restricted data from owners means reduced effectiveness for the tool.
And of course we want to prevent misuse of the system
real-world intruders can use the system to upload potential targets. This will require the verification of submitted models.
We also want to deter would-be intruders from becoming actual intruders by inadvertently improving their break-in skills, which might encourage them to attempt infiltrating a real-world building.
We are excited by the preliminary results and the feed back our prototypes received.
Elements we will explore in future tests of BreachMob include:
Partnering with a building owner to test the validity of BreachMob in real world scenarios to determine how effective and realistic BreachMob is in uncovering vulnerabilities.
Developing the interface between owners and BreachMob.
Building a collaborative multiplayer environment to explore how teamwork might affect the vulnerability-finding process.
And incorporating more concepts from information security, such as Bug Bounty programs to provide additional incentives for intruders.
We presented BreachMob – a tool that combines Virtual Reality and Open Design principles to test the security of physical environments.
Through our preliminary home and airport prototypes, we saw how static and dynamic vulnerabilities could be simulated on different kinds of properties.
Through our prototypes, we also learned that BreachMob is effective at capturing numerical data, and also encourages users to be creative in their methods of finding vulnerabilities.
Lastly, while there are many challenges, we believe that BreachMob suggests the potential for a new approach to physical security for different kinds and sizes of buildings.
Thank you for joining us for our presentation of BreachMob. And thank you to the organizers of VRST for having us. We look forward to your questions.