arXiv subjects

Gaston Pugliese

Publications and source records attributed to Gaston Pugliese.

4 recordsLinked to original sources

arXiv2026

Experiencing Apple's Lockdown Mode -- The Challenges of Providing Technology for At-Risk Users

Lockdown Mode, introduced in 2022 as an optional security hardening setting for Apple's operating systems, aims to protect users from "some of the most sophisticated digital threats". We present the first academic analysis of Lockdown Mode based on a three-month autoethnographic study of its everyday use. Our findings show that Lockdown Mode does not adhere to most principles proposed by Matthews et al. (2025) for technologies supporting prevention and monitoring of digital threats for at-risk users. Apple provides limited information about the underlying threat model and affected functionality, making it difficult for at-risk users to understand and evaluate the tool. Usability challenges further highlight the need for more granular controls, while the high volume of notifications offers little support for attack detection and instead contributes to user annoyance. Although we consider Lockdown Mode an important step toward improving security, we believe Apple should integrate principles for technology used by at-risk users more fully.

cs.CR↗

arXiv2026

SoK: Understanding Anti-Forensics Concepts and Research Practices Across Forensic Subdomains

Anti-forensics includes a growing set of techniques designed to obstruct forensic analysis. While cybercriminals increasingly rely on these methods, they also help researchers identify and remedy weaknesses in forensic tools, advancing the overall robustness of digital forensics. Despite repeated efforts to define it, anti-forensics remains vague and inconsistent in its use. It also poses ethical challenges regarding the appropriateness of research practices and the legitimacy of the field itself. This article presents a systematic analysis of 123 publications on anti-forensics, combining qualitative and quantitative methods. We quantify the main techniques and attack vectors, examine their occurrence in different digital forensic subdomains, and identify typical research methods, motivations, and applications. This work also discusses what these findings mean for future research and proposes directions for building a more coherent and ethically grounded understanding of anti-forensics.

cs.CR↗

arXiv2024

Started Off Local, Now We're in the Cloud: Forensic Examination of the Amazon Echo Show 15 Smart Display

Amazon Echo is one of the most popular product families of smart speakers and displays. Considering their growing presence in modern households as well as the digital traces associated with residents' interactions with these devices, analyses of Echo products are likely to become more common for forensic investigators at "smart home" crime scenes. With this in mind, we present the first forensic examination of the Echo Show 15, Amazon's largest smart display running on Fire OS and the first Echo device with Visual ID, a face recognition feature. We unveil a non-invasive method for accessing the unencrypted file system of the Echo Show 15 based on an undocumented pinout for the eMMC interface which we discovered on the main logic board. On the device, we identify various local usage artifacts, such as searched products, streamed movies, visited websites, metadata of photos and videos as well as logged events of Visual ID about movements and users detected by the built-in camera. Furthermore, we utilize an insecurely stored token on the Echo Show 15 to obtain access to remote user artifacts in Amazon's cloud, including Alexa voice requests, calendars, contacts, conversations, photos, and videos. In this regard, we also identify new Amazon APIs through network traffic analysis of two companion apps, namely Alexa and Photos. Overall, in terms of practical relevance, our findings demonstrate a non-destructive way of data acquisition for Echo Show 15 devices as well as how to lift the scope of forensic traces from local artifacts on the device to remote artifacts stored in the cloud.

cs.CR↗

arXiv2024

Nyon Unchained: Forensic Analysis of Bosch's eBike Board Computers

Modern eBike on-board computers are basically small PCs that not only offer motor control, navigation, and performance monitoring, but also store lots of sensitive user data. The Bosch Nyon series of board computers are cutting-edge devices from one of the market leaders in the eBike business, which is why they are especially interesting for forensics. Therefore, we conducted an in-depth forensic analysis of the two available Nyon models released in 2014 and 2021. On a first-generation Nyon device, Telnet access could be established by abusing a design flaw in the update procedure, which allowed the acquisition of relevant data without risking damage to the hardware. Besides the user's personal information, the data analysis revealed databases containing user activities, including timestamps and GPS coordinates. Furthermore, it was possible to forge the data on the device and transfer it to Bosch's servers to be persisted across their online service and smartphone app. On a current second-generation Nyon device, no software-based access could be obtained. For this reason, more intrusive hardware-based options were considered, and the data could be extracted via chip-off eventually. Despite encryption, the user data could be accessed and evaluated. Besides location and user information, the newer model holds even more forensically relevant data, such as nearby Bluetooth devices.

cs.CR↗