https://dl.ucsc.cmb.ac.lk/jspui/handle/123456789/4136 2026-07-18T16:54:05Z https://dl.ucsc.cmb.ac.lk/jspui/handle/123456789/4979 Title: Security Threats to Mobile Devices through Untrusted Chargers Authors: Minha, N.F Abstract: Abstract Mobile devices face growing security threats, including risks from untrusted chargers. This research explores how untrusted chargers can exploit vulnerabilities in mobile devices, particularly focusing on data theft through USB connections. The study aims to evaluate the impact of different Android security settings and assess the risks posed by compromised chargers, including advanced attack tools like the O.MG cable. Experiments were conducted using three Android devices SKY DEVICES E55, Samsung Galaxy J4, and Samsung Galaxy S Duos 3 along with an additional device - Galaxy Tab A9 (SM-X110) tested with an O.MG cable. The study was conducted in four phases to assess security vulnerabilities. Initially, devices were tested under default security settings to observe their normal performance. The second phase evaluated risks associated with enabling developer mode and USB debugging. In the third phase, an O.MG cable was used with an unlocked phone to examine the potential for unauthorized data extraction through an untrusted charger. Finally, the effectiveness of the device lock screen was tested by attempting data theft with a locked phone. Tools like Vysor for remote access, ADB platform tools for device communication, and Scrcpy for screen mirroring were used, enabling the successful extraction of sensitive information such as text messages, photos, and emails. The results revealed significant vulnerabilities, such as unauthorized data access and the potential for malware injection. Devices with developer mode and USB debugging enabled were found to be highly vulnerable to attacks, while locked devices with disabled debugging provided a stronger defense. The study highlights the importance of securing mobile devices by disabling USB debugging, locking devices while charging, and increasing user awareness of these risks 2025-06-20T00:00:00Z https://dl.ucsc.cmb.ac.lk/jspui/handle/123456789/4714 Title: Web Based Industrial Training Management System (ITMS) for National Water Supply & Drainage Board Authors: Thilakarathna, K. G. D. C. Abstract: Providing Industrial Training for several different subjects to fulfill industrial training, is one of the core activities of the Manpower Development & Training Division in National Water Supply & Drainage Board. Approximately 500 students from NWS & DB around the country participate in many different internship & on-the-job trainings per year. Previously, industrial training-related tasks such as trainee enrollment as well as issuing agreement, assignment letters and trainee records, requesting certificates, and so on were all done manually. Completing these job tasks takes a long time and requires additional staff. Another drawback of this manual procedure has been the maintenance of several types of papers in hardcopies, which makes it challenging to search information & prepare MIS reports when needed. The main objective of this system was to provide a “Web-Based Industrial Training Management System (ITMS)” to automate the activities carried around the internship & on-the-job training process by the manpower development & training division of the NWSDB, in a more secured, accurate and efficient way. In addition to that, this new system provided an accurate, reliable, efficient and user-friendly system for users. Major activities such as registering for requesting industrial training, requesting the service of a new trainee, assigning for industrial training, keeping attendance and work records, issuing a certificate were done very easily by this web-based ITM system. All the above-mentioned manual tasks are converted to function via the system by the developed web-based system and made the whole process zero paper based. This web-based system was developed using web development tools such as the PHP framework, MySQL, & Apache web server, etc. The ITMS manages every data & information through a central server, & only authenticated users could access that data and services via the internet. Finally, the major objective of this system which is to provide a “Web-Based Industrial Training Management System (ITMS)” to automate the activities carried around the internship & on-the-job training process by the manpower development & training division of the NWSDB, in a more secured, accurate and efficient way is achieved. And apart from that, new system provided a reliable, efficient and user-friendly system for users. It should be emphasized that the major goals were achieved by the developed web-based ITMS 2023-06-22T00:00:00Z https://dl.ucsc.cmb.ac.lk/jspui/handle/123456789/4707 Title: WiFi Blackbox - A Tamper-proof Forensic-ready Device for Wifi Networks Authors: Wickramsekara, A. S. Abstract: With the current trend of computer and communication technologies, wired computer networks are almost entirely being replaced by wireless networks. For this purpose, the IEEE 802.11 protocol, i.e., Wi-Fi, is increasingly being used. With this rapid increase in usage, Wi-Fi networks are turning into the most important target of network-based malicious activities. It has been found that most of the successful Wi-Fi-related attacks in recent history have originated from internal threat actors, which amounts to a 60% of all attacks. In order to make an impact on those kinds of internal Wi-Fi attacks, this research aims to create and deploy a forensic-ready device, called WiFi-Blackbox, for internal networks that acts as a passive control mechanism that monitors, stores, and communicates the activities in a Wi-Fi network and later detects anomalies and patterns from the gathered data and information. The WiFi-Blackbox device is mainly integrated with five main hardware components and five software modules. The main board is a Raspberry Pi 4 single-board computer, which is combined with an RTL881cu USB Wi-Fi adapter that operates in WiFi monitor mode to observe nearby Wi-Fi networks constantly. To make the device tamper-proof, various physical and technical controls have been applied, such as an reliable internal power supply to face power failures and a backup 4G modem to face network failures. The device is also equipped with a GPS sensor to detect the location of the device, which can be used to prevent theft. The enclosure open notifier is another technical security control that detects physical tampering attempts on the device by attempting to open the sealed enclosure of the device. All the hardware components are controlled by internal software modules, which were written with a mixture of Python, PHP, and Shell scripts. The Sniffing module connects with the W-FI adapter and sniffs all the data frames, stores relevant frames, and decrypts them where necessary. The Anomaly Detection module checks for anomalies in each data frame and notify the user. It uses a third-party virus database to detect viruses, Trojans, and other malware. At the same time, it detects anomalies such as denial-of-service attacks. The devices Backup and Maintenance module is responsible for keeping backups of captured frames, while the System Monitor module helps to maintain a healthy system. The Communication module is the key to securely communicate between multiple WiFi-Blackbox devices and notify about incidents to each other.. The evaluation was done in a controlled environment with known infected files. Furthermore, stress testing was done by using 10 Wi-Fi networks in the deployed environment. The results indicate that a continuous data capturing and anomaly detection takes the maximum CPU power and reaches a CPU heat of 86C. Also, the device’s data accuracy is about 99%, and the data corruption rate is less than 1%. This research indicates that internal Wi-Fi networks can be protected and WiFi-related activities can be tracked and saved for forensic purposes. At the same time, it shows the possibility of implementing a tamper-proof network monitoring platform and how to demotivate insider attackers by representing the device as a deterrent controller. 2023-06-22T00:00:00Z https://dl.ucsc.cmb.ac.lk/jspui/handle/123456789/4628 Title: An Alternative to Certi fcate Authorities using Blockchain based Decentralized PKI Authors: Fernando, W.K.B.A.K. Abstract: A digital certi cate is an electronic document which can be used to prove the own- ership of a public key, which is a crucial aspect in web communication. These digital certi cates are issued by a central governing body named Certi cate Au- thorities. Activities of these certi cation authorities are not transparent and not audited as well. The problem with certi cation authorities is that the internet community need to trust these certi cation authorities completely and currently we have placed immense trust in them. Due to the importance of the certi cation authorities they are tempting targets of criminals. There are many real-life examples for cer- ti cation authorities being hacked or misbehaving. If the certi cation authority is compromised, it is possible to create fake digital certi cates which can be used for malicious activities. We have identi ed the reason for this issue is the fact that certi cation au- thorities can be considered as a single point of failure in public key infrastructure. Hence in this project we propose to eliminate this central gure and try to nd out whether it is possible to decentralize the functionalities of a certi cation au- thorities by incorporating the blockchain technology. In this project, we have followed an experimental research approach. Our prototype implementation \TLSChain" is based on Ethereum blockchain network and integrated with novel on-chain domain veri cation. The test cases carried out revealed that the blockchain technology is a well-suited platform to build a Public Key Infrastructure and possible to eliminate Certi cate Authorities. After evaluating the monetary side of \TLSChain", it was evident the design should address the scalability aspect due to the volatile nature of the cypto currency market. 2022-08-09T00:00:00Z