Connected Skies

In October 2018, during a light show over Hong Kong’s Victoria Harbour, 46 drones suddenly dropped from the sky into the water. The cause was GPS jamming. Every drone flies on two invisible threads: satellite navigation tells it where it is, and a radio link connects it to its operator. A cheap jammer can cut both in seconds.

On the battlefield in Ukraine, the answer has been strikingly low-tech: cut the radio and fly on a wire. Drones now trail kilometres of fibre-optic cable, which no jammer can touch. But a wire limits range and manoeuvrability, and it doesn’t scale to swarms. Most missions can’t be flown on a leash.

This talk explores the wireless alternative: drones that plan their paths around the jammer. I show how that planning depends on three questions about the adversary: Does it move? Does it react? What does the drone know about it? I also show where research still falls short: most planners assume a jammer that never moves, and few measure the link itself.

The goal is drones that cut the wire and still stay connected.

The rapid proliferation of small unmanned aerial vehicles is creating new challenges for the monitoring and protection of low-altitude airspace. Existing counter-UAS solutions can be costly, infrastructure-heavy, or difficult to redeploy, motivating interest in lightweight and flexible sensing approaches.

This talk presents our work on the use of acoustics for drone security, covering three complementary directions: identifying individual drones from their acoustic signatures, estimating the number of drones operating in an area, and using microphone-equipped drones themselves as mobile sensing platforms for perimeter protection.

Together, these projects explore how passive acoustic sensing can provide a low-cost and adaptable layer for drone detection and monitoring. The presentation will highlight the main ideas, experimental results, and the broader potential of distributed acoustic sensing for future airspace security systems.

Imagine plugging in a USB flash drive, expecting to access a few documents. Instead, your computer recognizes a keyboard that nobody is touching. Within seconds, commands are executed, sensitive information may be exposed, and the attacker has gained a foothold. No software vulnerability needs to be exploited. The device is simply taking advantage of the fundamental assumption that the host trusts what a connected device claims to be.

More than a decade after its public demonstration, BadUSB remains a persistent security threat. Its underlying weakness is rooted in the USB architecture itself, making conventional software patches insufficient. Despite numerous proposed countermeasures, preventing malicious USB devices without compromising usability remains an open challenge.

This talk explores how BadUSB attacks work, from the fundamentals of USB enumeration to malicious firmware, keyboard impersonation, and automated keystroke injection. Drawing on real-world incidents, we examine the consequences of this attack vector and distinguish it from other USB-related threats, including conventional malware distribution and hardware sabotage. We then review existing defenses, highlighting their strengths, practical limitations, and the challenges that continue to prevent widespread adoption.

Building on this broader perspective, we introduce NoBU, our cyber-physical defense against BadUSB attacks, published at ACM AsiaCCS 2025. Rather than trusting a device’s declared identity, NoBU examines the physical evidence of keyboard activity, correlating received keystrokes with vibrations generated by actual key presses. We present its underlying principles, implementation, and experimental results, demonstrating how physical sensing can provide an additional layer of protection against malicious USB devices.

Securing distributed applications across the Cloud–Edge continuum is a challenging task, particularly when heterogeneous computing resources are managed by multiple infrastructure providers with different security capabilities and trust levels. This challenge is especially relevant to emerging cyber-physical systems, which support applications such as smart cities, healthcare, and environmental monitoring.

This talk presents a declarative approach to assessing the security of multi-service application deployments across Cloud–Edge infrastructures. Such an approach combines application security requirements, infrastructure security capabilities, and trust relationships among stakeholders to provide quantitative and explainable security assessments.

Building on this foundation, recent preliminary work extends our methodology from security assessment towards security optimisation. In particular, the talk discusses how security countermeasures can be optimised under budget constraints to improve the overall security of application deployments.