DEF CON 33 - No Brain No Gain - Mehmet Önder Key, Temel Demir & Dr Ahmet Furkan Aydogan

This presentation introduces a novel authentication method for IoT and industrial control systems using brain waves (EEG), addressing critical vulnerabilities in traditional security approaches. The system leverages unique brainwave patterns generated during specific cognitive tasks to provide robust, revocable authentication.

Key Takeaways:
• Critical Vulnerabilities: Traditional methods (passwords, biometrics) are highly susceptible to spoofing, lack reliable liveness detection, and cannot be revoked once compromised, creating severe risks in critical infrastructure.
• EEG Advantages: Brainwave authentication offers inherent security benefits:

• Liveness Detection: Requires active brain function, preventing post-mortem or replay attacks.
• Spoof Resistance: Brain patterns are unique, dynamic, and physiologically tied to the individual, making replication extremely difficult.
• Revocability: Compromised credentials can be reset by changing the cognitive task (e.g., imagining a different scenario).
• Coercion Resistance: Stress or fear alters brainwave patterns, hindering forced authentication.
  • Technical Workflow: Raw EEG data undergoes multi-stage processing: noise removal, segmentation, feature extraction, and authentication using Gaussian mixture models that compare live brain signals to registered patterns.