K Fujimoto

A Ueda

T Ohtani

M Takahashi

H Ito

H Tanaka

Anne-Marie Boullier

Borehole water and hydrologic model around the Nojima fault, SW Japan

Keywords: carbonate, stable isotope, water-rock interaction, geochemical speciation

The active fault drilling at Nojima Hirabayashi after the 1995 Hyogoken-nanbu (Kobe) earthquake (M JMA = 7.2) provides us with a unique opportunity to investigate subsurface fault structure and the in-situ properties of fault and fluid. The borehole intersected the fault gouge of the Nojima fault at a depth interval of 623m to 625m. The lithology is mostly Cretaceous granodiorite with some porphyry dikes.

The fault core is highly permeable due to fracturing. The borehole water was sampled in 1996 and 2000 from the depth interval between 630 and 650 m, just below the fault core. The chemical and isotopic compositions were analyzed. Carbon and oxygen isotope ratios of carbonates from the fault core were analyzed to estimate the origin of fluid.

The following conclusions were obtained.

) Carbon and oxygen isotope ratios of calcite indicated that the meteoric water flux had been localized at the fault core. (6) A difference in the carbon isotope ratio between the footwall and the hangingwall suggests that the fault has been acted as a hydrologic barrier, although the permeability along the fault is still high.

Introduction

A fault zone provides a pathway for fluid, which plays an important role in fault processes including long-term evolution of fault structure, fault creep, nucleation-propagation-arrest and recurrence of earthquake ruptures [START_REF] Hickman | Introduction to special section: Mechanical involvement of fluids in faulting[END_REF]. Geological Survey of Japan (GSJ) drilled a borehole at Nojima Hirabayashi just after 1995 Hyogoken-nanbu (Kobe) earthquake, succeeded in penetrating the fault core and recovered complete sequences of the fault rocks from the protolith to the fault core. The drilling of active fault is advantageous for integrated study of geological data and hydrological data and comparison to exhumed faults.

We conducted a series of studies on the fault rocks from the GSJ borehole and clarified the detailed fault zone architecture [START_REF] Ohtani | Internal structure of the Nojima Fault Zone from the Hirabayashi GSJ drill core[END_REF][START_REF] Tanaka | Structural and chemical characterization of shear zones in the freshly activated Nojima fault, Awaji Island, southwest Japan[END_REF], the assemblages and occurrences of alteration minerals [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF], and characteristics of paleo-fault-related fluid based on fluid inclusions [START_REF] Ohtani | Fault rocks and past to recent fluid characteristics from the borehole survey of the Nojima fault ruptured in the 1995 Kobe earthquake, southwest Japan[END_REF][START_REF] Boullier | Fluid inclusions in pseudotachylytes from the Nojima fault, Japan[END_REF]. These studies suggest intensive deformation and alteration is localized within a narrow fault core with thickness of about 30 cm, whereas the damaged zone extends more than a few tens of meters similar to the Punchbowl and San Gabriel faults, exhumed faults of the San Andreas system [START_REF] Chester | Internal structure and weakening mechanisms of the San Andreas fault[END_REF].

As for hydrological studies, pumping tests were performed in 1996 and 2000 to examine the permeability recovery after the event. The fault zone has higher permeability than the intact host rock [START_REF] Roeloffs | Hydrologic properties at the GSJ Hirabayashi borehole in the Nojima fault from analysis of pump test and time series data[END_REF]2004) and the chemistry of the borehole water indicate that the waters are carbonate rich and mostly of meteoric origin (Sato and[START_REF] Sato | Geochemical changes in anomalously discharged groundwater in Awaji Island after the 1995 Kobe earthquake[END_REF]2000). Recently, [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF] examined the occurrences and texture of carbonate minerals and concluded that some carbonate minerals were precipitated in very recent coseismic hydraulic fractures.

In this paper we summarize the characteristics of the borehole water and precipitated materials, and discuss the alteration and carbonate isotopes of carbonate. We will combine these informations with previous work to construct hydrologic model for the Nojima fault.

Outline of the fault and core geology

The Nojima fault is a NE-SW striking active right-lateral strike-slip fault with a minor reverse component [START_REF] Mizuno | Geology of the Akashi district with geological sheet map of 1:50000[END_REF]. The drilling site is situated at Nojima Hirabayashi, on the northwestern coast of the Awaji Island, southwest Japan, where the surface displacement of the 1995 event was a maximum of 2.5m (Awata et al., 1996) (Fig. 1). The drilling site is 74.6 m east of the surface rupture and reached a depth of 746.7 m with a maximum of 5 degrees deviation from the vertical as shown in Fig. 1. The geology and tectonic setting of this region is described in [START_REF] Murata | Quaternary vertical offset and average slip rate of the Nojima fault on Awaji island, Japan[END_REF].

The borehole intersected the fault gouge of the Nojima fault at about 624 m depth. We identified the fault core at the depth interval between 623.1 and 625.3 m because the thickest section of fault gouge in the borehole is in a steeply dipping zone that aligns with the surface trace. Furthermore, the results of geophysical logging [START_REF] Ito | Structure and physical properties of the Nojima Fault[END_REF] show various anomalies at this depth such as a sudden decrease in P-wave velocity. Temperature logging data show that the present temperature at the bottom of the hole is about 31˚C (Ito, unpublished data).

The internal structure of the Nojima fault was described in detail in [START_REF] Ohtani | Fault rocks and past to recent fluid characteristics from the borehole survey of the Nojima fault ruptured in the 1995 Kobe earthquake, southwest Japan[END_REF] and [START_REF] Tanaka | Structural and chemical characterization of shear zones in the freshly activated Nojima fault, Awaji Island, southwest Japan[END_REF] and we provide a brief summary here. The lithology is mostly Cretaceous granodiorite with some porphyry dikes. The rocks above 426m depth are nearly intact granodiorite. The borehole enters the fault zone at 426m depth and the rocks are affected by the fault through the bottom of the borehole. Characteristic alteration minerals in the fault zone are smectite, zeolites (laumontite, stilbite) and carbonate minerals (calcite, siderite, and dolomite) as shown in Fig. 2. The mineral assemblages and texture indicate several episodes of hydrothermal activity in the fault zone. Chlorite, which is distributed throughout the entire depth, is probably a relic of deuteric alteration. Carbonate minerals are important as sealing material in the shallower level of the Nojima fault [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF][START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF]. Intense alteration is localized in the narrow zone of fault gouge and fault breccias. [START_REF] Boullier | Fluid inclusions in pseudotachylytes from the Nojima fault, Japan[END_REF] described pseudotachylyte bands in the fault core and estimated the formation condition to be 200˚C and deeper than 10 km. [START_REF] Murakami | Dating pseudotachylyte of the Nojima fault using the zircon fission-track method[END_REF] conducted zircon fission track dating of the pseudotachylyte and estimated the cooling time to be 30 to 40 Ma. These facts suggest that the recovered samples of the core of the Nojima fault experienced long and complicated history.

Borehole water chemistry

Experimental

The borehole was completed with a casing that is perforated in the 630 and 650 m depth interval, just below the fault core. Borehole water was sampled during the pumping tests performed in April, 1996 (about one year after the event) and in February, 2000 (about five years after the event). The chemistry of the borehole water obtained in 1996 were analyzed by [START_REF] Sato | Chemical and isotopic compositions of groundwater obtained from the Hirabayashi well[END_REF] and discussed in [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF]. Chemistry of 2000 water is provided here (Table 1 and2).

The pumping rate was 50 l/min. The electric conductivity and pH were measured on-site with electrodes after sampling. The borehole water was immediately filtered through a 0.45 µm membrane, acidified, and stored in plastic bottles for subsequent chemical and isotopic analysis. The analysis was conducted by Mitsubishi Materials. Total iron and Fe 3+ were analyzed using spectrophotometric techniques. The samples were pretreated by addition of aliquots of 1,10-phenanthroline, HCl and ammonium acetate solutions for Fe 3+ determinations. For total iron determinations, HCl, hydrochloric hydroxylamine solution, 1,10-phenanthroline and ammonium acetate solution were added to water samples. Ferrous iron was calculated from the difference between total iron and Fe 3+ .

A titration method was used for carbonate species determinations. Anions were measured by ion chromatography and cations were determined by ICP-AES. Analytical uncertainties are typically about 5 to 10 % for trace components and better than 5% for major components.

Ionic and isotopic compositions

The chemical compositions of the borehole waters are shown in Table 1 (data for the 1996 sample is after Sato andTakahashi, 1997, 2000). The major cation and anion components are calcium and bicarbonate ions, respectively. The ionic characteristics are similar to those of local spring water in the northern part of the Awaji Island [START_REF] Sato | Chemical and isotopic compositions of groundwater obtained from the Hirabayashi well[END_REF]. The water chemistry of the 1996 and 2000 samples is essentially the same.

The isotopic compositions of the 1996 water were examined by [START_REF] Sato | Chemical and isotopic compositions of groundwater obtained from the Hirabayashi well[END_REF]. They concluded that the water was derived from local ground water because the hydrogen and oxygen isotope ratios are the same trend as that of local ground water and the helium isotopic ratio is the same as that of the atmosphere. The isotopic composition of the 2000 water is similar to the 1996 water (Table 2).

The geochemical speciation

We ran a geochemical speciation code on the borehole water samples and calculated the saturation index (SI) of several minerals at the temperature range between 25 and 100 ˚C using WEB-PHREEQ, a WWW implementation of the aqueous geochemical modeling program PHREEQC (http://www.ndsu.nodak.edu/webphreeq/). Details of the code are given in [START_REF] Parkhurst | PHREEQC (Version 2), A computer program for speciation, batch-reaction, one-dimensional transport and Inverse geochemical calculations[END_REF]. Figure 3 shows changes in the saturation index (SI) of carbonates (calcite, siderite and dolomite), quartz, Ca-montmorillonite and illite with at 25˚C as for the 1996 water and 2000 water respectively. Gibbsite and goethite are assumed to be an equilibrium phase. As [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF] mentioned, the 1996 water is saturated with respect to calcite, siderite, dolomite, quartz, illite and Ca-montmorillonite at 25˚C. This is concordant with the assemblages of alteration minerals in the fault gouge zone [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF]. The SI values of calcite, siderite and dolomite are positive, whereas, those of quartz, Ca-montmorillonite and illite decrease with temperature. They change from positive to negative at about 90˚C. The changes in SI values can be used as a geothermometer [START_REF] Reed | Calculation of pH and mineral equilibria in hydrothermal waters with application to geothermometry and studies of boiling and dilution[END_REF]. It suggests that the water comes from a reservoir at about 90 ˚C and in equilibrium with those minerals. If the present geothermal gradient in this region is about 24˚C /km [START_REF] Kitajima | Terrestrial heat flow in Nojima-Hirabayashi, Awaji Island[END_REF], the depth of the reservoir might be 4km. The calculation results are quite similar to those for the 2000 water except siderite is always undersaturated.

Precipitates from the borehole water

Small amounts of solid materials were found on the borehole seismometer, that was settled near the bottom of the hole during March 2003 to March 2004. The materials were brownish in color, and calcite, goethite and opaline silica were identified by the X-ray powder diffraction patterns. A SEM image (Fig. 4) shows that calcite exhibits rectangular crystals of about a few tens of micrometers in length. The siliceous materials (opaline silica) and iron oxide or hydroxide (goethite?) are considered to be in equilibrium with the borehole water and geochemical speciation mentioned above. Therefore, we think the materials were precipitated in-situ from the borehole water. [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF] found euhedral carbonate crystals (5 -50 µm in size) in the fault core and hangingwall. They concluded that they were precipitated in recent seismic stages. Our findings support their conclusions.

Carbon and oxygen isotope ratios of carbonates in fault rocks

The samples from the GSJ borehole includes carbonate minerals (calcite, siderite and dolomite) as veins or partial replacement of primary mafic minerals through the whole core [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF]. They are also major matrix cements in the fault core [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF]. Their carbon and oxygen isotope ratios are expected to record the precipitation environment and origin of the fluid. [START_REF] Ueda | Isotopic study of the Nojima fault cores[END_REF] analyzed 36 carbonate containing rock samples from the various depth covering fault zone and intact part. The carbonate isotope is characterized by high δ 18 O(SMOW) values which may result from the influence of sea water carbon [START_REF] Ueda | Isotopic study of the Nojima fault cores[END_REF]. Sea water has not been recognized in groundwaters and the surrounding hot springs around the Nojima fault, thus, the possibility of connate sea waters should be considered. This is confirmed by [START_REF] Arai | Sealing processes with calcite in the Nojima active fault zone revealed from isotope analysis of calcite[END_REF] using the NIED core, which penetrates the Nojima fault at deeper depth than GSJ borehole.

We analyzed three additional samples of fault gouge from 623 to 625 m depth. The collected samples were powdered, and about 100 mg aliquot of powder were reacted with phosphoric acid in vacuum at 25˚C for one day (McCrea, 1950) and the CO 2 gas extracted was analyzed for the isotopic compositions by a Finnigan Mat Delta-E mass spectrometer. The uncertainties are within ±0.2 ‰ for both carbon and oxygen isotopes. The analysis was conducted by Mitsubishi Materials. The changes in both carbon and oxygen isotope ratios with depth are shown in Fig. 5.

Carbonates in the fault core (623 ~ 625m depth) are characterized by low δ 18 O (about 15 ‰) and relatively high δ 13 C (-3.5 ~ -1.9 ‰) values compared to the fault rocks analyzed by [START_REF] Ueda | Isotopic study of the Nojima fault cores[END_REF]. We re-examined the previous data by [START_REF] Ueda | Isotopic study of the Nojima fault cores[END_REF] and found the hangingwall and footwall are different in both carbon and oxygen isotope ratios. The isotopic variation of carbonate among intact part, hangingwall, and footwall will be discussed later.

Carbonates in the intact zone (above 426m depth) are characterized by lowδ 13 C (< -5.8 ‰). Carbonates in the hangingwall (426 ~ 623m depth) and footwall (625 ~ 746m depth) are different in δ 13 C values, but δ 18 O values are nearly in the same range. δ 13 C value is -1.3 to -6.0 ‰ in the hangingwall and it is -0.5 to -2.4 ‰ in the footwall. This difference results from differences in the original fluid and/or precipitation environment.

Discussion

Implications for fault healing after 1995 event

Understanding fault healing process is one of the biggest goals for fault drilling after a large seismic event. As for the Nojima fault, various explorations including electric conductivity survey, seismic survey, pumping test and injection test, have been conducted repeatedly (e.g., [START_REF] Ando | Geological and geophysical studies of the Nojima fault from drilling: An outline of the Nojima fault probe[END_REF].

Fault healing means recovery of strength in a strict sense, however, this is difficult to measure. On the other hand, fault healing may be achieved mostly by chemical processes such as dissolution and precipitation of mineral species in the fault zone. Water is necessary for these processes. Thus, changes in hydrological characteristic such as permeability are very important.

The vertical hydraulic diffusivity was estimated to be 0.5 m 2 /s in 1996 [START_REF] Roeloffs | Hydrologic properties at the GSJ Hirabayashi borehole in the Nojima fault from analysis of pump test and time series data[END_REF] and did not change in order of magnitude in 2000 [START_REF] Roeloffs | Hydrologic properties and fluid pressure response to strain in the recently ruptured Nojima fault, Japan[END_REF]. Seeing that the ionic and stable-isotope characteristics of 2000 borehole water are similar to 1996 borehole water, the reservoir and fluid path might not change between 1996 April to 2000 February. This suggests that the fault has not been healed from a hydrological viewpoint. [START_REF] Tadokoro | Evidence for rapid fault healing derived from temporal changes in S wave splitting[END_REF] suggested that the Nojima fault was healed in 33 months after the 1995 event based on the S wave splitting. We do not think this is paradoxical. Hydraulic conductivity obtained by borehole tests reflects the shallow part of the fault. Considering that reservoir temperature is about 90˚C and there is no signature of deep component, it would take a lot of time to adhere the fractured fault plane in this shallow part due to the low reaction rates.

In contrast, the reaction rate would be accelerated by higher temperature and pressures in the deeper portion of the fault.

Localized meteoric water flux at the fault core

The carbonates from GSJ borehole are characterized by high δ 18 O relative to calcite from hydrothermal fields in the world [START_REF] Ueda | Isotopic study of the Nojima fault cores[END_REF]. Oxygen isotope ratio of carbonate is mainly affected by the nature of source fluid and the temperature of precipitation, to a first approximation. As for the source fluid, sea water (0 ‰) and local meteoric water (-7.5 ‰;after Sato and Takahashi, 2000) are possible end members since there is no signature of mantle or lower crust in the fluids around the Nojima fault. The temperature dependence of oxygen isotope value of calcite which is in equilibrium with sea water and local meteoric water can be calculated as follows. α means fractionation factor between two species.

α CaCO3-H2O =( The results are shown in Fig. 6. The calculation implies two possibilities of the origin of the fluid. One is that connate sea water precipitates carbonates at relatively higher temperatures (100 ~ 200˚C) and the other is that meteoric water precipitates them at relatively lower temperature (<50˚C).

We think the second possibility is preferable because of the following two reasons. (1) Water from the fault core is basically meteoric origin. (2) Ca-bearing mineral species is laumontite under higher temperature environment (higher than about 120˚C), instead of calcite [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF]. Thus, localized meteoric water flow at the fault core.

As [START_REF] Ohtani | Fault rocks and past to recent fluid characteristics from the borehole survey of the Nojima fault ruptured in the 1995 Kobe earthquake, southwest Japan[END_REF] and [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF] described, there are several stages of carbonate precipitation. The carbon isotope values mentioned above represent all stages and the difference in each stage should be further checked using a micro-scale analysis technique.

Hydrologic model around the Nojima fault

The carbonates of the hangingwall and footwall have different isotopic characteristics. There are several explanations for this. One simple interpretation is that the isotopes reflect a difference in precipitation temperature. Zeolite species indicate that the hangingwall side has a higher temperature signature than the footwall side due to the reverse component of the Nojima fault [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF]. If the fluid has the same carbon isotope value, carbonate in the footwall side would have lower carbon isotope ratio than that of hangingwall side based on the temperature dependence of the isotope fractionation. As previously mentioned, the carbonate isotope value in the hangingwall side is actually lower than that of footwall side. However, the temperature difference might be less than a few tens of degrees based on the displacement estimation by [START_REF] Murata | Quaternary vertical offset and average slip rate of the Nojima fault on Awaji island, Japan[END_REF] and a current geothermal gradient obtained by [START_REF] Kitajima | Terrestrial heat flow in Nojima-Hirabayashi, Awaji Island[END_REF]. The difference in carbon isotope ratios cannot be explained by the temperature difference alone. Another possible interpretation is that the fluids in the hangingwall side and in the footwall side originally had different carbon isotope ratios, and that the Nojima fault acted as a hydrologic barrier across the fault. [START_REF] Lockner | Permeability and strength of core samples from the Nojima fault of the 1995 Kobe earthquake[END_REF] measured strength and matrix permeability of the core samples at 50 MPa confining pressure. The obtained permeability ranges are as follows; 0.1 to 1 microdarcy in the fault core, about 100 microdarcy in the damage zone, and less than sub nanodarcy for the intact rock. They inferred that the post-seismic fault zone acts as a high permeability fluid conduit for fluid flow in the plane of the fault because the fault core is likely to act as a barrier across the fault. Their results are in good agreement with the scheme proposed by [START_REF] Caine | Fault zone architecture and permeability structure[END_REF], though they did not concerned the effect of fracture permeability. The scheme [START_REF] Caine | Fault zone architecture and permeability structure[END_REF] is based on the fault architecture, which was characterized by widths of a damage zone and a fault core relative to the width of a total fault zone. Each zone is a distinct structural and hydrogeologic unit. The Nojima fault is categorized into the combined conduit-barrier system because it has both a localized fault core and a wide damage zone.

In the combined conduit-barrier system, the fault core may usually act as a barrier and may act as a conduit during deformation until fractures or pore spaces are filled with minerals. In contrast, the damage zone always acts as conduit [START_REF] Caine | Fault zone architecture and permeability structure[END_REF]. The carbon and oxygen isotope data presented in this paper support this scheme and the permeability structure proposed by Locker et al. (2000).

Geochemical/mineralogical studies on the samples from the fault core indicate that the fault core mainly composed of hydrous and carbonate minerals and volatile contents are much higher than those of the damage zone [START_REF] Fujimoto | Alteration and mass transfer inferred from the Hirabayashi GSJ drill core penetrating the Nojima Fault, Japan[END_REF]. Probably, the fault core acts as a conduit only a short interval after a seismic event, considering the minerals can be precipitated quickly [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF] and the recurrence time of the Nojima fault is order of thousand years [START_REF] Awata | Paleoseismology and activity study of the Nojima fault system, which generated the Hyogo-ken Nanbu earthquake of January 17, 1995[END_REF]. The high vertical hydraulic diffusivity obtained by pumping tests (Roeloffs andMatsumoto, 2000, 2004) reflects the high permeability of the damage zone.

Comparison with the other fault drillings

Recently, several boreholes have been drilled to intersect active faults such as Chelungpu fault, Taiwan, San Andreas fault, USA, and Aigion fault, Corinth, Greece.

Geologic settings of the above faults are completely different. Chelungpu fault, activated in 1999 Chichi earthquake, is one of major thrust faults in sedimentary sequences extending for over 100 km on the western flank of the Taiwan fold-andthrust belt. San Andreas Fault is a transform fault between Pacific and North American plates. Aigion fault is a normal fault in limestone layers, which extends in the southern part of the Corinth basin.

Detailed comparison is beyond the focus of this paper, however, carbonate minerals seem to be dominant as fractures or cavities filling in the fault zones (Chelungpu fault; Hashimoto et al., 2005, San Andreas fault;Evans et al., 2005, Aigion fault;[START_REF] Labaume | Deformation mechanisms and fluid driven mass transfer in the recent fault zones of the Corinth Rift (Greece)[END_REF] as in the Nojima fault zone. Abundance of carbonate minerals in the shallow part of the fault zone is probably due to up-flow of carbonate rich fluid through a conduit in the fault zones. [START_REF] Kharaka | Geochemistry and hydromechanical interactions of fluids associated with the San Andreas fault system, California[END_REF] found relatively high flux of CO 2 of mantle origin associated with the San Andreas fault system. Roll of carbonate minerals and carbon bearing fluids in fault processes should be paid more attention.

Borehole test and geophysical exploration can provide a snap shot image or physical state of the fault zone. On the contrary, geological and geochemical analysis of core samples can indicate the history which the fault zone has experienced. Their integrations are necessary to understand an overall seismic cycle, which is one of the main targets of the drilling of active faults.

Conclusions

(1) Ionic and isotopic compositions of borehole water did not change from 1996 to 2000 and borehole water is mostly derived from local ground water as [START_REF] Sato | Chemical and isotopic compositions of groundwater obtained from the Hirabayashi well[END_REF] mentioned.

(2) Geochemical speciation suggests that the borehole water was derived from a relatively deep reservoir, which may be situated at the depth of 4 km and a temperature of about 90˚C.

(3) The shallower part of the Nojima fault (shallower than the reservoir depth) has not been healed from the hydrological viewpoint five years after the large seismic event, in contrast to the rapid healing detected by S wave splitting [START_REF] Tadokoro | Evidence for rapid fault healing derived from temporal changes in S wave splitting[END_REF]. ( 4) Precipitation of calcite from present borehole water supports the idea of postseismic precipitation of some portion of calcite in the fault core [START_REF] Boullier | Textural evidence for recent co-seismic circulation of fluids in the Nojima fault zone, Awaji island, Japan[END_REF]). (5) Carbon and oxygen isotope ratios of calcite indicate the meteoric water flux has been localized to the fault core. (6) The difference in carbon isotope ratio between the footwall andhangingwall suggests that the fault has acted as a hydrologic barrier, though the permeability along the fault is still high.

Figure captions

Fig. 1

 1 Fig.1 Geologic map and fault trace (modified from Ohtani et al., 2000) Fig.2 Distribution of alteration minerals (modified from Fujimoto et al., 2001). Fig.3 Changes of saturation index values (S.I.) of several minerals with temperature. Fig.4 Secondary electron image of precipitates from the borehole water. Calcite appears in the center and surrounding fine materials are goethite. A scale bar is shown in the photograph. Fig.5 Changes of carbon and oxygen isotope ratios with depth. Fig.6 Oxygen isotope of calcite in equilibrium with seawater and local meteoric water with temperature. Fractionation factor was based on O'Neil et al. (1969).

Table 1

 1 Chemical composition of GSJ borehole water sample in 1996 April and 2000 February. Data of the 1996 borehole water is after[START_REF] Sato | Geochemical changes in anomalously discharged groundwater in Awaji Island after the 1995 Kobe earthquake[END_REF].

					1996 Apr	2000 Feb
	pH				7.8	7.57
	Na + (mg/L)	36.2	32.3
	K + (mg/L)	4.7	6.92
	Ca 2+ (mg/L)	56.2	59.9
	Mg 2+ (mg/L)	20	23.8
	Fe 2+ (mg/L)	1	<0.1
	Fe 3+ (mg/L)	0.94	0.1
	Mn 2+ (mg/L)	0.16	0.07
	Cl -(mg/L)	20.4	16
	SO 4	2-(mg/L)	5.1	9.6
	NO 3	-(mg/L)	<0.05	<0.1
	F -(mg/L)	0.7	0.5
	HS -(mg/L)	<0.001	<1
	CO 3	2-(mg/L)	<5	<1
	HCO 3	-(mg/L)	330	390
	H 2 SiO 3 (mg/L)	57.2	84

Acknowledgements

This work was supported by Geological Survey of Japan. The authors thank to Dr. Tsutomu Sato and Dr. Norio Matsumoto of Geological Survey of Japan for providing important information. The suggestions from the reviewers are helpful for improvement of the manuscript.


IoT: Different definitions, similar concepts

The Internet of Things and the Future Internet

There are currently many terms flying around when trying to characterise the future development of the Internet: In addition to the Internet of Things, there is the Internet of Services, 3D Internet, Internet of Content, and Next-Generation Networks, just to name a few. It is important to note that these terms should not be regarded as different "Internets" that will exist in parallel, but rather as different aspects of a common Future Internet. The European Commission has understood this and is therefore taking concerted action and clustering the research projects it is funding in the 7 th Framework Programme into what it calls the Future Internet Assembly. Furthermore, collaborations are on-going and likely will be intensified with similar efforts in the USA and Japan.

From an enterprise and economic perspective, the Future Internet is the basis for a web-based service economy [1]. There will be service platforms and a multitude of services available over the Internet, hence the term Internet of Services. The granularity of these services will be very different, ranging from high-level business services to low-level sensor services provided by the Internet of Things. The role of the Internet of Things is to bridge the gap between the physical world and its representation in information systems. This leads us to our definition of the Internet of Things:

"A world where physical objects are seamlessly integrated into the information network, and where the physical objects can become active participants in business processes. Services are available to interact with these "smart objects" over the Internet, query their state and any information associated with them, taking into account security and privacy issues."

Different Definitions, Similar Concepts

Despite the global buzz around the Internet of Things, there is no single, universally accepted definition for the term. Different definitions are used by various groups to describe or promote a particular view of what IoT means and its most important attributes. Some definitions specify the concept of the Internet or the Internet Protocol (IP), while others, perhaps surprisingly, do not. For example, consider the following definitions.

The Internet Architecture Board (IAB) begins RFC 7452, 33 "Architectural Considerations in Smart Object

Networking'', with this description:

The term "Internet of Things" (IoT) denotes a trend where a large number of embedded devices employ communication services offered by the Internet protocols. Many of these devices, often called "smart objects,'' are not directly operated by humans, but exist as components in buildings or vehicles, or are spread out in the environment.

Within the Internet Engineering Task Force (IETF), the term "smart object networking" is commonly used in reference to the Internet of Things. In this context, "smart objects" are devices that typically have significant constraints, such as limited power, memory, and processing resources, or bandwidth. 34 Work in the IETF is organized around specific requirements to achieve network interoperability between several types of smart objects. This definition in a call for papers for a feature topic issue of IEEE Communications Magazine 37 links the IoT back to cloud services:

The Internet of Things (IoT) is a framework in which all things have a representation and a presence in the Internet. More specifically, the Internet of Things aims at offering new applications and services bridging the physical and virtual worlds, in which Machine-to-Machine (M2M) communications represents the baseline communication that enables the interactions between Things and applications in the cloud.

The Oxford Dictionaries 38 offers a concise definition that invokes the Internet as an element of the IoT:

Internet of things (noun): The interconnection via the Internet of computing devices embedded in everyday objects, enabling them to send and receive data.

All of the definitions describe scenarios in which network connectivity and computing capability extends to a constellation of objects, devices, sensors, and everyday items that are not ordinarily considered to be "computers''; this allows the devices to generate, exchange, and consume data, often with minimal human intervention. The various definitions of IoT do not necessarily disagree -rather they emphasize different aspects of the IoT phenomenon from different focal points and use cases.

WWW.INTERNETSOCIETY.ORG

ed in 2012, the International Telecommunication Union (ITU) ITU-T Recommendation Y.2060, w of the Internet of things, 36 discusses the concept of interconnectivity, but does not specifically tie to the Internet:

Internet of things (IoT):

A global infrastructure for the information society, enabling advanced services by interconnecting (physical and virtual) things based on existing and evolving interoperable information and communication technologies.

Note 1-Through the exploitation of identification, data capture, processing and communication capabilities, the IoT makes full use of things to offer services to all kinds of applications, whilst ensuring that security and privacy requirements are fulfilled.

Note 2-From a broader perspective, the IoT can be perceived as a vision with technological and societal implications. Raise and growth of IoT • Avi-on lighting ecosystem • Also a leader in Z-Wave & ZigBee w/ GE-branded lighting and appliance controls. ZigBee brand is EZ ZigBee.

-Ilumi #71334 -Includes temperature and humidity sensor

• Lumiere #81750

-"world's first smart essential oil diffuser" with "plug-andplay capsules" -"Analyses your profile to perfectly match your schedule, mood and pains. Tell it how you feel, and it will do the rest!"

• Aroma Therapeutics -AromaCare #80941

-"First Diffuser of essential oils connected"

• Beewi #31154

-"First Connected Oil diffuser with temp, humidity , CO2 sensors"

AromaCare

Scent Diffusers

• SensorWake #80541

-Alarm clock -Wake to scent of coffee, peaches, beach, mint or money

• P&G Febreze IoT scent diffuser #70560 (Thread Group)

-Includes temperature and humidity sensor

• Lumiere #81750

-"world's first smart essential oil diffuser" with "plug-andplay capsules" -"Analyses your profile to perfectly match your schedule, mood and pains. Tell it how you feel, and it will do the rest!"

• Aroma Therapeutics -AromaCare #80941

-"First Diffuser of essential oils connected"

• Beewi #31154 tion of the time and energy of the device to communiother devices and integrate the required services. five-layer model, the Application Layer is the interface end-users can interact with a device and query for interta. It also provides an interface to the Business Layer gh-level analysis and reports can be produced. The echanisms of accessing data in the application layer andled at this layer. This layer is hosted on powerful ue to its complex and enormous computational needs. ing these points on the one hand and sticking to the y of the architecture on the other hand, the five-layer ure is the most applicable model for IoT applications.

IV. IoT ELEMENTS standing the IoT building blocks helps to gain a better to the real meaning and functionality of the IoT. In wing sections we discuss six main elements needed r the functionality of the IoT as illustrated in Fig. 4. shows the categories of these elements and examples and control thousands of smart devices and appliances inside buildings using their smartphones [24]- [26].

Single Board Computers (SBCs) integrated with sensors and built-in TCP/IP and security functionalities are typically used to realize IoT products (e.g., Arduino Yun, Raspberry PI, Bea-gleBone Black, etc.). Such devices typically connect to a central management portal to provide the required data by customers.

C. Communication

The IoT communication technologies connect heterogeneous objects together to deliver specific smart services. Typically, the IoT nodes should operate using low power in the presence of lossy and noisy communication links. Examples of communication protocols used for the IoT are WiFi, Bluetooth, IEEE 802.15.4, Z-wave, and LTE-Advanced. Some specific communication technologies are also in use like RFID, Near Field Communication (NFC) and ultra-wide bandwidth (UWB). RFID is the first technology used to realize the M2M concept (RFID

D. Computation

Processing units (e.g., microcontrollers, microprocessors, SOCs, FPGAs) and software applications represent the "brain" and the computational ability of the IoT. Various hardware plat- Why it is difficult to secure IoT?

• Battery life extension

• Limited energy to execute the designed functionality and heavy security instructions can drain the devices' resources • Use the minimum security requirements on the device, which is not recommended especially when dealing with sensitive data. • harvest energy from natural resources (e.g., light, heat, vibration, wind): requires hardware upgrade and increases cost

• Lightweight computation

• limited memory space which can't handle the computing and storage requirements of advanced cryptography algorithms. • Latency hiding technique: breaking down the query results of large size into small sized data sets.

• Lightweight encryption scheme: Identity-based Encryption

• Physical attack: performed when the attacker is in a close distance of the device

• Use secure booting by applying a cryptographic hash algorithms and digital signature to verify its authentication and the integrity of the software

• Network attack: manipulating the IoT network system to cause damage

• Authenticate itself to the network before any transmission or reception of data

• Software attack: happen when the IoT applications present some security vulnerabilities that allow the attacker to seize the opportunity and harm the system. • Encryption attack: breaking the system encryption. This kind of attacks can be done by side channel, cryptanalysis, and man-in-the-middle attacks • Taxonomy classification for IoT attacks based on how the attacker features deviates from the legitimate IoT devices

• ignoring, reducing, misusing, and extending the system functionality

• Creating a covert channel: organization building that implemented smart lights

IoT botnets

• December 2013: first IoT botnet

• 25% of the botnet was made up of devices other than computers, including smart TV, baby monitors and other household appliances

• October 2016: Mirai botnet

• Many web sites including: Twitter, Netflix, Spotify, Airbnb, Reddit, Etsy, SoundCloud and The New York Times, were reported inaccessible by users caused by a distributed denial of service attack (DDoS) attack using a network of consumer devices from the Internet of Things (IoT)

• 2016: IRCTelnet

IoT communication protocols

IoT communication models (RFC 7452)

• Device to device communications

Device-to-Device Communications

The device-to-device communication model represents two or more devices that directly connect and communicate between one another, rather than through an intermediary application server. These device communicate over many types of networks, including IP networks or the Internet. Often, however these devices use protocols like Bluetooth, 40 Z-Wave, 41 or ZigBee 42 to establish direct device-to-device communications, as shown in Figure 1. IoT communication models (RFC 7452)

• Device to Cloud communications

Device-to-Cloud Communications

In a device-to-cloud communication model, the IoT device connects directly to an Internet cloud service li an application service provider to exchange data and control message traffic. This approach frequently ta advantage of existing communications mechanisms like traditional wired Ethernet or Wi-Fi connections to establish a connection between the device and the IP network, which ultimately connects to the cloud service. This is shown in Figure 2. IoT communication models (RFC 7452)

• Device to Gateway model

Device-to-Gateway Model

In the device-to-gateway model, or more typically, the device-to-application-layer gateway (ALG) model, the

IoT device connects through an ALG service as a conduit to reach a cloud service. In simpler terms, this means that there is application software operating on a local gateway device, which acts as an intermediary between the device and the cloud service and provides security and other functionality such as data or protocol translation. The model is shown in Figure 3.

DOWNLOAD GUIDE FOR LINKS

IoT communication protocols comparison

Comparison ([C.(Gomez(et(al.,(MPI(Sensors(journal(2012,(vol12] Comparison ([C.(Gomez(et(al.,(MPI(Sensors(journal(2012,(vol12]( IoT communication protocols comparison (cont.) Comparison((cont.) ([C.( Gomez(et(al.,(MPI(Sensors(journal(2012,(vol12] Comparison((cont.) ([C.( Gomez(et(al.,(MPI(Sensors(journal(2012,(vol12 1, is constructed according to the layers previously described. While the is slightly different for each radio configuration in Table 1, for brevity this work focuses on the format for R2. Additionally, not depicted in Figure 1 • Examines vulnerabilities in the device implementation

• Low HTTP authentication, backup files to reimage the system and retrieve passwords

• Exploits a new vulnerability to create a persistent attack channel by injecting a rogue controller in the Z-Wave network

• Put the primary controller in inclusion mode using a crafted HTTP packet • Replicate the primary controller to build a rogue one Information hiding in the Z-Wave MAC frame

• Hide information in the MAC frame at rates R1 and R2 (64B)

• MSDU: variable length (payload information)

• Basic command class: SET, GET, REPORT (known length)

• Determine available bytes remaining

• Attacker can hide up to 51B in a singlecast frame and up to 22B in a multicast frame available to hide information at R1 and R2 are less than half of R3.

Singlecast MAC frames includes the home ID, source ID, frame control, length, and destination ID totalling 9B (Figure 2 and 3). A one byte non-correcting frame checksum is used to validate the MAC frame for data rates R1 and R2 (2B are used for R3). Given our channel configuration, we know that the frame checksum of messages supported in our experimental Z-Wave network is one byte. Thus, there are 54B remaining for the MSDU (frame payload). A similar calculation can be done to discover the maximum payload length of the multicast frame (Figure 3). There are 39B used in the multicast frame excluding the MSDU. Therefore, the MSDU is 25B.

Space available to hide information

The MSDU field has a variable length and contains the frame payload information. The length depends on the command class being sent to a device in the Z-Wave network. The command class determines the function that needs to be performed by a device. One example is the Basic command class which is supported by all Z-Wave devices. The Basic command class uses three commands: SET to turn a device on or off, GET to request a device status, and REPORT to respond to a request.

Since we know that all devices, including the controller, will accept messages containing the Basic command class (RaZberry Project n.d.), we can determine the length required in the MSDU for the Basic command class portion of the payload. This will allow us to determine available bytes remaining.

The representation of the Basic command class in the MAC frame is 0x20. The byte field following is dependent upon the command SET (0x01), GET (0x02), or REPORT (0x03). In either case, the payload length needed to support the Basic command class is at least 3B. Since all Z-Wave devices support the Basic command class, an attacker can hide up to 51B of data in a singlecast MAC frame and up to 22B in a multicast MAC frame. When the Z-Wave transceiver receives a packet, the header and EoF are stripped away as the packet moves up the protocol stack. Once at the application layer, the command class function is executed and the injected bytes Z-wave covert channel: information hiding

• Gain access to the Z-wave gateway by using a rogue controller technique (Fuller et Ramsey,2015) • Attacker crafts Z-Wave packets containing hidden information

• Transmit them using a Software-Defined radio (SDR) and scapyradio.

• A running script on the gateway scans for any injected packet Some useful tools for Z-wave security analysis

• Scapy-radio (https://bitbucket.org/cybertools/scapyradio/src): built upon Gnu radio and Scapy for pentesting for RF-based protocols

• Packets sniffing and injection using scapy library

• EZ-Wave (https://github.com/AFITWiSec/EZ-Wave ): set of tools built upon Scapy-radio. Three python based tools: EZStumbler, EZFingerprint, EZRecon.

• EZStumbler: passive and active scanner for discovering and enumerating Z-wave networks • EZFingerprint: identify the manufacture, product name and firmware versions • EZRecon: status information from a target, sensor reading, configuration settings

• Z-attack (https://github.com/advens/Z-Attack ): Z-wave packet interception and injection using RfCat USB dongle • Z-force (https://code.google.com/archive/p/z-force/): intercept and decrypt Z-wave keys

Bluetooth Low Energy (BLE) protocol

What(is(BLE( BLE(is(part(of(Bluetooth(SIG(specificaGon,(IEEE802.15.1( V4.0+(standard,(since(2010( • BLE(is(very(different(from(classic(Bluetooth,(so(it(can( almost(be(considered(as(another(stand3alone(standard( • BLE(is(one(of(the(Low(power(networking(technology(for( enabling(IoT( -Output(power:(10mW (Scanner,(Master,(then(sends(connecGon(request,(slave(responds,(connecGon( established( • Data(exchanges(between(the(slave(and(the(master(at(predefined( Gmes((duty3cycle)( 8(

•

BLE packet format

5( some of the BLE Controller features are inherited from the classic Bluetooth Controller are currently incompatible. Hence, a device that only implements as a single-mode device) cannot communicate with a device that only implem is expected that many devices will implement both the classic Bluetooth a ks. These devices are called dual-mode devices.

Layer

[C. (Gomez(et(al.,(MPI(Sensors(journal(2012,(vol12] Although some of the BLE Controller features are inherited from the class oth types of Controller are currently incompatible. Hence, a device that only i s referred to as a single-mode device) cannot communicate with a device that luetooth. It is expected that many devices will implement both the classic rotocol stacks. These devices are called dual-mode devices.

.2. Physical Layer BLE operates in the 2.4 GHz Industrial Scientific Medical (ISM) band requency (RF) channels with 2 MHz channel spacing. There are two type dvertising channels and data channels. Advertising channels are used onnection establishment and broadcast transmission, whereas data channels a ommunication between connected devices.

Three channels are defined as advertising channels. These channels hav requencies that minimize overlapping with IEEE 802.11 channels 1, 6 and 1 sed in several countries.

An adaptive frequency hopping mechanism is used on top of the data ch [C.(Gomez(et(al.,(MPI(Sensors(journal(2012,(vol12]( BLE link layer BLE(link(layer( 11(

• One(packet(format(and(two(PDU(types:( AdverGsing(and(data(( Bluetooth Low Energy and Bluetooth Packet ransmitted data from a Bluetooth low energy device is formatted according to the Bluetooth Co fication and is comprised by the parts shown in Figure 1.

Figure 1. Bluetooth Low Energy Data Packet

reamble is a 1 byte value used for synchronization and timing estimation at the receiver. It will s be 0xAA for broadcasted packets. The Access Address is also fixed for broadcasted packets E89BED6. The packet payload consists of a header and payload. The header describes the p nd the PDU Type defines the purpose of the device. For broadcasting applications, there are t

Central

Advertising event T_advEvent

Devices can advertise for a variety of reasons:

Advertising packet types

AdverGsing(packet(types(

• Connectable:(a(scanner(can(iniGate(a(connecGon(upon( recepGon(of(an(adverGsing(packet( • Non3connectable:(a(scanner(cannot(iniGate(a( connecGon((only(for(broadcasGng) ATT: Attribute protocol ATT((Aeribute(Protocol)( Client3server(model:(client(requests(data(and( server(sends(data(to(clients( • Server(contains(data(organized(in(forms(of( Aeributes( • Each(aeribute(has(( a(163bit(handle,(( a(1283bit(UUID((Universal(Unique(ID,(for(type(and( nature(of(data(value),(can(be(shortened(to(16(or(32( bits,(Standardized' GATT: Generic Attribute Profile GATT((Generic(Aeribute(Profile)(

•
• Dealing(with(data(exchange(in(BLE,(GATT( defines(a(basic(data(model(and(procedures(to( allow(devices(to(discover,(read,(write,(and( push(data(elements(between(them.(It(is,(in( essence,(the(topmost(data(layer(of(BLE.( • Data(is(organized(hierarchically(in(secGons( called(services,(which(group(conceptually( related(pieces(of(user(data(called( characteris/cs.( 17( GATT client GATT(client( • The(GATT(client(corresponds(to(the(ATT(client.(It( sends(requests(to(a(server(and(receives( responses((and(server3iniGated(updates)(from(it.( The(GATT(client(does(not(know(anything(in( advance(about(the(server's(aeributes,(so(it(must( first(inquire(about(the(presence(and(nature(of( those(aeributes(by(performing(service(discovery.( Auer(compleGng(service(discovery,(it(can(then( start(reading(and(wriGng(aeributes(found(in(the( server,(as(well(as(receiving(server3iniGated( updates.( 18( GATT serverGATT(server(

• The(GATT(server(corresponds(to(the(ATT(server.(It( receives(requests(from(a(client(and(sends( responses(back.(It(also(sends(server3iniGated( updates(when(configured(to(do(so,(and(it(is(the( role(responsible(for(storing(and(making(the(user( data(available(to(the(client,(organized(in( aeributes.(Every(BLE(device(sold(must(include(at( least(a(basic(GATT(server(that(can(respond(to( client(requests,(even(if(only(to(return(an(error( response.(( 19( GATT data hierarchy Covering(the(usage(model(of(the(lower3level( radio(protocols(to(define(roles,(procedures,( and(modes(that(allow(devices(to(broadcast( data,(discover(devices,(establish(connecGons,( manage(connecGons,(and(negoGate(security( levels,(GAP(is,(in(essence,(the(topmost(control( layer(of(BLE.(This(profile(is(mandatory(for(all( BLE(devices,(and(all(must(comply(with(it.( 23(

BLE possible attacks

• Attacks on advertisements

• Advertisement spoofing: spoof and advertise them with configurable interval • Denial of service: advertise a cloned device

• Passive interception

• Unencrypted transmission can be intercepted by a passive eavesdropper

• Active interception

• Attacker invoked connections with the device and the mobile application, and relays messages between them: Man in the middle (MiTM)

• Attacks on pairing

• Attack the pairing process to guess the Long Term key 7 "encrypting") and signing options for the broadcasted values. The advertised packets change their values with predefined frequency, and the value is possible to "decode" only using the vendor's mobile application. However, such mechanisms have to overcome several limitationson both the hardware and software side, as well as compromise for offline usage requirements. As vendors guard the "shuffling" algorithm's technical details in the way of top-secret intellectual property, it may raise concerns whether the mechanism was properly reviewed by a professional cryptographer.

Depending on the level of risk, the ideal solution would be to not rely on received advertisement packets for critical functionality.

Interception of transmitted data is also possible by active attack, using the newly introduced tool.

Example vulnerabilities

Smart finder

An example "smart finder" device implemented authentication in a form of a static 6-digit password sent from the mobile application to the device in cleartext form characteristic write. A screendump below presents the password ('123456') intercepted using the GATTacker tool:

BLE security

Mike Ryan

Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013 • Whitelisting

• Create a whitelist of accepted devices' MAC addresses.

BLE encryption BLE (v4.0) security: encryption Open Z-Wave

Scapy-Radio

Dans la console, on lance Scapy, qui combiné à GNU Radio nous permet de décoder des paquets Z-Wave et d'en injecter. Les principales commandes utilisées sont :

-sniffradio() : écoute les paquets échangés et les décode en message (requête ou acquittement)

Packets capture

• Capturing packets between a USB controller and a plug (Dongle(and(SmartRF(sniffer( (coupled(with(wireshark)( • For(Linux,(Bluez(Bluetooth(stack, Step 1: Get the HomeID

• Prerequisites: install OpenZWave Control Panel sudo apt install openzwave-controlpanel

• Option 1: Using an SDR (see lab session 1)

Step 1: Get the HomeID

• Option 2: Use a DVDB-T tuner (30 € hardware)

• Install rtl-sdr sudo apt install rtl-sdr

Step 1: Get the HomeID cd ../..

ln -s waving-z/build/wave-in wave-in sudo apt install rtl-sdr

Step 1: Get the HomeID Step 2: Create a universal controller Step 2: Network Auto-discovery Let's explore network connections

The embedded web server private key

35

  Published in 2012, the International Telecommunication Union (ITU) ITU-T Recommendation Y.2060, Overview of the Internet of things, 36 discusses the concept of interconnectivity, but does not specifically tie the IoT to the Internet: 3.2.2 Internet of things (IoT): A global infrastructure for the information society, enabling advanced

-•-

  New Sengled Voice (microphone/speaker) • voice control of devices • Voice communications • Audio analytics -glass breaking and baby crying -Snap (camera) -BOOST (Wi-Fi extender) Makes IR air conditioners smart • Hub + Pods • Learns and adapts • IFTTT • Pod: 6LoWPAN for control, BLE for beacons • Pod sensors -Temperature -Relative humidity -iBeacon presence -Piezo-electric disc (senses fan level of AC in room units) -Light (for activation of night mode) -6 IR emitters -IR receiver (pass-through for existing remotes) Alarm clock -Wake to scent of coffee, peaches, beach, mint or money • P&G Febreze IoT scent diffuser #70560 (Thread Group)

  IoT integration Source: http://www.electronicdesign.com/iot/designing-industrial-internet-things IoT elements IEEE COMMUNICATION SURVEYS & TUTORIALS, VOL. 17, NO. 4, FOURTH QUARTER 2015 e IoT elements.

Figure 3 . 1 Figure 3 . 1

 3131 Figure 3.1 Architecture of a wireless sensor node

Microcontroller 6LoWPAN :

 6LoWPAN The Wireless Embedded Internet, Shelby & Bormann 47 Microcontroller • Main processing units of embedded devices • Special purpose and highly integrated -Integrated RAM, ROM, I/O, peripherals -Extremely good power to performance ratio -Cheap, typically 0.25 -10.00 USD • Executes programs including embedded system control, Wireless Embedded Internet, Shelby & Bormann IoT: common operating systems

  Andrea, C. Chrysostomou, and G. Hadjichristofi, "Internet of things: Security vulnerabilities and challenges," in 2015 IEEE Symposium on Computers and Communication (ISCC), July 2015.

Figure 1 .

 1 Figure 1. Example of device-to-device communication model.

Figure 2 .

 2 Figure 2. Device-to-cloud communication model diagram.

Figure 3 .

 3 Figure 3. Device-to-gateway communication model diagram.Source:((Tschofenig,(H.,(et.(al.,(Architectural(Considera9ons(in(Smart(Object(Networking.(Tech.(no.(RFC(7452.(Internet(Architecture(Board,(Mar.(2015.(Web.( <hNps://www.rfcQeditor.org/rfc/rfc7452.txt>.(

Figure 4 .-

 4 Figure 4. Back-end data sharing model diagram.

  are the NWK, SAR, or ENC adaptation layers pear when those specific adaptations are invoked. consists of a preamble for symbol synchronization consisting of the binary pattern 01010101 a Start of Frame (SOF) delimiter and followed by data passed from the MAC layer as a PHY Service DU). The MAC layer includes the fields shown in Figure 1. The Home ID is a four-byte unique n instance of a Z-Wave Home Area Network (HAN). The Source ID and Destination ID fields specify a unique device identifier within a Z-Wave HAN, of the sender and receiver. The Frame Control of the subfields shown in Table 2. Of particular interest to this work are the Acknowledgement he Sequence Number subfields. The Length field represents the byte length of the PSDU. The MAC nit (MSDU) is the data passed from the LLC layer. Finally, the MAC layer is concluded with an eightting Frame Check Sequence (FCS).

  rk over wireless or wired s a "smart home". The first systems such as X10 used ldings as the communication ited bandwidth, they were ectrical interference. Wireless come these limitations of the vide easier expansion and vices. However, as the radio d or injected by the attackers, and integrity of wireless ortance in these systems. As ey establishment, encryption, device authentication were open wireless protocols such ity services are built on top of lgorithms such as Advanced ccessful attacks against them exploit the implementation anagement practices [1] [2]. d by Sigma Designs, Inc. tegrity protection and device gaining momentum against control panels. An open source implementation of Zprotocol stack, open-zwave [4], is available but it doe support the security services as of yet.

Figure 1 -

 1 Figure 1 -Z-Wave protocol layers

Figure 3 :

 3 Figure 3: MAC layer frame structure: (a) singlecast frame and (b) multicast frame

•

  Dissects the packet and retrieving the needed information • Clears the log file • Counter-measure: misuse-base introduction detection by monitoring Z-wave frames

Figure 4 :

 4 Figure 4: MAC frame consisting of (a) home ID, (b) source ID, (c) frame control, (e) length, (e) destination ID, (f) basic command class, command, and payload, (g) hidden information in MSDU, and (h) checksum The key to this attack is locating Z-Wave packets on the gateway controller. The RaZberry Pi keeps a detailed log that contains all actions on the Z-Wave network. Once awake, the Python script scans the log file for any injected packet containing the hidden information. The injected packet contains a marker [FE FE] in the MSDU (Figure 4.g). This marker is used because it is unlikely that a standard Z-Wave packet will contain consecutive bytes [FE]. Upon identification, the Python script dissects the packet retrieving needed information including the attack type [01] and IP address [A2-56-C0-05] (Figure 5). Any attack type can be added depending on the needs of the attacker. Examples include Ping of Death to deny service or Reverse File Transfer to retrieve the /etc/passwd file or other important files.

  (TI(CC2540(USB(dongle(BLE(sniffer(quide:( hep://processors.wiki.G.com/index.php/BLE_sniffer_guide#AdverGsement_packets](

•

  Prevent tracking by changing the MAC of the device on a frequent basis.

•

  The TK is used to compute a "confirm" value: all used values for its computation are in plaintext over the air.• After that the master and slave, compute a short-term key (STK), and finally an LTK. • The STK exchange messages are encrypted using the TKAnd That's It⇀ TK → STK ⇀ STK → LTK ⇀ LTK → Session keys KEY EXCHANGE = BR0KEN Cracking the TK Reference: Mike Ryan, Bluetooth: With Low Energy comes Low Security, USENIX WOOT, 2013 Mike Ryan Bluetooth Smart / Bluetooth LE USENIX WOOT, August 2013 37 Cracking the TK confirm = AES(TK, AES(TK, rand XOR p1) XOR p2) GREEN = we have it RED = we want it TK: integer between 0 and 999,999 Just Works TM : always 0! With crackle: Time to crack < 1 second

FIGURE 14 :

 14 FIGURE 14: Partie réception dans GNU Radio

FIGURE 15 :

 15 FIGURE 15: Partie émission dans GNU Radio

•-

  ubertooth-btle -f -c ble.pcap• Open the ble.pcap with wireshark • Filter the packet to display connection packets and non zero data packets: btle.data_header.length > 0 || btle.advertising_header.pdu_type == 0x05 Bluetooth discovery Wi-Fi Channel 11 Capturing packets to PCAP More details: https://github.com/greatscottgadgets/ubertooth/wiki/Capturing-BLE-in-Wireshark Lab session 3 Z-Wave network takeover Loïc Rouch, Frédéric Beck, Jérôme François, Abdelkader LahmadiObjective • Z-Wave network takeover -Avoid specific hardware -Take full advantage of official hardware certified by the ZOpen the door sensor -LED bulb blinks in red to simulate an alarm • Central point: Home ID -Unique -Set during controller manufacturing -Randomly regenerated when the controller is re-initialized

  • billion networked devices by 2020 according to Morgan Stanley • billion of IoT connections by 2025 according to Huawei

	Consumer IoT devices Bluetooth (BLE) Mesh
	Environmental	Smart Home	Wearable
	Monitoring
	Smart Grid			Medical & Healthcare
	cepro.com/ces	cepro.com/CES2016guide	jjacobson@ehpub.com	© 2016 EH Publishing
	Connected Vehicle
				Industrial Automation
		Smart City

• billion Internet-connected objects by 2019 (according to Cisco)

Source: http://www.cisco.com/c/en/us/about/security-center/secure-iot-proposed-framework.html

Internet of Things applications

TABLE II BUILDING BLOCKS AND TECHNOLOGIES OF THE IOT Node Architecture

 II

•

  Device connects to application layer gateway to reach a cloud service • Local gateway could be a smartphone running an app to communicate with the device and relay data to a cloud service as ownership of and access to the data. At the same time, users can generally have confidence that devices designed for the specific platform can be integrated.

Tschofenig, H., et. al., Architectural Considerations in Smart Object Networking. Tech. no. RFC 7452. Internet Architecture Board, Mar. 2015. Web. https://www.rfc-editor.org/rfc/rfc7452.txt such

Table 2 .

 2 Main characteristics of ZigBee, 6LoWPAN, Z-Wave, BLE and classic Bluetooth. The data of ZigBee, 6LoWPAN and Z-Wave has been obtained or adapted from the literature [2].

	(

Table 2 .

 2 Cont.

	(

Table 2 .

 2 ]( Cont. Wireless protocol developed by the company ZenSys in 1999, acquired by Sigma Designs in 2008. • Based on the ITU-T G.9959 standard: but it is a proprietary protocol • Network: control nodes and slave nodes, mesh network • Data rates (US) • In Europe 868.42 MHZ • Range 50 meters • PHY Service Data Unit sizes: 170B at R3 and 64B at R1 or R2 rates

	Sensors 2012, 12

ZigBee 6LoWPAN (Over 802.15.4) Z-Wave Bluetooth Low Energy Classic Blueto Edge Router, Mesh Node Z-wave protocol •

Joseph Hall et al. und protocol overview rotocol

  is defined in terms of layers. The Physical (PHY) layer controls the behavior of the radio cording to the configurations in Table1. The Medium Access Control (MAC) layer links network naging acknowledgements, error checking, and retransmissions. The Logical Link Control (LLC) access to instances of different network protocol stacks (e.g., 6LoWPAN). Between the MAC and adaptation layers for handling Mesh Network Routing (NWK), Segmentation and Reassembly Encryption (ENC). Finally, the Application (APP) layer controls end device behavior. The PHY, MAC, s are specified by ITU-T G.9959, while the implementation of the APP layer is left to the device .

	configurations (US)
		Rate 1 (R1)	Rate 2 (R2)	Rate 3 (R3)
	Data rate	9.6 kbps	40 kbps	100 kbps
	Symbol rate	19.2 kBaud	40 kBaud	100 kBaud
	Center freq	908.42 MHz	908.40 MHz	916 MHz
	Modulation	FSK	FSK	GFSK
	Coding	Manchester	NRZ	NRZ
	Deviation	±20 KHz	±20 KHz	±29 KHz
	e, illustrated in Figure

•

  Delete the log entries from the UI • Transmit commands to the devices bypassing the gateway

Reference: Fuller et al, Rogue Z-Wave Controllers: A Persistent Attack Channel, in 2015 IEEE 40th Local Computer Networks Conference Workshops (LCN Workshops)

  Bluetooth Low Energy Data Packet alue used for synchronization and timing estimation at the receiver. It will asted packets. The Access Address is also fixed for broadcasted packets, set t payload consists of a header and payload. The header describes the packet ines the purpose of the device. For broadcasting applications, there are three own in Table1. ADV_IND and ADV_NONCONN_IND have been described and non-connectable) while ADV_SCAN_IND is simply a non-connectable e additional information by scan responses.

	igure 1. le 1. Advertising PDU Types for Broadcasting Data
	• To broadcast promiscuously Packet Name • To broadcast promiscuously ADV_IND • To transmit signed data to a previously bonded device Description Connectable undirected advertising event ADV_NONCONN_IND Non-connectable undirected advertising • To advertise their presence to a device wanting to connect event
	• To reconnect asynchronously due to a local event To reconnect asynchronously due to a local event ADV_SCAN_IND Scannable undirected advertising event

ether the advertisers address (contained in the Payload) is public (TxAdd = 0) Add is reserved for other types of packets not covered in this application note, ons.

•

  Enable security by default through unique, hard to crack default user names and passwords. User names and passwords for IoT devices supplied by the manufacturer are often never changed by the user and are easily cracked. Botnets operate by continuously scanning for IoT devices that are protected by known factory default user names and passwords.• Build the device using the most recent operating system that is technically viable and economically feasible. Many IoT devices use Linux operating systems, but may not use the most up-to-date operating system. •

Use hardware that incorporates security features to

  strengthen the protection and integrity of the device. For example, use computer chips that integrate security at the transistor level, embedded in the processor, and provide encryption and anonymity.•

Design with system and operational disruption in mind

	Security Updates and Vulnerability Management Prioritize Security Measures According to
	• Patches would be applied automatically and leverage Potential Impact
	cryptographic integrity and authenticity protections to • Know a device's intended use and environment,
	more quickly address vulnerabilities. where possible. This awareness helps developers and
	manufacturers consider the technical characteristics • Consider coordinating software updates among third-of the IoT device, how the device may operate, and party vendors to address vulnerabilities and security improvements to ensure consumer devices have the the security measures that may be necessary
	complete set of current protections. • Perform a "red-teaming" exercise, where developers
	actively try to bypass the security measures needed at • Develop automated mechanisms for addressing vulnerabilities the application, network, data, or physical layers
	• Identify and authenticate the devices connected to • Develop a policy regarding the coordinated disclosure of the network, especially for industrial consumers and vulnerabilities, including associated security practices to address identified vulnerabilities. business networks.
	• Develop an end-of-life strategy for IoT products

Notre démarche : expériences et résulta 3.1 Environnement de travail : ressources utilisée 3.1.1 Ressources matérielles Communication radio : la carte Ettus-USRP B210

  Zwave est une librairie open source dédiée aux développeurs souhaitant tester et incorporer des fonctionnalités Z-Wave à leurs applications. Nous utiliserons cette librairie avec notre contrôleur USB pour contrôler le réseau Z-Wave. Full-duplex, dual-channel and they offer large radio spectrum capabilities as well as a great amount of bandwidth étés capables de détecter le message d'activation envoyé par le contrô lorsque le capteur de mouvement était activé, et en conséquence, d'en de désactivation aussitôt. L'attaque a été couronnée de succès et a créé C'est sur leur travail que nous avons basé notre approche. GNU Radio sur une machine virtuelle Linux. Ce logiciel est open source et a 'avantage de présenter une interface graphique ergonomique où il suffit d'assembler des odules. En reprenant les travaux des ingénieurs ADS, on réceptionne les paquets Z-Wave avec e modèle :

		3.1.2 Ressources logicielles Open-Zwave SDR boards GNU Radio plifie la tâche pour l'écoute des paquets échangés mais ne correspond pas vraiment à un cas réel de réseau domotique Z-Wave. Scapy development that was necessary to make that Scapy-radio happen.
	.	• http://www.openzwave.com/ • Open source programming library for Z-Wave PC controllers • Control panel for Z-wave devices Open-Voici une impression d'écran d'Open-Zwave Control Panel, une interface graphique pour Open-Zwave : • Software Defined Radio: a radio communication system where the signal-capturing components are software-configurable and the signal-processing components are software-implemented • Examples: HackRF, bladeRF, USRP2 • GNU Radio is a framework GNU Radio • Interactive packet manipulation program Software Defined Radio Pour traiter les signaux reçus par la carte SDR et les transformer en paquets, nous • Click and play GUI (GNU Radio companion) • Gr-modtool to help extend it • Python and C++ • Supports a lot of SDR utilisons GNU Radio sur une machine virtuelle Linux. Ce logiciel est open source et a l'avantage de présenter une interface graphique ergonomique où il suffit d'assembler des modules. En reprenant les travaux des ingénieurs ADS, on réceptionne les paquets Z-Wave avec ce modèle : • Used world-wide by pentesters • Full Python code • Supported under Windows, Linux, Mac OSX • Lots of protocols already supported • Native Fuzzing capabilities Scapy IN socket OUT socket GRC flow graph (GNU Radio) OUT socket IN socket layer layer layer layer Scapy UDP SuperSocket layer layer layer layer layer layer layer layer UDP + GNU Radio • 3 Ettus USRP B210 • Easy to extend custom encapsulation
		FIGURE 14: Partie réception dans GNU Radio
		FIGURE 13: Open-Zwave Control Panel

XMLRPC Control Fig. 3: Scapy-radio architecture https://bitbucket.org/cybertools/scapy-radio/src Source: Jean-Michel Picod et al, « Bringing Software Defined Radio to Penetration Testing Community », Blackhat 2014 GNU Radio: Receiving Z-Wave packets tilisons

  • sniffradio() and show() y-Radio, on utilise les commandes sniffradio() et show() comm ent pour capturer et analyser les paquets. ivons à capturer l'échange suivant : Étude et Analyse sur la sécur p est un tableau de paquets. Pour analyse utilise les commandes p[0].show() et p[1].sho Plug -> controller: state notification Étude et Analyse sur la sécurité des objets connectés

	BLE sniffing informaGon(
	Lab session 2
	BLE protocol Sniffing

FIGURE 20: Echange capturé • CC2540(USB

  Start at the bottom and work our way up:Capturing Physical layer: http://ubertooth.sourceforge.net/Sniffing BLE packets• Spectrum analysis: run ubertooth-specan-ui• Start ubertooth-btle to capture packets to a PCAP file

	Ubertooth one Ubertooth Block Diagram
			PHY layer		Link layer
			RF↔Bits		Bits↔Packets
	CC2591	RF	CC2400	How do we sniff it? LPC175x Bits
	RF Amp		lescan( Radio	→	GATT ARM MCU
			PC →	22(	ATT Packets
				→	L2CAP
	Mike Ryan		→ Bluetooth Smart / Bluetooth LE → Ubertooth	Link Layer PHY USENIX WOOT, August 2013 USB	20
			Mike Ryan	Bluetooth Smart / Bluetooth LE	USENIX WOO

•

  Use the set_home_id.sh script -./set_home_id.sh /dev/ttyACM0 HOMEID • Restart it to get a universal controller

-Modified HomeID with pre-registered nodes

-Start Open Z-Wave Control Panel ozwcp

•

  Set the device interface to /dev/ttyACM0 • Do not check the USB checkbox • Click on Initialize • The controller starts with the new HomeID and performs Network auto-discovery Set level to 0 and press submit to neutralize it The smart plug provides a Wifi network: mFI D25CE7 • Connect your host to this WiFi network • Execute nmap to find the IP of the connected smart plug: • Nmap -sn 192.186.2.0/24 • Using your browser type the IP address of the smart plug (192.168.2.20) • Scan the device using nmap to identify the open ports Telnet connections (port 23) • Possible SSH connections with easy to find login/password • Dropbear sshd 0.51: 2 vulnerabilities • Lighttpd 1.4.31: 6 vulnerabilities • DNS resolver (port 53): could be used as a DDoS amplifier • Let's connect to the device using telnet!! • Let's explore the file system

	Inside a smart plug
	Lab session 4
	Inside a smart plug

-~10 minutes long process • Led Bulb should have NodeID 21 -Open the door sensor, alarm goes on -• Cool How?: inside a smart plug •

MiTM BLE attack

Counter-measures How to fix the problem?

• Use the BLE security features • Incorporate security at the design phase

• Building security in at the design phase reduces potential disruptions and avoids the much more difficult and expensive endeavor of attempting to add security to products after they have been developed and deployed.

• Security updates and vulnerability management

• Vulnerabilities may be discovered in products after they have been deployed

• Prioritize security measure according to potential impact

• Risk models differ substantially across the IoT ecosystem. For example, industrial consumers (such as nuclear reactor owners and operators) will have different considerations than a retail consumer.

• Connect carefully and deliberately

• IoT consumers can also help contain the potential threats posed by network connectivity by connecting carefully and deliberately, and weighing the risks of a potential breach or failure of an IoT device against the costs of limiting connectivity to the Internet.

Connect Carefully and Deliberately

• Advise IoT consumers on the intended purpose of any network connections. Direct internet connections may not be needed to operate critical functions of an IoT device, particularly in the industrial setting • Make intentional connections. There are instances when it is in the consumer's interest not to connect directly to the Internet, but instead to a local network that can aggregate and evaluate any critical information • Build in controls to allow manufacturers, service providers, and consumers to disable network connections or specific ports when needed or desired to enable selective connectivity