Reviewerly/exHarmony huggingface dataset:
Work in Progress: Evaluation of Security Standards through a Cyber Range using Hackers’ Tactics, Techniques and Procedures

We present a framework for the creation of a cyber range to test the effectiveness of security standards, policies and frameworks. These assets guide organisations on how to protect themselves from cyber threats. They have been created via a variety of methods including standards bodies, anecdotal evidence, findings from successful attacks and others. To date, however, there is not an agreed process for creating cyber ranges to conduct a practical assessment of the recommended controls. As a result, the ability of enterprises and standards bodies to judge the effectiveness of these measures is limited. Utilising hackers’ tactics, techniques, and procedures to evaluate security standards, should be an effective method for testing a lifelike cyber range which complies to a specific standard. We have started to produce the blueprint for such a laboratory, presented here to showcase our initial findings, using the Cyber Essentials framework as an initial use case. 1.
SoK: Analysis of Root Causes and Defense Strategies for Attacks on Microarchitectural Optimizations

Microarchitectural optimizations are expected to play a crucial role in ensuring performance scalability in the post-Moore era. However, recent attacks have demonstrated that these optimizations, which were assumed to be secure, can be exploited. Moreover, new attacks surface at a rapid pace limiting the scope of existing defenses. These developments prompt the need to review microarchitectural optimizations with an emphasis on security, so as to understand the attack landscape and the potential defense strategies.We provide a framework to analyze attacks on a wide range of microarchitectural optimizations and use that to systematize both transient and non-transient attacks and defenses, while highlighting the similarities and differences. We identify four root causes of timing-based side-channel attacks: determinism, sharing, access violation and information flow, through our systematic analysis. Leveraging our framework, we systematize existing defenses and show that they target these root causes in the different attack steps. We believe that our framework can assist in understanding the attack and defense landscape and provide guidance for designing secure microarchitectural optimizations.
Work in Progress: A Glance at Social Media Self-Censorship in North America

There is a growing trend of social backlash and ostracism for thoughts and opinions shared online. Coupled with the rise of strict content moderation or digital nudges discouraging unpopular opinions, this trend calls into question whether users feel comfortable expressing their views freely on social media. Self-censorship can be defined as the “act of intentionally and voluntarily withholding information from others in the absence of formal obstacles” [4].In this work, we sought to understand the self-censorship behavior of Canadian and United States social media users through an online survey. Our analysis suggests that users’ exhibit different degrees of concern when posting controversial content, and that these differences can be explained by demographic, psychometric and political orientation factors. Our results also suggest that there seems to be a consensus on the type of content that is more prone to be self-censored.
An Analysis System to Test Security of Software on Continuous Integration-Continuous Delivery Pipeline

This work presents a modular and scalable analysis system to integrate different Applications Security Testing tools inside a Continuous Integration-Continuous Delivery Pipeline. Docker containerization and tools for stateless execution allow parallelism and replication. As a result of the analysis of an application, the system execution produces as output a unique JSON report that contains all the vulnerabilities found by the tools executed, with a risk score associated to each vulnerability. Two Application Security Testing tools, OWASP ZAP and SonarQube, have been integrated using Gitlab Platform to apply DevOps methodology for java web application analysis. Results on the OWASP Benchmark test suite confirm a consistent improvement of the security analysis and allow comparison of tools accuracy by vulnerability category.
Code Vulnerability Detection via Signal-Aware Learning

Machine Learning-based modeling of source code understanding tasks has been gaining popularity. Accompanying their rapid proliferation is an emerging scrutiny over the models’ reliability. Concerns have been raised regarding the models not actually learning task-relevant source code features, but fitting other correlated data. To improve model trustworthiness, in this work, we explore data-driven approaches for enhancing model signal awareness, i.e., learning the relevant signals in the input for making predictions. We do so by incorporating the notion of code complexity during model training, both (i) explicitly via curriculum learning, and (ii) implicitly by augmenting the training dataset with simplified signal-preserving programs. With our techniques, we achieve up to 4.8x improvement in signal awareness of vulnerability detection models. Using the notion of code complexity, we present a novel interpretation of the model learning behaviour from the perspective of the dataset. We use it to introspect model learning difficulties, and analyze the learning enhancements achieved with our approaches.
Been Here Already? Detecting Synchronized Browsers in the Wild

Browsers have become the most popular and used platform for accessing the web. Their wide and exclusive usage as a medium for doing several tasks in the Internet comes with serious security and privacy risks for the users. For example, it has been shown that web sites can employ browser fingerprinting and cross-device tracking techniques to de-anonymizing or profiling a user’s browser. On the other hand, browsers become richer in functionality by the years. One very convenient feature, introduced recently and being available to most major web browsers, is synchronizing the browsers on different devices. Browser synchronization allows users to share settings and preferences of their browser running on multiple devices (e.g., on their laptop and smartphone).In this paper, we are the first to deliver a framework that can be used by web site operators to detect if different HTTP requests, issued from different browsers, are actually requests performed by the same user through multiple synchronized browsers running on different devices. For detecting this, we reconstruct different sessions based on their requested resources, timestamps and cookies. In addition, we evaluate our methodology by conducting a user study that collects anonymized HTTP requests from several users, and we prove that the detection of synchronized sessions is possible with a success rate higher than 75%. Our results indicate a serious implication to users’ privacy that has not been studied before.
Understanding the Security Risks of Decentralized Exchanges by Uncovering Unfair Trades in the Wild

DEX, or decentralized exchange, is a prominent class of decentralized finance (DeFi) applications on blockchains, attracting a total locked value worth tens of billions of USD today.This paper presents the first large-scale empirical study that uncovers unfair trades on popular DEX services on Ethereum and Binance Smart Chain (BSC). By joining and analyzing 60 million transactions, we find 671, 400 unfair trades on all six measured DEXes, including Uniswap, Balancer, and Curve. Out of these unfair trades, we attribute 55, 000 instances, with high confidence, to token thefts that cause a value loss of more than 3.88 million USD. Furthermore, the measurement study uncovers previously unknown causes of extractable value and real-world adaptive strategies to these causes. Finally, we propose countermeasures to redesign secure DEX protocols and to harden deployed services against the discovered security risks.
Finding Fixed Vulnerabilities with Off-the-Shelf Static Analysis

Software depends on upstream projects that regularly fix vulnerabilities, but the documentation of those vulnerabilities is often unreliable or unavailable. Automating the collection of existing vulnerability fixes is essential for downstream projects to reliably update their dependencies due to the sheer number of dependencies in modern software. Prior efforts rely solely on incomplete databases or imprecise or inaccurate statistical analysis of upstream repositories. In this paper, we introduce Differential Alert Analysis (DAA) to discover vulnerability fixes in software projects. In contrast to statistical analysis, DAA leverages static analysis security testing (SAST) tools, which reason over code context and semantics. We provide a language-independent implementation of DAA and show that for Python and Java based projects, DAA has high precision for a ground-truth dataset of vulnerability fixes — even with noisy and low-precision SAST tools. We then use DAA in two large-scale empirical studies covering several prominent ecosystems, finding hundreds of resolved alerts, including many never publicly disclosed. DAA thus provides a powerful, accurate primitive for software projects, code analysis tools, vulnerability databases, and researchers to characterize and enhance the security of software supply chains.
Understanding, Measuring, and Detecting Modern Technical Support Scams

Technical support scams (TSS) are social engineering attacks that aim to exploit users that have limited knowledge about technology, such as the elderly, causing significant financial loss to vulnerable citizens. The security community has attempted to respond to these web-based scams with different countermeasures. However, to the best of our knowledge, no robust countermeasures have been proposed thus far to defend against modern TSS campaigns that abuse web search engines to inflate their rankings in search results and lure many potential victims.To defend against these TSS attacks, in this paper we first study the TSS ecosystem, with particular focus on how modern TSS campaigns are operated and promoted on the web. Then, we capitalize on our findings by proposing a novel detection system named TASR that can be used to differentiate TSS websites from legitimate technical support websites in a topic-agnostic way, by leveraging features that capture key traits of how TSS web pages are promoted. Our cross-validation tests show that TASR can detect 94.5% of the TSS links in web search results at a false positive rate of less than 1%, significantly outperforming previous work.
A ‘Human-in-the-Loop’ approach for Information Extraction from Privacy Policies under Data Scarcity

Machine-readable representations of privacy policies are door openers for a broad variety of novel privacy-enhancing and, in particular, transparency-enhancing technologies (TETs). In order to generate such representations, transparency information needs to be extracted from written privacy policies. However, respective manual annotation and extraction processes are laborious and require expert knowledge. Approaches for fully automated annotation, in turn, have so far not succeeded due to overly high error rates in the specific domain of privacy policies. In the end, a lack of properly annotated privacy policies and respective machine-readable representations persists and enduringly hinders the development and establishment of novel technical approaches fostering policy perception and data subject informedness.In this work, we present a prototype system for a ‘ Human-in-the-Loop’ approach to privacy policy annotation that integrates ML-generated suggestions and ultimately human annotation decisions. We propose an ML-based suggestion system specifically tailored to the constraint of data scarcity prevalent in the domain of privacy policy annotation. On this basis, we provide meaningful predictions to users thereby streamlining the annotation process. Additionally, we also evaluate our approach through a prototypical implementation to show that our ML-based extraction approach provides superior performance over other recently used extraction models for legal documents.
Towards more rigorous domain-based metrics: quantifying the prevalence and implications of “Active” Domains

The Domain Name System (DNS) is a critical component of the internet infrastructure. As such it is often the subject of various measurements with a view to quantifying different aspects of its use. Some of these measurements cover legitimate uses; however, identifying any threats associated with domain names has also become a vital task in enhancing DNS security. Current abuse metrics used for identifying malicious domains typically rely on the count of domains listed on Reputation Blocklists and are normalized by the size of the zone for registries or domains under management for registrars. However, these metrics are imprecise and do not account for whether the domain name is resolvable or serves active content. In this paper, we propose a novel approach to identify active domains, which account for domains that serve actual content under the control of the registrant. We demonstrate the proportions of inactive, active, and non-resolving domains across different samples of the name space. Our findings suggest that current normalized metrics are not necessarily giving a true picture of the underlying situation. By introducing a more precise classification system for domains, we show how this can lead to more reliable and robust metrics that can, for example, enhance DNS security by enabling a more thorough analysis of active domains. We also discuss the implications of these findings for registries and registrars, highlighting how they can use this information to combat domain abuse more effectively.
How Cryptocurrency Exchange Interruptions Create Arbitrage Opportunities

Centralized cryptocurrency exchanges offer users a more convenient platform to trade their digital assets at the cost of reduced control. As a result, when these exchanges suffer interruptions users struggle to access their funds or modify their orders. We investigate 41 events at the popular exchange Bitfinex, and measure the impact these events have on trades, volume, and pricing. We find that the volume to trade ratio increases during events, as fewer traders are moving large amounts of bitcoin. We also find that these interruptions often occur at the same time as arbitrage opportunities, with substantial profit opportunities.
Recurring Contingent Service Payment

Fair exchange protocols let two mutually distrustful parties exchange digital data in a way that neither party can cheat. They have various applications such as the exchange of digital items, or the exchange of digital coins and digital services between a buyer/client and seller/server.In this work, we formally define and propose a generic blockchain-based construction called "Recurring Contingent Service Payment" (RC-S-P). It (i) lets a fair exchange of digital coins and verifiable service reoccur securely between clients and a server while ensuring that the server is paid if and only if it delivers a valid service, and (ii) ensures the parties’ privacy is preserved. RC-S-P supports arbitrary verifiable services, such as "Proofs of Retrievability" (PoR) or verifiable computation and imposes low on-chain over-heads. Our formal treatment and construction, for the first time, consider the setting where either client or server is malicious.We also present a concrete efficient instantiation of RC-S-P when the verifiable service is PoR. We implemented the concrete instantiation and analysed its cost. When it deals with a 4-GB outsourced file, a verifier can check a proof in only 90 milliseconds, and a dispute between a prover and verifier is resolved in 0.1 milliseconds.At CCS 2017, two blockchain-based protocols were proposed to support the fair exchange of digital coins and a certain verifiable service; namely, PoR. In this work, we show that these protocols (i) are susceptible to a free-riding attack which enables a client to receive the service without paying the server, and (ii) are not suitable for cases where parties’ privacy matters, e.g., when the server’s proof status or buyer’s file size must remain private from the public. RC-S-P simultaneously mitigates the above attack and preserves the parties’ privacy.
Asynchronous Remote Key Generation for Post-Quantum Cryptosystems from Lattices

Asynchronous Remote Key Generation (ARKG), introduced by Frymann et al. at CCS 2020, allows for the generation of unlinkable public keys by third parties, for which corresponding private keys may be later learned only by the key pair’s legitimate owner. These key pairs can then be used in common public-key cryptosystems, including signatures, PKE, KEMs, and schemes supporting delegation, such as proxy signatures. The only known instance of ARKG generates discrete-log-based keys.In this paper, we introduce new ARKG constructions for lattice-based cryptosystems. The key pairs generated using our ARKG scheme can be applied to lattice-based signatures and KEMs, which have recently been selected for standardisation in the NIST PQ process, or as alternative candidates.In particular, we address challenges associated with the noisiness of lattice hardness assumptions, which requires a new generalised definition of ARKG correctness, whilst preserving the security and privacy properties of the former instantiation. Our ARKG construction uses key encapsulation techniques by Brendel et al. (SAC 2020) coined Split KEMs. As an additional contribution, we also show that Kyber (Bos et al., EuroS&P 2018) can be used to construct a Split KEM. The security of our protocol is based on standard LWE assumptions. We also discuss its use with selected candidates from the NIST process and provide an implementation and benchmarks.
SIM: Secure Interval Membership Testing and Applications to Secure Comparison

The offline-online model is a leading paradigm for practical secure multi-party computation (MPC) protocol design that has successfully reduced the overhead for several prevalent privacy-preserving computation functionalities common to diverse application domains. However, the prohibitive overheads associated with secure comparison – one of these vital functionalities – often bottlenecks current and envisioned MPC solutions. Indeed, an efficient secure comparison solution has the potential for significant real-world impact through its broad applications.This work identifies and presents SIM, a secure protocol for the functionality of interval membership testing. This security functionality, in particular, facilitates secure less-than-zero testing and, in turn, secure comparison. A key technical challenge is to support a fast online protocol for testing in large integer rings while keeping the precomputation tractable. Motivated by the map-reduce paradigm, this work introduces the innovation of (1) computing a sequence of intermediate functionalities on a partition of the input into input blocks and (2) securely aggregating the output from these intermediate outputs. This innovation allows controlling the size of the precomputation through a granularity parameter representing these input blocks’ size – enabling application-specific automated compiler optimizations.To demonstrate our protocols’ efficiency, we implement and test their performance in a high-demand application: privacy-preserving machine learning. The benchmark results show that switching to our protocols yields significant performance improvement, which indicates that using our protocol in a plug-and-play fashion can improve the performance of various security applications. Our new paradigm of protocol design may be of independent interest because of its potential for extensions to other functionalities of practical interest.
A Certified Radius-Guided Attack Framework to Image Segmentation Models

Image segmentation is an important problem in many safety-critical applications such as medical imaging and autonomous driving. Recent studies show that modern image segmentation models are vulnerable to adversarial perturbations, while existing attack methods mainly follow the idea of attacking image classification models. We argue that image segmentation and classification have inherent differences, and design an attack framework specially for image segmentation models. Our goal is to thoroughly explore the vulnerabilities of modern segmentation models, i.e., aiming to misclassify as many pixels as possible under a perturbation budget in both white-box and black-box settings.Our attack framework is inspired by certified radius, which was originally used by defenders to defend against adversarial perturbations to classification models. We are the first, from the attacker perspective, to leverage the properties of certified radius and propose a certified radius guided attack framework against image segmentation models. Specifically, we first adapt randomized smoothing, the state-of-the-art certification method for classification models, to derive the pixel’s certified radius. A larger certified radius of a pixel means the pixel is theoretically more robust to adversarial perturbations. This observation inspires us to focus more on disrupting pixels with relatively smaller certified radii. Accordingly, we design a pixel-wise certified radius guided loss, when plugged into any existing white-box attack, yields our certified radius-guided white-box attack.Next, we propose the first black-box attack to image segmentation models via bandit. A key challenge is no gradient information is available. To address it, we design a novel gradient estimator, based on bandit feedback, which is query-efficient and provably unbiased and stable. We use this gradient estimator to design a projected bandit gradient descent (PBGD) attack. We further use pixels’ certified radii and design a certified radius-guided PBGD (CR-PBGD) attack. We prove our PBGD and CR-PBGD attacks can achieve asymptotically optimal attack performance with an optimal rate. We evaluate our certified-radius guided white-box and black-box attacks on multiple modern image segmentation models and datasets. Our results validate the effectiveness of our certified radius-guided attack framework.
The Peculiar Case of Tailored Phishing against SMEs: Detection and Collective DefenseMechanisms at a Small IT Company

Phishing attacks are increasingly more sophisticated, with attackers exploiting publicly available information on their targets to personalize their attacks. Although an increasing body of research has investigated the effectiveness of tailored phishing campaigns, researchers have primarily focused on large enterprises. Company size, composition, and resource availability (e.g., of security experts or a phishing response team handling incidents) play an important role in the studied dynamics. However, whether the same also applies to small and medium-sized enterprises (SMEs), which typically do not have those resources, is unclear. On the other hand, studying SME security is hard as they generally have no expertise in-house to run the required experiments. This work provides a first study filling this gap by investigating the effectiveness of tailored phishing campaigns against an SME IT company in Europe. To this end, we conducted a field experiment targeting 30 employees at an SME and, subsequently, interviewed nine employees to understand the cognitive processes underlying the detection and response of our phishing campaign as well as the group defense mechanisms at the SME. Our findings show that expectation mismatch was the primary method for detecting our phishing email and that the collective defense mechanism enabled a surprisingly prompt response and containment of the attack, possibly, due to the network dynamics of a small company.