waashk/dblp huggingface dataset:
cryptanalysis of a cognitive authentication scheme (extended abstract). we present attacks against two cognitive authentication schemes [9] proposed at the 2006 ieee symposium on security and privacy. these authentication schemes are designed to be secure against eavesdropping attacks while relying only on human cognitive skills. they achieve authentication via challenge response protocols based on a shared secret set of pictures. our attacks use a sat solver to recover a user's secret key in a few seconds, after observing only a small number of successful logins. these attacks demonstrate that the authentication schemes of [9] are not secure against an eavesdropping adversary.
usable mandatory integrity protection for operating systems. existing mandatory access control systems for operating systems are difficult to use. we identify several principles for designing usable access control systems and introduce the usable mandatory integrity protection (umip) model that adds usable mandatory access control to operating systems. the umip model is designed to preserve system integrity in the face of network-based attacks. the usability goals for umip are twofold. first, configuring a umip system should not be more difficult than installing and configuring an operating system. second, existing applications and common usage practices can still be used under umip. umip has several novel features to achieve these goals. for example, it introduces several concepts for expressing partial trust in programs. furthermore, it leverages information in the existing discretionary access control mechanism to derive file labels for mandatory integrity protection. we also discuss our implementation of the umip model for linux using the linux security modules framework, and show that it is simple to configure, has low overhead, and effectively defends against a number of network-based attacks.
minimal tcb code execution. we propose an architecture that allows code to execute in complete isolation from other software while trusting only a tiny software base that is orders of magnitude smaller than even minimalist virtual machine monitors. our technique also enables more meaningful attestation than previous proposals, since only measurements of the security-sensitive portions of an application need to be included. we achieve these guarantees by leveraging hardware support provided by commodity processors from amd and intel that are shipping today.
a systematic approach to uncover security flaws in gui logic. to achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the human-computer interface is compromised. gui logic flaws are a category of software vulnerabilities that result from logic bugs in gui design/implementation. visual spoofing attacks that exploit these flaws can lure even securityconscious users to perform unintended actions. the focus of this paper is to formulate the problem of gui logic flaws and to develop a methodology for uncovering them in software implementations. specifically, based on an in-depth study of key subsets of internet explorer (ie) browser source code, we have developed a formal model for the browser gui logic and have applied formal reasoning to uncover new spoofing scenarios, including nine for status bar spoofing and four for address bar spoofing. the ie development team has confirmed all these scenarios and has fixed most of them in their latest build. through this work, we demonstrate that a crucial subset of visual spoofing vulnerabilities originate from gui logic flaws, which have a well-defined mathematical meaning allowing a systematic analysis.
beyond stack inspection: a unified access-control and information-flow security model. modern component-based systems, such as java and microsoft .net common language runtime (clr), have adopted stack-based access control (sbac). its purpose is to use stack inspection to verify that all the code responsible for a security-sensitive action is sufficiently authorized to perform that action. previous literature has shown that the security model enforced by sbac is flawed in that stack inspection may allow unauthorized code no longer on the stack to influence the execution of security-sensitive code. a different approach, history-based access control (hbac), is safe but may prevent authorized code from executing a security-sensitive operation if less trusted code was previously executed. in this paper, we formally introduce information-based access control (ibac), a novel security model that verifies that all and only the code responsible for a security-sensitive operation is sufficiently authorized. given an access-control policy á, we present a mechanism to extract from it an implicit integrity policy é, and we prove that ibac enforces é. furthermore, we discuss large-scale application code scenarios to which ibac can be successfully applied.
the emperor's new security indicators. we evaluate website authentication measures that are designed to protect users from man-in-the-middle, "phishing', and other site forgery attacks. we asked 67 bank customers to conduct common online banking tasks. each time they logged in, we presented increasingly alarming clues that their connection was insecure. first, we removed https indicators. next, we removed the participant's site-authentication image-the customer-selected image that many websites now expect their users to verify before entering their passwords. finally, we replaced the bank's password-entry page with a warning page. after each clue, we determined whether participants entered their passwords or withheld them. we also investigate how a study's design affects participant behavior: we asked some participants to play a role and others to use their own accounts and passwords. we also presented some participants with security-focused instructions. we confirm prior findings that users ignore https indicators: no participants withheld their passwords when these indicators were removed. we present the first empirical investigation of site-authentication images, and we find them to be ineffective: even when we removed them, 23 of the 25 (92%) participants who used their own accounts entered their passwords. we also contribute the first empirical evidence that role playing affects participants' security behavior: role-playing participants behaved significantly less securely than those using their own passwords.
multi-dimensional range query over encrypted data. we design an encryption scheme called multi-dimensional range query over encrypted data (mrqed), to address the privacy concerns related to the sharing of network audit logs and various other applications. our scheme allows a network gateway to encrypt summaries of network flows before submitting them to an untrusted repository. when network intrusions are suspected, an authority can release a key to an auditor, allowing the auditor to decrypt flows whose attributes (e.g., source and destination addresses, port numbers, etc.) fall within specific ranges. however, the privacy of all irrelevant flows are still preserved. we formally define the security for mrqed and prove the security of our construction under the decision bilinear diffie-hellman and decision linear assumptions in certain bilinear groups. we study the practical performance of our construction in the context of network audit logs. apart from network audit logs, our scheme also has interesting applications for financial audit logs, medical privacy, untrusted remote storage, etc. in particular, we show that mrqed implies a solution to its dual problem, which enables investors to trade stocks through a broker in a privacypreserving manner.
using rescue points to navigate software recovery. we present a new technique that enables software recovery in legacy applications by retrofitting exception-handling capabilities, error virtualization using rescue points. we introduce the idea of "rescue points" as program locations to which an application can recover its execution in the presence of failures. the use of rescue points reduces the chance of unanticipated execution paths thereby making recovery more robust by mimicking system behavior under controlled error conditions. these controlled error conditions can be thought of as a set erroneous inputs, like the ones used by most quality-assurance teams during software development, designed to stress-test an application. to discover rescue points applications are profiled and monitored during tests that bombard the program with bad/random inputs. the intuition is that by monitoring application behavior during these runs, we gain insight into how programmer-tested program points are used to propagate faults gracefully.
on the optimal communication complexity of multiphase protocols for perfect communication. in the perfectly secure message transmission (psmt) problem, two synchronized non-faulty players (or processors), the sender s and the receiver r are connected by n wires (each of which facilitates 2-way communication); s has a message, represented by a sequence of - elements from a finite field, that he wishes to send to r; after exchanging messages in phases r should correctly obtain s's message, while an adversary listening on and actively controlling any set of t (or less) wires should have no information about s's message. similarly, in the problem of perfect reliable message transmission (prmt), the receiver r should correctly obtain s's message, in spite of the adversary actively controlling any set of t (or less) wires.
a cryptographic decentralized label model. information-flow security policies are an appealing way of specifying confidentiality and integrity policies in information systems. most previous work on language-based security has assumed that programs run in a closed, managed environment and that they use potentially unsafe constructs, such as declassification, to interface to external communication channels, perhaps after encrypting data to preserve its confidentiality. this situation is unsatisfactory for systems that need to communicate over untrusted channels or use untrusted persistent storage, since the connection between the cryptographic mechanisms used in the untrusted environment and the abstract security labels used in the trusted language environment is ad hoc and unclear. this paper addresses this problem in three ways: first, it presents a simple, security-typed language with a novel mechanism called packages that provides an abstract means for creating opaque objects and associating them with security labels; well-typed programs in this language enforce noninterference. second, it shows how to implement these packages using public-key cryptography. this implementation strategy uses a variant of myers and liskov's decentralized label model, which supports a rich label structure in which mutually distrusting data owners can specify independent confidentiality and integrity requirements. third, it demonstrates that this implementation of packages is sound with respect to dolev-yao style attackers such an attacker cannot determine the contents of a package without possessing the appropriate keys, as determined by the security label on the package.
network flow watermarking attack on low-latency anonymous communication systems. many proposed low-latency anonymous communication systems have used various flow transformations such as traffic padding, adding cover traffic (or bogus packets), packet dropping, flow mixing, flow splitting, and flow merging to achieve anonymity. it has long been believed that these flow transformations would effectively disguise network flows, thus achieve good anonymity. in this paper, we investigate the fundamental limitations of flow transformations in achieving anonymity, and we show that flow transformations do not necessarily provide the level of anonymity people have expected or believed. by injecting unique watermark into the inter-packet timing domain of a packet flow, we are able to make any sufficiently long flow uniquely identifiable even if 1) it is disguised by substantial amount of cover traffic, 2) it is mixed or merged with a number of other flows, 3) it is split into a number subflows, 4) there is a substantial portion of packets dropped, and 5) it is perturbed in timing due to either natural network delay jitter or deliberate timing perturbation. in addition to demonstrating the theoretical limitations of low-latency anonymous communications systems, we develop the first practical attack on the leading commercial low-latency anonymous communication system. our real-time experiments show that our flow watermarking attack only needs about 10 minutes activeweb browsing traffic to "penetrate" the total net shield service provided by www.anonymizer.com. our analytical and empirical results demonstrate that achieving anonymity in low-latency communication systems is much harder than we have realized, and current flow transformation based low-latency anonymous communication systems need to be revisited.
dsss-based flow marking technique for invisible traceback. law enforcement agencies need the ability to conduct electronic surveillance to combat crime, terrorism, or other malicious activities exploiting the internet. however, the proliferation of anonymous communication systems on the internet has posed significant challenges to providing such traceback capability. in this paper, we develop a new class of flow marking technique for invisible traceback based on direct sequence spread spectrum (dsss), utilizing a pseudo-noise (pn) code. by interfering with a sender's traffic and marginally varying its rate, an investigator can embed a secret spread spectrum signal into the sender's traffic. the embedded signal is carried along with the traffic from the sender to the receiver, so the investigator can recognize the corresponding communication relationship, tracing the messages despite the use of anonymous networks. the secret pn code makes it difficult for others to detect the presence of such embedded signals, so the traceback, while available to investigators is, effectively invisible. we demonstrate a practical flow marking system which requires no training, and can achieve both high detection and low false positive rates. using a combination of analytical modeling, simulations, and experiments on tor (a popular internet anonymous communication system), we demonstrate the effectiveness of the dsss-based flow marking technique.
on the safety and efficiency of firewall policy deployment. firewall policy management is challenging and error-prone. while ample research has led to tools for policy specification, correctness analysis, and optimization, few researchers have paid attention to firewall policy deployment: the process where a management tool edits a firewall's configuration to make it run the policies specified in the tool. in this paper, we provide the first formal definition and theoretical analysis of safety in firewall policy deployment. we show that naive deployment approaches can easily create a temporary security hole by permitting illegal traffic, or interrupt service by rejecting legal traffic during the deployment. we define safe and most-efficient deployments, and introduce the shuffling theorem as a formal basis for constructing deployment algorithms and proving their safety. we present efficient algorithms for constructing most-efficient deployments in popular policy editing languages. we show that in certain widelyinstalled policy editing languages, a safe deployment is not always possible. we also show how to leverage existing diff algorithms to guarantee a safe, mostefficient, and monotonic deployment in other editing languages.
exploring multiple execution paths for malware analysis. malicious code (or malware) is defined as software that fulfills the deliberately harmful intent of an attacker. malware analysis is the process of determining the behavior and purpose of a given malware sample (such as a virus, worm, or trojan horse). this process is a necessary step to be able to develop effective detection techniques and removal tools. currently, malware analysis is mostly a manual process that is tedious and time-intensive. to mitigate this problem, a number of analysis tools have been proposed that automatically extract the behavior of an unknown program by executing it in a restricted environment and recording the operating system calls that are invoked. the problem of dynamic analysis tools is that only a single program execution is observed. unfortunately, however, it is possible that certain malicious actions are only triggered under specific circumstances (e.g., on a particular day, when a certain file is present, or when a certain command is received). in this paper, we propose a system that allows us to explore multiple execution paths and identify malicious actions that are executed only when certain conditions are met. this enables us to automatically extract a more complete view of the program under analysis and identify under which circumstances suspicious actions are carried out. our experimental results demonstrate that many malware samples show different behavior depending on input read from the environment. thus, by exploring multiple execution paths, we can obtain a more complete picture of their actions.
moats and drawbridges: an isolation primitive for reconfigurable hardware based systems. blurring the line between software and hardware, reconfigurable devices strike a balance between the raw high speed of custom silicon and the post-fabrication flexibility of general-purpose processors. while this flexibility is a boon for embedded system developers, who can now rapidly prototype and deploy solutions with performance approaching custom designs, this results in a system development methodology where functionality is stitched together from a variety of "soft ip cores," often provided by multiple vendors with different levels of trust. unlike traditional software where resources are managed by an operating system, soft ip cores necessarily have very fine grain control over the underlying hardware. to address this problem, the embedded systems community requires novel security primitives which address the realities of modern reconfigurable hardware. we propose an isolation primitive, moats and drawbridges, that are built around four design properties: logical isolation, interconnect traceability, secure reconfigurable broadcast, and configuration scrubbing. each of these is a fundamental operation with easily understood formal properties, yet maps cleanly and efficiently to a wide variety of reconfigurable devices. we carefully quantify the required overheads on real fpgas and demonstrate the utility of our methods by applying them to the practical problem of memory protection.
sybillimit: a near-optimal social network defense against sybil attacks. decentralized distributed systems such as peer-to-peer systems are particularly vulnerable to sybil attacks, where a malicious user pretends to have multiple identities (called sybil nodes). without a trusted central authority, defending against sybil attacks is quite challenging. among the small number of decentralized approaches, our recent sybilguard protocol [42] leverages a key insight on social networks to bound the number of sybil nodes accepted. although its direction is promising, sybilguard can allow a large number of sybil nodes to be accepted. furthermore, sybilguard assumes that social networks are fast mixing, which has never been confirmed in the real world. this paper presents the novel sybillimit protocol that leverages the same insight as sybilguard but offers dramatically improved and near-optimal guarantees. the number of sybil nodes accepted is reduced by a factor of theta(sqrt(n)), or around 200 times in our experiments for a million-node system. we further prove that sybillimit’s guarantee is atmost a log n factor away from optimal, when considering approaches based on fast-mixing social networks. finally, based on three large-scale real-world social networks, we provide the first evidence that real-world social networks are indeed fast mixing. this validates the fundamental assumption behind sybillimit’s and sybilguard’s approach.
verifying the safety of user pointer dereferences. operating systems divide virtual memory addresses into kernel space and user space. the interface of a modern operating system consists of a set of system call procedures that may take pointer arguments called user pointers. it is safe to dereference a user pointer if and only if it points into user space. if the operating system dereferences a user pointer that does not point into user space, then a malicious user application could gain control of the operating system, reveal sensitive data from kernel space, or crash the machine. because the operating system cannot trust user processes, the operating system must check that the user pointer points to user space before dereferencing it. in this paper, we present a scalable and precise static analysis capable of verifying the absence of unchecked user pointer dereferences. we evaluate an implementation of our analysis on the entire linux operating system with over 6.2 million lines of code with false alarms reported on only 0.05% of dereference sites.
secure web browsing with the op web browser. current web browsers are plagued with vulnerabilities, providing hackers with easy access to computer systems via browser-based attacks. browser security efforts that retrofit existing browsers have had limited success because the design of modern browsers is fundamentally flawed. to enable more secure web browsing, we design and implement a new browser, called the op web browser, that attempts to improve the state-of-the-art in browser security. our overall design approach is to combine operating system design principles with formal methods to design a more secure web browser by drawing on the expertise of both communities. our overall design philosophy is to partition the browser into smaller subsystems and make all communication between subsystems simple and explicit. at the core of our design is a small browser kernel that manages the browser subsystems and interposes on all communications between them to enforce our new browser security features. to show the utility of our browser architecture, we design and implement three novel security features. first, we develop novel and flexible security policies that allows us to include plugins within our security framework. our policy removes the burden of security from plugin writers, and gives plugins the flexibility to use innovative network architectures to deliver content while still maintaining the confidentiality and integrity of our browser, even if attackers compromise the plugin. second, we use formal methods to prove that the address bar displayed within our browser user interface always shows the correct address for the current web page. third, we design and implement a browser-level information-flow tracking system to enable post-mortem analysis of browser-based attacks. if an attacker is able to compromise our browser, we highlight the subset of total activity that is causally related to the attack, thus allowing users and system administrator to determine easily which web site lead to the compromise and to assess the damage of a successful attack. to evaluate our design, we implemented op and tested both performance and file system impact. to test performance, we measure latency to verify op's performance penalty from security features will be minimal from a users perspective. our experiments show that on average the speed of the op browser is comparable to firefox and the audit log footprint for the same pages average around 80kb.