waashk/dblp huggingface dataset:
saner: composing static and dynamic analysis to validate sanitization in web applications. web applications are ubiquitous, perform mission-critical tasks, and handle sensitive user data. unfortunately, web applications are often implemented by developers with limited security skills, and, as a result, they contain vulnerabilities. most of these vulnerabilities stem from the lack of input validation. that is, web applications use malicious input as part of a sensitive operation, without having properly checked or sanitized the input values prior to their use.past research on vulnerability analysis has mostly focused on identifying cases in which a web application directly uses external input in critical operations. however, little research has been performed to analyze the correctness of the sanitization process. thus, whenever a web application applies some sanitization routine to potentially malicious input, the vulnerability analysis assumes that the result is innocuous. unfortunately, this might not be the case, as the sanitization process itself could be incorrect or incomplete.in this paper, we present a novel approach to the analysis of the sanitization process. more precisely, we combine static and dynamic analysis techniques to identify faultysanitization procedures that can be bypassed by an attacker. we implemented our approach in a tool, called saner, and we applied it to a number of real-world applications. our results demonstrate that we were able to identify several novel vulnerabilities that stem from erroneous sanitization procedures.
clearshot: eavesdropping on keyboard input from video. eavesdropping on electronic communication is usually prevented by using cryptography-based mechanisms. however, these mechanisms do not prevent one from obtaining private information through side channels, such as the electromagnetic emissions of monitors or the sound produced by keyboards. while extracting the same information by watching somebody typing on a keyboard might seem to be an easy task, it becomes extremely challenging if it has to be automated. however, an automated tool is needed in the case of long-lasting surveillance procedures or long user activity, as a human being is able to reconstruct only a few characters per minute. this paper presents a novel approach to automatically recovering the text being typed on a keyboard, based solely on a video of the user typing. as part of the approach, we developed a number of novel techniques for motion tracking, sentence reconstruction, and error correction. the approach has been implemented in a tool, called clearshot, which has been tested in a number of realistic settings where it was able to reconstruct a substantial part of the typed information.
predictable design of network-based covert communication systems. this paper presents a predictable and quantifiable approach to designing a covert communication system capable of effectively exploiting covert channels found in the various layers of network protocols. two metrics are developed that characterize the overall system. a measure of probability of detection is derived using statistical inference techniques. a measure of reliability is developed as the bit error rate of the combined noisy channel and an appropriate error-correcting code. to support reliable communication, a family of error-correcting codes are developed that handle the high symbol insertion rates found in these covert channels. the system metrics are each shown to be a function of the covert channel signal-to-noise ratio, and as such the two can be used to perform system level design trade-offs. validation of the system design methodology is provided by means of an experiment using real network traffic data.
preserving caller anonymity in voice-over-ip networks. applications such as voip need to provide anonymity to clients while maintaining low latency to satisfy quality of service (qos) requirements. existing solutions for providing anonymity such as mix networks are not well suited to applications like voip, ssh, and gaming which require low communication latency. this paper investigates the problem of on-demand construction of qos sensitive routes on anonymizing networks using the voip application. we first describe triangulation based timing analysis attacks on shortest path route set up protocols. we show that even when a small fraction (sim1) of the network is malicious, the adversary can infer the source (caller) with reasonably high probability. second, we describe random walk based route set up protocols that significantly improve anonymity while satisfying latency-based qos guarantees. we describe a prototype implementation of our proposal and show that our protocols can significantly reduce the probability of inferring the caller. we present a detailed experimental evaluation to demonstrate our attacks and quantify the performance and scalability of our guards.
practical proactive integrity preservation: a basis for malware defense. unlike today's reactive approaches, information flow based approaches can provide positive assurances about overall system integrity, and hence can defend against sophisticated malware. however, there hasn't been much success in applying information flow based techniques to desktop systems running modern cots operating systems. this is, in part, due to the fact that a strict application of information flow policy can break existing applications and os services. another important factor is the difficulty of policy development, which requires us to specify integrity labels for hundreds of thousands of objects on the system. this paper develops a new approach for proactive integrity protection that overcomes these challenges by decoupling integrity labels from access policies. we then develop an analysis that can largely automate the generation of integrity labels and policies that preserve the usability of applications in most cases. evaluation of our prototype implementation on a linux desktop distribution shows that it does not break or inconvenience the use of most applications, while stopping a variety of sophisticated malware attacks.
thinking inside the box: system-level failures of tamper proofing. pin entry devices (peds) are critical security components in emv smartcard payment systems as they receive a customer's card and pin. their approval is subject to an extensive suite of evaluation and certification procedures. in this paper, we demonstrate that the tamper proofing of peds is unsatisfactory, as is the certification process. we have implemented practical low-cost attackson two certified, widely-deployed peds -- the ingenico i3300 and the dionextreme. by tapping inadequately protected smartcard communications, an attacker with basic technical skills can expose card details and pins, leaving cardholders open to fraud. we analyze the anti-tampering mechanisms of the two peds and show that, while the specific protection measures mostly work as intended, critical vulnerabilities arise because of the poor integration of cryptographic, physical and procedural protection. as these vulnerabilities illustrate a systematic failure in the design process, we propose a methodology for doing it better in the future. these failures also demonstrate a serious problem with the common criteria. so we discuss the incentive structures of the certification process, and show how they can lead to problems of the kind we identified. finally, we recommend changes to the common criteria framework in light of the lessons learned.
spot me if you can: uncovering spoken phrases in encrypted voip conversations. despite the rapid adoption of voice over ip (voip), its security implications are not yet fully understood. since voip calls may traverse untrusted networks, packets should be encrypted to ensure confidentiality. however, we show that when the audio is encoded using variable bit rate codecs, the lengths of encrypted voip packets can be used to identify the phrases spoken within a call. our results indicate that a passive observer can identify phrases from a standard speech corpus within encrypted calls with an average accuracy of 50%, and with accuracy greater than 90% for some phrases. clearly, such an attack calls into question the efficacy of current voip encryption standards. in addition, we examine the impact of various features of the underlying audio on our performance and discuss methods for mitigation.
compromising reflections-or-how to read lcd monitors around the corner. we present a novel eavesdropping technique for spying at a distance on data that is displayed on an arbitrary computer screen, including the currently prevalent lcd monitors. our technique exploits reflections of the screen's optical emanations in various objects that one commonly finds in close proximity to the screen and uses those reflections to recover the original screen content. such objects include eyeglasses, tea pots, spoons, plastic bottles, and even the eye of the user. we have demonstrated that this attack can be successfully mounted to spy on even small fonts using inexpensive, off-the-shelf equipment (less than 1500 dollars) from a distance of up to 10 meters. relying on more expensive equipment allowed us to conduct this attack from over 30 meters away, demonstrating that similar attacks are feasible from the other side of the street or from a close-by building. we additionally establish theoretical limitations of the attack; these limitations may help to estimate the risk that this attack can be successfully mounted in a given environment.
zero-knowledge in the applied pi-calculus and automated verification of the direct anonymous attestation protocol. we devise an abstraction of zero-knowledge protocols that is accessible to a fully mechanized analysis. the abstraction is formalized within the applied pi-calculus using a novel equational theory that abstractly characterizes the cryptographic semantics of zero-knowledge proofs. we present an encoding from the equational theory into a convergent rewriting system that is suitable for the automated protocol verifier proverif. the encoding is sound and fully automated. we successfully used proverif to obtain the first mechanized analysis of (a simplified variant of) the direct anonymous attestation (daa) protocol. this required us to devise novel abstractions of sophisticated cryptographic security definitions based on interactive games. the analysis reported a novel attack on daa that was overlooked in its existing cryptographic security proof. we propose a revised variant of daa that we successfully prove secure using proverif.
xfa: faster signature matching with extended automata. automata-based representations and related algorithms have been applied to address several problems in information security, and often the automata had to be augmented with additional information. for example, extended finite-state automata (efsa) augment finite-state automata (fsa) with variables to track dependencies between arguments of system calls. in this paper, we introduce extended finite automata (xfas) which augment fsas with finite scratch memory and instructions to manipulate this memory. our primary motivation for introducing xfas is signature matching innetwork intrusion detection systems (nids). representing nids signatures as deterministic finite-state automata (dfas) results in very fast signature matching but for several classes of signatures dfas can blowup in space. using nondeterministic finite-state automata (nfa) to represent nids signatures results in a succinct representation but at the expense of higher time complexity for signature matching. in other words, dfas are time-efficient but space-inefficient, and nfas are space-efficient but time-inefficient. in our experiments we have noticed that for a large class of nids signatures xfas have time complexity similar to dfas and space complexity similar to nfas. for our test set, xfas use 10 timesless memory than a dfa-based solution, yet achieve 20 times higher matching speeds.
fable: a language for enforcing user-defined security policies. this paper presents fable, a core formalism for a programming language in which programmers may specify security policies and reason that these policies are properly enforced. in fable, security policies can be expressed by associating security labels with the data or actions they protect. programmers define the semantics of labels in a separate part of the program called the enforcement policy. fable prevents a policy from being circumvented by allowing labeled terms to be manipulated only within the enforcement policy; application code must treat labeled values abstractly. together, these features facilitate straightforward proofs that programs implementing a particular policy achieve their high-level security goals. fable is flexible enough to implement a wide variety of security policies, including access control, information flow, provenance, and security automata. we have implemented fable as part of the links web programming language; we call the resulting language selinks. we report on our experience using selinks to build two substantial applications, a wiki and an on-line store, equipped with a combination of access control and provenance policies. to our knowledge, no existing framework enables the enforcement of such a wide variety of security policies with an equally high level of assurance.
anonymous networking with minimum latency in multihop networks. the problem of security against timing based traffic analysis in multihop networks is considered in this work. in particular, the relationship between the level of anonymity provided and the quality of service, as measured by network latency, is analyzed theoretically. using an information theoretic measure of anonymity of routes in eavesdropped networks is considered, and packet scheduling strategies are designed to guarantee any desired level of anonymity. in particular, for individual relays, scheduling strategies based on mixing are designed so that the incoming and outgoing transmission epochs do not reveal any information. the proposed strategies utilize a limited fraction of dummy transmissions, and a significant reduction in packet latency at individual relays is demonstrated analytically for poisson distributed arrivals. to minimize overall network latency, a randomized selection strategy is considered to choose the set of relays that use the designed scheduling strategies. the random selection is optimized for the desired level of anonymity using a well known distortion rate optimization in information theory. the tradeoff between overall network latency and anonymity in the network is characterized for centralized and decentralized scheduling strategies.
civitas: toward a secure voting system. civitas is the first electronic voting system that is coercion-resistant, universally and voter verifiable, and suitable for remote voting. this paper describes the design and implementation of civitas. assurance is established in the design through security proofs, and in the implementation through information-flow security analysis. experimental results give a quantitative evaluation of the tradeoffs between time, cost, and security.
lares: an architecture for secure active monitoring using virtualization. host-based security tools such as anti-virus and intrusion detection systems are not adequately protected on today's computers. malware is often designed to immediately disable any security tools upon installation, rendering them useless. while current research has focused on moving these vulnerable security tools into an isolated virtual machine, this approach cripples security tools by preventing them from doing active monitoring. this paper describes an architecture that takes a hybrid approach, giving security tools the ability to do active monitoring while still benefiting from the increased security of an isolated virtual machine. we discuss the architecture and a prototype implementation that can process hooks from a virtual machine running windows xp on xen. we conclude with a security analysis and show the performance of a single hook to be 28 microseconds in the best case.
automatic patch-based exploit generation is possible: techniques and implications. the automatic patch-based exploit generation problem is: given a program p and a patched version of the program p, automatically generate an exploit for the potentially unknown vulnerability present in p but fixed in p. in this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for 5 microsoft programs based upon patches provided via windows update. although our techniques may not work in all cases, a fundamental tenant of security is to conservatively estimate the capabilities of attackers. thus, our results indicate that automatic patch-based exploit generation should be considered practical. one important security implication of our results is that current patch distribution schemes which stagger patch distribution over long time periods, such as windows update, may allow attackers who receive the patch first to compromise the significant fraction of vulnerable hosts who have not yet received the patch.
partial security policies to support timeliness in secure real-time databases. conflicts in database systems with both real-time and security requirements can be unresolvable. we address this issue by allowing a database system to provide partial security in order to improve real-time performance when necessary. systems that are partially secure allow potential security violations such as covert channel use at certain situations. we present the idea of requirement specification that enables the system designer to specify important properties of the database at an appropriate level. to help the designer, a tool can process the database specification to find unresolvable conflicts, and to allow the designer to specify the rules to follow during execution when those conflicts arise. we discuss several partial security policies and compare their performance in terms of timeliness and potential security violations.
a new quantum lower bound method, : with applications to direct product theorems and time-space tradeoffs. we give a new version of the adversary method for proving lower bounds on quantum query algorithms. the new method is based on analyzing the eigenspace structure of the problem at hand. we use it to prove a new and optimal strong direct product theorem for 2-sided error quantum algorithms computing k independent instances of a symmetric boolean function: if the algorithm uses significantly less than k times the number of queries needed for one instance of the function, then its success probability is exponentially small in k. we also use the polynomial method to prove a direct product theorem for 1-sided error algorithms for k threshold functions with a stronger bound on the success probability. finally, we present a quantum algorithm for evaluating solutions to systems of linear inequalities, and use our direct product theorems to show that the time-space tradeoff of this algorithm is close to optimal.
constant factor approximation of vertex-cuts in planar graphs. we devise the first constant factor approximation algorithm for minimum quotient vertex-cuts in planar graphs. our algorithm achieves approximation ratio 1+4/3(1+ε) with running time o(w• n3+2/ε), where w is the total weight of the vertices. the approximation ratio improves to 4/3(1+ε+o(1)) if there is an optimal quotient vertex-cut (a*,b*,c*) where the weight of c* is of low order compared to those of a* and b*; this holds, for example, when the input graph has uniform weights and costs. the ratio further improves to 1+ε+o(1) if, in addition, min[w(a*),w(b*)] ≤ 1/3 w.we use our algorithm for quotient vertex-cuts to achieve the first constant-factor pseudo-approximation for vertex separators in planar graphs.our technical contribution is two-fold. first, we prove a structural theorem for planar graphs, showing the existence of a near-optimal quotient vertex-cut whose high-level structure is that of a bounded-depth tree. second, we develop an algorithm that optimizes over such complex structures in running time that depends (exponentially) not on the size of the structure, but rather only on its depth. these techniques may be applicable in other problems.
a unifying framework for the theory of iterative arrays of machines a mathematical framework is defined in which many questions concerning uniform arrays of finite-state machines can be formulated and studied. an outline is then presented that informally describes some research areas that have been under investigation. some of the results uncovered to date are described and many open problems are stated.
the care and feeding of lr(k) grammars we consider methods of modifying lr(k) parsers [1] while preserving the ability of that parsing method to detect errors at the earliest possible point on the input. two transformations are developed, and the methods of korenjak [2] and deremer [3] are expressed in terms of these transformations. the relation between these two methods is exposed. proofs are for the most part omitted, but can be found in [4].
quantum lower bound for the collision problem. (math) the collision problem is to decide whether a function x: { 1,&ldots;,n} &rarr; { 1, &ldots;,n} is one-to-one or two-to-one, given that one of these is the case. we show a lower bound of &omega;(n1/5) on the number of queries needed by a quantum computer to solve this problem with bounded error probability. the best known upper bound is o(n1/3), but obtaining any lower bound better than &omega;(1) was an open problem since 1997. our proof uses the polynomial method augmented by some new ideas. we also give a lower bound of &omega;(n1/7) for the problem of deciding whether two sets are equal or disjoint on a constant fraction of elements. finally we give implications of these results for quantum complexity theory.
a technique for speeding up lr(k) parsers we present a new transformation that reduces the size and increases the speed of lr(k) parsers. this transformation can be applied to all lr(k) parsers including those produced by knuth's and deremer's techniques. the transformation causes the parser to avoid reductions by productions of the form a &ran; b where a and b are non-terminals.
multilinear formulas and skepticism of quantum computing. several researchers, including leonid levin, gerard 't hooft, and stephen wolfram, have argued that quantum mechanics will break down before the factoring of large numbers becomes possible. if this is true, then there should be a natural set of quantum states that can account for all quantum computing experiments performed to date, but not for shor's factoring algorithm. we investigate as a candidate the set of states expressible by a polynomial number of additions and tensor products. using a recent lower bound on multilinear formula size due to raz, we then show that states arising in quantum error-correction require nω(log n) additions and tensor products even to approximate, which incidentally yields the first superpolynomial gap between general and multilinear formula size of functions. more broadly, we introduce a complexity classification of pure quantum states, and prove many basic facts about this classification. our goal is to refine vague ideas about a breakdown of quantum mechanics into specific hypotheses that might be experimentally testable in the near future.
node listings for reducible flow graphs in [1], kennedy conjectures that for every n node reducible flow graph, there is a sequence of nodes (with repetitions) of length o(nlogn) such that all acyclic paths are subsequences thereof. such a sequence would, if it could be found easily, enable one to do various kinds of global data flow analyses quickly. we show that for all reducible flow graphs such a sequence does exist, even if the number of edges is much larger than n. if the number of edges is o(n), the node listing can be found in o(nlogn) time.