waashk/dblp huggingface dataset:
reflections on the 30th anniversary of the ieee symposium on security and privacy. this article is a retrospective of concepts and people who have contributed significantly to the ieee symposium on security and privacy over the past 30 years.
chip and pin is broken. emv is the dominant protocol used for smart card payments worldwide, with over 730 million cards in circulation. known to bank customers as “chip and pin”, it is used in europe; it is being introduced in canada; and there is pressure from banks to introduce it in the usa too. emv secures credit and debit card transactions by authenticating both the card and the customer presenting it through a combination of cryptographic authentication codes, digital signatures, and the entry of a pin. in this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s pin, and to remain undetected even when the merchant has an online connection to the banking network. the fraudster performs a man-in-the-middle attack to trick the terminal into believing the pin verified correctly, while telling the card that no pin was entered at all. the paper considers how the flaws arose, why they remained unknown despite emv’s wide deployment for the best part of a decade, and how they might be fixed. because we have found and validated a practical attack against the core functionality of emv, we conclude that the protocol is broken. this failure is significant in the field of protocol design, and also has important public policy implications, in light of growing reports of fraud on stolen emv cards. frequently, banks deny such fraud victims a refund, asserting that a card cannot be used without the correct pin, and concluding that the customer must be grossly negligent or lying. our attack can explain a number of these cases, and exposes the need for further research to bridge the gap between the theoretical and practical security of bank payment systems. it also demonstrates the need for the next version of emv to be engineered properly.
overcoming an untrusted computing base: detecting and removing malicious hardware automatically. the computer systems security arms race between attackers and defenders has largely taken place in the domain of software systems, but as hardware complexity and design processes have evolved, novel and potent hardware-based security threats are now possible. this paper presents a hybrid hardware/software approach to defending against malicious hardware. we propose bluechip, a defensive strategy that has both a design-time component and a runtime component. during the design verification phase, bluechip invokes a new technique, unused circuit identification (uci), to identify suspicious circuitry—those circuits not used or otherwise activated by any of the design verification tests. bluechip removes the suspicious circuitry and replaces it with exception generation hardware. the exception handler software is responsible for providing forward progress by emulating the effect of the exception generating instruction in software, effectively providing a detour around suspicious hardware. in our experiments, bluechip is able to prevent all hardware attacks we evaluate while incurring a small runtime overhead. the acm portal is published by the association for computing machinery. copyright © 2010 acm, inc. terms of usage privacy policy code of ethics contact us useful downloads: adobe acrobat quicktime windows media player real player
all you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask). dynamic taint analysis and forward symbolic execution are quickly becoming staple techniques in security analyses. example applications of dynamic taint analysis and forward symbolic execution include malware analysis, input filter generation, test case generation, and vulnerability discovery. despite the widespread usage of these two techniques, there has been little effort to formally define the algorithms and summarize the critical issues that arise when these techniques are used in typical security contexts. the contributions of this paper are two-fold. first, we precisely describe the algorithms for dynamic taint analysis and forward symbolic execution as extensions to the run-time semantics of a general language. second, we highlight important implementation choices, common pitfalls, and considerations when using these techniques in a security context.
taintscope: a checksum-aware directed fuzzing tool for automatic software vulnerability detection. fuzz testing has proven successful in finding security vulnerabilities in large programs. however, traditional fuzz testing tools have a well-known common drawback: they are ineffective if most generated malformed inputs are rejected in the early stage of program running, especially when target programs employ checksum mechanisms to verify the integrity of inputs. in this paper, we present taintscope, an automatic fuzzing system using dynamic taint analysis and symbolic execution techniques, to tackle the above problem. taintscope has several novel contributions: 1) taintscope is the first checksum-aware fuzzing tool to the best of our knowledge. it can identify checksum fields in input instances, accurately locate checksum-based integrity checks by using branch profiling techniques, and bypass such checks via control flow alteration. 2) taintscope is a directed fuzzing tool working at x86 binary level (on both linux and window). based on fine-grained dynamic taint tracing, taintscope identifies which bytes in a well-formed input are used in security-sensitive operations (e.g., invoking system/library calls) and then focuses on modifying such bytes. thus, generated inputs are more likely to trigger potential vulnerabilities. 3) taintscope is fully automatic, from detecting checksum, directed fuzzing, to repairing crashed samples. it can fix checksum values in generated inputs using combined concrete and symbolic execution techniques. we evaluate taintscope on a number of large real-world applications. experimental results show that taintscope can accurately locate the checksum checks in programs and dramatically improve the effectiveness of fuzz testing. taintscope has already found 27 previously unknown vulnerabilities in several widely used applications, including adobe acrobat, google picasa, microsoft paint, and imagemagick. most of these severe vulnerabilities have been confirmed by secunia and ocert, and assigned cve identifiers (such as cve-2009-1882, cve-2009-2688). corresponding patches from vendors are released or in progress based on our reports.
round-efficient broadcast authentication protocols for fixed topology classes. we consider resource-constrained broadcast authentication for $n$ receivers in a static, known network topology. there are only two known broadcast authentication protocols that do not use asymmetric cryptography, one-time signatures, multi-receiver macs, or time synchronization [1], [2]. both these protocols require three passes of a message front traversing the network. we investigate whether this amount of interaction can be improved efficiently for specific common topology classes, namely, linear topologies, tree topologies and fully connected topologies. we show modifications to the protocols allowing them to complete in just two passes in the linear and fully connected cases with a small constant factor increase in per-node communication overhead, and a further optimization that achieves the equivalent of just a single pass in the linear case with $o(\log n)$ increase in per-node communication overhead. we also prove new lower bounds for round complexity, or the maximum number of consecutive interactions in a protocol. we show that protocols with efficient per-node communication overhead (polylogarithmic in $n$) must require at least $2\log n$ rounds in any topology; this implies that our two-pass protocol in the fully-connected topology requires the fewest possible passes, and this bound is asymptotically tight for the full-duplex communication model. furthermore, we show that communication-efficient protocols must take asymptotically more than $2\log n$ rounds on trees; this implies that that there are some tree topologies for which two passes do not suffice and the existing three-pass algorithms may be optimal.
identifying dormant functionality in malware programs. to handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. to mitigate this issue, previous work introduced techniques such as multi-path or forced execution to increase the coverage of dynamic malware analysis. unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. in this paper, we propose reanimator, a novel solution to determine the capabilities (malicious functionality) of malware programs. our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. more precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. we then leverage these models to check whether similar code is present in other samples. this allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. we evaluate our approach on thousands of real-world malware samples, and we show that our system is successful in identifying additional, malicious functionality. as a result, our approach can significantly improve the coverage of malware analysis results.
investigation of triangular spamming: a stealthy and efficient spamming technique. spam is increasingly accepted as a problem associated with compromised hosts or email accounts. this problem not only makes the tracking of spam sources difficult but also enables a massive amount of illegitimate or unwanted emails to be disseminated quickly. various attempts have been made to analyze, backtrack, detect, and prevent spam using both network as well as content characteristics. however, relatively less attention has been given to understanding how spammers actually carry out their spamming activities from a network angle. spammers’ network behavior has significant impact on spammers’ common goal, sending spam in a stealthy and efficient manner. our work thoroughly investigates a fairly unknown spamming technique we name as triangular spamming that exploits routing irregularities of spoofed ip packets. it is highly stealthy and efficient in that triangular spamming enables 1) exploiting bandwidth diversity of botnet hosts to carry out spam campaigns effectively without divulging precious high-bandwidth hosts and 2) bypassing the current smtp traffic blocking policies. despite its relative obscurity, its use has been confirmed by the network operator community. through carefully devised probing techniques and actual deployment of triangular spamming on planetlab (a wide-area distributed testbed), we investigate the feasibility, impact of triangular spamming and propose practical detection and prevention methods. from our probing experiments, we found that 97% of the networks which block outbound smtp traffic are vulnerable to triangular spamming and only 44% of them are listed on spamhaus policy blocking list (pbl). the acm portal is published by the association for computing machinery. copyright © 2010 acm, inc. terms of usage privacy policy code of ethics contact us useful downloads: adobe acrobat quicktime windows media player real player
a practical attack to de-anonymize social network users. social networking sites such as facebook, linkedin, and xing have been reporting exponential growth rates and have millions of registered users. in this paper, we introduce a novel de-anonymization attack that exploits group membership information that is available on social networking sites. more precisely, we show that information about the group memberships of a user (i.e., the groups of a social network to which a user belongs) is sufficient to uniquely identify this person, or, at least, to significantly reduce the set of possible candidates. that is, rather than tracking a user's browser as with cookies, it is possible to track a person. to determine the group membership of a user, we leverage well-known web browser history stealing attacks. thus, whenever a social network user visits a malicious website, this website can launch our de-anonymization attack and learn the identity of its visitors. the implications of our attack are manifold, since it requires a low effort and has the potential to affect millions of social networking users. we perform both a theoretical analysis and empirical measurements to demonstrate the feasibility of our attack against xing, a medium-sized social network with more than eight million members that is mainly used for business relationships. furthermore, we explored other, larger social networks and performed experiments that suggest that users of facebook and linkedin are equally vulnerable. the acm portal is published by the association for computing machinery. copyright © 2010 acm, inc. terms of usage privacy policy code of ethics contact us useful downloads: adobe acrobat quicktime windows media player real player
reconciling belief and vulnerability in information flow. belief and vulnerability have been proposed recently to quantify information flow in security systems. both concepts stand as alternatives to the traditional approaches founded on shannon entropy and mutual information, which were shown to provide inadequate security guarantees. in this paper we unify the two concepts in one model so as to cope with (potentially inaccurate) attackers' extra knowledge. to this end we propose a new metric based on vulnerability that takes into account the adversary's beliefs.
authenticating primary users' signals in cognitive radio networks via integrated cryptographic and wireless link signatures. to address the increasing demand for wireless bandwidth, cognitive radio networks (crns) have been proposed to increase the efficiency of channel utilization; they enable the sharing of channels among secondary (unlicensed) and primary (licensed) users on a non-interference basis. a secondary user in a crn should constantly monitor for the presence of a primary user's signal to avoid interfering with the primary user. however, to gain unfair share of radio channels, an attacker (e.g., a selfish secondary user) may mimic a primary user's signal to evict other secondary users. therefore, a secure primary user detection method that can distinguish a primary user's signal from an attacker's signal is needed. a unique challenge in addressing this problem is that federal communications commission (fcc) prohibits any modification to primary users. consequently, existing cryptographic techniques cannot be used directly. in this paper, we develop a novel approach for authenticating primary users' signals in crns, which conforms to fcc's requirement. our approach integrates cryptographic signatures and wireless link signatures (derived from physical radio channel characteristics) to enable primary user detection in the presence of attackers. essential to our approach is a {\em helper node} placed physically close to a primary user. the helper node serves as a "bridge" to enable a secondary user to verify cryptographic signatures carried by the helper node's signals and then obtain the helper node's authentic link signatures to verify the primary user's signals. a key contribution in our paper is a novel physical layer authentication technique that enables the helper node to authenticate signals from its associated primary user. unlike previous techniques for link signatures, our approach explores the geographical proximity of the helper node to the primary user, and thus does not require any training process.
hypersafe: a lightweight approach to provide lifetime hypervisor control-flow integrity. virtualization is being widely adopted in today’s computing systems. its unique security advantages in isolating and introspecting commodity oses as virtual machines (vms) have enabled a wide spectrum of applications. however, a common, fundamental assumption is the presence of a trustworthy hypervisor. unfortunately, the large code base of commodity hypervisors and recent successful hypervisor attacks (e.g., vm escape) seriously question the validity of this assumption. in this paper, we present hypersafe, a lightweight approach that endows existing type-i bare-metal hypervisors with a unique self-protection capability to provide lifetime control flow integrity. specifically, we propose two key techniques. the first one, non-bypassable memory lockdown, reliably protects the hypervisor’s code and static data from being compromised even in the presence of exploitable memory corruption bugs (e.g., buffer overflows), therefore successfully providing hypervisor code integrity. the second one, restricted pointer indexing, introduces one layer of indirection to convert the control data into pointer indexes. these pointer indexes are restricted such that the corresponding call/return targets strictly follow the hypervisor control flow graph, hence expanding protection to control-flow integrity. we have built a prototype and used it to protect two open-source type-i hypervisors: bitvisor and xen. the experimental results with synthetic hypervisor exploits and benchmarking programs show hypersafe can reliably enable the hypervisor self-protection and provide the integrity guarantee with a small performance overhead.
how good are humans at solving captchas? a large scale evaluation. captchas are designed to be easy for humans but hard for machines. however, most recent research has focused only on making them hard for machines. in this paper, we present what is to the best of our knowledge the first large scale evaluation of captchas from the human perspective, with the goal of assessing how much friction captchas present to the average user. for the purpose of this study we have asked workers from amazon’s mechanical turk and an underground captchabreaking service to solve more than 318 000 captchas issued from the 21 most popular captcha schemes (13 images schemes and 8 audio scheme). analysis of the resulting data reveals that captchas are often difficult for humans, with audio captchas being particularly problematic. we also find some demographic trends indicating, for example, that non-native speakers of english are slower in general and less accurate on english-centric captcha schemes. evidence from a week’s worth of ebay captchas (14,000,000 samples) suggests that the solving accuracies found in our study are close to real-world values, and that improving audio captchas should become a priority, as nearly 1% of all captchas are delivered as audio rather than images. finally our study also reveals that it is more effective for an attacker to use mechanical turk to solve captchas than an underground service.
bootstrapping trust in commodity computers. trusting a computer for a security-sensitive task (such as checking email or banking online) requires the user to know something about the computer's state. we examine research on securely capturing a computer's state, and consider the utility of this information both for improving security on the local computer (e.g., to convince the user that her computer is not infected with malware) and for communicating a remote computer's state (e.g., to enable the user to check that a web server will adequately protect her data). although the recent "trusted computing" initiative has drawn both positive and negative attention to this area, we consider the older and broader topic of bootstrapping trust in a computer. we cover issues ranging from the wide collection of secure hardware that can serve as a foundation for trust, to the usability issues that arise when trying to convey computer state information to humans. this approach unifies disparate research efforts and highlights opportunities for additional work that can guide real-world improvements in computer security.
object capabilities and isolation of untrusted web applications. a growing number of current web sites combine active content (applications) from untrusted sources, as in so-called mashups. the object-capability model provides an appealing approach for isolating untrusted content: if separate applications are provided disjoint capabilities, a sound object-capability framework should prevent untrusted applications from interfering with each other, without preventing interaction with the user or the hosting page. in developing language-based foundations for isolation proofs based on object-capability concepts, we identify a more general notion of authority safety that also implies resource isolation. after proving that capability safety implies authority safety, we show the applicability of our framework for a specific class of mashups. in addition to proving that a javascript subset based on google caja is capability safe, we prove that a more expressive subset of javascript is authority safe, even though it is not based on the object-capability model.
experimental security analysis of a modern automobile. modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. while this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks. in this paper we experimentally evaluate these issues on a modern automobile and demonstrate the fragility of the underlying system structure. we demonstrate that an attacker who is able to infiltrate virtually any electronic control unit (ecu) can leverage this ability to completely circumvent a broad array of safety-critical systems. over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input\dash including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. we find that it is possible to bypass rudimentary network security protections within the car, such as maliciously bridging between our car's two internal subnets. we also present composite attacks that leverage individual weaknesses, including an attack that embeds malicious code in a car's telematics unit and that will completely erase any evidence of its presence after a crash. looking forward, we discuss the complex challenges in addressing these vulnerabilities while considering the existing automotive ecosystem.