Proceedings of the 12th European Workshop on Systems Security最新文献

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312494

Daniele Cono D'Elia, Emilio Coppa, Andrea Salvati, C. Demetrescu

引用次数: 7

Configuration-Driven Software Debloating 配置驱动的软件膨胀

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312501

Hyungjoon Koo, Seyedhamed Ghavamnia, M. Polychronakis

{"title":"Configuration-Driven Software Debloating","authors":"Hyungjoon Koo, Seyedhamed Ghavamnia, M. Polychronakis","doi":"10.1145/3301417.3312501","DOIUrl":"https://doi.org/10.1145/3301417.3312501","url":null,"abstract":"With legitimate code becoming an attack surface due to the proliferation of code reuse attacks, software debloating is an effective mitigation that reduces the amount of instruction sequences that may be useful for an attacker, in addition to eliminating potentially exploitable bugs in the removed code. Existing debloating approaches either statically remove code that is guaranteed to not run (e.g., non-imported functions from shared libraries), or rely on profiling with realistic workloads to pinpoint and keep only the subset of code that was executed. In this work, we explore an alternative configuration-driven software debloating approach that removes feature-specific code that is exclusively needed only when certain configuration directives are specified---which are often disabled by default. Using a semi-automated approach, our technique identifies libraries solely needed for the implementation of a particular functionality and maps them to certain configuration directives. Based on this mapping, feature-specific libraries are not loaded at all if their corresponding directives are disabled. The results of our experimental evaluation with Nginx, VSFTPD, and OpenSSH show that using the default configuration in each case, configuration-driven debloating can remove 77% of the code for Nginx, 53% for VSFTPD, and 20% for OpenSSH, which represent a significant attack surface reduction.","PeriodicalId":125091,"journal":{"name":"Proceedings of the 12th European Workshop on Systems Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130916497","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 51

Forward and Backward Private Searchable Encryption with SGX SGX的向前和向后私有可搜索加密

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312496

Ghous Amjad, S. Kamara, Tarik Moataz

{"title":"Forward and Backward Private Searchable Encryption with SGX","authors":"Ghous Amjad, S. Kamara, Tarik Moataz","doi":"10.1145/3301417.3312496","DOIUrl":"https://doi.org/10.1145/3301417.3312496","url":null,"abstract":"Symmetric Searchable Encryption (SSE) schemes enable users to search over encrypted data hosted on an untrusted server. Recently, there has been a lot of interest in forward and backward private SSE. The notion of forward privacy guarantees that updates to the encrypted structure do not reveal their association to any query made in the past. Backward privacy, on the other hand, guarantees that queries do not reveal their association to deleted documents. But strong backward private schemes are known to be inefficient in terms of both communication and computation. One avenue for improvement is leveraging the power of trusted execution environments such as Intel SGX inside the untrusted server to improve some of these inefficiencies. In this work, we propose the first SGX-supported dynamic SSE constructions that are forward-private as well as backward-private. To the best of our knowledge, while there is some work on SGX-supported Oblivious RAM (ORAM) and static SSE, there is no work on SGX-supported dynamic SSE. We propose three constructions that cover all types of backward privacy in literature that are very efficient compared to the state of the art backward private schemes. Our communication complexity is always the number of current documents matching the query and we show that there is no need for 'total obliviousness' in constructions for the strongest notion of backward privacy.","PeriodicalId":125091,"journal":{"name":"Proceedings of the 12th European Workshop on Systems Security","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125569492","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 46

Pythia: Identifying Dangerous Data-flows in Django-based Applications python:识别基于django的应用程序中的危险数据流

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312497

Linos Giannopoulos, Eirini Degkleri, P. Tsanakas, Dimitris Mitropoulos

{"title":"Pythia: Identifying Dangerous Data-flows in Django-based Applications","authors":"Linos Giannopoulos, Eirini Degkleri, P. Tsanakas, Dimitris Mitropoulos","doi":"10.1145/3301417.3312497","DOIUrl":"https://doi.org/10.1145/3301417.3312497","url":null,"abstract":"Web frameworks that allow developers to create applications based on design patterns such as the Model View Controller (MVC), provide by default a number of security checks. Nevertheless, by using specific constructs, developers may disable these checks thus re-introducing classic application vulnerabilities such as Cross-site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Framework-specific elements including (1) the complex nature of these applications, (2) the different features that they involve (e.g. templates), and (3) the inheritance mechanisms that governs them, make the identification of such issues very difficult. To tackle this problem, we have developed Pythia, a scheme that analyzes applications based on the Django framework. To identify potentially dangerous data flows that can lead to XSS and CSRF defects, Pythia takes into account all the aforementioned elements and employs ideas coming from standard data-flow analysis and taint tracking schemes. To the best of our knowledge, Pythia is the first mechanism to consider framework-specific elements in its analysis. We have evaluated our scheme with positive results. Specifically, we used Pythia to examine five open-source applications that are currently in production and have thousands of users including an e-voting service, and a web-based translation management system. In four cases we have identified dangerous paths that in turn led to vulnerabilities. Notably, in many cases the paths involved the particular features of Django-based applications e.g. templates.","PeriodicalId":125091,"journal":{"name":"Proceedings of the 12th European Workshop on Systems Security","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129055672","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

T-IBE-T: Identity-Based Encryption for Inter-Tile Communication T-IBE-T:基于身份的层间通信加密

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312500

Alexander Würstlein, Wolfgang Schröder-Preikschat

引用次数: 0

Is Privacy possible without Anonymity?: The case for microblogging services 没有匿名就有隐私吗?微博服务的案例

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312498

P. Papadopoulos, A. Papadogiannakis, M. Polychronakis, E. Markatos

{"title":"Is Privacy possible without Anonymity?: The case for microblogging services","authors":"P. Papadopoulos, A. Papadogiannakis, M. Polychronakis, E. Markatos","doi":"10.1145/3301417.3312498","DOIUrl":"https://doi.org/10.1145/3301417.3312498","url":null,"abstract":"Traditional approaches to privacy are usually based on top of anonymizing or pseudonymizing systems. For example, users who would like to protect their identity and/or hide their activities while browsing the web frequently use anonymizing systems (e.g., Tor) or services (e.g., VPNs and proxies). Although anonymizing systems are usually effective, recent revelations suggest that anonymization can be compromised and can be used to provide a false sense of security. In this paper we assume a world where anonymization is (practically) not possible. Imagine, for example, a community where the use of anonymizing systems is frowned upon or even forbidden. Is it possible for users to protect their privacy when they can not hide their identity? In this paper, we focus our question on users interested in following information channels in microblogging services and we show that it is possible for users to protect their privacy even if they can not hide their identity. To do so, we propose two obfuscation-based algorithms and quantify their effectiveness. We show that obfuscation can be used in such a way so that attackers can not use this service to increase their a priori knowledge on whether a user is interested in a channel or not.","PeriodicalId":125091,"journal":{"name":"Proceedings of the 12th European Workshop on Systems Security","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128595353","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Security Analysis of Devolo HomePlug Devices Devolo HomePlug设备的安全性分析

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312499

Rouven Scholz, Christian Wressnegger

引用次数: 4

Market Manipulation as a Security Problem: Attacks and Defenses 作为安全问题的市场操纵:攻击与防御

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312493

V. Mavroudis

引用次数: 9

Pitfalls of open architecture: How friends can exploit your cryptocurrency wallet 开放架构的陷阱:朋友如何利用你的加密货币钱包

Proceedings of the 12th European Workshop on Systems Security Pub Date : 2019-03-25 DOI: 10.1145/3301417.3312495

Thanh Bui, S. Rao, M. Antikainen, T. Aura

引用次数: 12

Proceedings of the 12th European Workshop on Systems Security 第12届欧洲系统安全研讨会论文集

Proceedings of the 12th European Workshop on Systems Security Pub Date : 1900-01-01 DOI: 10.1145/3301417

引用次数: 0