Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security最新文献

An End-to-End Analysis of Covid-Themed Scams in the Wild 对野外以covid为主题的骗局进行端到端分析

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3582831

Behzad Ousat, M. Tofighi, Amin Kharraz

{"title":"An End-to-End Analysis of Covid-Themed Scams in the Wild","authors":"Behzad Ousat, M. Tofighi, Amin Kharraz","doi":"10.1145/3579856.3582831","DOIUrl":"https://doi.org/10.1145/3579856.3582831","url":null,"abstract":"Covid19-themed attacks took the Internet by surprise in March 2020. Adversaries updated their attack strategies rapidly and started to exploit users’ attention to this unprecedented event and distribute their malicious payloads. In this work, we perform a retrospective analysis of adversarial operations over the first four months from February 15th, 2020 to June 16th, 2020. By combining a variety of measurement perspectives, we perform a three-step analysis, by (1) analyzing the composition, growth, and reachability of Covid19-themed attack pages, (2) identifying the modus operandi of attackers, and (3) assessing the actual impact on end-users. Our measurements serve as a lens into the fragile parts of the Web ecosystem during a previously unseen attack. We argue that precipitous growth of Covid19-themed attacks in just a few weeks represents adversaries’ technical and operational agility in adapting their attack strategies and also demonstrates how novice attack techniques can bypass common defense mechanisms and expose unsuspecting users to different forms of attacks. Drawing upon these analyses, we discuss what went poorly, in an effort to understand how the technical community can respond more effectively to such events in the future.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127103060","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Scalable Double Oracle Algorithm for Hardening Large Active Directory Systems 一种用于加固大型Active Directory系统的可伸缩双Oracle算法

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3590343

Yumeng Zhang, Max Ward, Mingyu Guo, Hung Nguyen

引用次数: 1

SPARTA: Signal Propagation-based Attack Recognition and Threat Avoidance for Automotive Networks 基于信号传播的汽车网络攻击识别和威胁避免

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595788

Oleg Schell, Marcel Kneib

{"title":"SPARTA: Signal Propagation-based Attack Recognition and Threat Avoidance for Automotive Networks","authors":"Oleg Schell, Marcel Kneib","doi":"10.1145/3579856.3595788","DOIUrl":"https://doi.org/10.1145/3579856.3595788","url":null,"abstract":"With wider availability of wireless interfaces and a rising integration of software, it becomes easier for attackers to access vehicular communication networks and exploit vulnerabilities in Electronic Control Units (ECUs). Once having compromised an ECU, the intruder can control safety-relevant functions without requiring physical access to the vehicle. An essential aspect for the feasibility of such attacks is the lack of security measures in the Controller Area Network (CAN). And although physical-based Intrusion Detection Systems (IDSs) gain relevance for CAN security, current voltage and time-based systems have reached a point where crucial improvements can only be achieved at intolerable expense. To assess the potential of novel approaches, we present SPARTA, an advanced Intrusion Detection and Prevention System (IDPS) which identifies the sending ECU by measuring signal arrival differences on the CAN bus. With a highly reliable detection procedure, SPARTA improves current IDSs and implements an active prevention mechanism to decimate the impact of attacks. In this context, it not only detects violations of the transmission authenticity, but also recognizes the attempt of a denial-of-service (DoS) attack. Further, SPARTA was designed to require few resources and to meet real-time constraints of automotive systems. For this reason, the entire approach was realized on a resource-constrained embedded system and evaluated on different CAN and CAN with Flexible Data-Rate (CAN-FD) setups to demonstrate the efficiency, performance and adaptability to external influences of a dynamic environment.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"124 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122510098","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Eliminating Vulnerabilities by Disabling Unwanted Functionality in Binary Programs 通过禁用二进制程序中不需要的功能来消除漏洞

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595796

Mohamad Mansouri, Jun Xu, G. Portokalidis

引用次数: 1

RaceBench: A Triggerable and Observable Concurrency Bug Benchmark RaceBench:一个可触发和可观察的并发Bug基准

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595787

Jia Wen Liang, Ming Yuan, Zhanzhao Ding, Siqi Ma, Xinhui Han, Chao Zhang

{"title":"RaceBench: A Triggerable and Observable Concurrency Bug Benchmark","authors":"Jia Wen Liang, Ming Yuan, Zhanzhao Ding, Siqi Ma, Xinhui Han, Chao Zhang","doi":"10.1145/3579856.3595787","DOIUrl":"https://doi.org/10.1145/3579856.3595787","url":null,"abstract":"Concurrency bugs are one of the most harmful and hard-to-address issues in multithreaded software. Such bugs are hard to discover, reproduce, diagnose or fix due to their non-deterministic nature. Although more and more bug discovery solutions are proposed in recent years, it is difficult to evaluate them with existing concurrency bug datasets. The demand for building a high-quality benchmark of concurrency bugs emerges. In this paper, we present an automated bug injection solution to automatically inject representative concurrency bugs into real world multithreaded C/C++ programs, and present the first triggerable and observable concurrency bug benchmark RaceBench. We have conducted a large-scale empirical study on concurrency bugs, learned their patterns, and built a program state model to characterize them, which enables us to inject representative bugs. To make the bugs triggerable, we follow the dynamic execution traces of target programs and inject bugs at locations that are reachable from the program entry. To make the bugs observable, these bugs are followed by explicit security assertions, removing the requirement of sophisticated sanitizers to detect the existence of such bugs. We built a benchmark consisting of 1500 bugs injected into 15 programs, and evaluated four concurrency bug discovery tools and one general bug discovery tool with it. Results showed that existing concurrency bug discovery solutions are still in the early stage, and our benchmark could shed light on the future direction of improvements.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"73 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128293686","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

CryptoShield - Automatic On-Device Mitigation for Crypto API Misuse in Android Applications 在Android应用程序中自动缓解加密API滥用的设备上

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3582832

Florian Draschbacher, Johannes Feichtner

{"title":"CryptoShield - Automatic On-Device Mitigation for Crypto API Misuse in Android Applications","authors":"Florian Draschbacher, Johannes Feichtner","doi":"10.1145/3579856.3582832","DOIUrl":"https://doi.org/10.1145/3579856.3582832","url":null,"abstract":"Misuse of cryptographic APIs remains one of the most common flaws in Android applications. The complexity of cryptographic APIs frequently overwhelms developers. This can lead to mistakes that leak sensitive user data to trivial attacks. Despite herculean efforts by platform provider Google, countermeasures introduced so far were not successful in preventing these flaws. Users remain at risk until an effective systemic mitigation has been found. In this paper, we propose a practical solution that mitigates crypto API misuse in compiled Android applications. It enables users to protect themselves against misuse exploitation until the research community has identified an effective long-term solution. CryptoShield consists of generic mitigation procedures for the most critical crypto API misuse scenarios and an implementation that autonomously extends protection onto all applications on an unrooted Android device. Our on-device CryptoShield Agent injects an instrumentation module into application packages, where it can intercept crypto API calls for detecting misuse and applying mitigations. Our solution was designed for real-world applicability. It retains the update flow through Google Play and can be integrated into existing MDM infrastructure. As a demonstration of CryptoShield’s efficiency and efficacy, we conduct automated (1604 apps) and manual (99 apps) analyses on the most popular applications from Google Play, as well as measurements on synthetic benchmarks. Our solution mitigates crypto API misuse in 96 % of all vulnerable apps, while retaining full functionality for 92 % of all apps. On-device instrumentation takes roughly 11 seconds per application package on average, with minimal impact on package size (5 %) and negligible runtime overhead (571 ms on average app launches, 101 ms worst-case mitigation overhead per crypto API call).","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"113 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124762892","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

How Secure Are The Main Real-World Mix Networks — Case Studies To Explore Vulnerabilities And Usability 现实世界中主要的混合网络有多安全——探讨漏洞和可用性的案例研究

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595785

Kun Peng

{"title":"How Secure Are The Main Real-World Mix Networks — Case Studies To Explore Vulnerabilities And Usability","authors":"Kun Peng","doi":"10.1145/3579856.3595785","DOIUrl":"https://doi.org/10.1145/3579856.3595785","url":null,"abstract":"Mix net is the most frequently used secure MPC (multi-party computation) application in the real world, where multiple routers cooperates to anonymise a batch of data. It builds an important network security mechanism to implement anonymous communication and has a wide range of applications like AI training and online services. So far, security of mix nets is only analysed in theoretic cryptographic models, and their security in real-world systems has not drawn enough attention from researchers. In this paper, several popular commercial mix net services are surveyed and they have a common strategy: developing an academic shuffling scheme into a real-world mix net system and assuming that its theoretic security properties can guarantee robustness of the systems in practical usages. Our analysis illustrates that the straightforward assumption is not reliable and a mix net has to face various challenges and attackers beyond their academic prototypes estimate. Especially, we show that in practice some users of a mix net may collude with the service providers to compromise reliability of the mix net, which is a realistic environment factor usually ignored in cryptographic protocol design. So, the anonymous communication services based on mix net in practical usage are not so reliable as widely believed and their applications in network security have non-negligible vulnerabilities or risks.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129538325","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Faster TFHE Bootstrapping with Block Binary Keys 更快的TFHE引导与块二进制密钥

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3595804

Changmin Lee, Seonhong Min, Jinyeong Seo, Yongsoo Song

{"title":"Faster TFHE Bootstrapping with Block Binary Keys","authors":"Changmin Lee, Seonhong Min, Jinyeong Seo, Yongsoo Song","doi":"10.1145/3579856.3595804","DOIUrl":"https://doi.org/10.1145/3579856.3595804","url":null,"abstract":"Fully Homomorphic Encryption over the Torus (TFHE) is a homomorphic encryption scheme which supports efficient Boolean operations over encrypted bits. TFHE has a unique feature in that the evaluation of each binary gate is followed by a bootstrapping procedure to refresh the noise of a ciphertext. In particular, this gate bootstrapping involves two algorithms called the blind rotation and key-switching. In this work, we introduce several optimization techniques for the TFHE bootstrapping. We first define a new key distribution, called the block binary distribution, where the secret key can be expressed as a concatenation of several vectors of Hamming weight at most one. We analyze the hardness of (Ring) LWE with a block binary secret and provide candidate parameter sets which are secure against the best-known attacks. Then, we use the block key structure to simplify the inner working of blind rotation and reduce its complexity. We also modify the RLWE key generation and the gadget decomposition method to improve the performance of the key-switching algorithm in terms of complexity and noise growth. Finally, we use the TFHE library to implement our algorithms and demonstrate their benchmarks. Our experimentation shows that the execution time of TFHE bootstrapping is reduced from 10.5ms down to 6.4ms under the same security level, and the size of the bootstrapping key decreases from 109MB to 60MB.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124541646","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Data Privacy Examination against Semi-Supervised Learning 针对半监督学习的数据隐私审查

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3590333

Jiadong Lou, Xu Yuan, Miao Pan, Hao Wang, N. Tzeng

{"title":"Data Privacy Examination against Semi-Supervised Learning","authors":"Jiadong Lou, Xu Yuan, Miao Pan, Hao Wang, N. Tzeng","doi":"10.1145/3579856.3590333","DOIUrl":"https://doi.org/10.1145/3579856.3590333","url":null,"abstract":"Semi-supervised learning, which learns with only a small amount of labeled data while collecting voluminous unlabeled data to aid its training, has achieved promising performance lately, but it also raises a serious privacy concern: Whether a user’s data has been collected for use without authorization. In this paper, we propose a novel membership inference method against semi-supervised learning, serving to protect user data privacy. Due to involving both the labeled and unlabeled data, the membership patterns of semi-supervised learning’s training data cannot be well captured by the existing membership inference solutions. To this end, we propose two new metrics, i.e., inter-consistency and intra-entropy, tailored specifically to the semi-supervised learning paradigm, able to respectively measure the similarity and calculate the cross-entropy among prediction vectors from the perturbed versions. By exploiting the two metrics for membership inference, our method can dig out membership patterns imprinted on prediction outputs of semi-supervised learning models, thus facilitating effective membership inference. Extensive experiments have been conducted for comparing our method with five rectified baseline inference techniques across four datasets on six semi-supervised learning algorithms. Experimental results exhibit that our inference method achieves over 80% accuracy under each experimental setting, substantially outperforming all baseline techniques.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"111 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114762920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AbsIntIO: Towards Showing the Absence of Integer Overflows in Binaries using Abstract Interpretation 使用抽象解释来显示二进制文件中不存在整数溢出

Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security Pub Date : 2023-07-10 DOI: 10.1145/3579856.3582814

Alexander Kuechler, Leon Wenning, F. Wendland

{"title":"AbsIntIO: Towards Showing the Absence of Integer Overflows in Binaries using Abstract Interpretation","authors":"Alexander Kuechler, Leon Wenning, F. Wendland","doi":"10.1145/3579856.3582814","DOIUrl":"https://doi.org/10.1145/3579856.3582814","url":null,"abstract":"In the past years, the CWE-190 integer overflow led to many vulnerabilities. Program verification techniques such as Abstract Interpretation can show that no such bug is present in a given program. To date, such techniques often aim to verify the correctness of source code. However, as the source code is not always available or might not have been subject to such an analysis, it is advisable to apply abstract integer range analysis to the binary. However, analyzing binaries imposes other challenges which are not always addressed accurately by existing analysis tools. As an example, some tools fail to model bitwise operators, recover type information or do not account for compiler optimizations. We propose techniques to address these limitations and illustrate their effects in our configurable reference implementation AbsIntIO. AbsIntIO applies abstract integer range analysis to binaries with the goal to show that no integer overflow is possible. We evaluate the effects of the improvements and observed a reduction of the error rates. Hence, the improvements provide a step towards verifying the correctness of binaries.","PeriodicalId":156082,"journal":{"name":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123947788","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0