2009 30th IEEE Symposium on Security and Privacy最新文献

Exploiting Unix File-System Races via Algorithmic Complexity Attacks 通过算法复杂性攻击利用Unix文件系统竞争

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.10

Xiang Cai, Yuwei Gui, Rob Johnson

引用次数: 66

Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments 相当糟糕的代理:浏览器HTTPS部署中被忽视的对手

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.12

Shuo Chen, Ziqing Mao, Yi-Min Wang, Ming Zhang

{"title":"Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments","authors":"Shuo Chen, Ziqing Mao, Yi-Min Wang, Ming Zhang","doi":"10.1109/SP.2009.12","DOIUrl":"https://doi.org/10.1109/SP.2009.12","url":null,"abstract":"HTTPS is designed to provide secure web communications over insecure networks. The protocol itself has been rigorously designed and evaluated by assuming the network as an adversary. This paper is motivated by our curiosity about whether such an adversary has been carefully examined when HTTPS is integrated into the browser/web systems. We focus on a specific adversary named “Pretty-Bad-Proxy” (PBP). PBP is a malicious proxy targeting browsers’ rendering modules above the HTTP/HTTPS layer. It attempts to break the end-to-end security guarantees of HTTPS without breaking any cryptographic scheme. We discovered a set of vulnerabilities exploitable by a PBP: in many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers – they affect multiple major browsers and a large number of websites. We believe that the PBP adversary has not been rigorously examined in the browser/web industry. The vendors of the affected browsers have all confirmed the vulnerabilities reported in this paper. Most of them have patched or planned on patching their browsers. We believe the attack scenarios described in this paper may only be a subset of the vulnerabilities under PBP. Thus further (and more rigorous) evaluations of the HTTPS deployments in browsers appear to be necessary.","PeriodicalId":161757,"journal":{"name":"2009 30th IEEE Symposium on Security and Privacy","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115738007","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 26

Secure Content Sniffing for Web Browsers, or How to Stop Papers from Reviewing Themselves 安全内容嗅探网络浏览器，或如何阻止文件审查自己

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.3

A. Barth, Juan Caballero, D. Song

引用次数: 118

Native Client: A Sandbox for Portable, Untrusted x86 Native Code 原生客户端:可移植的、不受信任的x86原生代码的沙箱

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1145/1629175.1629203

Bennet S. Yee, D. Sehr, Gregory Dardyk, J. B. Chen, R. Muth, Tavis Ormandy, S. Okasaka, Neha Narula, Nicholas Fullagar

引用次数: 727

Automatic Discovery and Quantification of Information Leaks 信息泄漏的自动发现与量化

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.18

M. Backes, Boris Köpf, A. Rybalchenko

引用次数: 220

Formally Certifying the Security of Digital Signature Schemes 正式验证数字签名方案的安全性

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.17

Santiago Zanella Béguelin, G. Barthe, B. Grégoire, Federico Olmedo

引用次数: 25

Fingerprinting Blank Paper Using Commodity Scanners 使用商品扫描仪对空白纸张进行指纹识别

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.7

W. Clarkson, T. Weyrich, Adam Finkelstein, N. Heninger, J. A. Halderman, E. Felten

引用次数: 100

Plaintext Recovery Attacks against SSH 针对SSH的明文恢复攻击

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.5

Martin R. Albrecht, K. Paterson, Gaven J. Watson

引用次数: 114

Privacy Weaknesses in Biometric Sketches 生物识别草图中的隐私缺陷

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.24

K. Simoens, P. Tuyls, B. Preneel

引用次数: 191

Noninterference for a Practical DIFC-Based Operating System 一种实用的基于difc的操作系统的抗干扰性

2009 30th IEEE Symposium on Security and Privacy Pub Date : 2009-05-17 DOI: 10.1109/SP.2009.23

M. Krohn, Eran Tromer

引用次数: 66