Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security最新文献_第2页

Establishing and Maintaining Root of Trust on Commodity Computer Systems 商品计算机系统信任根的建立与维护

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329913

V. Gligor

{"title":"Establishing and Maintaining Root of Trust on Commodity Computer Systems","authors":"V. Gligor","doi":"10.1145/3321705.3329913","DOIUrl":"https://doi.org/10.1145/3321705.3329913","url":null,"abstract":"Suppose that a trustworthy program must be booted on a commodity system that may contain persistent malware. Establishing root of trust (RoT) ensures the system has all and only the content chosen by a trusted verifier or the verifier discovers unaccounted content, with high probability. Obtaining such an assurance is challenging because malware can survive in system states across repeated secure- and trusted-boot operations and act on behalf of a powerful remote adversary. I this presentation, I illustrate both the theoretical and practical challenges of RoT establishment unconditionally; i.e., without secrets, trusted hardware modules (e.g., TPMs, HSMs) or adversary computation bounds. I also illustrate the only unconditional solution to this problem known to date. Establishing root of trust forces the adversary to repeat the malware-insertion attack, perhaps at some added cost. However, the inherent size and complexity of commodity OS components (aka., the \"giants\") render them vulnerable to such successful attacks. In contrast, small and simple software components with rather limited function and high-assurance security properties (aka., the \"wimps\") can, in principle, be resistant to attack. Maintaining root of trust assures a user that a commodity computer's wimps are isolated from, and safely co-exist with, adversary-controlled giants. However, regardless how secure program isolation may be, I/O separation must also be achieved despite the pitfalls of commodity architectures that encourage I/O hardware sharing, not isolation. In this presentation, I also illustrate the challenges of I/O separation and present and approach that enables the co-existence secure wimps with insecure giants, via an example of a system implemented at CMU.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":" November","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131977971","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

SoK 势利小人

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329810

Mustafa Khairallah, Xiaolu Hou, Zakaria Najm, J. Breier, Shivam Bhasin, Thomas Peyrin

{"title":"SoK","authors":"Mustafa Khairallah, Xiaolu Hou, Zakaria Najm, J. Breier, Shivam Bhasin, Thomas Peyrin","doi":"10.1145/3321705.3329810","DOIUrl":"https://doi.org/10.1145/3321705.3329810","url":null,"abstract":"Recently, the NIST launched a competition for lightweight cryptography and a large number of ciphers are expected to be studied and analyzed under this competition. Apart from the classical security, the candidates are desired to be analyzed against physical attacks. Differential Fault Analysis (DFA) is an invasive physical attack method for recovering key information from cipher implementations. Up to date, almost all the block ciphers have been shown to be vulnerable against DFA, while following similar attack patterns. However, so far researchers mostly focused on particular ciphers rather than cipher families, resulting in works that reuse the same idea for different ciphers. In this article, we aim at bridging this gap, by providing a generic DFA attack method targeting Substitution-Permutation Network (SPN) based families of symmetric block ciphers. We provide the overview of the state-of-the-art of the fault attacks on SPNs, followed by generalized conditions that hold on all the ciphers of this design family. We show that for any SPN, as long as the fault mask injected before a non-linear layer in the last round follows a non-uniform distribution, the key search space can always be reduced. This shows that it is not possible to design an SPN-based cipher that is completely secure against DFA, without randomization. Furthermore, we propose a novel approach to find good fault masks that can leak the key with a small number of instances. We then developed a tool, called Joint Difference Distribution Table (JDDT) for pre-computing the solutions for the fault equations, which allows us to recover the last round key with a very small number of pairs of faulty and non-faulty ciphertexts. We evaluate our methodology on various block ciphers, including PRESENT-80, PRESENT-128, GIFT-64, GIFT-128, AES-128, LED-64, LED-128, Skinny, Pride and Prince. The developed technique would allow automated DFA analysis of several candidates in the NIST competitio","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122441657","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

Waves of Malice: A Longitudinal Measurement of the Malicious File Delivery Ecosystem on the Web 恶意浪潮:网络上恶意文件传递生态系统的纵向测量

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329807

Colin C. Ife, Yun Shen, S. Murdoch, G. Stringhini

{"title":"Waves of Malice: A Longitudinal Measurement of the Malicious File Delivery Ecosystem on the Web","authors":"Colin C. Ife, Yun Shen, S. Murdoch, G. Stringhini","doi":"10.1145/3321705.3329807","DOIUrl":"https://doi.org/10.1145/3321705.3329807","url":null,"abstract":"We present a longitudinal measurement of malicious file distribution on the Web. Following a data-driven approach, we identify network infrastructures and the files that they download. We then study their characteristics over a short period (one day), over a medium period (daily, over one month) as well as in the long term (weekly, over one year). This analysis offers us an unprecedented view of the malicious file delivery ecosystem and its dynamics. We find that the malicious file delivery landscape can be divided into two distinct ecosystems: a much larger, tightly connected set of networks that is mostly responsible for the delivery of potentially unwanted programs (PUP), and a number of disjoint network infrastructures that are responsible for delivering malware on victim computers. We find that these two ecosystems are mostly disjoint, but it is not uncommon to see malware downloaded from the PUP Ecosystem, and vice versa. We estimate the proportions of PUP-to-malware in the wild to be heavily skewed towards PUP (17:2) and compare their distribution patterns. We observe periodicity in the activity of malicious network infrastructures, and we find that although malicious file operations present a high degree of volatility, 75% of the observed malicious networks remain active for more than six weeks, with 26% surviving for an entire year. We then reason on how our findings can help the research and law enforcement communities in developing better takedown techniques.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122714550","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

E-Spion: A System-Level Intrusion Detection System for IoT Devices E-Spion:物联网设备的系统级入侵检测系统

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329857

Anand Mudgerikar, Puneet Sharma, E. Bertino

{"title":"E-Spion: A System-Level Intrusion Detection System for IoT Devices","authors":"Anand Mudgerikar, Puneet Sharma, E. Bertino","doi":"10.1145/3321705.3329857","DOIUrl":"https://doi.org/10.1145/3321705.3329857","url":null,"abstract":"As the Internet of Things (IoT) grows at a rapid pace, there is a need for an effective and efficient form of security tailored for IoT devices. In this paper, we introduce E-Spion, an anomaly-based system level Intrusion Detection System (IDS) for IoT devices. E-Spion profiles IoT devices according to their 'behavior' using system level information, like running process parameters and their system calls, in an autonomous, efficient, and scalable manner. These profiles are then used to detect anomalous behaviors indicative of intrusions. E-Spion provides three layers of detection with increasing detection efficiency but at the same time higher overhead costs on the devices. We have extensively evaluated E-Spion using a comprehensive dataset of 3973 IoT malware samples in our testbed. We observe a detection efficiency ranging from 78% to 100% depending on the layers of detection employed. We provide an analysis and comparison of the different layers of E-Spion in terms of detection accuracy and overhead costs. We also analyze the behavior of the malware samples in terms of our device logs at each layer.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"5 1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128732579","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 30

Cracking the Graph Routes in WirelessHART Networks 破解无线shart网络中的图路由

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3331004

Xia Cheng, Junyang Shi, M. Sha

{"title":"Cracking the Graph Routes in WirelessHART Networks","authors":"Xia Cheng, Junyang Shi, M. Sha","doi":"10.1145/3321705.3331004","DOIUrl":"https://doi.org/10.1145/3321705.3331004","url":null,"abstract":"As a key response to the Fourth Industrial Revolution, IEEE 802.15.4-based wireless sensor-actuator network (WSAN) technology is gaining rapid adoption in process industries because of its advantage in lowering deployment and maintenance cost and effort in industrial facilities, such as steel mills, oil refineries, and chemical plants. Although most industrial applications operate at low data rates, they often require their underlying networks to provide real-time and reliable data deliveries in harsh industrial environments. IEEE 802.15.4-based WSANs are appealing for use in industrial networks, since they operate at low-power and can be manufactured inexpensively. To meet the stringent real-time and reliability requirements, WSANs, such as WirelessHART networks, make a set of unique design choices such as employing the Time Slotted Channel Hopping (TSCH) and graph routing that distinguish themselves from traditional wireless sensor networks designed for best effort services. However, the security aspects of this increasingly important class of wireless networks are insufficiently investigated in the literature. Our recent work shows that an attacker can reverse engineer the TSCH channel hopping sequences by silently observing the channel activities and put the network in danger of selective jamming attacks, where the attacker jams only the transmission of interest on its specific communication channel in its specific time slot, which makes the attacks energy-efficient and hardly detectable. A critical step for an attacker to launch selective jamming is to identify the routing paths. Our study shows that an attacker can crack the routes used by the graph routing in WirelessHART networks by silently observing the packet transmission activities. In this poster proposal, we present a vulnerability analysis and our case study performed on a 50-device physical testbed using a publicly accessible WirelessHART implementation.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115292257","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Running Language Interpreters Inside SGX: A Lightweight,Legacy-Compatible Script Code Hardening Approach 在SGX内部运行语言解释器:一种轻量级的、与旧版本兼容的脚本代码加固方法

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329848

Huibo Wang, Erick Bauman, Vishal M. Karande, Zhiqiang Lin, Yueqiang Cheng, Yinqian Zhang

{"title":"Running Language Interpreters Inside SGX: A Lightweight,Legacy-Compatible Script Code Hardening Approach","authors":"Huibo Wang, Erick Bauman, Vishal M. Karande, Zhiqiang Lin, Yueqiang Cheng, Yinqian Zhang","doi":"10.1145/3321705.3329848","DOIUrl":"https://doi.org/10.1145/3321705.3329848","url":null,"abstract":"Recent advances in trusted execution environments, specifically with Intel's introduction of SGX on consumer processors, have provided unprecedented opportunities to create secure applications with a small TCB. While a large number of SGX solutions have been proposed, nearly all of them focus on protecting native code applications, leaving scripting languages unprotected. To fill this gap, this paper presents SCRIPTSHIELD, a framework capable of running legacy script code while simultaneously providing confidentiality and integrity for scripting code and data. In contrast to the existing schemes that either require tedious and time-consuming re-development or result in a large TCB by importing an entire library OS or container, SCRIPTSHIELD keeps the TCB small and provides backwards compatibility (i.e., no changes needed to the scripting code itself). The core idea is to customize the script interpreter to run inside an SGX enclave and pass scripts to it. We have implemented SCRIPTSHIELD and tested with three popular scripting languages: Lua, JavaScript, and Squirrel. Our experimental results show that SCRIPTSHIELD does not cause noticeable overhead. The source code of SCRIPTSHIELD has been made publicly available as an open source project.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127334526","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

What Happens After You Leak Your Password: Understanding Credential Sharing on Phishing Sites 泄露密码后会发生什么:了解钓鱼网站上的凭证共享

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329818

Peng Peng, Chao Xu, Luke Quinn, Hang Hu, Bimal Viswanath, Gang Wang

{"title":"What Happens After You Leak Your Password: Understanding Credential Sharing on Phishing Sites","authors":"Peng Peng, Chao Xu, Luke Quinn, Hang Hu, Bimal Viswanath, Gang Wang","doi":"10.1145/3321705.3329818","DOIUrl":"https://doi.org/10.1145/3321705.3329818","url":null,"abstract":"Phishing has been a big concern due to its active roles in recent data breaches and state-sponsored attacks. While existing works have extensively analyzed phishing websites and their operations, there is still a limited understanding of the information sharing flows throughout the end-to-end phishing process. In this paper, we perform an empirical measurement on the transmission and sharing of stolen login credentials. Over 5 months, our measurement covers more than 179,000 phishing URLs (47,000 live phishing sites). First, we build a measurement tool to feed fake credentials to live phishing sites. The goal is to monitor how the credential information is shared with the phishing server and potentially third-party collectors on the client side. Second, we obtain phishing kits from a subset of phishing sites to analyze how credentials are sent to attackers and third-parties on the server side. Third, we set up honey accounts to monitor the post-phishing exploitation activities from attackers. Our study reveals the key mechanisms for information sharing during phishing, particularly with third-parties. We also discuss the implications of our results for phishing defenses.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126987454","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 36

Vendor-Independent Monitoring on Programmable Logic Controller Status for ICS Security Log Management 面向ICS安全日志管理的可编程控制器状态独立监控

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3331007

Jongwon Choi, HyungKwan Kim, Seungoh Choi, Jeong-Han Yun, Byung-gil Min, HyoungChun Kim

引用次数: 5

A New Blind ECDSA Scheme for Bitcoin Transaction Anonymity 一种新的比特币交易匿名盲ECDSA方案

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329816

X. Yi, Kwok-Yan Lam, D. Gollmann

{"title":"A New Blind ECDSA Scheme for Bitcoin Transaction Anonymity","authors":"X. Yi, Kwok-Yan Lam, D. Gollmann","doi":"10.1145/3321705.3329816","DOIUrl":"https://doi.org/10.1145/3321705.3329816","url":null,"abstract":"In this paper, we consider a scenario where a bitcoin liquidity provider sells bitcoins to clients. When a client pays for a bitcoin online, the provider is able to link the client's payment information to the bitcoin sold to that client. To address the privacy concerns of clients, we require that the bitcoin provider cannot tell the relationship between the real identities of clients and the sold bitcoins in the blockchain. This requirement can be effectively achieved by using blind signatures. However, existing blind signature schemes are incompatible with the Elliptic Curve Digital Signature Algorithm (ECDSA) which is used by most of the existing bitcoin protocol, thus cannot be applied directly in Bitcoin. In this paper, we propose a new blind signature scheme that allows generating a blind signature compatible with the standard ECDSA. Afterwards, we make use of the new scheme to achieve bitcoin transaction anonymity. The new scheme is built on a variant of the Paillier cryptosystem and its homomorphic properties. As long as the modified Paillier cryptosystem is semantically secure, the new blind signature scheme has blindness and unforgeability.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130420625","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 32

Understanding Users' Risk Perceptions about Personal Health Records Shared on Social Networking Services 了解用户对在社交网络服务上共享个人健康记录的风险认知

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security Pub Date : 2019-07-02 DOI: 10.1145/3321705.3329838

Yuri Son, Geumhwan Cho, Hyoungshick Kim, Simon S. Woo

{"title":"Understanding Users' Risk Perceptions about Personal Health Records Shared on Social Networking Services","authors":"Yuri Son, Geumhwan Cho, Hyoungshick Kim, Simon S. Woo","doi":"10.1145/3321705.3329838","DOIUrl":"https://doi.org/10.1145/3321705.3329838","url":null,"abstract":"To understand users' risk perceptions about sharing their PHR on SNS, we first conducted a qualitative user study by interviewing 16 participants. Next, we conducted a large-scale online user study with 497 participants in the U.S. to validate our qualitative results from the first study. Our study results show that a majority of users do not show strong motivation of sharing PHR on SNS due to several concerns such as misuse/abuse and security issues of shared PHR. In particular, participants are highly concerned about sharing diseases and diagnostic test results than other types of PHRs (e.g., details of hospital visits and medical interviews). However, we found about 55.13% of the participants have the experiences of sharing their health-related information on SNS. Also, we learned that users' sharing behavior for disease data can be significantly influenced by the severity/type of the disease as well as preferred recipients. Based on our findings, we propose a recommendation method to automatically determine whether users' posts can be shared with everyone on SNS by analyzing the keywords frequently occurred in health-related posts. Our implementation using Random Forest achieved an F-measure of 87.4%, indicating that PHR can be restrictively shared with high accuracy, when sharing health-related posts on SNS.","PeriodicalId":189657,"journal":{"name":"Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security","volume":"522 ","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-07-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120878382","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0