Proceedings 2023 Network and Distributed System Security Symposium最新文献_第4页

I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape 我仍然知道你上周日看了什么:HbbTV协议在欧洲智能电视领域的隐私

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24102

Carlotta Tagliaro, Florian Hahn, Riccardo Sepe, Alessio Aceti, Martina Lindorfer

{"title":"I Still Know What You Watched Last Sunday: Privacy of the HbbTV Protocol in the European Smart TV Landscape","authors":"Carlotta Tagliaro, Florian Hahn, Riccardo Sepe, Alessio Aceti, Martina Lindorfer","doi":"10.14722/ndss.2023.24102","DOIUrl":"https://doi.org/10.14722/ndss.2023.24102","url":null,"abstract":"—The ever-increasing popularity of Smart TVs and support for the Hybrid Broadcast Broadband TV (HbbTV) standard allow broadcasters to enrich content offered to users via the standard broadcast signal with Internet-delivered apps, e.g., ranging from quizzes during a TV show to targeted ad-vertisement. HbbTV works using standard web technologies as transparent overlays over a TV channel. Despite the number of HbbTV-enabled devices rapidly growing, studies on the proto-col’s security and privacy aspects are scarce, and no standard protective measure is in place. We fill this gap by investigating the current state of HbbTV in the European landscape and assessing its implications for users’ privacy. We shift the focus from the Smart TV’s firmware and app security, already studied in-depth in related work, to the content transmission protocol itself. Contrary to traditional “linear TV” signals, HbbTV allows for bi-directional communication: in addition to receiving TV content, it also allows for transmitting data back to the broadcaster. We describe techniques broadcasters use to measure users’ (viewing) preferences and show how the protocol’s implementation can cause severe privacy risks by studying its deployment by 36 TV channels in five European countries (Italy, Germany, France, Austria, and Finland). We also survey users’ awareness of Smart TV and HbbTV-related risks. Our results show little understanding of the possible threats users are exposed to. Finally, we present a denylist-based mechanism to ensure a safe experience for users when watching TV and to reduce the privacy issues that HbbTV may pose.","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"343 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132306418","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

ReScan: A Middleware Framework for Realistic and Robust Black-box Web Application Scanning ReScan:一个用于现实和健壮的黑盒Web应用程序扫描的中间件框架

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24169

Kostas Drakonakis, S. Ioannidis, Jason Polakis

{"title":"ReScan: A Middleware Framework for Realistic and Robust Black-box Web Application Scanning","authors":"Kostas Drakonakis, S. Ioannidis, Jason Polakis","doi":"10.14722/ndss.2023.24169","DOIUrl":"https://doi.org/10.14722/ndss.2023.24169","url":null,"abstract":"—Black-box web vulnerability scanners are invaluable for security researchers and practitioners. Despite recent approaches tackling some of the inherent limitations of scanners, many have not sufficiently evolved alongside web browsers and applications, and often lack the capabilities for handling the inherent challenges of navigating and interacting with modern web applications. Instead of building an alternative scanner that could naturally only incorporate a limited set of the wide range of vulnerability-finding capabilities offered by the multitude of existing scanners, in this paper we propose an entirely different strategy. We present ReScan, a scanner-agnostic middleware framework that transparently enhances scanners’ capabilities by mediating their interaction with web applications in a realistic and robust manner, using an orchestrated, fully-fledged modern browser. In essence, our framework can be used in conjunction with any vulnerability scanner, thus allowing users to benefit from the capabilities of existing and future scanners. Our extensible and modular framework includes a collection of enhancement techniques that address limitations and obstacles commonly faced by state-of-the-art scanners. Our experimental evaluation demonstrates that despite the considerable (and expected) overhead introduced by a fully-fledged browser, our framework significantly improves the code coverage achieved by popular scanners (168% on average), resulting in a 66% and 161% increase in the number of reflected and stored XSS vulnerabilities detected, respectively.","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134255272","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Him of Many Faces: Characterizing Billion-scale Adversarial and Benign Browser Fingerprints on Commercial Websites 多重面孔的他:商业网站上数十亿规模的敌对和良性浏览器指纹的特征

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24394

Shujiang Wu, Pengfei Sun, Yao Zhao, Yinzhi Cao

引用次数: 2

Post-GDPR Threat Hunting on Android Phones: Dissecting OS-level Safeguards of User-unresettable Identifiers Android手机上的后gdpr威胁搜索:剖析用户不可重置标识符的操作系统级安全措施

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.23176

M. H. Meng, Qing Zhang, Guangshuai Xia, Yuwei Zheng, Yanjun Zhang, Guangdong Bai, Zhi Liu, S. Teo, J. Dong

{"title":"Post-GDPR Threat Hunting on Android Phones: Dissecting OS-level Safeguards of User-unresettable Identifiers","authors":"M. H. Meng, Qing Zhang, Guangshuai Xia, Yuwei Zheng, Yanjun Zhang, Guangdong Bai, Zhi Liu, S. Teo, J. Dong","doi":"10.14722/ndss.2023.23176","DOIUrl":"https://doi.org/10.14722/ndss.2023.23176","url":null,"abstract":"—Ever since its genesis, Android has enabled apps to access data and services on mobile devices. This however involves a wide variety of user-unresettable identiﬁers (UUIs), e.g., the MAC address, which are associated with a device permanently. Given their privacy sensitivity, Android has tightened its UUI access policy since its version 10, in response to the increasingly strict privacy protection regulations around the world. Non- system apps are restricted from accessing them and are required to use user-resettable alternatives such as advertising IDs. In this work, we conduct a systematic study on the effective- ness of the UUI safeguards on Android phones including both Android Open Source Project (AOSP) and Original Equipment Manufacturer (OEM) phones. To facilitate our large-scale study, we propose a set of analysis techniques that discover and assess UUI access channels. Our approach features a hybrid analysis that consists of static program analysis of Android Framework and forensic analysis of OS images to uncover access channels. These channels are then tested with differential analysis to identify weaknesses that open any attacking opportunity. We have conducted a vulnerability assessment on 13 popular phones of 9 major manufacturers, most of which are top-selling and installed with the recent Android versions. Our study reveals that UUI mis- handling pervasively exists, evidenced by 51 unique vulnerabilities found (8 listed by CVE). Our work unveils the status quo of the UUI protection in Android phones, complementing the existing studies that mainly focus on apps’","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"259 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117112712","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Browser Permission Mechanisms Demystified 揭开浏览器权限机制的面纱

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.23109

Kazuki Nomoto, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Tatsuya Mori

{"title":"Browser Permission Mechanisms Demystified","authors":"Kazuki Nomoto, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Tatsuya Mori","doi":"10.14722/ndss.2023.23109","DOIUrl":"https://doi.org/10.14722/ndss.2023.23109","url":null,"abstract":"—Modern Web services provide rich content by ac- cessing resources on user devices, including hardware devices such as cameras, microphones, and GPSs. Web browser vendors have adopted permission mechanisms that achieve appropriate control over access to such resources to protect user privacy. The permission mechanism gives users the ability to grant or deny their browser access to resources for each website. Despite the importance of permission mechanisms in protecting user privacy, previous studies have not been conducted to systematically understand their behavior and implementation. In this study, we developed P ERMIUM , a web browser analysis framework that automatically analyzes the behavior of permission mechanisms implemented by various browsers. Using the P ERMIUM frame- work, we systematically studied the behavior of permission mechanisms for 22 major browser implementations running on five different operating systems, including mobile and desktop. We determined that the implementation and behavior of permission mechanisms are fragmented and inconsistent between operating systems, even for the same browser (i.e., Windows Chrome vs. iOS Chrome) and that the implementation inconsistencies can lead to privacy risks. Based on the behavior and implementation inconsistencies of the permission mechanism revealed by our measurement study, we developed two proof-of-concept attacks and evaluated their feasibility. The first attack uses the permission information collected by exploiting the inconsistencies to secretly track the user. The second attack aims to create a situation in which the user cannot correctly determine the origin of the permission request, and the user incorrectly grants permission to a malicious site. Finally, we clarify the technical issues that must be standardized in privacy mechanisms and provide recommendations to OS/browser vendors to mitigate the threats identified in this study.","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"155 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114336822","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation 幽灵域名重载:域名授权和撤销中的脆弱链接

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.23005

Xiang Li, Baojun Liu, Xuesong Bai, Mingming Zhang, Qifan Zhang, Zhou Li, Haixin Duan, Qi Li

{"title":"Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation","authors":"Xiang Li, Baojun Liu, Xuesong Bai, Mingming Zhang, Qifan Zhang, Zhou Li, Haixin Duan, Qi Li","doi":"10.14722/ndss.2023.23005","DOIUrl":"https://doi.org/10.14722/ndss.2023.23005","url":null,"abstract":"—In this paper, we propose P HOENIX D OMAIN , a general and novel attack that allows adversaries to maintain the revoked malicious domain continuously resolvable at scale, which enables an old, mitigated attack, Ghost Domain. P HOENIX D OMAIN has two variations and affects all mainstream DNS software and public DNS resolvers overall because it does not violate any DNS specifications and best security practices. The attack is made possible through systematically “ reverse engineer ” the cache operations of 8 DNS implementations, and new attack surfaces are revealed in the domain name delegation processes. We select 41 well-known public DNS resolvers and prove that all surveyed DNS services are vulnerable to P HOENIX D OMAIN , including Google Public DNS and Cloudflare DNS. Extensive measurement studies are performed with 210k stable and distributed DNS recursive resolvers, and results show that even after one month from domain name revocation and cache expiration, more than 25% of recursive resolvers can still resolve it. The proposed attack provides an opportunity for adversaries to evade the security practices of malicious domain take-down. We have reported discovered vulnerabilities to all affected vendors and suggested 6 types of mitigation approaches to them. Until now, 7 DNS software providers and 15 resolver vendors, including BIND, Unbound, Google, and Cloudflare, have confirmed the vulnerabilities, and some of them are implementing and publishing mitigation patches according to our suggestions. In addition, 9 CVE numbers have been assigned. The study calls for standardization to address the issue of how to revoke domain names securely and maintain cache consistency.","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121096667","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

REDsec: Running Encrypted Discretized Neural Networks in Seconds REDsec:在几秒钟内运行加密离散神经网络

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24034

Lars Folkerts, Charles Gouert, N. G. Tsoutsos

{"title":"REDsec: Running Encrypted Discretized Neural Networks in Seconds","authors":"Lars Folkerts, Charles Gouert, N. G. Tsoutsos","doi":"10.14722/ndss.2023.24034","DOIUrl":"https://doi.org/10.14722/ndss.2023.24034","url":null,"abstract":"—Machine learning as a service (MLaaS) has risen to become a prominent technology due to the large development time, amount of data, hardware costs, and level of expertise required to develop a machine learning model. However, privacy concerns prevent the adoption of MLaaS for applications with sensitive data. A promising privacy preserving solution is to use fully homomorphic encryption (FHE) to perform the ML compu- tations. Recent advancements have lowered computational costs by several orders of magnitude, opening doors for secure practical applications to be developed. In this work, we introduce the REDsec framework that optimizes FHE-based private machine learning inference by leveraging ternary neural networks. Such neural networks, whose weights are constrained to { -1,0,1 } , have special properties that we exploit to operate efﬁciently in the homomorphic domain. REDsec introduces novel features, includ- ing a new data re-use scheme that enables bidirectional bridging between the integer and binary domains for the ﬁrst time in FHE. This enables us to implement very efﬁcient binary operations for multiplication and activations, as well as efﬁcient integer domain additions. Our approach is complemented by a new GPU acceleration library, dubbed (RED)cuFHE, which supports both binary and integer operations on multiple GPUs. REDsec brings unique beneﬁts by supporting user-deﬁned models as input (bring-your- own-network), automation of plaintext training, and efﬁcient evaluation of private inference leveraging TFHE. In our analysis, we perform inference experiments with the MNIST, CIFAR-10, and ImageNet datasets and report performance improvements compared to related works.","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116173835","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

SynthDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications SynthDB:通过程序分析合成数据库，用于Web应用程序的安全测试

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24632

An Chen, Jiho Lee, Basanta Chaulagain, Yonghwi Kwon, K. H. Lee

引用次数: 1

ProbFlow : Using Probabilistic Programming in Anonymous Communication Networks ProbFlow:在匿名通信网络中使用概率规划

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24140

Hussein Darir, G. Dullerud, N. Borisov

引用次数: 1

EdgeTDC: On the Security of Time Difference of Arrival Measurements in CAN Bus Systems CAN总线系统中到达时间差的安全性研究

Proceedings 2023 Network and Distributed System Security Symposium Pub Date : 1900-01-01 DOI: 10.14722/ndss.2023.24271

Marc Roeschlin, Giovanni Camurati, Pascal Brunner, Mridula Singh, Srdjan Capkun

{"title":"EdgeTDC: On the Security of Time Difference of Arrival Measurements in CAN Bus Systems","authors":"Marc Roeschlin, Giovanni Camurati, Pascal Brunner, Mridula Singh, Srdjan Capkun","doi":"10.14722/ndss.2023.24271","DOIUrl":"https://doi.org/10.14722/ndss.2023.24271","url":null,"abstract":"—A Controller Area Network (CAN bus) is a message-based protocol for intra-vehicle communication designed mainly with robustness and safety in mind. In real-world deployments, CAN bus does not offer common security features such as message authentication. Due to the fact that automotive suppliers need to guarantee interoperability, most manufacturers rely on a decade- old standard (ISO 11898) and changing the format by introducing MACs is impractical. Research has therefore suggested to address this lack of authentication with CAN bus Intrusion Detection Systems (IDSs) that augment the bus with separate modules. IDSs attribute messages to the respective sender by measuring physical-layer features of the transmitted frame. Those features are based on timings, voltage levels, transients—and, as of recently, Time Difference of Arrival (TDoA) measurements. In this work, we show that TDoA-based approaches presented in prior art are vulnerable to novel spooﬁng and poisoning attacks. We describe how those proposals can be ﬁxed and present our own method called EdgeTDC . Unlike existing methods, EdgeTDC does not rely on Analog-to-digital converters (ADCs) with high sampling rate and high dynamic range to capture the signals at sample level granularity. Our method uses time-to-digital converters (TDCs) to detect the edges and measure their timings. Despite being inexpensive to implement, TDCs offer low latency, high location precision and the ability to measure every single edge (rising and falling) in a frame. Measuring each edge makes analog sampling redundant and allows the calculation of statistics that can even detect tampering with parts of a message. Through extensive experimentation, we show that EdgeTDC can successfully thwart masquerading attacks in the CAN system of modern vehicles.","PeriodicalId":199733,"journal":{"name":"Proceedings 2023 Network and Distributed System Security Symposium","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124685637","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3