Proceedings of the 7th Symposium on Hot Topics in the Science of Security最新文献

{"title":"Vulnerability trends in web servers and browsers","authors":"M. Raunak, R. Kuhn, Richard M. Kogut, R. Kacker","doi":"10.1145/3384217.3384227","DOIUrl":"https://doi.org/10.1145/3384217.3384227","url":null,"abstract":"In previous work we have looked at trends in vulnerabilities due to ordinary programming errors [2, 3]. This analysis focuses on two of the most widely used types of software in today's internet, web browsers and web servers. In addition to reports of vulnerabilities, we were able to consider market share to infer some information about the impact of vulnerabilities. The key questions we sought to address are: (1) What is the trend in vulnerabilities for these components, and the magnitude of their impact on users? (2) Are web browsers and servers becoming more secure over time as vulnerabilities are discovered and programmers become more experienced? (3) How do trends vary by vulnerability type?","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"94 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115540822","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Using Intel SGX to improve private neural network training and inference","authors":"Ryan Karl, Jonathan Takeshita, Taeho Jung","doi":"10.1145/3384217.3386399","DOIUrl":"https://doi.org/10.1145/3384217.3386399","url":null,"abstract":"The importance of leveraging machine learning (ML) algorithms to make critical business and government decisions continues to grow. To improve performance, such algorithms are often outsourced to the cloud, but within privacy sensitive domains this presents several challenges for ensuring data is protected from malicious parties. One practical solution to these problems comes from Trusted Execution Environments (TEEs), which utilize hardware technologies to isolate sensitive computations from untrusted software. This paper investigates a new technique utilizing a TEE to allow for the high performance training and execution of Deep Neural Networks (DNNs), an ML algorithm that has recently been used with great success in a variety of challenging tasks, including speech and face recognition.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115554295","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Approaches to ethical hacking: expanding conceptual frameworks for research","authors":"L. Provost, Rebecca Labitt, Danielle Alexandre, Asher Rodriguez","doi":"10.1145/3384217.3386400","DOIUrl":"https://doi.org/10.1145/3384217.3386400","url":null,"abstract":"The ever-changing digital landscape remains more vulnerable than ever with cybersecurity becoming increasingly important to the success of the digital economy and its stakeholders. With models including cloud computing, mobility and IoT systems, understanding how tools and methodologies for security testing have evolved is an important task. In particular, more sophisticated approaches to vulnerability assessment are currently used and necessary to address more complex security vulnerabilities. One of the central tools used in vulnerability testing is penetration testing, along with other techniques that are more broadly classified as ethical hacking. This study addresses the following research questions. (1) What are the current research trends including, current terminology and concepts, used in ethical hacking? (2) What are current challenges and best practices in ethical hacking? (3) In our multiple case-study, how do these findings relate to each case of our three industry case studies in ethical hacking? We began by conducting a systematic review of 112 articles of peer-reviewed journals, conference proceedings and edited books from the time period of 2012-2019 to address these questions. We ranked the techniques presented in the 42 papers, a subset of the original set, based on theoretical merits, transparency of information and additional strict inclusion/exclusion criteria. Next, we provide an analysis of current research in the field including application scenarios, models, methodologies and tools. This included the completion of a literature review that includes a conceptual analysis of current terminology used in ethical hacking, both in research and in practice. We then summarize our analysis, findings and suggestions for improvements in conceptual frameworks for research in this area. Lastly, we used our resulting conceptual framework in a multi-case study approach to three ethical hacking cases for three industry participants. These results include details of the ethical hacking process in each case. In concluding our study, we argue that current frameworks for research are limited in scope and unable to address the complexity of ethical hacking within complex cybersecurity ecosystems. The result of the literature review and multiple-case study research is an improved framework for research that encompasses a multitude of factors and attributes of major attacks that threaten computer security; a more robust, integrative multi-layered framework embracing the complexity of cybersecurity ecosystems.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123787383","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A curated dataset of security defects in scientific software projects","authors":"Justin Murphy, Elias T. Brady, Md. Shazibul Islam Shamim, A. Rahman","doi":"10.1145/3384217.3384218","DOIUrl":"https://doi.org/10.1145/3384217.3384218","url":null,"abstract":"Scientific software is defined as software that is used to explore and analyze data to investigate unanswered research questions in the scientific community [6]. The domain of scientific software includes software needed to construct a research pipeline such as software for simulation and data analysis, large-scale dataset management, and mathematical libraries [4]. Programming languages such as Julia [1] are used to develop scientific software efficiently and achieve desired program execution time. Julia was used in Celeste1, a software used in astronomy research. Celeste was used to load 178 terabytes of astronomical image data to produce a catalog of 188 million astronomical objects in 14.6 minutes2. The Celeste-related example provides anecdotal evidence on the value of studying Julia-related projects from a cybersecurity perspective.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114434009","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Neutralizing manipulation of critical data by enforcing data-instruction dependency","authors":"Chandra Sharma, Nathan Miller, G. Amariucai","doi":"10.1145/3384217.3385620","DOIUrl":"https://doi.org/10.1145/3384217.3385620","url":null,"abstract":"In this paper, we propose a new approach to neutralize attacks that tamper with critical program data. Our technique uses a sequence of instructions as a trap against the illicit modification of the critical data. In a nutshell, we set up a dependency such that the continued execution of the program is contingent upon the successful execution of the instruction sequence and the successful execution of the instruction sequence is contingent upon the integrity of the critical data. In particular, we discuss a specific implementation of our technique focusing on a critical data that is often subject to malicious manipulation: the return address of a function. We show that our technique can be an effective countermeasure to defend against attacks that overwrite the return address to divert control to a malicious code. We further show that our technique offers significant protection without resorting to complementary defenses such as ASLR, DEP or StackGuard.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129826003","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Time series anomaly detection in medical break-the-glass","authors":"Qais Tasali, Nikesh Gyawali, Eugene Y. Vasserman","doi":"10.1145/3384217.3386397","DOIUrl":"https://doi.org/10.1145/3384217.3386397","url":null,"abstract":"The time-critical nature of medical emergencies, the requirements for system availability, and for real-time communication all make it exceedingly challenging to consistently enforce least-privilege access during medical emergencies (Break the Glass situations). Strict access control has to be suspended (must fail-open) when an emergency is declared, and only after the emergency has passed can a post-hoc audit be performed to determine the reasons (legitimacy) for overriding access control - standard operating procedure for healthcare facilities. Unfortunately, this does not proactively protect against misuse, but provides for identification and punishment of culprits. It is therefore essentially impossible to limit clinicians access to bare minimum permissions to perform life-saving activities during emergency access, especially in distributed medical systems. In this work we investigate the effectiveness of anomaly detection to ease the human burden of post-hoc audits in the medical Break-the-Glass (BTG) context. We use two different prediction models to perform real-time and post-BTG statistical analysis on time-series session log data for flagging anomalous user sessions and actions. Our approach combines a real-time fast analysis engine working on a partial feature set, as well as a post-hoc, slower analysis tool which works with the complete times series data of everything which occurred during the entire time of the emergency.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"08 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128295054","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"The more the merrier: adding hidden measurements to secure industrial control systems","authors":"J. Giraldo, D. Urbina, Cheeyee Tang, A. Cárdenas","doi":"10.1145/3384217.3385624","DOIUrl":"https://doi.org/10.1145/3384217.3385624","url":null,"abstract":"Industrial Control Systems (ICS) collect information from a variety of sensors throughout the process, and then use that information to control some physical components. Control engineers usually have to pick which measurements they are going to use and then they purchase sensors to take these measurements. However, in most cases they only need a small subset of all possible measurements that can be used. Economic and efficiency reasons motivate engineers to use only a small number of sensors for controlling a system; however, as attacks against industrial systems continue to increase, we need to study a systematic way to add sensors to the system to identify potentially malicious attacks. We propose the addition of hidden sensor measurements to a system to improve its security. Hidden sensor measurements are by our definition measurements that were not considered in the original design of the system, and are not used for any operational reason. We only add them to improve the security of the system and using them in anomaly detection and mitigation. We show the addition of these new, independent, but correlated measurements to the system makes it harder for adversaries to launch false-data injection stealthy attacks and, even if they do, it is possible to limit the impact caused by those attacks. When an attack is detected, we replace the compromised sensor measurements with estimated ones from the new sensors improving the risky open-loop simulations proposed by previous work.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114066835","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Ghostbusting: mitigating spectre with intraprocess memory isolation","authors":"Ira JenkinsPrashant, AnantharamanRebecca ShapiroJ, Peter BradySergey, BratusSean Smith, Prashant Anantharaman, I. Jenkins, Rebecca Shapiro","doi":"10.1145/3384217.3385627","DOIUrl":"https://doi.org/10.1145/3384217.3385627","url":null,"abstract":"Spectre attacks have drawn much attention since their announcement. Speculative execution creates so-called transient instructions, those whose results are ephemeral and not committed architecturally. However, various side-channels exist to extract these transient results from the microarchitecture, e.g., caches. Spectre Variant 1, the so-called Bounds Check Bypass, was the first such attack to be demonstrated. Leveraging transient read instructions and cache-timing effects, the adversary can read secret data. In this work, we explore the ability of intraprocess memory isolation to mitigate Spectre Variant 1 attacks. We demonstrate this using Executable and Linkable Format-based access control (ELFbac) which is a technique for achieving intraprocess memory isolation at the application binary interface (ABI) level. Additionally, we consider Memory Protection Keys (MPKs), a recent extension to Intel processors, that partition virtual pages into security domains. Using the original Spectre proof-of-concept (POC) code, we show how ELFbac and MPKs can be used to thwart Spectre Variant 1 by constructing explicit policies to allow and disallow the exploit. We compare our techniques against the commonly suggested mitigation using serialized instructions, e.g., lfence. Additionally, we consider other Spectre variants based on transient execution that intraprocess memory isolation would naturally mitigate.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130899280","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Toward just-in-time patching for containerized applications","authors":"Olufogorehan Tunde-Onadele, Yuhang Lin, Jingzhu He, Xiaohui Gu","doi":"10.1145/3384217.3384225","DOIUrl":"https://doi.org/10.1145/3384217.3384225","url":null,"abstract":"Containers have become increasingly popular in distributed computing environments. However, recent studies have shown that containerized applications are susceptible to various security attacks. Traditional pre-scheduled software update approaches not only become ineffective under dynamic container environments but also impose high overhead to containers. In this paper, we propose a new on-demand targeted patching framework for containerized applications. OPatch combines dynamic vulnerability exploit identification and targeted vulnerability patching to achieve more efficient security attack containment. We have implemented a prototype of OPatch and evaluated our schemes over 31 real world security vulnerability exploits in 23 commonly used server applications. Results show that OPatch can accurately detect and classify 81% vulnerability exploits and reduce security patching overhead by up to 84% for memory and 40% for disk.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115079482","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Application of the armament cyber assessment framework: a security assessment methodology for military systems","authors":"A. McCarthy, Liam Furey, K. Smith, Daniel Hawthorne-Madell, R. Blaine","doi":"10.1145/3384217.3384222","DOIUrl":"https://doi.org/10.1145/3384217.3384222","url":null,"abstract":"As the Army modernizes, its weapon systems are becoming increasingly more cyber dependent. This increased connectivity provides incredible opportunities, but also introduces new risks. This paper introduces the Armament Cyber Assessment Framework (ACAF), a schema for creating security assessment workflows integrated into the design process. The goal of ACAF is to introduce a security oriented mindset into the solution prior to release, and to provide meaningful results at every level. This goal is accomplished through the study and incorporation of multiple industry leading frameworks into a uniquely iterative process. ACAF is implemented for testing via the Global Vulnerability Assessment and Penetration Platform (GVAPP). GVAPP works to provide automated vulnerability information during the armament design process. It offers meaningful risk calculus to armament designers without cyber security backgrounds to mitigate potential vulnerabilities prior to fielding the system. This work focuses on military applications, but is applicable to similar civilian platform technologies.","PeriodicalId":205173,"journal":{"name":"Proceedings of the 7th Symposium on Hot Topics in the Science of Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130342184","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}