Kuan-Chien Wang, Wei Cheng, J. Zhang, Minmin Sun, Kazuya Sakai, Wei-Shinn Ku
{"title":"HoneyContainer: Container-based Webshell Command Injection Defending and Backtracking","authors":"Kuan-Chien Wang, Wei Cheng, J. Zhang, Minmin Sun, Kazuya Sakai, Wei-Shinn Ku","doi":"10.1109/SVCC56964.2023.10165511","DOIUrl":"https://doi.org/10.1109/SVCC56964.2023.10165511","url":null,"abstract":"The web server is a vulnerable component in enterprise systems, susceptible to a variety of attack strategies. Of these, webshell attacks are particularly insidious, as they can be uploaded through legitimate paths and executed using network traffic that is indistinguishable from that of normal users. Despite the existence of several proposed detection methods for identifying webshell attacks, attackers can still easily evade them. To address this issue, we present HoneyContainer, an architecture designed to detect webshell-based command injection attacks, trace the origin of the attacker, and redirect malicious traffic to a honeypot container. Our prototype implementation of Honey-Container has been validated using 214 webshell files, with results demonstrating its ability to detect all shell command injection events and redirect malicious traffic. Our evaluations also indicate that the overhead caused by HoneyContainer is minimal and unlikely to be noticeable by normal users. The source code is released at https://github.com/wei-juncheng/webshell php5 demo","PeriodicalId":243155,"journal":{"name":"2023 Silicon Valley Cybersecurity Conference (SVCC)","volume":"18 5part1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120843730","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"EGO-6: Enhancing Geofencing Security Systems with Optimal Deployment of 6G TRPs","authors":"A. Famili, A. Stavrou, Haining Wang, J. Park","doi":"10.1109/SVCC56964.2023.10165032","DOIUrl":"https://doi.org/10.1109/SVCC56964.2023.10165032","url":null,"abstract":"Geofencing technologies enable the creation of virtual boundaries around specific locations to regulate actions within that area. These boundaries provide a flexible, yet secure way to control access, monitor activity, and enforce rules. A prime example is the use of geofencing to establish no-fly zones for drones, ensuring aviation safety. Geofencing can also be used in virtual environments, such as metaverse platforms, to restrict user access to specific rooms, enhancing security and management. In this article, we present EGO-6, an optimization framework for a geofencing system tracking users in indoor environments. EGO6 optimizes 6G transmission/reception point (TRP) deployment in three-dimensional spaces with its innovative technique. Using Evolutionary Algorithm (EA) advancements, EGO-6 calculates minimum 6G anchor requirements and their optimal placement to lower deployment costs and tracking errors. Solving this complex NP-Hard challenge which belongs to Mixed Integer Programming (MIP) problems, EGO-6 offers cost-efficient anchor configurations for improved indoor geofencing and user tracking with fewer deployed 6G TRPs.","PeriodicalId":243155,"journal":{"name":"2023 Silicon Valley Cybersecurity Conference (SVCC)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129091084","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
David Llanio Reyes, A. Perez-Pons, Rogelio Bofill Dean
{"title":"Anomaly Detection in Embedded Devices Through Hardware Introspection","authors":"David Llanio Reyes, A. Perez-Pons, Rogelio Bofill Dean","doi":"10.1109/SVCC56964.2023.10165049","DOIUrl":"https://doi.org/10.1109/SVCC56964.2023.10165049","url":null,"abstract":"The growth in the number of embedded devices within society has increased and continues to increase significantly throughout the world. The evolution of cyber-physical systems and their availability on the Internet of Things domain has made it possible to incorporate these devices in systems to provide environmental monitoring and status evaluation. The deployment of these devices requires high levels of security to protect their functionality. This includes detecting any potential impact on the devices’ integrity, as it can have a negative impact on its performance, functionality, and security. We propose a Hardware Introspection for Anomaly Detection (HIAD) framework that aims to detect abnormal device behavior through machine learning techniques employing processor-level hardware debugging capabilities. Through the JTAG (Joint Test Action Group) interface found in embedded devices, we can extract memory traces and utilize the extracted data to form image representations to train machine learning and deep learning models to detect anomalous execution. HIAD is a powerful tool that can monitor a bare-metal program’s execution while minimally impacting performance, and yielding effective identification of execution variations.","PeriodicalId":243155,"journal":{"name":"2023 Silicon Valley Cybersecurity Conference (SVCC)","volume":"65 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129306620","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Investigation and Countermeasure toward Unintentional Access to Docker Container","authors":"Yueyang Li, Luyi Li, Ruxue Luo, Yuzhen Chen, Arijet Sarker, Sang-Yoon Chang, Wenjun Fan","doi":"10.1109/SVCC56964.2023.10165201","DOIUrl":"https://doi.org/10.1109/SVCC56964.2023.10165201","url":null,"abstract":"Due to the ease of management and the high performance of the containerization, many services have been deployed on container, e.g., Web server running in Docker. However, the Docker implementation suffers several fatal loopholes. In this paper, we perform a study on a persistent security problem of Docker, i.e., the port mapping statement results in a wrong IPTABLES rule, which has been disclosed for a while but is still not solved. Therefore, we are motivated to investigate and articulate this vulnerability with a technical explanation. Nevertheless, we proposed several solutions to address the problem. Further, we applied our network testbed for demonstrating the loophole and the effectiveness of the security solutions. We tested the performance of both attack and defense prototyping. The experimental results show that our approach not only increase the time cost for the attacker to identify the target but also bring negligible overhead for deploying the countermeasures.","PeriodicalId":243155,"journal":{"name":"2023 Silicon Valley Cybersecurity Conference (SVCC)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127028317","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Daisy Reyes, Eno Dynowski, T. Chovan, John Mikos, Eric Chan-Tin, M. Abuhamad, S. Kennison
{"title":"WebTracker: Real Webbrowsing Behaviors","authors":"Daisy Reyes, Eno Dynowski, T. Chovan, John Mikos, Eric Chan-Tin, M. Abuhamad, S. Kennison","doi":"10.1109/SVCC56964.2023.10164930","DOIUrl":"https://doi.org/10.1109/SVCC56964.2023.10164930","url":null,"abstract":"With increased privacy concerns, anonymity tools such as VPNs and Tor have become popular. However, the packet metadata such as the packet size and number of packets can still be observed by an adversary. This is commonly known as fingerprinting and website fingerprinting attacks have received a lot of attention recently as a known victim’s website visits can be accurately predicted, deanonymizing that victim’s web usage. Most of the previous work have been performed in laboratory settings and have made two assumptions: 1) a victim visits one website at a time, and 2) the whole website visit with all the network packets can be observed. To validate these assumptions, a new private webbrowser extension called WebTracker is deployed with real users. WebTracker records the websites visited, when the website loading starts, and when the website loading finishes. Results show that users’ browsing patterns are different than what was previously assumed. Users may browse the web in a way that acts as a countermeasure against website fingerprinting due to multiple websites overlapping and downloading at the same time. Over 15% of websites overlap with at least one other website and each overlap was 66 seconds. Moreover, each overlap happens roughly 9 seconds after the first website download has started. Thus, this reinforces some previous work that the beginning of a website is more important than the end for a website fingerprinting attack.","PeriodicalId":243155,"journal":{"name":"2023 Silicon Valley Cybersecurity Conference (SVCC)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-05-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125473437","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}