European Workshop on System Security最新文献_第2页

A connection pattern-based approach to detect network traffic anomalies in critical infrastructures 一种基于连接模式的方法，用于检测关键基础设施中的网络流量异常

European Workshop on System Security Pub Date : 2014-04-13 DOI: 10.1145/2592791.2592792

B. Genge, Dorin Adrian Rusu, P. Haller

引用次数: 32

Improving Mac OS X security through gray box fuzzing technique 通过灰盒模糊技术提高Mac OS X的安全性

European Workshop on System Security Pub Date : 2014-04-13 DOI: 10.1145/2592791.2592793

S. Mazzone, M. Pagnozzi, Aristide Fattori, Alessandro Reina, A. Lanzi, D. Bruschi

引用次数: 5

On measuring the impact of DDoS botnets 关于测量DDoS僵尸网络的影响

European Workshop on System Security Pub Date : 2014-04-13 DOI: 10.1145/2592791.2592794

Arne Welzel, C. Rossow, H. Bos

引用次数: 37

Memory deduplication as a threat to the guest OS 内存重复数据删除对客户操作系统构成威胁

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972552

K. Suzaki, K. Iijima, T. Yagi, Cyrille Artho

引用次数: 130

An empirical study on the security of cross-domain policies in rich internet applications 富互联网应用中跨域策略安全性的实证研究

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972558

Georgios Kontaxis, Demetres Antoniades, Iasonas Polakis, E. Markatos

{"title":"An empirical study on the security of cross-domain policies in rich internet applications","authors":"Georgios Kontaxis, Demetres Antoniades, Iasonas Polakis, E. Markatos","doi":"10.1145/1972551.1972558","DOIUrl":"https://doi.org/10.1145/1972551.1972558","url":null,"abstract":"Adobe Flash and Microsoft Silverlight are two widely adopted platforms for providing Rich Internet Applications (RIA) over the World Wide Web. The need for RIAs to retrieve content hosted on different domains, in order to enrich user experience, led to the use of cross-domain policies by content providers. Cross-domain policies define the list of RIA hosting domains that are allowed to retrieve content from the content provider's domain. Misinterpretation or misconfigurations of the policies may give the opportunity to malicious RIAs to access and handle users' private data.\u0000 In this paper we present an extensive study on the deployment and security issues of cross-domain policies in the web. Through the examination of a large set of popular and diverse (both geographically and content-wise) websites, we reveal that about 50% (more than 6.500 websites) of the websites that have adopted such policies are vulnerable to attacks. Furthermore, we find such policies in more than 50% of the top 500 websites, examined both globally and per-country. Additionally, we examine local sets of e-shopping websites and find that up to 83% implement weak policies. Interestingly, we observe that the less popular a website is, the higher the probability that it will have a weak policy. Compared to previous studies there is an obvious increasing trend in the adoption of RIA but, at the same time, a decreasing trend regarding secure implementations. Through a proof-of-concept attack implementation and a number of real-world examples, we highlight the security impacts of these policy misconfigurations.","PeriodicalId":302603,"journal":{"name":"European Workshop on System Security","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-04-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130542982","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

On passive inference attacks against physical-layer key extraction? 针对物理层密钥提取的被动推理攻击?

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972559

Matthew Edman, A. Kiayias, B. Yener

{"title":"On passive inference attacks against physical-layer key extraction?","authors":"Matthew Edman, A. Kiayias, B. Yener","doi":"10.1145/1972551.1972559","DOIUrl":"https://doi.org/10.1145/1972551.1972559","url":null,"abstract":"Physical-layer key extraction techniques attempt to derive a shared symmetric cryptographic key between two wireless devices based on the principle of channel reciprocity, which states that the signal envelope between two communicating devices is strongly correlated. A key security assumption made in previous literature is that the signal envelope observed by an adversary located greater than a half-wavelength away is uncorrelated with that shared between the two communicating devices; however, this assumption has yet to be rigorously evaluated in previous work on physical-layer key extraction. In this paper, we present an experimental analysis that examines the relationship between the channel measurements used to extract a symmetric key between two devices and those observed by one or more distantly located passive adversaries. We find that, contrary to previous assumptions, there does exist a strong correlation in measurements observed by adversaries located significantly greater than a half-wavelength away from two communicating wireless devices. Further, we provide initial results that show the extent to which the adversary is able to leverage such correlations to infer portions of the key extracted between two devices using previously published physical-layer key extraction techniques.","PeriodicalId":302603,"journal":{"name":"European Workshop on System Security","volume":"125 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-04-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115807458","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 67

Combining static and dynamic analysis for the detection of malicious documents 将静态分析与动态分析相结合，实现对恶意文档的检测

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972555

Zacharias Tzermias, Giorgos Sykiotakis, M. Polychronakis, E. Markatos

引用次数: 131

Abusing locality in shared web hosting 滥用局部性在共享虚拟主机

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972553

Nick Nikiforakis, W. Joosen, Martin Johns

引用次数: 16

Attack surface reduction for commodity OS kernels: trimmed garden plants may attract less bugs 减少商品操作系统内核的攻击面:修剪过的花园植物可能会吸引更少的bug

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972557

Anil Kurmus, A. Sorniotti, R. Kapitza

{"title":"Attack surface reduction for commodity OS kernels: trimmed garden plants may attract less bugs","authors":"Anil Kurmus, A. Sorniotti, R. Kapitza","doi":"10.1145/1972551.1972557","DOIUrl":"https://doi.org/10.1145/1972551.1972557","url":null,"abstract":"Kernel vulnerabilities are a major current practical security problem, as attested by the weaknesses and flaws found in many commodity operating system kernels in recent years. Ever-growing code size in those projects, due to the addition of new features and the reluctance to remove legacy support, indicate that this problem will remain a severe system security threat in the foreseeable future. Reactive measures such as bug fixes via code reviews and testing, while effective, can only alleviate the issue. Furthermore, common practices in system hardening often focus on complex and sometimes hard to achieve goals that require extensive manual intervention such as security policies for sandboxing.\u0000 In this paper, we explore an alternative, automated and effective way of reducing the attack surface in commodity operating system kernels, which we call trimming. Trimming is a two-fold process: an initial analysis of a given system for unused kernel code sections is followed by an enforcement phase, in which the unused sections are removed or prevented from being executed. We discuss the requirements that should be reflected in the design of a trimming infrastructure, and present a lightweight and flexible implementation example for the Linux kernel by using dynamic binary instrumentation as provided by kprobes. Our evaluations show we can, in the case of a web server, reduce the attack surface of the kernel (in terms of the number of kernel functions accessible from unprivileged users) by about 88%.","PeriodicalId":302603,"journal":{"name":"European Workshop on System Security","volume":"65 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-04-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121947714","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 41

Thwarting real-time dynamic unpacking 阻碍实时动态拆包

European Workshop on System Security Pub Date : 2011-04-10 DOI: 10.1145/1972551.1972556

Leyla Bilge, A. Lanzi, D. Balzarotti

引用次数: 10