2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献

FP -TESTER : Automated Testing of Browser Fingerprint Resilience FP -TESTER:自动测试浏览器指纹弹性

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-27 DOI: 10.1109/EuroSPW.2018.00020

Antoine Vastel, Walter Rudametkin, Romain Rouvoy

{"title":"FP -TESTER : Automated Testing of Browser Fingerprint Resilience","authors":"Antoine Vastel, Walter Rudametkin, Romain Rouvoy","doi":"10.1109/EuroSPW.2018.00020","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00020","url":null,"abstract":"Despite recent regulations and growing user awareness, undesired browser tracking is increasing. In addition to cookies, browser fingerprinting is a stateless technique that exploits a device's configuration for tracking purposes. In particular, browser fingerprinting builds on attributes made available from Javascript and HTTP headers to create a unique and stable fingerprint. For example, browser plugins have been heavily exploited by state-of-the-art browser fingerprinters as a rich source of entropy. However, as browser vendors abandon plugins in favor of extensions, fingerprinters will adapt. We present FP-TESTER, an approach to automatically test the effectiveness of browser fingerprinting countermeasure extensions. We implement a testing toolkit to be used by developers to reduce browser fingerprintability. While countermeasures aim to hinder tracking by changing or blocking attributes, they may easily introduce subtle side-effects that make browsers more identifiable, rendering the extensions counterproductive. FP-TESTER reports on the side-effects introduced by the countermeasure, as well as how they impact tracking duration from a fingerprinter's point-of-view. To the best of our knowledge, FP-TESTER is the first tool to assist developers in fighting browser fingerprinting and reducing the exposure of end-users to such privacy leaks.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130792939","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Enhancing Transparency and Consent in the IoT 提高物联网的透明度和共识

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00023

C. Castelluccia, M. Cunche, D. Métayer, Victor Morel

引用次数: 32

How to Squeeze a Crowd: Reducing Bandwidth in Mixing Cryptocurrencies 如何挤人群:减少混合加密货币的带宽

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00012

Alishah Chator, M. Green

{"title":"How to Squeeze a Crowd: Reducing Bandwidth in Mixing Cryptocurrencies","authors":"Alishah Chator, M. Green","doi":"10.1109/EuroSPW.2018.00012","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00012","url":null,"abstract":"Several popular cryptocurrencies incorporate privacy features that \"mix\" real transactions with cover traffic in order to obfuscate the public transaction graph. The underlying protocols, which include CryptoNote and Monero's RingCT, work by first identifying a real transaction output (TXO), sampling a number of cover outputs, and transmitting the entire resulting set to verifiers, along with a zero knowledge (or WI) proof that hides the identity of the real transaction. Unfortunately, many of these schemes suffer from a practical limitation: the description of the combined input set grows linearly with size of the anonymity set. In this work we propose a simple technique for efficiently sampling cover traffic from a finite (and public) set of known values, while deriving a compact description of the resulting transaction set. This technique, which is based on programmable hash functions, allows us to dramatically reduce transaction bandwidth when large cover sets are used.We refer to our construction as a recoverable sampling scheme, and note that it may be of independent interest for other privacy applications. We present formal security definitions; prove our constructions secure; and show how these constructions can be integrated with various currencies and different cover sampling distributions.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123612758","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Privacy Risk Analysis to Enable Informed Privacy Settings 隐私风险分析以启用知情隐私设置

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00019

S. De, D. Métayer

引用次数: 21

Incentivized Delivery Network of IoT Software Updates Based on Trustless Proof-of-Distribution 基于分布式无信任证明的物联网软件更新激励交付网络

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00011

Oded Leiba, Yechiav Yitzchak, Ron Bitton, Asaf Nadler, A. Shabtai

{"title":"Incentivized Delivery Network of IoT Software Updates Based on Trustless Proof-of-Distribution","authors":"Oded Leiba, Yechiav Yitzchak, Ron Bitton, Asaf Nadler, A. Shabtai","doi":"10.1109/EuroSPW.2018.00011","DOIUrl":"https://doi.org/10.1109/EuroSPW.2018.00011","url":null,"abstract":"The Internet of Things (IoT) network of connected devices currently contains more than 11 billion devices and is estimated to double in size within the next four years. The prevalence of these devices makes them an ideal target for attackers. To reduce the risk of attacks vendors routinely deliver security updates (patches) for their devices. The delivery of security updates becomes challenging due to the issue of scalability as the number of devices may grow much quicker than vendors' distribution systems. Previous studies have suggested a permissionless and decentralized blockchainbased network in which nodes can host and deliver security updates, thus the addition of new nodes scales out the network. However, these studies do not provide an incentive for nodes to join the network, making it unlikely for nodes to freely contribute their hosting space, bandwidth, and computation resources. In this paper, we propose a novel decentralized IoT software update delivery network in which participating nodes (referred to as distributors) are compensated by vendors with digital currency for delivering updates to devices. Upon the release of a new security update, a vendor will make a commitment to provide digital currency to distributors that deliver the update; the commitment will be made with the use of smart contracts, and hence will be public, binding, and irreversible. The smart contract promises compensation to any distributor that provides proof-of-distribution, which is unforgeable proof that a single update was delivered to a single device. A distributor acquires the proof-of-distribution by exchanging a security update for a device signature using the Zero-Knowledge Contingent Payment (ZKCP) trustless data exchange protocol. Eliminating the need for trust between the security update distributor and the security consumer (IoT device) by providing fair compensation, can significantly increase the number of distributors, thus facilitating rapid scale out.","PeriodicalId":326280,"journal":{"name":"2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132312893","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 36

The Impact of Uncle Rewards on Selfish Mining in Ethereum 大叔奖励对以太坊自私挖矿的影响

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00013

Fabian Ritz, A. Zugenmaier

引用次数: 66

Privacy Compliance Via Model Transformations 通过模型转换实现隐私遵从性

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00024

Thibaud Antignac, R. Scandariato, G. Schneider

引用次数: 20

Blockchain as a Service (BaaS): Providers and Trust 区块链即服务(BaaS):提供者和信任

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00015

Jatinder Singh, Johan David Michels

引用次数: 48

Decentralizing Digital Identity: Open Challenges for Distributed Ledgers 去中心化数字身份:分布式账本的公开挑战

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00016

Paul Dunphy, L. Garratt, F. Petitcolas

引用次数: 20

Vulnerability Detection on Mobile Applications Using State Machine Inference 基于状态机推理的移动应用漏洞检测

2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2018-04-23 DOI: 10.1109/EuroSPW.2018.00008

Wesley van der Lee, S. Verwer

引用次数: 2