2022 IEEE Security and Privacy Workshops (SPW)最新文献_第3页

DABANGG: A Case for Noise Resilient Flush-Based Cache Attacks DABANGG:基于刷新的噪声弹性缓存攻击案例

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833897

A. Saxena, Biswabandan Panda

{"title":"DABANGG: A Case for Noise Resilient Flush-Based Cache Attacks","authors":"A. Saxena, Biswabandan Panda","doi":"10.1109/spw54247.2022.9833897","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833897","url":null,"abstract":"Flush-based cache attacks like Flush+Reload and Flush+Flush are highly precise and effective. Most of the flush-based attacks provide high accuracy in controlled and isolated environments where attacker and victim share OS pages. However, we observe that these attacks are prone to low accuracy on a noisy multi-core system with co-running applications. Two root causes for the varying accuracy of flush-based attacks are: (i) the dynamic nature of core frequencies that fluctuate depending on the system load, and (ii) the relative placement of victim and attacker threads in the processor, like same or different physical cores. These dynamic factors critically affect the execution latency of key instructions like clflush and mov, rendering the pre-attack calibration step ineffective.We propose DABANGG, a set of novel refinements to make flush-based attacks resilient to system noise by making them aware of frequency and thread placement. First, we introduce pre-attack calibration that is aware of instruction latency variation. Second, we use low-cost attack-time optimizations like fine-grained busy waiting and periodic feedback about the latency thresholds to improve the effectiveness of the attack. Finally, we provide victim-specific parameters that significantly improve the attack accuracy. We evaluate DABANGG-enabled Flush+Reload and Flush+Flush attacks against the standard attacks in side-channel and covert-channel experiments with varying levels of compute, memory, and IO-intensive system noise. In all scenarios, DABANGG+Flush+Reload and DABANGG+Flush+Flush outperform the standard attacks in stealth and accuracy.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"89 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125460588","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers 现代浏览器中解析与安全相关的HTTP头信息的安全性研究

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833880

Hendrik Siewert, M. Kretschmer, Marcus Niemietz, Juraj Somorovsky

{"title":"On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers","authors":"Hendrik Siewert, M. Kretschmer, Marcus Niemietz, Juraj Somorovsky","doi":"10.1109/spw54247.2022.9833880","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833880","url":null,"abstract":"Web browsers are among the most important but also complex software solutions to access the web. It is therefore not surprising that web browsers are an attractive target for attackers. Especially in the last decade, security researchers and browser vendors have developed sandboxing mechanisms like security-relevant HTTP headers to tackle the problem of getting a more secure browser. Although the security community is aware of the importance of security-relevant HTTP headers, legacy applications and individual requests from different parties have led to possible insecure configurations of these headers. Even if specific security headers are configured correctly, conflicts in their functionalities may lead to unforeseen browser behaviors and vulnerabilities. Recently, the first work which analyzed duplicated headers and conflicts in headers was published by Calzavara et al. at USENIX Security [1]. The authors focused on inconsistent protections by using both, the HTTP header X-Frame-Options and the framing protection of the Content-Security-Policy.We extend their work by analyzing browser behaviors when parsing duplicated headers, conflicting directives, and values that do not conform to the defined ABNF metalanguage specification. We created an open-source testbed running over 19,800 test cases, at which nearly 300 test cases are executed in the set of 66 different browsers. Our work shows that browsers conform to the specification and behave securely. However, all tested browsers behave differently when it comes, for example, to parsing the Strict-Transport-Security header. Moreover, Chrome, Safari, and Firefox behave differently if the header contains a character, which is not allowed by the defined ABNF. This results in the protection mechanism being fully enforced, partially enforced, or not enforced and thus completely bypassable.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125397671","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Biometric Identification System based on Object Interactions in Internet of Things Environments 物联网环境下基于物体交互的生物识别系统

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833878

Klaudia Krawiecka, S. Birnbach, Simon Eberz, I. Martinovic

{"title":"Biometric Identification System based on Object Interactions in Internet of Things Environments","authors":"Klaudia Krawiecka, S. Birnbach, Simon Eberz, I. Martinovic","doi":"10.1109/spw54247.2022.9833878","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833878","url":null,"abstract":"Attributing interactions with Internet of Things (IoT) devices to specific users in smart environments is extremely important as it enables personalized configurations and access control. This requirement is particularly stringent when it comes to parental control measures designed to protect children from contact with dangerous machinery or viewing materials that are inappropriate for their age. To this end, we show that naturally occurring interactions with objects in smart environments can be used as a behavioral biometric in order to identify users. The heterogeneous nature of smart devices enables the collection of a wide variety of inputs from such interactions. In addition, this system model allows for seamless identification, without the need for active user participation or rearrangement of the IoT devices.We conduct a remote study taking place in six households composed of 25 participants. We demonstrate that our system can identify users in multi-user environments with an average accuracy of at least 91% for a single object interaction without requiring any sensors on the object itself. This accuracy rises to 100% when six or more consecutive interactions are considered.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129720019","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

yoU aRe a Liar://A Unified Framework for Cross-Testing URL Parsers 你是一个骗子://交叉测试URL解析器的统一框架

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833883

Dashmeet Kaur Ajmani, Igibek Koishybayev, A. Kapravelos

{"title":"yoU aRe a Liar://A Unified Framework for Cross-Testing URL Parsers","authors":"Dashmeet Kaur Ajmani, Igibek Koishybayev, A. Kapravelos","doi":"10.1109/spw54247.2022.9833883","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833883","url":null,"abstract":"A variety of attacks, including phishing, remote-code execution, server-side request forgery, and hostname redirection, are delivered to users over the web. The beginning of most of the web exploits is an innocent-looking URL. Malformed or misinterpreted URLs can lead to remote code execution attacks as well. The IETF and WHATWG standards organizations define the components of a URL and act as an implementation guide for URL parsers. They state which characters are allowed in each portion of the URL and loosely suggest what to do in case an undefined character is present in the URL. The existence of two standards is the first concern, and the addition of server-side request forgery in the latest version of OWASP Top 10, suggests that neither of these standards is being followed accurately and concisely. Moreover, neither of these specifications describe an exact implementation standard, causing inconsistencies in the way the various parsers interpret the same URL. For example, malicious users can find ways to craft URLs to look like they are pointing to one resource but actually direct the user to different one. This problem is worsened when one application uses two separate parsers for validation and resource fetching.In this paper, we design a framework that unifies the testing suites of 8 URL parsers from popular web-related projects and highlights the inconsistencies between them. We examine and dive deep into the URL parser implementation across the most popular libraries, browsers, and command-line tools, and discover many open areas for exploitation. Our findings include identifying categories of inconsistencies, developing proof-of-concept exploits, and highlighting the need for a comprehensive implementation standard to be developed and enforced at the earliest.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127870164","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Measuring Developers’ Web Security Awareness from Attack and Defense Perspectives 从攻击和防御的角度衡量开发人员的Web安全意识

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833858

Merve Sahin, Tolga Ünlü, Cédric Hébert, Lynsay A. Shepherd, Natalie J. Coull, Colin McLean

{"title":"Measuring Developers’ Web Security Awareness from Attack and Defense Perspectives","authors":"Merve Sahin, Tolga Ünlü, Cédric Hébert, Lynsay A. Shepherd, Natalie J. Coull, Colin McLean","doi":"10.1109/spw54247.2022.9833858","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833858","url":null,"abstract":"Web applications are the public-facing components of information systems, which makes them an easy entry point for various types of attacks. While it is often the responsibility of web developers to implement the proper security controls, it remains a challenge for them to develop a good understanding of the whole attack surface.This paper aims to understand developers’ familiarity with a number of web attack and defense mechanisms. In particular, we conducted two different experiments: First, we employed a questionnaire to understand the perceived attack surface and the types of security controls that are often considered. Second, we designed a Capture the Flag challenge aiming to push participants to discover as many attack points as possible on a given web application. We found that one third of developers are not aware of the clients’ ability to intercept and modify all parts of an HTTP request. Moreover, developers’ attack awareness focuses on a limited set of attacks (such as Cross-site scripting and SQL injection), overlooking a large part of the attack surface.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"101 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127515398","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Misleading Deep-Fake Detection with GAN Fingerprints 利用GAN指纹进行误导性深度假检测

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.48550/arXiv.2205.12543

Vera Wesselkamp, Konrad Rieck, Dan Arp, Erwin Quiring

引用次数: 4

Capabilities-based access control for IoT devices using Verifiable Credentials 使用可验证凭据的物联网设备基于功能的访问控制

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833873

N. Fotiou, V. Siris, George C. Polyzos, Yki Kortesniemi, D. Lagutin

引用次数: 7

Abusing Trust: Mobile Kernel Subversion via TrustZone Rootkits 滥用信任:移动内核颠覆通过TrustZone Rootkits

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833891

D. Marth, Clemens Hlauschek, Christian Schanes, T. Grechenig

{"title":"Abusing Trust: Mobile Kernel Subversion via TrustZone Rootkits","authors":"D. Marth, Clemens Hlauschek, Christian Schanes, T. Grechenig","doi":"10.1109/spw54247.2022.9833891","DOIUrl":"https://doi.org/10.1109/spw54247.2022.9833891","url":null,"abstract":"The Arm TrustZone is the de facto standard for hardware-backed Trusted Execution Environments (TEEs) on mobile devices, providing isolation for secure computations to be shielded from the normal world, and thus from the rest of the system. Most real-world TEEs are proprietary, difficult-to-inspect, and notoriously insecure: In the past years, it has been demonstrated over and over again that TEEs of millions of devices worldwide, and the Trusted Applications (TAs) they harbor, are often vulnerable to attacks such as control flow hijacking. Not only do we have to trust these TEEs to provide a secure environment for TAs such as keystore and Digital Rights Management (DRM), code running in the secure world provided by the Arm TrustZone also has full access to the memory of the regular operating system (OS). Since Thomas Roth first proposed a TrustZone-based rootkit in 2013, progress regarding such rootkits seems to have stalled in the offensive research community. The biggest challenge for TrustZone rootkits is that no interpretation of normal world memory is available in the secure world. Automated reverse engineering of kernel data structures at runtime is one way to implement rootkit functions. We present mechanisms to engineer the interpretation of Linux kernel memory for malicious subversion and the circumvention of basic protection mechanisms from the secure world. We provide a fully working proof-of-concept rootkit located in the Arm TrustZone to demonstrate the proposed mechanisms. We evaluate and show compatibility of the rootkit across different versions of the Linux kernel despite changing data structures. Our results highlight the feasibility of TrustZone rootkits that potentially survive kernel updates and raise awareness about the real danger of having to put trust into unvetted proprietary vendor code, which, as we show, can easily be abused.","PeriodicalId":334852,"journal":{"name":"2022 IEEE Security and Privacy Workshops (SPW)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126159580","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

AirTag of the Clones: Shenanigans with Liberated Item Finders 克隆人的空中标签:利用被解放的物品查找器的恶作剧

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-05-01 DOI: 10.1109/spw54247.2022.9833881

Thomas M. Roth, Fabian Freyer, M. Hollick, J. Classen

引用次数: 9

Using 3D Shadows to Detect Object Hiding Attacks on Autonomous Vehicle Perception 利用3D阴影检测自动驾驶汽车感知中的物体隐藏攻击

2022 IEEE Security and Privacy Workshops (SPW) Pub Date : 2022-04-29 DOI: 10.48550/arXiv.2204.13973

Zhongyuan Hau, Soteris Demetriou, Emil C. Lupu

引用次数: 2