2022 IEEE Secure Development Conference (SecDev)最新文献

Tutorial: LLVM for Security Practitioners 教程:LLVM安全从业人员

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/secdev53368.2022.00012

J. Criswell, Ethan Johnson, Colin Pronovost

引用次数: 0

Towards cryptographically-authenticated in-memory data structures 迈向加密认证的内存数据结构

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00018

Setareh Ghorshi, Lachlan J. Gunn, Hans Liljestrand, N. Asokan

引用次数: 1

Tutorial: Analyzing, Exploiting, and Patching Smart Contracts in Ethereum 教程:分析、利用和修补以太坊中的智能合约

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00013

Jens-Rene Giesen, Sébastien Andreina, Michael Rodler, Ghassan O. Karame, Lucas Davi

引用次数: 0

Design and User Study of a Constraint-based Framework for Business Logic Flaw Discovery 基于约束的业务逻辑缺陷发现框架设计与用户研究

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00029

C. Cheh, Nicholas Tay, Binbin Chen

{"title":"Design and User Study of a Constraint-based Framework for Business Logic Flaw Discovery","authors":"C. Cheh, Nicholas Tay, Binbin Chen","doi":"10.1109/SecDev53368.2022.00029","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00029","url":null,"abstract":"Business logic flaws are common in web application security and pose a huge problem to developers. While there are many tools that check application code for implementation-level vulnerabilities, they are often blind to flaws caused by violation of design-level considerations. In this work, we present a framework that guides developers to create security test scenarios or misuse case scenarios by relating design constraints to existing functional use case scenarios. Those design constraints can then be translated into misuse case scenarios which can be run using existing test code that were written for functional use case scenarios in order to discover potential business logic flaws. In this paper, we conduct a user study with eleven experienced programmers to determine the feasibility of our approach and compare the complexity of our framework to the conventional approach of creating misuse case scenarios from scratch. The results of that study show that our framework saves time, improves coverage, and enhances re-usability compared to the conventional approach of creating misuse case scenarios in an ad-hoc manner.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128096022","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

How Do Developers Follow Security-Relevant Best Practices When Using NPM Packages? 开发人员在使用NPM包时如何遵循与安全相关的最佳实践?

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00027

Md Mahir Asef Kabir, Ying Wang, D. Yao, Na Meng

{"title":"How Do Developers Follow Security-Relevant Best Practices When Using NPM Packages?","authors":"Md Mahir Asef Kabir, Ying Wang, D. Yao, Na Meng","doi":"10.1109/SecDev53368.2022.00027","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00027","url":null,"abstract":"Node.js has become popular among developers, partially because of its large software ecosystem of NPM (Node Package Manager) packages. When building JavaScript (JS) applications on top of NPM packages, developers can reuse the provided functionalities to improve programmer productivity. However, many NPM packages have been recently found vulner-able or malicious. Such packages can introduce vulnerabilities into their client JS applications, and realize software supply chain attacks. To reduce the impact of potentially malicious NPM packages in Node.js software ecosystem, experts suggested best practices to developers when they maintain package depen-dencies. These best practices include using specific commands and/or tools to (a) conduct security audit for dependencies and remove vulnerable dependencies, (b) remove unused and duplicated dependencies, and (c) fixate the version information of library/package dependencies. We were curious how developers followed and will follow those best practices. For this paper, we did a large-scale empirical study on 841 popularly used open-source JS applications. By analyzing their configuration files (e.g., package.json and package-lock.json), we revealed that only 32% of the applications lock the version numbers of package dependencies. The commands/tools reported (i) vulnerable, (ii) unused, and (iii) duplicated dependencies separately in 55 %, 90 %, and 83 % of applications, which fact implies that developers often ignored the best practices we examined. We did a user study with developers to acquire their opinions on the suggested best practices and got interesting feedback. Our research will enlighten future research on the management of NPM package dependencies.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126440251","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Secure Development Workflows in CI/CD Pipelines CI/CD管道中的安全开发工作流

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00024

Pranshu Bajpai, Adam Lewis

引用次数: 1

From Lemons to Peaches: Improving Security ROI through Security Chaos Engineering 从柠檬到桃子:通过安全混沌工程提高安全投资回报率

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00021

Kelly Shortridge

引用次数: 1

Industrial Strength Static Detection for Cryptographic API Misuses 加密API误用的工业强度静态检测

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00022

Ya Xiao, Yang Zhao, N. Allen, Nathan Keynes, D. Yao, C. Cifuentes

引用次数: 0

A Hierarchical Database of One Million Websites 100万个网站的分层数据库

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00025

Jack B. Harrison, Joseph R. Harrison, Madison G. Boswell, Alan J. Michaels

引用次数: 0

Salsa: SGX Attestation for Live Streaming Applications Salsa: SGX直播应用认证

2022 IEEE Secure Development Conference (SecDev) Pub Date : 2022-10-01 DOI: 10.1109/SecDev53368.2022.00019

Tobias Cloosters, Sebastian Surminski, Gerrit Sangel, Lucas Davi

{"title":"Salsa: SGX Attestation for Live Streaming Applications","authors":"Tobias Cloosters, Sebastian Surminski, Gerrit Sangel, Lucas Davi","doi":"10.1109/SecDev53368.2022.00019","DOIUrl":"https://doi.org/10.1109/SecDev53368.2022.00019","url":null,"abstract":"Intel SGX is a hardware-based security feature that allows executing software in enclaves that are strongly isolated from the operating system and applications. Even if an attacker gains full control over the system, it is not possible to inspect these enclaves. This makes SGX enclaves an adequate solution for storing and processing highly sensitive data, such as encryption keys. However, recent research demonstrates that enclaves are still highly vulnerable to standard software exploitation attacks. While SGX features static attestation, i.e., allowing validation of the integrity of the program code and data in the enclave, static attestation cannot cope with run-time attacks such as return-oriented programming. We present Salsa, the first solution to allow control-flow attestation of SGX enclaves. To show its applicability, we leverage Salsa to implement a video streaming service that uses an SGX enclave to decode the video stream. When a compromise of the SGX enclave is detected, the streaming of the video stops instantly. In the evaluation, we demonstrate that the performance of this setup is sufficiently efficient to attest a live video streaming service.","PeriodicalId":407946,"journal":{"name":"2022 IEEE Secure Development Conference (SecDev)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131711423","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0