Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security最新文献_第9页

Breaking Web Applications Built On Top of Encrypted Data 打破基于加密数据的Web应用程序

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2978351

Paul Grubbs, R. McPherson, Muhammad Naveed, T. Ristenpart, Vitaly Shmatikov

引用次数: 86

A Systematic Analysis of the Juniper Dual EC Incident Juniper双EC事件的系统分析

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2978395

Stephen Checkoway, Shaanan N. Cohney, Christina Garman, M. Green, N. Heninger, Jacob Maskiewicz, E. Rescorla, H. Shacham, R. Weinmann

{"title":"A Systematic Analysis of the Juniper Dual EC Incident","authors":"Stephen Checkoway, Shaanan N. Cohney, Christina Garman, M. Green, N. Heninger, Jacob Maskiewicz, E. Rescorla, H. Shacham, R. Weinmann","doi":"10.1145/2976749.2978395","DOIUrl":"https://doi.org/10.1145/2976749.2978395","url":null,"abstract":"In December 2015, Juniper Networks announced multiple security vulnerabilities stemming from unauthorized code in ScreenOS, the operating system for their NetScreen VPN routers. The more sophisticated of these vulnerabilities was a passive VPN decryption capability, enabled by a change to one of the elliptic curve points used by the Dual EC pseudorandom number generator. In this paper, we describe the results of a full independent analysis of the ScreenOS randomness and VPN key establishment protocol subsystems, which we carried out in response to this incident. While Dual EC is known to be insecure against an attacker who can choose the elliptic curve parameters, Juniper had claimed in 2013 that ScreenOS included countermeasures against this type of attack. We find that, contrary to Juniper's public statements, the ScreenOS VPN implementation has been vulnerable since 2008 to passive exploitation by an attacker who selects the Dual EC curve point. This vulnerability arises due to apparent flaws in Juniper's countermeasures as well as a cluster of changes that were all introduced concurrently with the inclusion of Dual EC in a single 2008 release. We demonstrate the vulnerability on a real NetScreen device by modifying the firmware to install our own parameters, and we show that it is possible to passively decrypt an individual VPN session in isolation without observing any other network traffic. We investigate the possibility of passively fingerprinting ScreenOS implementations in the wild. This incident is an important example of how guidelines for random number generation, engineering, and validation can fail in practice.","PeriodicalId":432261,"journal":{"name":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125583406","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 83

DEMO: High-Throughput Secure Three-Party Computation of Kerberos Ticket Generation 演示:Kerberos票据生成的高吞吐量安全三方计算

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2989035

Toshinori Araki, Assaf Barak, Jun Furukawa, Yehuda Lindell, Ariel Nof, Kazuma Ohara

引用次数: 6

POSTER: Identifying Dynamic Data Structures in Malware 海报:识别恶意软件中的动态数据结构

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2989041

Thomas Rupprecht, Xi Chen, D. H. White, J. Mühlberg, H. Bos, Gerald Lüttgen

引用次数: 1

POSTER: Towards Highly Interactive Honeypots for Industrial Control Systems 海报:面向工业控制系统的高度交互蜜罐

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2989063

Stephan Lau, Johannes Klick, S. Arndt, Volker Roth

{"title":"POSTER: Towards Highly Interactive Honeypots for Industrial Control Systems","authors":"Stephan Lau, Johannes Klick, S. Arndt, Volker Roth","doi":"10.1145/2976749.2989063","DOIUrl":"https://doi.org/10.1145/2976749.2989063","url":null,"abstract":"Honeypots are a common tool to set intrusion alarms and to study attacks against computer systems. In order to be convincing, honeypots attempt to resemble actual systems that are in active use. Recently, researchers have begun to develop honeypots for programmable logic controllers (PLCs). The tools of which we are aware have limited functionality compared to genuine devices. Particularly, they do not support running actual PLC programs. In order to improve upon the interactive capabilities of PLC honeypots we set out to develop a simulator for Siemens S7-300 series PLCs. Our current prototype XPOT supports PLC program compilation and interpretation, the proprietary S7comm protocol and SNMP. While the supported feature set is not yet comprehensive, it is possible to program it using standard IDEs such as Siemens' TIA portal. Additionally, we emulate the characteristics of the network stack of our reference PLC in order to resist OS fingerprinting attempts using tools such as Nmap. Initial experiments with students whom we trained in PLC programming indicate that XPOT may resist cursory inspection but still fails against knowledgeable and suspicious adversaries. We conclude that high-interactive PLC honeypots need to support a fairly complete feature set of the genuine, simulated PLC.","PeriodicalId":432261,"journal":{"name":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123955285","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

DEMO: Integrating MPC in Big Data Workflows 演示:在大数据工作流中集成MPC

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2989034

Nikolaj Volgushev, Malte Schwarzkopf, A. Lapets, Mayank Varia, Azer Bestavros

{"title":"DEMO: Integrating MPC in Big Data Workflows","authors":"Nikolaj Volgushev, Malte Schwarzkopf, A. Lapets, Mayank Varia, Azer Bestavros","doi":"10.1145/2976749.2989034","DOIUrl":"https://doi.org/10.1145/2976749.2989034","url":null,"abstract":"Secure multi-party computation (MPC) allows multiple parties to perform a joint computation without disclosing their private inputs. Many real-world joint computation use cases, however, involve data analyses on very large data sets, and are implemented by software engineers who lack MPC knowledge. Moreover, the collaborating parties -- e.g., several companies -- often deploy different data analytics stacks internally. These restrictions hamper the real-world usability of MPC. To address these challenges, we combine existing MPC frameworks with data-parallel analytics frameworks by extending the Musketeer big data workflow manager [4]. Musketeer automatically generates code for both the sensitive parts of a workflow, which are executed in MPC, and the remainder of the computation, which runs on scalable, widely-deployed analytics systems. In a prototype use case, we compute the Herfindahl-Hirschman Index (HHI), an index of market concentration used in antitrust regulation, on an aggregate 156GB of taxi trip data over five transportation companies. Our implementation computes the HHI in about 20 minutes using a combination of Hadoop and VIFF [1], while even \"mixed mode\" MPC with VIFF alone would have taken many hours. Finally, we discuss future research questions that we seek to address using our approach.","PeriodicalId":432261,"journal":{"name":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121901492","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

DEMO: OffPAD - Offline Personal Authenticating Device with Applications in Hospitals and e-Banking 演示:OffPAD -离线个人认证设备及其在医院和电子银行的应用

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2989033

Denis Migdal, Christian Johansen, A. Jøsang

{"title":"DEMO: OffPAD - Offline Personal Authenticating Device with Applications in Hospitals and e-Banking","authors":"Denis Migdal, Christian Johansen, A. Jøsang","doi":"10.1145/2976749.2989033","DOIUrl":"https://doi.org/10.1145/2976749.2989033","url":null,"abstract":"Identity and authentication solutions often lack usability and scalability, or do not provide high enough authentication assurance. The concept of Lucidman (Local User-Centric Identity Management) is an approach to providing scalable, secure and user friendly identity and authentication functionalities. In this context we demonstrate the use of an OffPAD (Offline Personal Authentication Device) as a trusted device to support different forms of authentication. The Lucidman/OffPAD approach consists of locating the identity management and authentication functionalities on the user side instead of on the server side or in the cloud. This demo aims to show how OffPAD strengthens authentication assurance, improves usability, minimizes trust requirements, and has the advantage that trusted online interaction can be achieved even on malware infected client platforms. The trusted device OffPAD has been designed as a phone cover, therefore not requiring the user to carry an extra gadget. We focus on six demonstrators, three useful in e-banking and three in the hospital domain where nurses, doctors, or patients are authenticated and access is granted in various situations base on the OffPAD. A video with the same title is available online at www.offpad.org.","PeriodicalId":432261,"journal":{"name":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115134614","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Host of Troubles: Multiple Host Ambiguities in HTTP Implementations 问题主机:HTTP实现中的多主机歧义

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2978394

Jianjun Chen, Jian Jiang, Haixin Duan, N. Weaver, Tao Wan, V. Paxson

引用次数: 28

An Empirical Study of Mnemonic Sentence-based Password Generation Strategies 基于助记语句的密码生成策略的实证研究

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2978346

Weining Yang, Ninghui Li, Omar Chowdhury, Aiping Xiong, R. Proctor

引用次数: 38

POSTER: Towards Privacy-Preserving Biometric Identification in Cloud Computing 海报:云计算中保护隐私的生物特征识别

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Pub Date : 2016-10-24 DOI: 10.1145/2976749.2989048

Changhee Hahn, Junbeom Hur

引用次数: 4