Proceedings of the 15th ACM conference on Computer and communications security最新文献_第3页

Session details: System security 1 会话详细信息:系统安全

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/3260808

Wenke Lee

引用次数: 0

A look in the mirror: attacks on package managers 照镜子:对包管理器的攻击

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455841

Justin Cappos, Justin Samuel, S. Baker, J. Hartman

{"title":"A look in the mirror: attacks on package managers","authors":"Justin Cappos, Justin Samuel, S. Baker, J. Hartman","doi":"10.1145/1455770.1455841","DOIUrl":"https://doi.org/10.1145/1455770.1455841","url":null,"abstract":"This work studies the security of ten popular package managers. These package managers use different security mechanisms that provide varying levels of usability and resilience to attack. We find that, despite their existing security mechanisms, all of these package managers have vulnerabilities that can be exploited by a man-in-the-middle or a malicious mirror. While all current package managers suffer from vulnerabilities, their security is also positively or negatively impacted by the distribution's security practices. Weaknesses in package managers are more easily exploited when distributions use third-party mirrors as official mirrors. We were successful in using false credentials to obtain an official mirror on all five of the distributions we attempted. We also found that some security mechanisms that control where a client obtains metadata and packages from may actually decrease security. We analyze current package managers to show that by exploiting vulnerabilities, an attacker with a mirror can compromise or crash hundreds to thousands of clients weekly. The problems we disclose are now being corrected by many different package manager maintainers.","PeriodicalId":440730,"journal":{"name":"Proceedings of the 15th ACM conference on Computer and communications security","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134645558","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 82

BootJacker: compromising computers using forced restarts BootJacker:使用强制重启危及计算机

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455840

Ellick Chan, Jeffrey C. Carlyle, Francis M. David, R. Farivar, R. Campbell

引用次数: 35

Type-checking zero-knowledge 类型检查0知识

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455816

M. Backes, Catalin Hritcu, Matteo Maffei

引用次数: 53

Traitor tracing with constant size ciphertext 用固定大小的密文跟踪叛徒

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455834

D. Boneh, M. Naor

引用次数: 115

Session details: System security 2 会话详细信息:系统安全

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/3260813

R. Sion

引用次数: 0

Assessing query privileges via safe and efficient permission composition 通过安全有效的权限组合评估查询权限

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455810

S. Vimercati, S. Foresti, S. Jajodia, S. Paraboschi, P. Samarati

引用次数: 23

Spamalytics: an empirical analysis of spam marketing conversion 垃圾邮件分析:垃圾邮件营销转化的实证分析

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455774

Chris Kanich, C. Kreibich, Kirill Levchenko, Brandon Enright, G. Voelker, V. Paxson, S. Savage

引用次数: 180

Efficient attributes for anonymous credentials 匿名凭据的有效属性

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455814

J. Camenisch, Thomas Gross

{"title":"Efficient attributes for anonymous credentials","authors":"J. Camenisch, Thomas Gross","doi":"10.1145/1455770.1455814","DOIUrl":"https://doi.org/10.1145/1455770.1455814","url":null,"abstract":"We extend the Camenisch-Lysyanskaya anonymous credential system such that selective disclosure of attributes becomes highly efficient. The resulting system significantly improves upon existing approaches, which suffer from a linear complexity in the total number of attributes. This limitation makes them unfit for many practical applications, such as electronic identity cards. Our system can incorporate an arbitrary number of binary and finite-set attributes without significant performance impact. Our approach folds all such attributes in a single attribute base and, thus, boosts the efficiency of all proofs of possession. The core idea is to encode discrete binary and finite-set attribute values as prime numbers. We use the divisibility property for efficient proofs of their presence or absence. We additionally contribute efficient methods for conjunctions and disjunctions. The system builds on the Strong-RSA assumption alone. We demonstrate the applicability and performance improvements of our method in realistic application scenarios, such as, electronic identity cards and complex/structured credentials. Our method has crucial advantages in devices with restricted computational capabilities, such as smartcards and cell phones.","PeriodicalId":440730,"journal":{"name":"Proceedings of the 15th ACM conference on Computer and communications security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-10-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129977535","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 32

A formal framework for reflective database access control policies 用于反射数据库访问控制策略的正式框架

Proceedings of the 15th ACM conference on Computer and communications security Pub Date : 2008-10-27 DOI: 10.1145/1455770.1455808

L.E. Olson, Carl A. Gunter, P. Madhusudan

引用次数: 40