首页 > 最新文献

Proceedings 2019 Network and Distributed System Security Symposium最新文献

英文 中文
Network and System Security: 17th International Conference, NSS 2023, Canterbury, UK, August 14–16, 2023, Proceedings 网络与系统安全:第17届国际会议,NSS 2023,坎特伯雷,英国,8月14-16日,2023,论文集
Pub Date : 2023-01-01 DOI: 10.1007/978-3-031-39828-5
{"title":"Network and System Security: 17th International Conference, NSS 2023, Canterbury, UK, August 14–16, 2023, Proceedings","authors":"","doi":"10.1007/978-3-031-39828-5","DOIUrl":"https://doi.org/10.1007/978-3-031-39828-5","url":null,"abstract":"","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2023-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81658313","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Network and System Security: 16th International Conference, NSS 2022, Denarau Island, Fiji, December 9–12, 2022, Proceedings 网络和系统安全:第16届国际会议,NSS 2022,斐济德纳劳岛,12月9日至12日,2022,会议记录
Pub Date : 2022-01-01 DOI: 10.1007/978-3-031-23020-2
{"title":"Network and System Security: 16th International Conference, NSS 2022, Denarau Island, Fiji, December 9–12, 2022, Proceedings","authors":"","doi":"10.1007/978-3-031-23020-2","DOIUrl":"https://doi.org/10.1007/978-3-031-23020-2","url":null,"abstract":"","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2022-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82273301","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Network and System Security: 15th International Conference, NSS 2021, Tianjin, China, October 23, 2021, Proceedings 网络与系统安全:第15届国际会议,NSS 2021,天津,中国,2021年10月23日,会议录
Pub Date : 2021-01-01 DOI: 10.1007/978-3-030-92708-0
{"title":"Network and System Security: 15th International Conference, NSS 2021, Tianjin, China, October 23, 2021, Proceedings","authors":"","doi":"10.1007/978-3-030-92708-0","DOIUrl":"https://doi.org/10.1007/978-3-030-92708-0","url":null,"abstract":"","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2021-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90196936","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Network and System Security: 14th International Conference, NSS 2020, Melbourne, VIC, Australia, November 25–27, 2020, Proceedings 网络与系统安全:第14届国际会议,NSS 2020,墨尔本,维多利亚州,澳大利亚,11月25日至27日,2020,会议录
Pub Date : 2020-01-01 DOI: 10.1007/978-3-030-65745-1
Kutyłowski, Jun Zhang, Chao Chen
{"title":"Network and System Security: 14th International Conference, NSS 2020, Melbourne, VIC, Australia, November 25–27, 2020, Proceedings","authors":"Kutyłowski, Jun Zhang, Chao Chen","doi":"10.1007/978-3-030-65745-1","DOIUrl":"https://doi.org/10.1007/978-3-030-65745-1","url":null,"abstract":"","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2020-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86333389","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Neuro-Symbolic Execution: Augmenting Symbolic Execution with Neural Constraints 神经符号执行:神经约束下的增强符号执行
Pub Date : 2019-07-23 DOI: 10.14722/ndss.2019.23530
Shiqi Shen, Shweta Shinde, Soundarya Ramesh, Abhik Roychoudhury, P. Saxena
Symbolic execution is a powerful technique for program analysis. However, it has many limitations in practical applicability: the path explosion problem encumbers scalability, the need for language-specific implementation, the inability to handle complex dependencies, and the limited expressiveness of theories supported by underlying satisfiability checkers. Often, relationships between variables of interest are not expressible directly as purely symbolic constraints. To this end, we present a new approach—neuro-symbolic execution—which learns an approximation of the relationship between program values of interest, as a neural network. We develop a procedure for checking satisfiability of mixed constraints, involving both symbolic expressions and neural representations. We implement our new approach in a tool called NEUEX as an extension of KLEE, a state-of-the-art dynamic symbolic execution engine. NEUEX finds 33 exploits in a benchmark of 7 programs within 12 hours. This is an improvement in the bug finding efficacy of 94% over vanilla KLEE. We show that this new approach drives execution down difficult paths on which KLEE and other DSE extensions get stuck, eliminating limitations of purely SMT-based techniques.
符号执行是一种强大的程序分析技术。然而,它在实际应用中有许多限制:路径爆炸问题阻碍了可伸缩性,需要特定于语言的实现,无法处理复杂的依赖关系,以及底层可满足性检查器支持的理论的有限表达性。通常,感兴趣的变量之间的关系不能直接表示为纯粹的符号约束。为此,我们提出了一种新的方法-神经符号执行-它以神经网络的形式学习感兴趣的程序值之间关系的近似值。我们开发了一个程序来检查混合约束的可满足性,包括符号表达式和神经表示。我们在一个名为NEUEX的工具中实现了我们的新方法,作为KLEE的扩展,KLEE是一个最先进的动态符号执行引擎。在12小时内,NEUEX在7个程序的基准测试中发现了33个漏洞。这比香草KLEE的bug查找效率提高了94%。我们展示了这种新方法推动执行沿着KLEE和其他DSE扩展卡住的困难路径,消除了纯粹基于smt的技术的限制。
{"title":"Neuro-Symbolic Execution: Augmenting Symbolic Execution with Neural Constraints","authors":"Shiqi Shen, Shweta Shinde, Soundarya Ramesh, Abhik Roychoudhury, P. Saxena","doi":"10.14722/ndss.2019.23530","DOIUrl":"https://doi.org/10.14722/ndss.2019.23530","url":null,"abstract":"Symbolic execution is a powerful technique for program analysis. However, it has many limitations in practical applicability: the path explosion problem encumbers scalability, the need for language-specific implementation, the inability to handle complex dependencies, and the limited expressiveness of theories supported by underlying satisfiability checkers. Often, relationships between variables of interest are not expressible directly as purely symbolic constraints. To this end, we present a new approach—neuro-symbolic execution—which learns an approximation of the relationship between program values of interest, as a neural network. We develop a procedure for checking satisfiability of mixed constraints, involving both symbolic expressions and neural representations. We implement our new approach in a tool called NEUEX as an extension of KLEE, a state-of-the-art dynamic symbolic execution engine. NEUEX finds 33 exploits in a benchmark of 7 programs within 12 hours. This is an improvement in the bug finding efficacy of 94% over vanilla KLEE. We show that this new approach drives execution down difficult paths on which KLEE and other DSE extensions get stuck, eliminating limitations of purely SMT-based techniques.","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-07-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78204980","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 28
DroidCap: OS Support for Capability-based Permissions in Android DroidCap: Android中基于能力的权限的操作系统支持
Pub Date : 2019-02-25 DOI: 10.14722/ndss.2019.23398
A. Dawoud, Sven Bugiel
We present DroidCap, a retrofitting of Android’s central Binder IPC mechanism to change the way how permissions are being represented and managed in the system. In DroidCap, permissions are per-process Binder object capabilities. DroidCap's design removes Android’s UID-based ambient authority and allows the delegation of capabilities between processes to create least-privileged protection domains efficiently. With DroidCap, we show that object capabilities as underlying access control model integrates naturally and backward-compatible into Android’s stock permission model and application management. Thus, our Binder capabilities provide app developers with a new path to gradually adopting app compartmentalization, which we showcase at two favorite examples from the literature, privilege separated advertisement libraries and least privileged app components.
我们提出了DroidCap, Android的中央Binder IPC机制的改进,以改变系统中权限的表示和管理方式。在DroidCap中,权限是每个进程Binder对象的能力。DroidCap的设计消除了Android基于uid的环境权限,并允许进程之间的能力委托,以有效地创建最低特权保护域。通过DroidCap,我们展示了作为底层访问控制模型的对象功能自然且向后兼容地集成到Android的库存权限模型和应用程序管理中。因此,我们的Binder功能为应用程序开发人员提供了一条逐步采用应用程序分区的新途径,我们在文献中展示了两个最受欢迎的例子:特权分离的广告库和最低特权的应用程序组件。
{"title":"DroidCap: OS Support for Capability-based Permissions in Android","authors":"A. Dawoud, Sven Bugiel","doi":"10.14722/ndss.2019.23398","DOIUrl":"https://doi.org/10.14722/ndss.2019.23398","url":null,"abstract":"We present DroidCap, a retrofitting of Android’s central Binder IPC mechanism to change the way how permissions are being represented and managed in the system. In DroidCap, permissions are per-process Binder object capabilities. DroidCap's design removes Android’s UID-based ambient authority and allows the delegation of capabilities between processes to create least-privileged protection domains efficiently. With DroidCap, we show that object capabilities as underlying access control model integrates naturally and backward-compatible into Android’s stock permission model and application management. Thus, our Binder capabilities provide app developers with a new path to gradually adopting app compartmentalization, which we showcase at two favorite examples from the literature, privilege separated advertisement libraries and least privileged app components.","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-02-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74924104","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
MBeacon: Privacy-Preserving Beacons for DNA Methylation Data MBeacon: DNA甲基化数据的隐私保护信标
Pub Date : 2019-02-24 DOI: 10.14722/ndss.2019.23064
Inken Hagestedt, Yang Zhang, Mathias Humbert, Pascal Berrang, Haixu Tang, Xiaofeng Wang, M. Backes
The advancement of molecular profiling techniques fuels biomedical research with a deluge of data. To facilitate data sharing, the Global Alliance for Genomics and Health established the Beacon system, a search engine designed to help researchers find datasets of interest. While the current Beacon system only supports genomic data, other types of biomedical data, such as DNA methylation, are also essential for advancing our understanding in the field. In this paper, we propose the first Beacon system for DNA methylation data sharing: MBeacon. As the current genomic Beacon is vulnerable to privacy attacks, such as membership inference, and DNA methylation data is highly sensitive, we take a privacy-by-design approach to construct MBeacon. First, we demonstrate the privacy threat, by proposing a membership inference attack tailored specifically to unprotected methylation Beacons. Our experimental results show that 100 queries are sufficient to achieve a successful attack with AUC (area under the ROC curve) above 0.9. To remedy this situation, we propose a novel differential privacy mechanism, namely SVT2 , which is the core component of MBeacon. Extensive experiments over multiple datasets show that SVT2 can successfully mitigate membership privacy risks without significantly harming utility. We further implement a fully functional prototype of MBeacon which we make available to the research community
分子分析技术的进步为生物医学研究提供了大量的数据。为了促进数据共享,全球基因组学与健康联盟建立了Beacon系统,这是一个搜索引擎,旨在帮助研究人员找到感兴趣的数据集。虽然目前的Beacon系统只支持基因组数据,但其他类型的生物医学数据,如DNA甲基化,对于促进我们对该领域的理解也至关重要。在本文中,我们提出了第一个用于DNA甲基化数据共享的信标系统:MBeacon。鉴于目前的基因组信标容易受到成员推理等隐私攻击,且DNA甲基化数据高度敏感,我们采用基于隐私的设计方法构建MBeacon。首先,我们通过提出专门针对未受保护的甲基化信标的成员推理攻击来演示隐私威胁。我们的实验结果表明,100个查询足以实现AUC (ROC曲线下的面积)大于0.9的成功攻击。为了解决这种情况,我们提出了一种新的差分隐私机制,即SVT2,它是MBeacon的核心组件。在多个数据集上进行的大量实验表明,SVT2可以在不显著损害效用的情况下成功地降低会员隐私风险。我们进一步实现了MBeacon的全功能原型,并将其提供给研究社区
{"title":"MBeacon: Privacy-Preserving Beacons for DNA Methylation Data","authors":"Inken Hagestedt, Yang Zhang, Mathias Humbert, Pascal Berrang, Haixu Tang, Xiaofeng Wang, M. Backes","doi":"10.14722/ndss.2019.23064","DOIUrl":"https://doi.org/10.14722/ndss.2019.23064","url":null,"abstract":"The advancement of molecular profiling techniques \u0000fuels biomedical research with a deluge of data. To facilitate \u0000data sharing, the Global Alliance for Genomics and Health \u0000established the Beacon system, a search engine designed to help \u0000researchers find datasets of interest. While the current Beacon \u0000system only supports genomic data, other types of biomedical \u0000data, such as DNA methylation, are also essential for advancing \u0000our understanding in the field. In this paper, we propose the first \u0000Beacon system for DNA methylation data sharing: MBeacon. As \u0000the current genomic Beacon is vulnerable to privacy attacks, such \u0000as membership inference, and DNA methylation data is highly \u0000sensitive, we take a privacy-by-design approach to construct \u0000MBeacon. \u0000First, we demonstrate the privacy threat, by proposing a \u0000membership inference attack tailored specifically to unprotected \u0000methylation Beacons. Our experimental results show that 100 \u0000queries are sufficient to achieve a successful attack with AUC \u0000(area under the ROC curve) above 0.9. To remedy this situation, \u0000we propose a novel differential privacy mechanism, namely SVT2 \u0000, \u0000which is the core component of MBeacon. Extensive experiments \u0000over multiple datasets show that SVT2 \u0000can successfully mitigate \u0000membership privacy risks without significantly harming utility. \u0000We further implement a fully functional prototype of MBeacon \u0000which we make available to the research community","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-02-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78829063","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 38
JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits JavaScript模板攻击:自动推断主机信息的目标漏洞
Pub Date : 2019-02-24 DOI: 10.14722/ndss.2019.23155
Michael Schwarz, F. Lackner, D. Gruss
Today, more and more web browsers and extensions provide anonymity features to hide user details. Primarily used to evade tracking by websites and advertisements, these features are also used by criminals to prevent identification. Thus, not only tracking companies but also law-enforcement agencies have an interest in finding flaws which break these anonymity features. For instance, for targeted exploitation using zero days, it is essential to have as much information about the target as possible. A failed exploitation attempt, e.g., due to a wrongly guessed operating system, can burn the zero-day, effectively costing the attacker money. Also for side-channel attacks, it is of the utmost importance to know certain aspects of the victim’s hardware configuration, e.g., the instruction-set architecture. Moreover, knowledge about specific environmental properties, such as the operating system, allows crafting more plausible dialogues for phishing attacks. In this paper, we present a fully automated approach to find subtle differences in browser engines caused by the environment. Furthermore, we present two new side-channel attacks on browser engines to detect the instruction-set architecture and the used memory allocator. Using these differences, we can deduce information about the system, both about the software as well as the hardware. As a result, we cannot only ease the creation of fingerprints, but we gain the advantage of having a more precise picture for targeted exploitation. Our approach allows automating the cumbersome manual search for such differences. We collect all data available to the JavaScript engine and build templates from these properties. If a property of such a template stays the same on one system but differs on a different system, we found an environment-dependent property. We found environment-dependent properties in Firefox, Chrome, Edge, and mobile Tor, allowing us to reveal the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version. We stress that our method should be used in the development of browsers and privacy extensions to automatically find flaws in the implementation.
如今,越来越多的web浏览器和扩展提供匿名功能来隐藏用户详细信息。这些功能主要用于逃避网站和广告的跟踪,也被犯罪分子用来防止身份识别。因此,不仅追踪公司,执法机构也有兴趣找到打破这些匿名特性的漏洞。例如,对于使用零天的目标利用,必须尽可能多地了解目标的信息。一次失败的利用尝试,例如,由于错误猜测操作系统,可以烧毁零日漏洞,有效地使攻击者损失金钱。此外,对于侧信道攻击,了解受害者硬件配置的某些方面是至关重要的,例如,指令集架构。此外,关于特定环境属性(如操作系统)的知识允许为网络钓鱼攻击制作更合理的对话。在本文中,我们提出了一种完全自动化的方法来发现由环境引起的浏览器引擎的细微差异。此外,我们还提出了两种新的针对浏览器引擎的侧信道攻击来检测指令集架构和使用的内存分配器。利用这些差异,我们可以推断出系统的信息,包括软件和硬件。因此,我们不仅可以简化指纹的创建,而且还可以获得更精确的图像以进行有针对性的利用。我们的方法允许对这些差异进行繁琐的手动搜索。我们收集JavaScript引擎可用的所有数据,并根据这些属性构建模板。如果这样一个模板的属性在一个系统上保持不变,但在另一个系统上有所不同,那么我们就找到了依赖于环境的属性。我们在Firefox、Chrome、Edge和移动Tor中发现了与环境相关的属性,使我们能够揭示底层操作系统、CPU架构、使用的隐私增强插件以及确切的浏览器版本。我们强调,我们的方法应该用于浏览器和隐私扩展的开发,以自动发现实现中的缺陷。
{"title":"JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits","authors":"Michael Schwarz, F. Lackner, D. Gruss","doi":"10.14722/ndss.2019.23155","DOIUrl":"https://doi.org/10.14722/ndss.2019.23155","url":null,"abstract":"Today, more and more web browsers and extensions provide anonymity features to hide user details. Primarily used to evade tracking by websites and advertisements, these features are also used by criminals to prevent identification. Thus, not only tracking companies but also law-enforcement agencies have an interest in finding flaws which break these anonymity features. For instance, for targeted exploitation using zero days, it is essential to have as much information about the target as possible. A failed exploitation attempt, e.g., due to a wrongly guessed operating system, can burn the zero-day, effectively costing the attacker money. Also for side-channel attacks, it is of the utmost importance to know certain aspects of the victim’s hardware configuration, e.g., the instruction-set architecture. Moreover, knowledge about specific environmental properties, such as the operating system, allows crafting more plausible dialogues for phishing attacks. In this paper, we present a fully automated approach to find subtle differences in browser engines caused by the environment. Furthermore, we present two new side-channel attacks on browser engines to detect the instruction-set architecture and the used memory allocator. Using these differences, we can deduce information about the system, both about the software as well as the hardware. As a result, we cannot only ease the creation of fingerprints, but we gain the advantage of having a more precise picture for targeted exploitation. Our approach allows automating the cumbersome manual search for such differences. We collect all data available to the JavaScript engine and build templates from these properties. If a property of such a template stays the same on one system but differs on a different system, we found an environment-dependent property. We found environment-dependent properties in Firefox, Chrome, Edge, and mobile Tor, allowing us to reveal the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version. We stress that our method should be used in the development of browsers and privacy extensions to automatically find flaws in the implementation.","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-02-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91547241","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 45
Nearby Threats: Reversing, Analyzing, and Attacking Google's 'Nearby Connections' on Android 附近的威胁:逆转,分析和攻击谷歌在Android上的“附近连接”
Pub Date : 2019-02-24 DOI: 10.14722/ndss.2019.23367
D. Antonioli, Nils Ole Tippenhauer, Kasper Bonne Rasmussen
Google’s Nearby Connections API enables any An-droid (and Android Things) application to provide proximity-based services to its users, regardless of their network connectivity.The API uses Bluetooth BR/EDR, Bluetooth LE and Wi-Fi to let“nearby” clients (discoverers) and servers (advertisers) connectand exchange different types of payloads. The implementation ofthe API is proprietary, closed-source and obfuscated. The updatesof the API are automatically installed by Google across differentversions of Android, without user interaction. Little is knownpublicly about the security guarantees offered by the API, eventhough it presents a significant attack surface.In this work we present the first security analysis of theGoogle’s Nearby Connections API, based on reverse-engineeringof its Android implementation. We discover and implement sev-eral attacks grouped into two families: connection manipulation(CMA) and range extension attacks (REA). CMA-attacks allow anattacker to insert himself as a man-in-the-middle and manipulateconnections (even unrelated to nearby), and to tamper withthe victim’s interface and network configuration. REA-attacksallow an attacker to tunnel any nearby connection to remotelocations, even between two honest devices. Our attacks areenabled by REArby, a toolkit we developed while reversingthe API implementation. REArby includes a dynamic binaryinstrumenter, a packet dissector, and the implementations ofcustom Nearby Connections client and server. We plan to open-source REArby after a responsible disclosure period.
b谷歌的附近连接API允许任何Android(和Android Things)应用程序为其用户提供基于邻近的服务,而不管他们的网络连接情况如何。API使用蓝牙BR/EDR,蓝牙LE和Wi-Fi让“附近”客户端(发现者)和服务器(广告商)连接并交换不同类型的有效载荷。API的实现是专有的、闭源的和模糊的。API的更新由谷歌自动安装在不同版本的Android上,无需用户交互。公众对API提供的安全保证知之甚少,尽管它呈现了一个重要的攻击面。在这项工作中,我们提出了谷歌的附近连接API的第一个安全分析,基于其Android实现的逆向工程。我们发现并实现了几种攻击,分为两大类:连接操纵攻击(connection manipulation, CMA)和范围扩展攻击(range extension attacks, REA)。cma攻击允许攻击者将自己作为中间人插入并操纵连接(甚至与附近无关),并篡改受害者的接口和网络配置。rea攻击允许攻击者通过隧道将任何附近的连接连接到远程位置,甚至是两个诚实设备之间的连接。我们的攻击是通过REArby实现的,这是我们在逆转API实现时开发的一个工具包。REArby包括一个动态二进制仪器,一个数据包解析器,以及自定义附近连接客户端和服务器的实现。我们计划在一个负责任的披露期后开源REArby。
{"title":"Nearby Threats: Reversing, Analyzing, and Attacking Google's 'Nearby Connections' on Android","authors":"D. Antonioli, Nils Ole Tippenhauer, Kasper Bonne Rasmussen","doi":"10.14722/ndss.2019.23367","DOIUrl":"https://doi.org/10.14722/ndss.2019.23367","url":null,"abstract":"Google’s Nearby Connections API enables any An-droid (and Android Things) application to provide proximity-based services to its users, regardless of their network connectivity.The API uses Bluetooth BR/EDR, Bluetooth LE and Wi-Fi to let“nearby” clients (discoverers) and servers (advertisers) connectand exchange different types of payloads. The implementation ofthe API is proprietary, closed-source and obfuscated. The updatesof the API are automatically installed by Google across differentversions of Android, without user interaction. Little is knownpublicly about the security guarantees offered by the API, eventhough it presents a significant attack surface.In this work we present the first security analysis of theGoogle’s Nearby Connections API, based on reverse-engineeringof its Android implementation. We discover and implement sev-eral attacks grouped into two families: connection manipulation(CMA) and range extension attacks (REA). CMA-attacks allow anattacker to insert himself as a man-in-the-middle and manipulateconnections (even unrelated to nearby), and to tamper withthe victim’s interface and network configuration. REA-attacksallow an attacker to tunnel any nearby connection to remotelocations, even between two honest devices. Our attacks areenabled by REArby, a toolkit we developed while reversingthe API implementation. REArby includes a dynamic binaryinstrumenter, a packet dissector, and the implementations ofcustom Nearby Connections client and server. We plan to open-source REArby after a responsible disclosure period.","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-02-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75956019","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 20
Cybercriminal Minds: An investigative study of cryptocurrency abuses in the Dark Web 网络犯罪心理:对暗网中加密货币滥用的调查研究
Pub Date : 2019-02-24 DOI: 10.14722/NDSS.2019.23055
Seunghyeon Lee, Changhoon Yoon, Heedo Kang, Yeonkeun Kim, Yongdae Kim, Dongsu Han, Sooel Son, Seungwon Shin
The Dark Web is notorious for being a major distribution channel of harmful content as well as unlawful goods. Perpetrators have also used cryptocurrencies to conduct illicit financial transactions while hiding their identities. The limited coverage and outdated data of the Dark Web in previous studies motivated us to conduct an in-depth investigative study to understand how perpetrators abuse cryptocurrencies in the Dark Web. We designed and implemented MFScope, a new framework which collects Dark Web data, extracts cryptocurrency information, and analyzes their usage characteristics on the Dark Web. Specifically, MFScope collected more than 27 million dark webpages and extracted around 10 million unique cryptocurrency addresses for Bitcoin, Ethereum, and Monero. It then classified their usages to identify trades of illicit goods and traced cryptocurrency money flows, to reveal black money operations on the Dark Web. In total, using MFScope we discovered that more than 80% of Bitcoin addresses on the Dark Web were used with malicious intent; their monetary volume was around 180 million USD, and they sent a large sum of their money to several popular cryptocurrency services (e.g., exchange services). Furthermore, we present two real-world unlawful services and demonstrate their Bitcoin transaction traces, which helps in understanding their marketing strategy as well as black money operations.
暗网因成为有害内容和非法商品的主要分销渠道而臭名昭著。犯罪者还使用加密货币进行非法金融交易,同时隐藏自己的身份。在之前的研究中,暗网的有限覆盖和过时的数据促使我们进行深入的调查研究,以了解肇事者如何在暗网中滥用加密货币。我们设计并实现了MFScope,这是一个收集暗网数据,提取加密货币信息并分析其在暗网上使用特征的新框架。具体来说,MFScope收集了超过2700万个暗网页,并为比特币、以太坊和门罗币提取了大约1000万个唯一的加密货币地址。然后对它们的用途进行分类,以识别非法商品交易,并追踪加密货币的资金流动,以揭示暗网上的黑钱操作。总的来说,使用MFScope,我们发现黑暗网络上超过80%的比特币地址被恶意使用;他们的货币数量约为1.8亿美元,他们将大量资金发送到几种流行的加密货币服务(例如交易所服务)。此外,我们展示了两个真实世界的非法服务,并展示了他们的比特币交易痕迹,这有助于了解他们的营销策略以及黑钱操作。
{"title":"Cybercriminal Minds: An investigative study of cryptocurrency abuses in the Dark Web","authors":"Seunghyeon Lee, Changhoon Yoon, Heedo Kang, Yeonkeun Kim, Yongdae Kim, Dongsu Han, Sooel Son, Seungwon Shin","doi":"10.14722/NDSS.2019.23055","DOIUrl":"https://doi.org/10.14722/NDSS.2019.23055","url":null,"abstract":"The Dark Web is notorious for being a major distribution channel of harmful content as well as unlawful goods. Perpetrators have also used cryptocurrencies to conduct illicit financial transactions while hiding their identities. The limited coverage and outdated data of the Dark Web in previous studies motivated us to conduct an in-depth investigative study to understand how perpetrators abuse cryptocurrencies in the Dark Web. We designed and implemented MFScope, a new framework which collects Dark Web data, extracts cryptocurrency information, and analyzes their usage characteristics on the Dark Web. Specifically, MFScope collected more than 27 million dark webpages and extracted around 10 million unique cryptocurrency addresses for Bitcoin, Ethereum, and Monero. It then classified their usages to identify trades of illicit goods and traced cryptocurrency money flows, to reveal black money operations on the Dark Web. In total, using MFScope we discovered that more than 80% of Bitcoin addresses on the Dark Web were used with malicious intent; their monetary volume was around 180 million USD, and they sent a large sum of their money to several popular cryptocurrency services (e.g., exchange services). Furthermore, we present two real-world unlawful services and demonstrate their Bitcoin transaction traces, which helps in understanding their marketing strategy as well as black money operations.","PeriodicalId":20444,"journal":{"name":"Proceedings 2019 Network and Distributed System Security Symposium","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-02-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86598725","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 71
期刊
Proceedings 2019 Network and Distributed System Security Symposium
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1