首页 > 最新文献

Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security最新文献

英文 中文
Le rythme et la voix, premiers défis d’un traducteur de Claude Simon 节奏和声音,克劳德·西蒙翻译的第一个挑战
K. Holter
Pour tout lecteur il y a des rencontres textuelles plus decisives que d’autres. A plus forte raison pour un etudiant ou doctorant, puisque cela peut determiner la direction de sa vie professionnelle. Cela a ete mon cas, a ma premiere lecture de la premiere phrase de La Route des Flandres : Il tenait une lettre a la main, il leva les yeux me regarda puis de nouveau la lettre puis de nouveau moi, derriere lui je pouvais voir aller et venir passer les taches rouges acajou ocre des chevaux qu’on ...
对于任何读者来说,有一些文本会议比其他会议更有决定性。对于学生或博士生来说更是如此,因为这可以决定他们职业生涯的方向。这了我的情况,我以前读了弗兰德斯路的第一句:他手里拿着一封信,信再次抬起头来看着我,然后我然后又递给他身后,我会去见未来的桃木红赭色斑点马被...
{"title":"Le rythme et la voix, premiers défis d’un traducteur de Claude Simon","authors":"K. Holter","doi":"10.4000/CCS.940","DOIUrl":"https://doi.org/10.4000/CCS.940","url":null,"abstract":"Pour tout lecteur il y a des rencontres textuelles plus decisives que d’autres. A plus forte raison pour un etudiant ou doctorant, puisque cela peut determiner la direction de sa vie professionnelle. Cela a ete mon cas, a ma premiere lecture de la premiere phrase de La Route des Flandres : Il tenait une lettre a la main, il leva les yeux me regarda puis de nouveau la lettre puis de nouveau moi, derriere lui je pouvais voir aller et venir passer les taches rouges acajou ocre des chevaux qu’on ...","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"12 1","pages":"21-30"},"PeriodicalIF":0.0,"publicationDate":"2015-04-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89387102","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Simon au pays des soviets. Notes sur la réception de l’œuvre simonienne en Russie 西蒙在苏联国家。关于在俄罗斯接受西蒙尼作品的说明
Alexey Vishnyakov
Quel ecrivain pourrait ignorer un pays avec un heritage litteraire si brillant (Gogol, Tourgueniev, Tolstoi et Dostoievski)et qui ne peut etre nomme autrement que monumental ? Et puis – comment ne pas s’interesser a ce meme pays devenu un polygone pour la doctrine (l’utopie ?) marxiste […],le pays ou sont apparues des personnalites aussi monumentales(dans le mal comme dans le bien) que Lenine, Trotski ou Staline ? La Russie occupe dans l’ethnographie imaginaire de Simon l’une des premieres pl...
有哪个作家能忽视一个拥有如此辉煌文学遗产的国家(果戈理、屠格涅夫、托尔斯泰和陀思妥耶夫斯基),而这个国家只能被称为不朽的?此外,我们怎能不关心这个国家,这个国家已经成为马克思主义(乌托邦?)学说的多边形[…],这个国家出现了像列宁、托洛茨基或斯大林这样伟大的人物(无论好坏)?在西蒙的想象民族志中,俄罗斯占据了第一个pl…
{"title":"Simon au pays des soviets. Notes sur la réception de l’œuvre simonienne en Russie","authors":"Alexey Vishnyakov","doi":"10.4000/CCS.911","DOIUrl":"https://doi.org/10.4000/CCS.911","url":null,"abstract":"Quel ecrivain pourrait ignorer un pays avec un heritage litteraire si brillant (Gogol, Tourgueniev, Tolstoi et Dostoievski)et qui ne peut etre nomme autrement que monumental ? Et puis – comment ne pas s’interesser a ce meme pays devenu un polygone pour la doctrine (l’utopie ?) marxiste […],le pays ou sont apparues des personnalites aussi monumentales(dans le mal comme dans le bien) que Lenine, Trotski ou Staline ? La Russie occupe dans l’ethnographie imaginaire de Simon l’une des premieres pl...","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"74 1","pages":"145-168"},"PeriodicalIF":0.0,"publicationDate":"2014-05-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91396130","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Nonlinear Phenomena and Resonant Parametric Perturbation Control in QR-ZCS Buck DC-DC Converters QR-ZCS降压型DC-DC变换器的非线性现象及共振参数摄动控制
Fei-Hu Hsieh, Fengxia Liu, Hui-Chang Hsieh
{"title":"Nonlinear Phenomena and Resonant Parametric Perturbation Control in QR-ZCS Buck DC-DC Converters","authors":"Fei-Hu Hsieh, Fengxia Liu, Hui-Chang Hsieh","doi":"10.1007/978-3-642-33914-1_13","DOIUrl":"https://doi.org/10.1007/978-3-642-33914-1_13","url":null,"abstract":"","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"3 1","pages":"105-109"},"PeriodicalIF":0.0,"publicationDate":"2013-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"89368682","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Optical Spectrum Analysis of Chaotic Synchronization in a Bidirectional Coupled Semiconductor Laser System 双向耦合半导体激光系统混沌同步的光谱分析
I. Andrei, G. Popescu, C. Ticoș, M. Pascu
{"title":"Optical Spectrum Analysis of Chaotic Synchronization in a Bidirectional Coupled Semiconductor Laser System","authors":"I. Andrei, G. Popescu, C. Ticoș, M. Pascu","doi":"10.1007/978-3-642-33914-1_60","DOIUrl":"https://doi.org/10.1007/978-3-642-33914-1_60","url":null,"abstract":"","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"74 1","pages":"425-429"},"PeriodicalIF":0.0,"publicationDate":"2013-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91396123","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Crouching tiger - hidden payload: security risks of scalable vectors graphics 卧虎藏虎——隐藏载荷:可伸缩矢量图形的安全风险
M. Heiderich, Tilman Frosch, Meiko Jensen, Thorsten Holz
Scalable Vector Graphics (SVG) images so far played a rather small role on the Internet, mainly due to the lack of proper browser support. Recently, things have changed: the W3C and WHATWG draft specifications for HTML5 require modern web browsers to support SVG images to be embedded in a multitude of ways. Now SVG images can be embedded through the classical method via specific tags such as or , or in novel ways, such as with tags, CSS or inline in any HTML5 document. SVG files are generally considered to be plain images or animations, and security-wise, they are being treated as such (e.g., when an embedment of local or remote SVG images into websites or uploading these files into rich web applications takes place). Unfortunately, this procedure poses great risks for the web applications and the users utilizing them, as it has been proven that SVG files must be considered fully functional, one-file web applications potentially containing HTML, JavaScript, Flash, and other interactive code structures. We found that even more severe problems have resulted from the often improper handling of complex and maliciously prepared SVG files by the browsers. In this paper, we introduce several novel attack techniques targeted at major websites, as well as modern browsers, email clients and other comparable tools. In particular, we illustrate that SVG images embedded via tag and CSS can execute arbitrary JavaScript code. We examine and present how current filtering techniques are circumventable by using SVG files and subsequently propose an approach to mitigate these risks. The paper showcases our research into the usage of SVG images as attack tools, and determines its impact on state-of-the-art web browsers such as Firefox 4, Internet Explorer 9, and Opera 11.
迄今为止,可缩放矢量图形(SVG)图像在Internet上的作用相当小,这主要是由于缺乏适当的浏览器支持。最近,情况发生了变化:W3C和WHATWG的HTML5规范草案要求现代web浏览器支持以多种方式嵌入SVG图像。现在,SVG图像可以通过传统方法通过特定的标记(如或)嵌入,或者以新颖的方式嵌入,例如在任何HTML5文档中使用标记、CSS或内联。SVG文件通常被认为是纯图像或动画,并且从安全角度来看,它们被视为纯图像或动画(例如,当将本地或远程SVG图像嵌入到网站中或将这些文件上传到富web应用程序中时)。不幸的是,这个过程给web应用程序和使用它们的用户带来了很大的风险,因为已经证明SVG文件必须被认为是功能齐全的、单文件的web应用程序,可能包含HTML、JavaScript、Flash和其他交互式代码结构。我们发现,更严重的问题是由于浏览器对复杂和恶意准备的SVG文件的处理不当造成的。在本文中,我们介绍了几种针对主要网站,以及现代浏览器,电子邮件客户端和其他类似工具的新型攻击技术。特别地,我们说明了通过标记和CSS嵌入的SVG图像可以执行任意JavaScript代码。我们将研究并展示如何通过使用SVG文件规避当前的过滤技术,并随后提出一种减轻这些风险的方法。本文展示了我们对使用SVG图像作为攻击工具的研究,并确定了它对最先进的web浏览器(如Firefox 4、Internet Explorer 9和Opera 11)的影响。
{"title":"Crouching tiger - hidden payload: security risks of scalable vectors graphics","authors":"M. Heiderich, Tilman Frosch, Meiko Jensen, Thorsten Holz","doi":"10.1145/2046707.2046735","DOIUrl":"https://doi.org/10.1145/2046707.2046735","url":null,"abstract":"Scalable Vector Graphics (SVG) images so far played a rather small role on the Internet, mainly due to the lack of proper browser support. Recently, things have changed: the W3C and WHATWG draft specifications for HTML5 require modern web browsers to support SVG images to be embedded in a multitude of ways. Now SVG images can be embedded through the classical method via specific tags such as or , or in novel ways, such as with tags, CSS or inline in any HTML5 document. SVG files are generally considered to be plain images or animations, and security-wise, they are being treated as such (e.g., when an embedment of local or remote SVG images into websites or uploading these files into rich web applications takes place). Unfortunately, this procedure poses great risks for the web applications and the users utilizing them, as it has been proven that SVG files must be considered fully functional, one-file web applications potentially containing HTML, JavaScript, Flash, and other interactive code structures. We found that even more severe problems have resulted from the often improper handling of complex and maliciously prepared SVG files by the browsers.\u0000 In this paper, we introduce several novel attack techniques targeted at major websites, as well as modern browsers, email clients and other comparable tools. In particular, we illustrate that SVG images embedded via tag and CSS can execute arbitrary JavaScript code. We examine and present how current filtering techniques are circumventable by using SVG files and subsequently propose an approach to mitigate these risks. The paper showcases our research into the usage of SVG images as attack tools, and determines its impact on state-of-the-art web browsers such as Firefox 4, Internet Explorer 9, and Opera 11.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"88 1","pages":"239-250"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74882847","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 21
PaperSpeckle: microscopic fingerprinting of paper 纸斑:纸张的显微指纹
Ashlesh Sharma, L. Subramanian, E. Brewer
Paper forgery is among the leading causes of corruption in many developing regions. In this paper, we introduce PaperSpeckle, a robust system that leverages the natural randomness property present in paper to generate a fingerprint for any piece of paper. Our goal in developing PaperSpeckle is to build a low-cost paper based authentication mechanism for applications in rural regions such as microfinance, healthcare, land ownership records, supply chain services and education which heavily rely on paper based records. Unlike prior paper fingerprinting techniques that have extracted fingerprints based on the fiber structure of paper, PaperSpeckle uses the texture speckle pattern, a random bright/dark region formation at the microscopic level when light falls on to the paper, to extract a unique fingerprint to identify paper. In PaperSpeckle, we show how to extract a "repeatable" texture speckle pattern of a microscopic region of a paper using low-cost machinery involving paper, pen and a cheap microscope. Using extensive testing on different types of paper, we show that PaperSpeckle can produce a robust repeatable fingerprint even if paper is damaged due to crumpling, printing or scribbling, soaking in water or aging with time.
纸张伪造是许多发展中地区腐败的主要原因之一。在本文中,我们介绍了PaperSpeckle,这是一个强大的系统,它利用纸张中存在的自然随机性属性为任何一张纸生成指纹。我们开发PaperSpeckle的目标是为农村地区的小额信贷、医疗保健、土地所有权记录、供应链服务和教育等严重依赖纸质记录的应用建立一种低成本的基于纸张的认证机制。与之前基于纸张纤维结构提取指纹的纸张指纹技术不同,PaperSpeckle利用纹理斑点模式,即当光线照射到纸张上时,在微观水平上随机形成的亮/暗区域,来提取独特的指纹来识别纸张。在PaperSpeckle中,我们展示了如何使用低成本的机器(包括纸、笔和廉价的显微镜)提取纸张微观区域的“可重复”纹理斑点图案。通过对不同类型纸张的广泛测试,我们表明,即使纸张因皱缩、印刷或涂鸦、浸泡在水中或随着时间的推移而损坏,PaperSpeckle也能产生强大的可重复指纹。
{"title":"PaperSpeckle: microscopic fingerprinting of paper","authors":"Ashlesh Sharma, L. Subramanian, E. Brewer","doi":"10.1145/2046707.2046721","DOIUrl":"https://doi.org/10.1145/2046707.2046721","url":null,"abstract":"Paper forgery is among the leading causes of corruption in many developing regions. In this paper, we introduce PaperSpeckle, a robust system that leverages the natural randomness property present in paper to generate a fingerprint for any piece of paper. Our goal in developing PaperSpeckle is to build a low-cost paper based authentication mechanism for applications in rural regions such as microfinance, healthcare, land ownership records, supply chain services and education which heavily rely on paper based records. Unlike prior paper fingerprinting techniques that have extracted fingerprints based on the fiber structure of paper, PaperSpeckle uses the texture speckle pattern, a random bright/dark region formation at the microscopic level when light falls on to the paper, to extract a unique fingerprint to identify paper. In PaperSpeckle, we show how to extract a \"repeatable\" texture speckle pattern of a microscopic region of a paper using low-cost machinery involving paper, pen and a cheap microscope. Using extensive testing on different types of paper, we show that PaperSpeckle can produce a robust repeatable fingerprint even if paper is damaged due to crumpling, printing or scribbling, soaking in water or aging with time.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"106 1","pages":"99-110"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75297430","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 55
Poster: shaping network topology for privacy and performance 海报:塑造网络拓扑的隐私和性能
Nayantara Mallesh, M. Wright
While it is important to design anonymity systems to be robust against attacks, it is also important to provide good performance to users. We explore ways to improve the security and performance of anonymity systems by building both security and performance properties into the network topology. In particular, we study an expander graph based network topology and apply link-based performance metrics in order to build the topology graph. Such a network can be constructed to have enhanced performance and similar security properties to restricted route topologies with random links. Results show that a sparse, D-regular expander graph topology provides nearly the same security, as measured by the likelihood of an incoming stream exiting through any node in the network, as with a fully-connected graph. Further, when the expander graph is constructed with a bias towards faster links, there is a considerable gain in performance without much loss of security.
虽然设计匿名系统以抵御攻击很重要,但为用户提供良好的性能也很重要。我们探索通过在网络拓扑中构建安全和性能属性来提高匿名系统的安全性和性能的方法。特别地,我们研究了一个基于扩展图的网络拓扑,并应用基于链路的性能指标来构建拓扑图。这样的网络可以被构建为具有增强的性能和类似的安全属性,具有随机链路的受限路由拓扑。结果表明,稀疏的d规则扩展图拓扑提供了几乎相同的安全性,通过通过网络中任何节点的传入流的可能性来衡量,与全连接图。此外,当扩展图的构造偏向于更快的链接时,可以在不损失太多安全性的情况下获得相当大的性能增益。
{"title":"Poster: shaping network topology for privacy and performance","authors":"Nayantara Mallesh, M. Wright","doi":"10.1145/2046707.2093500","DOIUrl":"https://doi.org/10.1145/2046707.2093500","url":null,"abstract":"While it is important to design anonymity systems to be robust against attacks, it is also important to provide good performance to users. We explore ways to improve the security and performance of anonymity systems by building both security and performance properties into the network topology. In particular, we study an expander graph based network topology and apply link-based performance metrics in order to build the topology graph. Such a network can be constructed to have enhanced performance and similar security properties to restricted route topologies with random links. Results show that a sparse, D-regular expander graph topology provides nearly the same security, as measured by the likelihood of an incoming stream exiting through any node in the network, as with a fully-connected graph. Further, when the expander graph is constructed with a bias towards faster links, there is a considerable gain in performance without much loss of security.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"186 1","pages":"813-816"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73941447","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Automatically optimizing secure computation 自动优化安全计算
F. Kerschbaum
On the one hand, compilers for secure computation protocols, such as FairPlay or FairPlayMP, have significantly simplified the development of such protocols. On the other hand, optimized protocols with high performance for special problems demand manual development and security verification. The question considered in this paper is: Can we construct a compiler that produces optimized protocols? We present an optimization technique based on logic inference about what is known from input and output. Using the example of median computation we can show that our program analysis and rewriting technique translates a FairPlay program into an equivalent -- in functionality and security -- program that corresponds to the protocol by Aggarwal et al. Nevertheless our technique is general and can be applied to optimize a wide variety of secure computation protocols.
一方面,安全计算协议的编译器,如FairPlay或FairPlayMP,大大简化了这些协议的开发。另一方面,针对特殊问题的高性能优化协议需要人工开发和安全验证。本文考虑的问题是:我们能否构建一个生成优化协议的编译器?我们提出了一种基于从输入和输出中已知的逻辑推理的优化技术。使用中值计算的例子,我们可以展示我们的程序分析和重写技术将FairPlay程序转换为与Aggarwal等人的协议相对应的等效程序(在功能和安全性方面)。然而,我们的技术是通用的,可以应用于优化各种安全计算协议。
{"title":"Automatically optimizing secure computation","authors":"F. Kerschbaum","doi":"10.1145/2046707.2046786","DOIUrl":"https://doi.org/10.1145/2046707.2046786","url":null,"abstract":"On the one hand, compilers for secure computation protocols, such as FairPlay or FairPlayMP, have significantly simplified the development of such protocols. On the other hand, optimized protocols with high performance for special problems demand manual development and security verification. The question considered in this paper is: Can we construct a compiler that produces optimized protocols? We present an optimization technique based on logic inference about what is known from input and output. Using the example of median computation we can show that our program analysis and rewriting technique translates a FairPlay program into an equivalent -- in functionality and security -- program that corresponds to the protocol by Aggarwal et al. Nevertheless our technique is general and can be applied to optimize a wide variety of secure computation protocols.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"90 23","pages":"703-714"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://sci-hub-pdf.com/10.1145/2046707.2046786","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"72375197","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 51
AmazonIA: when elasticity snaps back 亚马逊:当弹性恢复时
Sven Bugiel, S. Nürnberger, T. Pöppelmann, A. Sadeghi, T. Schneider
Cloud Computing is an emerging technology promising new business opportunities and easy deployment of web services. Much has been written about the risks and benefits of cloud computing in the last years. The literature on clouds often points out security and privacy challenges as the main obstacles, and proposes solutions and guidelines to avoid them. However, most of these works deal with either malicious cloud providers or customers, but ignore the severe threats caused by unaware users. In this paper we consider security and privacy aspects of real-life cloud deployments, independently from malicious cloud providers or customers. We focus on the popular Amazon Elastic Compute Cloud (EC2) and give a detailed and systematic analysis of various crucial vulnerabilities in publicly available and widely used Amazon Machine Images (AMIs) and show how to eliminate them. Our Amazon Image Attacks (AmazonIA) deploy an automated tool that uses only publicly available interfaces and makes no assumptions on the underlying cloud infrastructure. We were able to extract highly sensitive information (including passwords, keys, and credentials) from a variety of publicly available AMIs. The extracted information allows to (i) start (botnet) instances worth thousands of dollars per day, (ii) provide backdoors into the running machines, (iii) launch impersonation attacks, or (iv) access the source code of the entire web service. Our attacks can be used to completely compromise several real web services offered by companies (including IT-security companies), e.g., for website statistics/user tracking, two-factor authentication, or price comparison. Further, we show mechanisms to identify the AMI of certain running instances. Following the maxim "security and privacy by design" we show how our automated tools together with changes to the user interface can be used to mitigate our attacks.
云计算是一种新兴的技术,它提供了新的业务机会和易于部署的web服务。在过去的几年里,关于云计算的风险和好处已经写了很多。关于云的文献经常指出安全和隐私挑战是主要障碍,并提出解决方案和指导方针来避免它们。然而,这些工作大多是针对恶意的云提供商或客户,而忽略了不知情的用户造成的严重威胁。在本文中,我们考虑了现实生活中云部署的安全和隐私方面,独立于恶意云提供商或客户。我们专注于流行的Amazon Elastic Compute Cloud (EC2),并对公开可用和广泛使用的Amazon Machine Images (ami)中的各种关键漏洞进行了详细和系统的分析,并展示了如何消除它们。我们的Amazon Image Attacks (AmazonIA)部署了一个自动化的工具,它只使用公开可用的接口,对底层云基础设施没有任何假设。我们能够从各种公开可用的ami中提取高度敏感的信息(包括密码、密钥和凭据)。提取的信息允许(i)启动(僵尸网络)实例,每天价值数千美元,(ii)为运行中的机器提供后门,(iii)发起模拟攻击,或(iv)访问整个web服务的源代码。我们的攻击可以用来完全破坏公司(包括it安全公司)提供的几个真实的web服务,例如,用于网站统计/用户跟踪,双因素身份验证或价格比较。此外,我们还展示了识别某些运行实例的AMI的机制。遵循“安全性和隐私设计”的格言,我们展示了如何使用我们的自动化工具以及对用户界面的更改来减轻我们的攻击。
{"title":"AmazonIA: when elasticity snaps back","authors":"Sven Bugiel, S. Nürnberger, T. Pöppelmann, A. Sadeghi, T. Schneider","doi":"10.1145/2046707.2046753","DOIUrl":"https://doi.org/10.1145/2046707.2046753","url":null,"abstract":"Cloud Computing is an emerging technology promising new business opportunities and easy deployment of web services. Much has been written about the risks and benefits of cloud computing in the last years. The literature on clouds often points out security and privacy challenges as the main obstacles, and proposes solutions and guidelines to avoid them. However, most of these works deal with either malicious cloud providers or customers, but ignore the severe threats caused by unaware users.\u0000 In this paper we consider security and privacy aspects of real-life cloud deployments, independently from malicious cloud providers or customers. We focus on the popular Amazon Elastic Compute Cloud (EC2) and give a detailed and systematic analysis of various crucial vulnerabilities in publicly available and widely used Amazon Machine Images (AMIs) and show how to eliminate them.\u0000 Our Amazon Image Attacks (AmazonIA) deploy an automated tool that uses only publicly available interfaces and makes no assumptions on the underlying cloud infrastructure. We were able to extract highly sensitive information (including passwords, keys, and credentials) from a variety of publicly available AMIs. The extracted information allows to (i) start (botnet) instances worth thousands of dollars per day, (ii) provide backdoors into the running machines, (iii) launch impersonation attacks, or (iv) access the source code of the entire web service. Our attacks can be used to completely compromise several real web services offered by companies (including IT-security companies), e.g., for website statistics/user tracking, two-factor authentication, or price comparison. Further, we show mechanisms to identify the AMI of certain running instances.\u0000 Following the maxim \"security and privacy by design\" we show how our automated tools together with changes to the user interface can be used to mitigate our attacks.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"14 1","pages":"389-400"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85852046","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 131
Poster: an implementation of the fully homomorphic smart-vercauteren crypto-system 海报:一个全同态智能vercauteren密码系统的实现
H. Perl, Michael Brenner, Matthew Smith
Since the discovery of a fully homomorphic cryptographic scheme by Gentry, a number of different schemes have been proposed that apply the bootstrap technique of Gentry's original approach. However, to date no implementation of fully homomorphic encryption has been publicly released. This poster presents a working implementation of the Smart-Vercauteren scheme that will be freely available and gives substantial implementation hints.
自从Gentry发现了一个完全同态密码方案以来,已经提出了许多不同的方案,这些方案应用了Gentry原始方法的自举技术。然而,到目前为止,还没有公开发布完全同态加密的实现。这张海报展示了Smart-Vercauteren方案的工作实现,该方案将免费提供,并提供了大量的实现提示。
{"title":"Poster: an implementation of the fully homomorphic smart-vercauteren crypto-system","authors":"H. Perl, Michael Brenner, Matthew Smith","doi":"10.1145/2046707.2093506","DOIUrl":"https://doi.org/10.1145/2046707.2093506","url":null,"abstract":"Since the discovery of a fully homomorphic cryptographic scheme by Gentry, a number of different schemes have been proposed that apply the bootstrap technique of Gentry's original approach. However, to date no implementation of fully homomorphic encryption has been publicly released. This poster presents a working implementation of the Smart-Vercauteren scheme that will be freely available and gives substantial implementation hints.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"2015 1","pages":"837-840"},"PeriodicalIF":0.0,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73296702","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 43
期刊
Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1