What if Bob only wishes to allow Alice s signatures to be turned into his, via giving rkA.B to the proxy, for the span of one week?

if the proxy is honest, Bob may simply issue it these instructions.if Bob does not fully trust the proxy, is his only option to change his public key?


Given the current state of the art in quantifying the value of security measures, and the difficulty of accurately assessing attack costs for a particular site, it is unlikely that exact quantitative comparisons between possibilities will be possible any time soon.

a comparative model will still provide value in decision making, and will also be valuable as an educational tool.


Such deductions on information veracity may be used by the information consumer for risk optimized decision-making (e.g., mission planning and adaptation) in a tactical setting.

our experience with DL and KANI has also exposed at least three limitations.


This can be explained by the high cost of multiplications of large operands, which we used to implement partial reduction.

partial reduction allows for compact implementations such that a complete implementation of point multiplication for arbitrary .eld degrees up to m = 255 .ts onto one lettersized sheet of paper.


In such cases, they just decrease the likelihood that their users will become victims of phishing; however, users must remain vigilant and .nd other means to protect themselves from phishing attacks.

false positives introduce serious usability concerns.


if we can keep the noise level above Gray encoded set of dibits, 11, 01, 00 and 10 are mapped p 3p 5p 7p certain threshold, the CR receivers will be able to retrieve to phases and , respectively.


This is because the control .ow is changed by using a di.erent compiler and/or optimization option, and the binary code is amended by the compiler, which initializes the runtime library and checks the stack.

the values are large enough to enable classi.cation in terms of source code, and the purpose of this paper has been achieved.


For instance, only minor changes would be necessary to allow the issuer to use any RSA modulus instead of only safe-prime products.

one would need to make a small order assumption [24].


The authors state that they achieved a 99% backwards compatibility and create only a minimal overhead.

the approach does not work if an attacker distributes the attack over a wide area or restricts the origin of the attack to parts of the network where the routers for the next hops do not mark packets.


Now, depending on a security policy, we may or may not wish to mark B->file_handler as tainted.

if all these structures are organized in a list, we certainly do not want to propagate taintedness to the next element of a list, B->next.


In a time when proprietary information represents crucial technical or business advantage, carefully safeguarding such information is essential to stay competitive.

it is equally important that the protection mechanism for such information should not disrupt the normal business processes.


By placing the ssh server in its own VM, we protect important information such as the user passwords and cryptographic keys used by the ssh server from the underlying OS if it gets compromised.

the ssh server would not be very useful to a remote user since once they log into the private VM, there would be no services or applications to access.


Protection is enforced by associating multiple encryption keys with the same document, and by allowing the clients to purchase as much decryption keys as the number of different document portions they are interested in.

all those approaches do not provide an access control model governing the generation of document encryption.


For .ghting SPAM, requiring the proof of work to be sequential is pointless: an attacker who is trying to generate multiple messages can generate the proofs for each message in parallel.

they do care about preventing amortization attacks: computing the proof for n messages in a batch should require approximately n times the work as computing the proof for a single message.


Key Equation solver inparticular scales only to a maximum parallelism of 16, andsigni.cantly decreases the ef.ciency for architectures withhigher parallelism.

if decoding speed is crucial,higher parallelism gives higher throughput.


For our example with the hospital, we would expect to have short periods of time where a patient is admitted to the hospital and its records are updated.

if a patient has a chronic disease then his records may be updated constantly for a long time.


The dynamic loading of new class .les could potentially change the code to run and thus reduce the e.ectiveness of our earlier static-analysis e.orts (as our analysis does not have access to all of the code that is about to run).

we cannot consider all apps with dynamic loading behavior malicious, because this behavior can be used legitimately.


System-level defenses have also been proposed for protection against TOCTTOU attacks [5, 11, 17, 39, 44] and link following attacks [8, 44].

system-level protection is fundamentally limited because it does not consider program context [7].


For valid requests, the consent manager has high precision on requests from R1 than those from R3.

for invalid requests, the consent manager does a better job in denying overrequests from R3 than those from R1.


It provides these VM images via the SSL channel to the dashboard.

to boot these VMs on a physical host, the dashboard VM must still communicate with the Sdom0 on that host, which is untrusted.


2.2.5 Socio-technical approaches Successful social engineering attacks often use the di.erent facets, discussed so far, in combination.

sociotechnical approaches have led to the most powerful weapons of social engineers.


The results obtained in the guessability study showed that users recorded RBGS passwords in the form of sketches, rather than textual descriptions, in spite of the instructions given to them.

more studies need to be conducted with different experimental set-ups, to understand various coping mechanisms to record/share RBGS passwords.


Since the randomness in the ciphertext contains all information needed to decrypt, no decryption oracle is required to simulate decryption before the challenge ciphertext with overwhelming probability.

this argument does not hold after the challenge ciphertext has been issued since the adversary may attempt to reuse part of the challenge ciphertext.


Hence, results regarding this tradeoff should have applications in other networking areas.

while the objectives are similar, the operating constraints are very different between the malcode propagation problem and applicationlayer broadcast problems.


UDSSS allows a receiver to quickly identify the right code sequence by having each code sequence uniquely identi.ed by the .rst few codes.

if the jammer has enough computational power, using the same property, she can .nd the correct sequence before the sender .nishes the transmission and jam the remaining transmission.


We do not require the presence of any remote code update protocols, such as Deluge.

if such a protocol is available, we assume that it is secure, i.e., the updated images are authenticated [9, 17, 18, 19].


In the ERP 2 scheme, the location data of a vehicle must be disclosed to the government when the vehicle is on a busy road at chargeable time.

the driver should be able to control whether or not to disclose his/her data to ACM must be honored.


As organizations usually have di.erent legal and technical requirements for identity management, they .nd it di.cult to give up this control.

with regard to the Internet, we can .nd many identity attributes which do not require strong veri.cation.


Keynote Talk Challenges and Opportunities for Virtualized Security in the Clouds Frank Siebenlist Argonne National Laboratory University of Chicago Argonne, IL, USA franks@mcs.anl.gov Abstract The virtualization technologies that underlie the cloud computing infrastructures pose challenges on enforcing security policy when we have a sense of ambiguity concerning the actual physical properties of the resources.

the virtual machine managers provide us with better sandboxing, detailed monitoring capabilities and fine-grained access control on the resource usage.


The incentive to plant Easter eggs (developers coding bugs intentionally in order to later bene.t from their discovery), might be decreased if the payment of a bounty decreases the developers bonus pool for the vulnerable product, or if bug bounties paid were deducted from developers pay.

the resourcefulness of devious developers to .nd ways to personally bene.t from any system should not be underestimated.


By increasing the number of paths, the percentage of vulnerable virtual links decreases to 4% (|P | = 4), and then to 1% (|P | = 6).

it is also possible to see that the percentage of virtual links with disjoint paths also decreases.


Ponder [9] and Rei [19] both support the speci.cation of user obligations.

in the basic constructs of both languages, time constraints of obligations, e.g., deadlines, cannot be directly expressed.


In contrast, the scheme may negatively impact an attacker when a large number of attempts are made from a single machine.

compChall may not be e.ective against attacks from a botnet.


Similarly, for IA schemes that rely on sensor data from di.erent on-board sensors, the accuracy of Itus will be negatively a.ected on some of the old devices with low sampling rates.

these are trivial limitations given the high penetration of modern Android devices.


Since the composition scheme is not order preserving, the attacks on OPE schemes will not be applicable either.

can the two-stage query processing strategy still be applied?


2008], we have experimented with such policies in another implementation of the TMI architecture.

we have not explored the addition of such facilities here, in order to simplify the exposition of our semantics and Haskell implementation.


Our design also supports .nergrained integrity requirements, i.e., at the level of resource types or speci.c resources themselves.

specifying such .ner policies must be done sensibly, as it increases bookkeeping at the server and could break existing interactions within embedded content if policies are speci.ed incorrectly.


The manager determines that the recipient s credentials do not allow rendering.

a short, decrypted sample may be included with the content.


In a previous work, we presented a very rudimentary sketch of incorporating PUFsintoanauthentication system(referenceomit  Figure 1: A sample 1-bit PUF based on ring oscillators ted for purposes of anonymity).

the focus of that paper was onjointinstallation ofPUF challengesto combatinsider threats.


The model that incorporated our minor adjustments generated no more false positives, as shown in column Final detection/FP rate.

the detection capabilities of the model remain basically unchanged, as shown in column Final detection/det.


A device does not have to wait until it receives a message to compute the next identi.er R, it can calculate the entire chain in beforehand.

if the mobile device is 1A computationally bounded attacker can not distinguish the output of a pseudo-random from a random bitstring.


This is a consequence of the large value (say, hundreds of thousands of Euros) of the respective outsourcing contracts if the service provider does not adhere to the policies, he looses a customer and a large sum of money.

the owners of web services that implement, for instance, the negotiation of health insurances, may have a strong interest in keeping sensitive data, even though this may con.ict with respective policies.


conflict indicates that they may threaten each other.


Due to its constant detection performance, DFA is the standard method for RegEx detection including CC detection.

the DFA su.ers from prohibitively high memory requirements due to the exponential growth of its states.


Adopting an economic approach in Proof of Work Proves Not to Work , Laurie and Clayton analyze the effectiveness of using computational puzzles to .ght spam [21].

wobber discovered an arithmetic error in a pro.t margin calculation that undermines one of the key results [8].


The security proof in [1] ensures that this scheme is unconditionally secure and t-collusion resistant; i.e., a coalition of no more than t compromised nodes cannot know anything about thekey sharedby anytwo noncompromised nodes.

an attacker who compromises t+1 nodes can use interpolation to recover the masterpolynomial f(x,y).


The most oftenused argument for trustworthiness is the number of lines of code that comprise the TCB [13, 17, 21].

from the above example, it is clear that the choice of an appropriate interface also has an important role in de.ning the TCB.


It is di.cult to directly translate these issues to our sandbox.

in general using a small sandbox kernel makes boundaries and capabilities explicit, which may mitigate the confusion that led to some of these errors.


The repeated invocation of consensus construction consumes more computation resources.

the additional computation overhead is overshadowed by its bene.ts: given the long-tail distribution of different proxies latencies, it effectively improves the time-to-.rst-byte latency by eliminating the effects of slow, corrupt, and/or failed proxies.


Several MD algorithms, including MD5, SHA-3 (Secure Hashing Algorithm), RIPEMD, are popularly used [13].

some applications might necessitate the use of mechanisms to ensure that the messages are authenticated , i.e.


6.1 Control-.ow Policies As we have demonstrated, REINS can rewrite many complex legacy binaries, enforcing coarse-grained control-.ow safety and preserving safe computed jumps without source code.

rEINS does not enforce the .ner-grained control-.ow integrity properties of CFI [1].


Here,[15] cites[16] for theoretical support.

a closer examination of [16] shows that it contains positive security results about the MAC-then-encrypt construction when the encryption schemeisimplemented using either a secure stream cipher or CBC modeof ablock cipher.


As a consequence, this permits to predict the existence of PUF outputs with speci.c properties with a high con.dence.

the positions of the PUF outputs with the speci.c properties are unknown.


To keep the sensitive user data con.dential against untrusted CSPs, a natural way is to apply cryptographic approaches, by disclosing decryption keys only to authorized users.

when enterprise users outsource con.dential data for sharing on cloud servers, the adopted encryption system should not only support .ne-grained access control, but also provide high performance, full delegation, and scalability, so as to best serve the needs of accessing data anytime and anywhere, delegating within enterprises, and achieving a dynamic set of users.


For example consider the problem of going to a nice Shakespearian Tour in Italy: you might decide to go to the city of Shylock, from there rent a car and travel to Romeo and Juliet s last resort, to jump then on a train and visit the Senate s seat where Pompeous spoke after Caesar s death.

you might as well decide to travel instead to Germany .rst and then the train to Verona from there.


Upon reaching defense node 8, it is aggregated with another incoming ap- proved traffic flow (bearing stamp 002), and both flows leave this node 8 bearing stamp 101 and continue toward the vic- tim.

attack traffic from the 126 subnet is rate limited by defense node 6, and becomes a monitored flow leaving this node with stamp 768.


The success rate is very high for 32 bits and even for 64 bits if 1024 hashes are allowed the success rate is generally over 75%.

32 or 64 bits may be insucient to be used directly as a symmetric session key.


This has made social networks more accessible from everywhere.

the mobile environment provides spammers with an easy way to interact with these sites and carry out their tasks.


Without loss of generality, we can use n-gram (joint distribution of bytes) by computing frequency of consecutive n bytes in P to model the information from the payload of unknown protocol requests.

the major problem with n-gram is that such feature-space contains redundant information and the selection of right value of n is not trivial (i.e., if n is small, the accuracy of the system decreases whereas large values of n signi.cantly increase the processing overheads) [23].


In the scenario above, Alice is allowed to and may want to like and share as many fan pages as she wants.

it is most likely the case that Alice does not want like or share a fan page which has a risk value below a certain threshold as this kind of actions may increase her own risk value.


The claim by some that Web 2.0 does not introduce new threats or technical problems is found to be valid.

web 2.0 culture of sharing and participation by everyone serves as a mass distribution channel for malicious code and content as well.


Meanwhile, the tickets are themselves tamper-proof, as they are signed by the TPM protected key.

these tickets are transient as they can only re.ect the genuine state of the platform up to the time when they are generated.


At the .rst glance, this idea of malware vaccine might not be very appealing because itis only effectivefor a speci.cknown malwareinfection.

weobservethatatonetime,typically there areveryfew high-pro.le malware families that widely propagate across the Internet.


Some people have resorted to adding address book contacts under the heading ICE, which stands for In Case of Emergency [24]; several different applications have also been developed to place this information on the lock screen.

none of the major smartphone platforms provide this feature by default.


Regarding privacy, it is also desirable to implement di.erent privacy pro.les, such that each user has relative freedom to choose how, when and against whom his/her data must be protected, and whetheror nottheobject-user wantstobe informed whenever some subject-user accesses his/her data.

subject-users generate only reports ontheir activity ondatapreviously createdby object-users; thus, theprivacy of subject-usersis taken into accountbygrantingthemprivilegesin order notto report certain actions; for example, a representative of the law authorities may have visioning access to some recorded scenes, and this event should not originate reports to the involved object-users.


Cryptographic soundness opens the perspective of combining the best of both worlds: fully automated proofs of computational security.

its applications have remained con.ned to protocols.


As we discussed in Section 4, among the currently avail able secure hardware ARM TrustZone seems to be capable of providing a secure user interface.

currently it is not freely programmable.


Supporting multi-user work.ows is seemingly at odds with the Tractability requirement, as the work.ow satis.ability problem has been shown to be NP-complete [26].

the proof of Theorem 1 makes use of recent results [4] to show that ACCostEvalSim is .xedparameter tractable in maximum task length (typically a small constant).


In some cases, differences between conditions that were statistically signi.cant when looking at all participants are no longer signi.cant when looking only at no-storage participants.

this may be due in part to the small number of no-storage participants.


It is also true that there remain signi.cant gaps between what biological systems and computer systems can do from a security perspective.

it is also true that past work in biologically-inspired security has, in turn, inspired a lot of poor quality security research.


We shall not discuss the body of work concerning analysis of .xed (i.e., non-administrative) policies.

we note that the use of model checking in the analysis of access-control policies (e.g., [13]) is useful because there is a wide range of safety questions that can be asked of a policy.


Thus, porting the decryption functionality in other RISC systems will be straight-forward.

cISC architectures such as x86 support variable-length instructions.


Therefore, we can accomplish that .rst step with k · O(B · log n) = O(B · log n) communication complexity.

when we then write to the map, each recursive ORAM has to, itself, read from all the recursive ORAMs below it in order to read its own map.


When the event E reaches a broker, if the set of attributes associated with the event satisfy the .lter Fj , then the broker knows that the event can be forwarded to Sj .

if the KP-ABE scheme is used as proposed in [3], then the broker is still able to obtain information on the .lters and attributes associated with events, thus violating the con.dentiality of events and .lters.


Moreover, we do not expect CPU-integrated protection against ROP to appear in the near future.

our solution is software-based and works with general purpose CPUs and operating systems.


Thus we cannot use its security results in a black-box manner.

in most cases, a white-box approach, where the actual security proof is modi.ed or extended, should be possible, and even very easy.


RELATED WORK Today s literature on sensor networks usually neglects an important feature: the correlation among the elements of the sample measured by the sensor network.

in reality, these measurements are always correlated.


This value, together with user s output (p-p ) a = s · gi ti computed for an arbitrary p , allows an off-line dictionary attack, where each candidate password p ' can be tested ' p-p by checking if s = a · (a) 1 looks like a valid plaintext.

if the shifted ElGamal encryption encrypts hp ins · h(p-p ) i ti stead of gp then a = is a one-time pad encryption of s because under the DDH assumption h i ti is a pseudorandom value, and hence so is hdpi ti for any dp (p - p ), even given w ai = g i ti , if i ti is random in Zq.


For example, both ecommerce.server.id1and e-commerce.server.id2 are out of secure states because of recent updates of vulnerabilities.

only one server can be patched first due to the limited resource of security professionals.


Wikipedia is merely one platform where the notion of document trust has relevance and was chosen as a research platform due to its open nature.

the application possibilies of our research span multiple venues, both open and closed.


The units of PIO access are small, i.e., one, two, or four bytes.

the hypervisor might need to handle I/O data in larger units.


If the policy maker indeed intends to make the permission more restrictive, the existing PA pa should be removed.

this scenario may also occur due to an unintentional error.


As a result, a SSL service also has no chance to be compromised by the deceptive captive portals.

sSLock may prohibit a user from getting to the Internet.


We hoped that this method of gaze-point selection would more accurately reflect the user s intended gaze-point.

we expected this might slow down gaze-point selection, since users hold down the space bar for a few seconds with each point.


There was growing interest in tools that would allow users to fill out online forms automatically, and some IPWG members felt that P3P should include these tools as well so that all data transfer would be done under P3P control.

other IPWG members were reluctant to associate a privacy protection tool with a tool that made data transfer easier.


Ideally, the Flicker PAL loader could restore the host OS to idle cores once the DRTM invocation has taken place, permitting other execution to continue while protecting the region of memory containing the PAL.

this is a substantial engineering challenge, fraught with security dangers, and thus we do not consider it in any way realistic.


In practice, the attacker A s signal can be observed by multiple jammers depending on the con.guration.

jamming by multiple jammers increase the interference on B, thus not impairing the security performance of proposed system.


This simple algorithm is su.cient to classify the nodes in our test network as either tarpits or real hosts with perfect accuracy and no false positives or negatives.

it is possible that a legitimate host would advertise a small window and also not include any TCP options.


The authors claim the forgery resistant property, i.e., an attacker cannot(easily) forge credit card numberseven if he knows the user s real credit card number and some virtual credit card transactions.

this property relies on the assumption that thelong-term sharedkey P is strong (i.e.


The Pioneer system provides code integrity guarantees to an external veri.er [27].

the veri.er in Pioneer needs to be a local host, because Pioneer cannot be used across the Internet.


A. Same-As Subject Management with Object Grouping Most online social networks provide some means for grouping subjects, e.g., Facebook Friend Lists and Google+ Circles.

most do not provide a means for grouping objects.


TEEM is designed as a secure TPM service running in the secure world of TrustZone, and a prototype is implemented on a general ARM SoC development board.

their implementation doesn t isolate TEEM from the Rich OS.


Furthermore, web servers must also support server-side scripting (e.g., PHP and ASP), which in turn requires further security hardening measures.

infection techniques that require user interaction such as pullbased infection techniques (e.g., drive-by downloads) and push-based techniques (e.g., opening malicious email attachments) are often not applicable to servers.


Theseoverheads are still signi.cant,however our scheme is compatible with several techniquesproposed in [4] that can reduce this overhead, such as using a single MACto cover not oneblockbut several blocks.

thekey point here is that AISE+BMT is more storage-ef.cient than global64+MT irrespectiveof the MACsize used.


The primary purpose of our tool so far has been to observe existing .ows in the wild, a scenario for which we don t need to worry about malicious code trying to circumvent our system.

with additional work, our framework could possibly lead to a protection mechanism as well.


Thus, we observe that the movements of point-and-clicks demonstrate a more consistent pattern than those of partial movements.

most partial movements are intentionally performed.


Thepaper[12] showsthat the system in[11] canbeattacked, and arguesthat asoftware-only solution to software authentication faces numerous challenges, making success unlikely.

in this paper we use performance counters to build a model that is used to check the integrity of the program dynamically.


To resolve mismatch, reconciliation methods such as Cascade [9] are proposed, where the two ends exchange messages to probabilistically identify mismatching bits.

we focus on low-data-rate patient monitoring applications that require periodic key renewal.


The TXT hardware protects certain memory regions, which are marked as protected even throughout a platform reset.

to tear down a protected environment our kernel module can send the appropriate CPU instruction.


The results indicated a drastic reduction in data size and computing time compared to principle component analysis, while preserving performance [20].

it was noted that though the randomized projection technique was very effective with data sets of large dimensionality, it showed limited performance in calibration tasks with low-dimensional data typical to chemical applications [20].


we noted why some mitigation strategies might not be feasible for enterprises.


CBMC implements a static analysis that can automatically determine loop bounds in many cases; obviously this does not always work, as the problem itself is undecidable.

for each of the examples given in Section 4, CBMC determined the loop bounds automatically.


Such antivirus software has seen a widespread adoption due to their low false-positive rate and ease of use [31].

the signature-based approach to malware detection is a reactive approach that requires malware .rst to be discovered and analyzed so that a signature can be added to a detection database.


It subsequently validates the target application by comparing the embedded hash values with the current ones.

in this approach, programmers must rebuild their applications every time security patches for the operating systems or hypervisors are released, because the hash values of those programs will be changed.


From Theorem 5, we can see that (i) for any DA scheme sk, if it has more than .n incorrect mappings, with probability 1, it will cause more DE than s0.


Therefore it contains more information than a single consumption value of similar low-resolution strategy.

its applicability is constrained to billing and cannot be used for forecasting since the tari.


First, the seminal Revirt work [7] shows that re-playable systems can be built.

revirt is not designed to distinguish true secondary attack e.ects from infection-free e.ects.


De.nition 1 already takes into account all possible ways which an attacker can follow to break the system.

the de.nition does not consider how the attacker is going to select an attack to execute among several alternatives and does not say what kind of knowledge the attacker possesses.


5 shows that MC-CDMA systems perform ine.ciently while the number of users is increasing, where signalto-noise ratio (SNR) is 10dB.

mC-DS-CDMA schemes are not subject to the increment of the number of users.


Particularly, one can append individual pair-wise SNP counts with decimal components, which removes the integer constraint we use to uniquely identify C00 from the two solutions of Equation 2 (Section 3.1).

this can still be insuf.cient to defeat our attack.


Theglobal counter approach avoids the use of address as a seed component.

when the counter reaches its maximum value for its size, it will wrap around and start to reuse its old values.


The original concept of sanitizable signatures [3] allows designated sanitizers to replace designated parts of a message.

here the sanitizer does not have the role of a proxy meaning that it does not sign the modi.ed message.


Data gathered from 21 people and 27 PIN combinations display that the heat transferred to the keypad depends on the amount of pressure exerted to the keys as well as the warmth of the hand.

the heat of the ATM was not taken into consideration as the keypad is used as an isolated test bed, without being wired to or placed on any electronic device.


4.2 IDRM is NP-Complete In a monotype I-hierarchy, as the permissions of a junior role can_be_acquired by senior roles, the role hierarchy can facilitate a top-down scan to solve the IDRM problem.

the presence of a hybrid hierarchy presents a more complicated and realistic model, in which a senior role may not have more permissions than a junior role (as illustrated in the Example 3).


This suggests that some users may not understand the security or liability implications of installing and using smartphone applications.

some participants said that they would contact their service providers to refund fraudulent SMS or phone charges; this expectation is likely well-founded for some service providers.


The fields of unmarshalled objects are initialized directly.

if the object that is unmarshalled implements a method of the exact signature private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException; then this method is invoked in the deserialization process.


Instead, the use of the object-relation model has bridged the mismatch between many existing application using the relational model and new needs where the object model is desired.

the genesis of Big Data truly began with the evolution of the world wide web, which at its inception, was only one application of the internet among many.


An attacker can delay a time synchronization message only up to 20µs without being noticed.

sPS exhibits no resiliency to compromised nodes.


The academic and professional qualification attributes of the candidate user can be validated by the academic degree and the employer certificate of the user.

the aggregate trust in the validity of these attributes must be greater than 0.9.


It is also di.cult to quantify the security of a computer con.guration [18] since the introduction of new security vulnerabilities and functionalities can make a once secure con.guration insecure.

evolution-based algorithms, which formulate better solutions from good solutions, are well suited for addressing such ill-formed and dynamic problems.


Table 2 demonstrates that data fusion typically cannot improve security DQ indicators considered in Table 1 beyond the best ones among the data streams.

data fusion may drive security indicators down due to the lack of security in other parts of the network.


In wireless networks, there exist side channels of CSI at clients, e.g., spatial dependency in CSI among clients [17].

the existing work that explores the dependency among clients requires additional devices, help from (malicious) clients, and other strict assumptions on fading channels.


5.3.2 Injecting code into a Harvard-based sensor withsmall packets The attack assumes that the adversary can inject arbitrarily large data into the sensor data memory.

since the maximum packet size is 28 bytes, the previous attack is impractical.


Under this setting, it is not possible for the service provider to link two access requests made by the same customer and therefore to pro.le its customers.

because the server now needs to issue many (possibly disposable) cards, their cost must be kept at a low level.


alphanumeric passwords) for user authentication is ubiquitous.

this common practice has some well-known weaknesses.


The di.erences between WPA and WPA2 are not relevant for this discussion.

wPA and WPA2 each operate in two primary modes: WPA-Enterprise (or WPA2-Enterprise), for use in a large-scale networks with an IEEE 802.1X-compliant authentication server, and WPA-Personal (or WPA2-Personal).


7.5 Denial-of-service We brie.y discuss denial-of-service (DoS) attacks a potential problem for methods such as cha.ng-by-tweaking that generate honeywords by predictably modifying usersupplied passwords.

(cha.ng-with-a-passwordmodel as well as the hybrid scheme of Section 5.5 o.er strong DoS resistance.)


They conclude that for |R| = |D|3 and h = o(|D|n), where 0 <E< 1, a ROPF is able to achieve one-wayness.

this only applies for classical one-wayness, i.e., aimed to recover the exact plaintext of a given ciphertext, not the ability of an adversary to correctly estimate a plaintext close to the actually underlying plaintext.


Similarly, the toast approach has a lower success rate 27.9%, which is better than vibration, but some participants said that without vibration they did not notice the toast message.

using vibration, toast and alert bar together is the most reliable way to alert users, which signi.cantly dropped the touchjacking attack s success rate to 6.97%.


Previous work (e.g., [15, 14, 9]) has extensively studied fraud in telecommunications, and in some cases has explored data mining and machine learning techniques [25, 10, 20].

these previous studies have mostly leveraged the static user pro.les and usage features for detection.


Then, v broadcasts these one-time certi.cates, and neighbors of v falsely believe that x is a direct neighbor of v. Unfortunately, we do not provide a proper countermeasure to defend against this type of man-in-the-middle attacks.

we point out that this type of attacks has watch node exists in the lower bound (c =0.4)critical area.


Officially, the RFID tag is used for updating security and counterfeit protection, and for conforming to the International Civil Aviation Organization (IACO) machinereadable travel documents.

this addition to the US passport has caused a huge debate among security and privacy experts, and national security advocates.


INTRODUCTION Public key based mechanisms are ideal to provide the authentication services.

the main problem of public key based security systems is to make each user its public-key available to others in such a way that its authenticity is verifiable.


All of these proposals [3, 12, 4] o.er the advantage of allowing access in emergency situations by simply removing the wearable device or powering it o..

the use of an external device makes the solution expensive and unpractical as patients are always obliged to wear these devices.


The location identi.ers generated by an Adeonaenabled device only need to be meaningful to the individual device owner since only she is allowed to track her device.

sMILE must allow independent, co-located users to deterministically compute the same encounter identi.er without revealing any information about the encounter s place or time to entities that were not present.


This implies that the M7 mimimorphic engine generates 143 .ngerprints that can be used to identify the mimimorphic instances!

the results are much better for M8 .les.Whereasthereare339 shared.ngerprintsinall M8 .les, 321 of them match legitimate .les, leaving only 18 additional .n- Table 7: Shared Fingerprints of All M7 and M8 Instances and Good/Bad FingerprintsinThem Sharedfprnts.


After PGD-ATRA comes into e.ect, PTE-ATRA can be launched without being detected.

pGD-ATRA can be detected by extending the PTE-ATRA detection scheme.


Since worm propagation does have very distinctive patterns, tra.c pattern based approaches could potentially detect and contain previously unknown worms and polymorphic worms.

tra.c pattern based approaches can only detect and contain a worm after the worm has started its propagation.


Suppose A refers to the event that node uj is selected on the attestation path at least once in the mevents.

ameans that node uj is never selected on the attestation path in the mevents.


Implementation of the list of e-mail subjects by Yagai Figure 4.

implementation of painted body of e-mail by Yagai it is not mentioned that which color is suitable for painting.


The TLD could authenticate laptops and only perform HKD for laptops not yet reported stolen.

this means signi.cant administrative overhead with per-laptop secrets on the TLD, or the addition of laptops to the company PKI and the maintenance of a Certi.cate Revocation List (CRL) to identify stolen laptops.


To calculate the memory load address, (table + index*8), we use a tainted operand, index, which has never been dereferenced before, and so i1 becomes tainted.

we have just reached the landmark for i1, meaning that dereferences of i1 propagate taintedness, but addresses derived from i1 in a clean way do not.


3.5 Timeout Method The most outstanding characteristic of the reconstruction operations is that if a mesh node does not have su.cient number of neighboring nodes, it simply can compute neither the master key shares nor its private key.

a situation as the following may also occur: a packet sent by a mesh node consisting of a service request drops due to collisions.


Histogram Splitting: To Further Improve the Watermarking Performance The histogram expansion model proposed in section 3 can be always used to find the optimal or sub-optimal value expansion Fig.8 Histogram types for value expansion schemes for a fixed histogram.

the histogram generation scheme actually also affects the final performance of a reversible watermarking algorithm.


of South Carolina Zhejiang University Columbia, SC 29208 Columbia, SC 29208 Hangzhou 310027, China xum@email.sc.edu Jesse Walker Intel Labs Hillsboro, OR 97124 jesse.walker@intel.com ABSTRACT Wireless sensor networks are increasingly being integrated into the modern automobile with the intention of improving safety and reducing costs.

it has been shown that the .rst widely-deployed and mandatory in-car sensor networks Tire Pressure Monitoring Systems (TPMSs) employ no cryptographic algorithms for protecting their wireless communication, incurring serious security and privacy risks for consumers.


Install-time permissions can provide users with control over their privacy and reduce the impact of bugs and vulnerabilities in applications.

an install-time permission system is ine.ective if developers routinely request more permissions than they require.


We restrict our attention to monotone access structures.

it is also possible to (ine.ciently) realize general access structures using our techniques by having the not of an attribute as a separate attribute altogether.


For example, in Figure 5 the user needs to be in a a policy that requires both a previous state and the current state.

speci.c ST state S0 to obtain the key promptly before entering S3.Along with all the previous tokens a user has, since history infor-this method will fail if the malicious user has a colluding partner that obtains the key at the speci.c location during the spe ci.c time and then immediately sends the key to the attacker, who mation is carried in the token, the complete state transition path can be determined so that it is possible to express a policy involving two or more previous states as in the second example.


They send all packets in a page, and wait for one ACK/NACK message back from each node.

in chain scheme, the sender has to wait for the ACK message from each node, then it can decide whether to send next packet or repeat the current packet, as we know that a node cannot verify a packet if its previous packet was lost.


No sanitizer can sanitize the portion of the document where legitimate mask data is not given to him/her.

legitimate mask data can be used to count up how many masks appear in a sanitized document.


When used to educate about organization-specific security policies and targeted attacks, PG and SRAs are likely to require similar supervisory effort (i.e., supervisors who know users' context well, set security policies, and help the system select and label instances of JRs and URs).

to the extent that PG seeks to educate only about generic threats, it has the advantage that it can benefit individuals without supervi-sion.


4.2 Modi.ers OMA REL does not include any of ODRL s modifying constraints, such as quality and watermark.

we can capture the semantics of time-based constraints using a parameterised modi.er t (t) that modi.es an action by limiting the amount of time for which it continues.


We worried that the critical usability requirements of requiring the application to be a Web application without binary code and requiring it to perform well enough so that users' workflows are not at all slowed down would be irreconcilable, in which case we were prepared to resort to using Java applets or something like them in the vein of Hushmail [9] (see Section 5).

in the end we were able to build the entire application out of scripts while satisfying all our usability concerns.


Multi-factor schemes that use an additional token or biometrics also may not need protection against guessing attacks, assuming the additional factors provide enough entropy.

singlefactor multi-stage schemes (e.g., SiteKey or personal questions with passwords) may bene.t from Uvauth; e.g., the fake session can start right at the end of .rst-stage of authentication.


The performance overhead is between 0.081% and 0.218%, which is higher than the other experiments.

the overhead is still considered negligible as it is within 0.218%.


Since only the main security o.cer knew about the penetration test, in few hours the security guards were all alerted and started searching for suspicious students.

in two cases the students were not able to social engineer the custodian directly and were forced to look for alternative approaches.


The implicit assumption the kernel is making is that the function pointer points to legitimate code that should be executed.

if the kernel module was able to write arbitrary values to the function pointer .eld, it could trick the core kernel into executing arbitrary code.


Like other network-based approaches, Nemean does not have the bene.t of a correlation step to pinpoint attack-containing bytes, but its knowledge of service semantics provides capabilities similar to our input context identi.cation.

our approach requires only simpli.ed message format speci.cations, whereas their approach seems to require more detailed knowledge of service semantics that needs to be incorporated into their implementation.


2.2 Primary problems with current mechanisms This paper does not aim to catalog problems with existing trust anchor management mechanisms.

this section discusses some problems in the areas of trust anchor store management and trust anchor constraints enforcement.


Note that these equations are not exactly true because the padding is not exactly the same in Hmac and in Nmac: in Hmac one block key is concatenated to the message and this changes the length of the hash function input and then changes the associated padding.

to simplify the notations, we can omit this particularity since it does not alterate the results.


Some signatures contain the information about the o.set in a .le, at which the byte sequence or the regular expression occurs.

bVMD does not contain all signatures of ClamAV.


And they attach great importance to human relationship and try to avoid uncertainties.

western cultures have opposite propensities.


The aggregate response is a linear combination of rows of the encoded .le matrix, and is a codeword (or suf.ciently close to a codeword) in the dispersal code.

we need to ensure that by aggregating MAC values on individual blocks, we obtain a valid MAC.


In fact, one could rightfully argue that this is not a method for bridging the semantic gap in the purest sense since the view is generated from within the monitored guest OS.

we include this pattern for the sake of completeness and because it can be successfully combined with other patterns.


A typical user may transfer money a few times a month.

users need to unlock their phone throughout the day and make payments several times every day.


Viewing the problem from a high level, there are many tracks we can take to make a network architecture that is more resilient to DoS than the current Internet: Signi.cant improvements in end-system software security will reduce the ease with which systems are compromised, and hence make the construction of zombie-armies more dif.cult.

we do not expect this to be suf.cient by itself.


1http://www.wooyun.org/ We similarly explore this aspect in our work (Section 4.3.2).

our study considers a much larger dataset in terms of white hat contributors and vulnerability reports.


Therefore, Service providers can get effective as an anti-bot countermeasure immediately if they change the generating logic of the CAPTCHA or change the CAPTCHA service.

breaking CAPTCHA method using neural network has effect to multiple services.


In practice, we could directly include a concrete sequence of requests in the state, and remove requests from this sequence as the system controls them.

such a concrete structure does not bring much in the decision process and tends to obfuscate the exposition of the framework, so we leave the concrete de.nition of the function Tr to be done at the implementation level.


Button Football has a lower ranking (9.7%), but is still within the top 10% of applications to receive analysis.

we note that Button Football s inclusion in the BOOT intent-.lter default poll is interesting for a game application.


The no-storage participants are most relevant when evaluating the memorability of secrets.

as users can and do store secrets for their real accounts, the behavior of storage participants also provides useful insights.


This type of approach allowsustogradually craftspecializedprotocolsthatincur appreciably lower overhead than state-of-the-art.

as is well known, lower overhead does not necessarily imply practicality.


Experts sometimes frown upon users who write down their passwords.

for online accounts, writing down many unique passwords may be preferable to reusing one password across different sites [18].


a get-out-of-jail card to prevent those playing adversarial roles from being prosecuted for their actions.

not all stakeholders can have information about all roles, as this would compromise the bene.ts of the adversarial aspects.


Hence, the maximum security level that can be achieved is t = 80 bits.

in the most recent implementation of FastGC [HEKM11] (version 0.1.1 released August 9, 2011), the last bit of the 80 bit wire labels is used as permutation bit for the point-and-permute technique of [NPS99] (cf.


Zendesk was not vulnerable to 7 out of 8 attacks.

by using the TRC attack, we were able to prove that Zendesk did not perform the recipient veri.cation (D) on a received token.


Traditional regular expressions implementations often employ the complete signatures to parse the input data.

in NIDS applications, the likelihood that a normal data stream completely matches a signature is low.


8.1 Heat-ray Effectiveness Heat-ray is designed to be run periodically on an organizations s security con.guration (e.g., to review con.guration changes made in the past week).

our evaluation focuses on the initial use of Heat-ray to reduce the threat of identity snowball attacks in an organization that has not previously been running Heat-ray.


[21] state that different software keyboards signi.cantly in.uence authentication performance and might in.uence password composition as some characters are easier to enter than others.

the analysis was restricted to smartphone keyboards and does not provide insights on the impact of the device itself.


Speci.callyintheexperiment,thefalse-negative rateiscontrolled within10% atthe expense of morethan70%false-positive rate.

given a generous delay queue threshold to accommodate normal traf.c, a majority of Storm s connections can pass through too.


XACML does not consider rules to be policies.

since the semantics assigned to rules allows them to behave as policies, we will consider them policies.


Because of their massive parallelism and computational power, in recent years GPUs have been considered a viable platform for this application [19-23].

existing work has mostly evaluated specific solutions on small datasets consisting of a few tens of patterns.


Note that in this process, we may need to .x a single jump instruction several times.

since inserting nop instructions between a jump and its destination can only increase the offset but never decrease it, we are sure to .nd a safe offset after a .nite number of iterations.


In the following decades, they were used by pro fessionals for speci.c use cases and were never meant to be everyman s universal authentication mechanism.

with personal computers in the 1980s and with the World Wide Web in the 1990s, alphanumeric passwords became omnipresent in users daily life.


Therefore, honest recommenders have to assume the defensive strategy of holding grudges against liars by keeping others RRep in order to guard their own interests.

dishonest recommenders, i.e., liars, treat all types of recommendation requesters alike since their utmost goal is to spread lies as widely as possible to take advantages such as promoting their colluders reputation.


These systems practicality in terms of security bene.ts has been demonstrated on real-world applications.

existing process-level DIFC systems have some drawbacks that hinder their adoption in practice.


For the professional receivers, no modi.cation was required, as each has ports for external antennas.

each of our consumer receivers had to be retro.tted with an SMA antenna port through which our signal could be broadcast.


The client process relies on the server process to make decision on the target of the control .ow.

the communication cost can be prohibitivelyhigh.


Thus, our proposed implementation of a secure password manager e.ectively hinders an attacker who utilizes XSS attacks against his victim.

the attacker model discussed by Gonzalez et al.


The remaining binary operators 8and nhave .avor of set intersection, which does not have counterparts in regular expressions.

observe that determining whether a string satis.es a regular expression is in NL-complete, where NL stands for Nondeterministic Logarithmic-Space, and is contained in P. determining whether a userset satis.es a term is NP-complete, even if the term uses only U and .


If the .nal page triggered a heuristics, the record is .agged as malicious.

the AV vendor employs a whitelist of known, good websites to .ag records as benign.


Moreover, the server would need to verify a certi.cate chain for each connection which is an expensive proposition.

the main problem with the above approach is that the server would still need to be authenticated.


Asymmetric encryption or publickey encryption is more computationally intensive than symmetric encryption.

symmetric encryption requires that both sender and receiver share a common key.


However, such the approach is computationally expensive, since it requires many iterations in the bisection method as well as a standard conic solution package.

the result of Lemma 1 is applied to solve the problem in a convex fashion.


The Password-based EAP methods do not provide immunity from dictionary attacks and man-in-the-middle attacks, which means that the Password-based EAP methods are not suitable for wireless communication according to RFC 4017.

these methods still find support by third party wireless LAN suppliers.


When run on real hardware, the number of cycles between the two calls to cycle_count will usually be between 5 and 255, so the code will call steal_passwords.

on an emulator, more time is likely to elapse, since each instruction must be translated before it can be .rst executed.


The NFC hardware of the Galaxy S3 comes with a built-in secure element used for the Google Wallet electronic payment system [28].

this secure element is locked and cannot be used for custom applications such as our immobilizer system.


If it is known that a user cannot violate a security property using their current privileges, then we do not need to actively monitor for security property violations,but insteadwe can simplykeepalogof actions.

we can answer the question of whether or not a user can violate a security property given their past actions and their current tasks by again using an intersection of .nite state machines as we did in section4.1.theNFAmodelingthe possible actionsthata usercantakeshouldbeginwithastringof transitionsthat represent the actionsthattheuserhasalreadytakensofar.Thatis,ratherthan have a set of states representing different time segments where the transitions model what actions the user is allowed to take, for time segments prior to the current time, only the transitions representing the actions which the user actually took should remain.


Our evaluation shows that, because of the regularity of its computation, an uncompressed DFA solution outperforms other implementations and is scalable in terms of the number of packet-flows that are processed in parallel.

on large and complex datasets, such representation may lead to exceeding the memory capacity of the GPU.


Generally, the mailbox ID is an individual user s telephone number, whereas the passcode is selected by the users themselves.

as a common practice, users select these passcodes as easily guessable last 4 digits of the telephone number itself, four zeros, four ones, rows of telephone keypads, sequence numbers such as 1234 etc.


Since this is an NP-hard problem, we provide a heuristic algorithm that has O(n 3) complexity.

due to the sophisticated pruning strategy employed in our implementation, for many practical data sets, it takes signi.cantly less time.


4.3.4 Multiprocessors and DMA Discussion Our proof-of-concept implementation currently does not address multiprocessors and DMA.

our approach can be extended, in principle, to include them.


In case of the Lotka-Volterra equations (4), we cannot obtain their expficit solution.

we can use a conserved quantity to analyze the orbits of the system in xy plane.


For example, we might want to group all social security numbers into an SSN attribute since it is likely that any SSN should be protected.

we may not need to protect all names, so it might make sense to represent each name as its own attribute and only control access to the ones deemed sensitive.


2.3 Data cleansing and partitioning Roles are introduced to compress the user-permission assignment relation so that if n users share m permissions instead of dealing with n × m user-permission assignments a role is introduced requiring a total of n + m assignments.

it is not clear that introducing a role will help in the administration when n or m are small.


This change is statistical significant (paired t test, p < 0.001).

user confidence in the existing training material condition did not improve in a statistically significant way: the average confidence rating was 4.18 pre test (variance = 0.18) and 4.32 post test (variance = 0.15).


Cloaking is a low-level primitive that operates on basic memory pages.

nearly all higher-level application resources including code, data, .les, andeven IPC streams are already managed as memory-mapped objects by modern operating systems, or can be adapted as such.


The networking between devices can be through network infrastructure (e.g., a home wireless LAN), which is assumed to be always accessible for nomadic mobile devices.

it requires deployment and maintenance and cannot assume to be always available.


To .nd a bijection which maps the vertex set V (G) to V (H), the graphs G and H have to be of the same order.

the latter is rarely the case when comparing call graphs.


Begnin nodes are providing positive trust values to other benign nodes and negative values for detected attackers.

attackers allocate every time a maximal positive trust value to other attackers and maximal negative values for benign nodes.


The binding of the key pair to the con.guration of the TCB guarantees that no other platform and even no modi.ed system booted on the same platform can decrypt the key and, hence, the wallet data.

for each device the user wants to use TruWallet, the user has to (i) establish a trusted channel, and (ii) if the TCB or the wallet have to be updated, the trusted channel has to be re-established.


As mentioned before, we can always control the scale of the test through random sampling.

our prior research [13] shows that a prominent property of web applications is low entropy inputs: even a single keystroke or a mouse click could trigger AJAX interactions and produce web traf.c.


If the attacker is able to modify the pointer (or register) before it is used by an indirect call instruction, he would be able to control one control .ow change but not the following ones.

solving this problem is out of the scope of this paper as it relates to protection of function pointers which can t be performed with this approach.


Similarly, .e, p.0..j denotes .e0,p0., .e1,p1.,..., .ej,pj.. Weuse [ and ] asan alternate form of parenthesis to aid the eye in recognizing the formula s syntactic structure 4A notion of weak accountabilityhas alsobeenproposed [8].

deciding weak accountability in general is co-NPcomplete, so we do not discuss it here, as the current paper focuses on practical issues.


Rather, for better ef.ciency the domain can omit this information and instead have the client browser .ll in the gaps with the policies, signi.cantly decreasing message overhead.

the highest message overhead is due to the structure of MSCs, which contain multiple X.509 certi.cates for the same key.


Under normal circumstances, this access would be justi.ed by the need for students to access the books, journals, or presentation laptops often stored in the professor s of.ce.

temporary circumstances may arise during which such access should be denied.


In fact, all the community users have two opposed interests: on one hand they compete against the customer devices which they serve for the available network bandwidth provided by the mesh routers, since they have to share the capacity of their outgoing wireless link established with other mesh routers of the WMCN.

mesh routers have an incentive to serve a large number of users in a fair way, since we assume they are rewarded by the mesh community network considering both the number of served customers and their satisfaction.


In XACML, these obligations are not returned by the PDP to the PEP, because the PDP s decision is Permit;hence the PEP will not see these obligations and thus cannot process them.

one may argue that it is desirable that certain obligations must be performed whenever an access is denied, no matter what reasons caused the deny to occur.


So, an adversary may try to gain information about the images displayed at registration by sending repeated requests with different ID s to the server.

even if the adversary is successful in getting the images, he cannot perform any attack, because user's password is the combination of three images from three grids, hence it is not easy to guess password.


If the SaaS-CP re.ects the content of the file Entity in the HTML response, which will be automatically displayed in the attacker s browser, the send Entity is unnecessary.

this is rarely the case for SAML token veri.cation.


Toxicity(a, s, t1,t2)= i t2 A(a, s, t) * (C(s, t) - D(s, t)) dt (1) t1 OptimalAttacker(s, t)= { 1 if C(s, t) - D(s, t) > 0 (2)0 otherwise MaxToxicity(s, t1,t2)= it2 OptimalAttacker(s, t) * (C(s, t) - D(s, t)) dt (3) t1 E.ectiveness(a, s, t1 , t2 )= Toxicity(a, s, t1,t2) (4) MaxToxicity(s, t1,t2) The de.nitions of toxicity and e.ectiveness are general and apply to any arbitrary functions C(s, t), A(a, s, t), and D(s, t).

we constructed the iCTF competition so that we could measure and observe these functions and ensure they are valid metrics.


For example, enterprise networking devices like Cisco routers and switches run on proprietary operating systems like IOS, which do not resemble traditional unix architecture.

recent advancements in exploitation and root-kitting techniques for proprietary operating systems like Cisco IOS [17, 14] could allow attackers to compromise high-end enterprise devices like backbone routers and .rewalls.


This statistical visualization is useful to prevent redundant consecutive display of the same icons.

as shown in Figure 3(2), horizontal red bars are also displayed in each source IP column.


the speci.c bu.er over.ow may alsobe exploitableby overwriting a stackfunctionpointer2; the initial VSEF won t catch this.


Serious security vulnerabilities due to residue objects have been sporadically discovered in leading browser products in the past, such as IE, Firefox and Safari.

this class of vulnerabilities has not been studied in the research literature.


A one-way hash chain [11] is a sequence of numbers generated by a one-way function F that has the property that for a given x it is easy to compute y = F(x).

given F and y, it is computationally infeasible to determine x, such that x = F-1(y).


Limiting Multitasking: Reduces the possibility of covert channels resulting from competition for access to resources (CPU time, cache and bus contention).

this limits the diversity of applications that can be implemented on the system.


Interposing on virtual functions (or pointers to virtual function tables) is also likely to be quite easy.

we did not have access to working exploits on real-world C++ applications, and hence didn t evaluate this choice experimentally.


On the other hand, data are often stored in a DBMS which enforces access control to ensure that only authorized subjects are able to access data.

access control does not solve the problem of malicious insiders who have the proper credentials to read data.


As a result, there is a need for the reference model to evolve.

if the reference model is updated too often, an attacker could spread out the attack over a longer period of time and possibly go unnoticed in the system [2].


propose more e.cient protocols based on cryptographic techniques like homomorphic encryption and secure multi-party computation for recommender systems based on collaborative .ltering [9, 11, 10].

in their proposals, the users are actively involved in the computations, which makes the overall construction more vulnerable to timeouts and latenciesintheusers connections.


In a similar context, many clustering algorithms [1] have been proposed for WSNs to group sensor nodes into network clusters and to elect a leader for each cluster for cluster management and data aggregation.

these leader election protocols require multiple rounds of group communication and often time synchronization among the participants.


The escort box resides in a secured wireless LAN.

network resources possessed by the wireless LAN, for example extra IP addresses and various centralized servers, may not be available at the time when the mobile guest roams in.


Second, normal email relay requires very little processing and it usually does not trigger noticeable systemwide actions.

when a worm infects a host, it usually triggers noticeable system actions such creating a new process, reading or writing .les, opening a new socket.


FACH and DCH, quickly transitioning down to PCH when the PCH state is enabled.

when the UE is misbehaving, either due to malware or a miscon.gured app, the pro.le of the state transitions notably changes as shown in Fig.


The advantages of the .rst approach is that one can directly measure all gates on each IC regardless of design structure.

the approach is very expensive and slow and requires wafer-level inspection, where there is signi.cant potential for damage.


The TMR represents true positive identi.cations of devices being shaken together.

the TNMR represents true negative identi.cations of devices being shaken together.


This implies that the containing page is restricted from directly accessing the content handled by the plug-in, and that the content can communicate freely with the origin it was loaded from.

a number of plug-ins provide an API for interaction between the plugin and the document.


The main challenge when implementing the disaggregated domain builder was that the existing code relies on .le system access, in order to load kernel images and, optionally, initial ramdisks for a new guest.

it is dif.cult to load a .le into our domain builder, because, as we have already remarked, MiniOS includes no physical device drivers, .le systems or networking stack.


With Masking the deceiver focuses on hiding the real by masking it such that it cannot be detected.

fully masking something to make it appear nonexistent may be challenging in many cases; this leads us to the use of repackaging.


Table2: RuntimeAnalysisforMimicFunction Digesting =O(n) Table building Reading a symbol 1 Pre.x lookup 1 Recording frequency 1 Input length n Tree conversion Sort Construct tree Number of tables C C C Encoding/Decoding =O(n) For each symbol Locate Huffman tree 1 Huffman de(en)coding 1 Input length n proximately the same frequency of the mimicry target.

withoutproper enhancements,themimicfunctionfallsshort against semantic analysisdetection.


Another of the state-diagrams in [10] also seems to make this assumption.

if this was the intention of the original model, it can be included without much di.culty.


Since there is no single hierarchy in a DAG, it is more challenging to transform the cluster hierarchy into a role hierarchy.

the cluster hierarchy will be more stable with respect to noise in the data.


For example, program execution [11] is an attestation technique that helps in measuring the system calls generated by the applications and it also computes the hash of these system calls, which could be used by a remote party for the purpose of veri.cation.

there are a few limitations with this approach, which are as follows: Firstly, it does not have such an automatic mechanism which can help in analyzing the source code of the target application so it will be analyzed statically by a challenger.


Even in the case of 9 streams, which 0.1 hasanaverage PDRof74.1% and corresponds to a very 0 poor quality of service, over 99% of all observed transmission delays occur within 60 msecs.

for the constant jammer, the time taken to acquire the channel will be large relative to normal MAC-sensing times, or even the times observed for poor QoS conditions.


Severaldevice manufacturers are evenfollowing this trendbyproducingsmartphones abletohandletwoSIMs(SubscriberIdenti.cation Modules) at the same time.

because users can install third-party applications on their smartphones, several security concerns may arise.


Oppnets are ideal for .rst responders that need to exchange information in the area of an incident [17, 4, 3].

data protection schemes for ad-hoc networks [18, 28] are mostly intended for protecting communications between a speci.c sender-recipient pair, i.e.


To our knowledge, no such study has been made so far.

an analy-sis of some PGP certificate graph properties is available at http:///www.pgpi.org and http:///pgp.dtype.org.


Similar method of veri.cation can be used for device identi.cation.

if required, the technique for device identi.cation can be altered by using other CA-based mechanisms as agreed upon by all nodes in the network.


Given the existing barriers of cost to adopt a new form of authentication (at least in terms of training and password resets), such incentives can play an important role.

we believe that advertising while authenticating is a delicate subject that may have unintended consequences if it is not deployed with care.


There exist constanttime implementations of many cryptographic algorithms, including AES, DES, RC4, SHA256, TEA, and Salsa20, and even RSA, as well as general techniques for turning implementations of cryptographic algorithms constant-time.

and quite astonishingly, there is no rigorous proof that constant-time algorithms are protected against cachebased attacks when executed concurrently on virtualization platforms with shared cache.


Also, it cannot directly handle physical to virtual address translation at all.

vigilante represents a per-process solution that works with virtual addresses.


Additionally, there are cases where switching to the newest kernel is absolutely necessary.

we do want reviewers,kerneldevelopers, system administrators and users to understand that the latest kernel is not always the best kernel.


These would be sufficient for most cases, and it is expected that this method is adopted in the implementations mentioned above.

it is a temporary solution and is not regarded as correct.


The given description is highly simpli.ed.

it gives an impression of how assets are categorized and described in XML-based syntax.


We emphasize that the BITREP gate can directly be applied to a twoparty case.

though their method is secure, the compu  Algorithm 1 Binary(x) .


Due to jit-based instrumentation, TRUSS is also able to detect unintended sequences issued in a ROP attack.

the DynamoRIO framework does not allow to instrument a program from its very .rst instruction.


Conventional post-mortem forensic work.ows perform this task by physically shutting downacomputerand copyingthecontentsof theharddrive for subsequent analysis.

live forensics are often desired for step 2 because they provide access to networked resources such as active SSH and VPN sessions, remote desktop connections, IM clients and .le transfers.


Controlling Data in the Cloud: Outsourcing Computation without Outsourcing Control Richard Chow, Philippe Golle, Markus Jakobsson,    Ryusuke Masuoka, Jesus Molina Elaine Shi, Jessica Staddon PARC                Fujitsu Laboratories of America {rchow,pgolle,mjakobss,eshi,staddon}       {ryusuke.masuoka, jesus.molina} @parc.com @us.fujitsu.com  ABSTRACT Cloud computing is clearly one of today s most enticing technology areas due, at least in part, to its cost-efficiency and flexibility.

despite the surge in activity and interest, there are significant, persistent concerns about cloud computing that are impeding momentum and will eventually compromise the vision of cloud computing as a new IT procurement model.


InMOSES, eachSPhas assigned an owner that is the entity authorised to de.ne and modify the SP.

the owner of an SP can be the user of the device that creates her ownSP.a user candeploy onherdevice SPesde.nedby third-parties.


For malware variants from the same family, this optimization can match over 90% of functions.

the number of matched functions for malware from different families is often below 20, most of which are shared library functions.


In this manner, if the cookie gets stolen, it can be used only through a TLS channel authenticated with C ertU A , which in turn is only possible for the party who knows the private key of the client s certi.cate.

this technique of strengthening cookie authentication process leads to further requirements being imposed on the service responsible for the HTTP session management.


For example, at the University of Michigan credit union s website, where one of the authors has an account, users authenticate properly and are taken to a secure account page.

one of the options on the accounts page is a link to sign-up for Bill Pay services.


2.1 Motivation Traditional return-oriented programming (ROP) attacks can (mostly) be contained with the help of address space layout randomization (ASLR): this technique makes it harder for an adversary to guess or brute-force addresses that are needed for ROP gadgets.

aSLR can be bypassed if the attacker can exploit an information leakage vulnerability, since such a vulnerability inadvertently reveals a valid, current address inside the running program.


An elliptic curve can be defined over any field (e.g., real, rational, complex).

elliptic curves used in cryptography are mainly defined over finite fields.


Requiring a certi.cate for the AIK from the Privacy-CA introduces another PKI dependency, but we expect very few AIK certi.cates (typically one to four TPMs for the platforms the user wants to use, e.g., laptop, home PC, of.ce PC, mobile device).

the number of certi.cates for usual SSL server authentication is much higher (e.g., 10 20 web sites or more used by one user).


We note that our proposal is only for a website requesting permissions of the underlying system.

we observe that in addition to requesting necessary permissions, a website can also register web-intents with the browser using the webifest .le, similar to the manifest .le in native apps.


On one hand, malware detection and analysis contribute a lot to tumor payload identi.cation.

our APKLancet system pays attention to tumor payload, which contains not only malicious code but also potentially risky third-party libraries.


The problem with such a model is that it is not able to describe an approach that considers several sequential system states or the change from one state to another in order to make a classi.cation.

thisisimportantbecause a sequenceof small state changes spread over multiple views might not be considered harmful by themselves, but may be malicious in this sequence.


This is not the case in completely dark environments.

also rather gloomy environments, i.e., a room in the late afternoon without any arti.cial light source (rather di.use light), can be considered for potential attack scenarios, at least in case the lux values vary slightly during the operation of the device.


However, they assume that the sensor nodes are tamperfree and can trust each other.In contrast, our pairwise key establishment scheme only requires that a sensor node not be compromised for a short time interval at the time of its deployment.

eschenauer and Gligor [9] present a key management scheme for sensor networks based on probabilistic key predeploy-ment.Chan et al [6] extend this scheme and present three new mechanisms for key establishment based on the framework of probabilistic key predeployment.Zhu et al [29] present an approach for establishing a pairwise key that is exclusively known to a pair of nodes with overwhelming probability, based on the combination of probabilistic key sharing and (threshold) secret sharing.We note most of these schemes only provide probabilistic security in the sense that the compromise of a fraction of sensor nodes may expose other nodes keys with some probability.our schemes provide deterministic security because the compromise of a fraction of sensor nodes does not reveal the pairwise keys between other nodes.


Dynamically when the store instruction is checked, MO should be writable, so there is no false alarm.

if the store instruction accesses MO through a pointer, no false positive occurs as we stated in section 3.6 since dynamically we skip checking all store instructions that could result in false positives.


PCA used higher-order logic (HOL) as a universal substrate in which other logics were de.ned; by virtue of being encoded in HOL, these application-speci.c logics inherited some desirable properties, such as consistency, of the underlying logic.

this implicitly assumed that the application-speci.c logics would share the substrate s notion of judgment and fundamental axioms, hence severely restricting the ways in which these logics could di.er (specifically, they would have to be non-linear, classical logics).


For example, the default Android mobile and Opera Mini browsers support Flash and videos can be played easily in the browser without user consent.

a word to PDF converter web app may not require Flash support.


We stress that the standard de.nition of Worry-Free Encryption already guarantees that the security of messages sent to other parties cannot be compromised.


Once the system operates on data from network, it immediately switches into emulated processor to track the data and keep it away from being executed.

the system performance degrades greatly as the workload contains more taint data from network, which prevents the system from being deployed in tra.c-dense server applications or information systems.


Prior research on minimizing the data lifetime has primarily focused on clearing the deallocated memory [17, 9].

this does not prevent memory pages from being checkpointed before they are deallocated.


In [17], transaction datasets are viewed as high-dimensional tabular data, and the proposed approach projects the input database onto lower dimensions.

graph datasets do not have a well de.ned set of items, i.e., dimensions, which renders the approach in [17] inapplicable in our FPM problem.


SPKI supports timed and one-time revalidations.

it does not support threshold VAs - instead, every VA listed in an SPKI certificate must validate the certificate.


One possible reason might be that the worm managed to infected all susceptible hosts.

the second variant reached slightly more IP addresses.


Note, that the same ideas can be applied to data collected from other Online Social Networks (OSN), such as Facebook or Foursquare1 .

different OSN capture social interactions around different and sometimes specific themes, i.e., Foursquare s venues.


Even if the new friends are revealed to the users, k-anonymity is still preserved.

not revealing the latent edges further enhances privacy as attackers have to .rst guess the right latent friends protecting a given node, and then attack a node.


to any role below r3, nor the privilege to add an edge from any role above r2 to r3.

from a security point of view this makes no sense, because with edge e in place there would be anyway a path to roles below r3, or a path from roles above r2.


EPAL[4] isaframeworkthatallows enterprises to manage personal data they have collected on the basis of privacy statements.


5.2 Ability to provide a quality sample With minimal instruction and very little practice, 90% of participants were able to use all of the biometric methods well enough to provide a sample that met the quality criteria.

there were three participants who could not use one of the biometric modalities.


There is no rigorous study of what kind of background noises will introduce acceptable sound distortion.

it is clear that distortion methods and levels, just as in text based CAPTCHAs, can have a significant impact on the usability of audio CAPTCHAs.


over per double word tagging, and provides higher accuracy.

per byte tagging of registers would introduce increased complexity in register operations, which is unacceptable.


Central Repository: When data is stored centrally, there is no need to locate the repositories.

the data owner looses the control over who can access his data.


The security of the protocol depends on the secrecy of the shared key K, but it is vulnerable only while the binding protocol executes.

if  Figure 3: No secrets protocol Protocol Defense Requirements Trust Shared Secret man-in-the-middle at- Secrecy: request, site control, boot Site: pass the security tokens, keep tack channels Boot Channel: small to shared secret private large capacity Encryption man-in-the-middle at- Integrity: request, site control, Site: pass the security tokens free tack boot channels Boot Channel: small capacity, full-duplex  Table 2: Protocols summary the secret key is revealed, authentication is compromised in both directions: an attacker in possession of the secret K can impersonate either the owner or the node.


Wi-Fi Protected Access (WPA) WPA and WPA2 were developed as a response to weaker security found in WEP.

despite providing more advanced security and encryption protocols, WPA2 still has one flaw.


The proposed CD scheme adopts this approach as it is ef.cient to sensors.

sensors receive the same code image disseminated in network reprogramming.


4In Unix-based systems the GOT holds absolute virtual addresses to library functions.

the adversary has also to ensure that SP points to return address 1.


Especially, for models with in.nite state spaces where all states actually are safe with respect to all rights, the problem s undecidability will render a heuristic search unsuccessful without the algorithm actually terminating with that result.

valuable hints on model correctness are obtained if model analysts are pointed to unsafe states and input sequences that lead to in these states.


Several user authentication schemes [1-7] have been proposed to prevent from unauthorized users from gaining access to the system.

only few schemes [1-4] have been proposed those are well suited for WSNs.


Furthermore the Dynamic SubTree (DST) group key agreement scheme by Mao et al.

[11] could be considered, since its average time cost is less than TGDH s. DST uses the unrealistic assumption that group member departure times is known in advance.


3.1 Auto-Worms Botnets comprising desktop computers are comparatively easy to create (or indeed buy) using many di.erent techniques such as emailviruses.

compromised servers havehigher value in terms of the potential for malice or the economic damage that can be wreaked.


INTRODUCTION Access control is one of the most fundamental aspects of computer security, and has been the subject of much formal study.

existing work on the formal analysis of access control systems has focused largely on comparing the relative expressive power of two access control systems Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro.t or commercial advantage and that copies bear this notice and the full citation on the .rst page.


For user-modedebuggers,certainhidingplug-inscould facilitate debuggers to conceal themselves.

since user-mode debuggersrelyonAPIs tocommunicatewithsystemdebugging server, it is highly possible to be detected by kernel modules.


There are already some existing countermeasures.

they put a stress only on information leaking, and there is no deterrent effect since malicious people are not punished with the countermeasures.


Thus, Chase [5] gave a multi-authority ABE scheme which supports many di.erent authorities operating simultaneously, each handing out secret keys for a di.erent set of attributes.


Akenti makes extensive use of X.509 public key certi.cates as the authorization token for encoding both user attributes as well as usage conditions.

akenti mainly supports discretionary access control (DAC) using ACLs and group based approach without considering hierarchical relationship between each group.


ID and password authentication is enough for usability-oriented services.

for security oriented services it isn t secure enough.


For example, delegation is a well-studied notion in authorization.

in the context of a new scheme such as ours, one still needs to make a number of choices regarding, for example, the depth of delegation that is allowed, and the sorts of power an individual at a particular depth has.


Malicious USB: The CA round two submission still did not verify the integrity of the message, but instead tried to empty the USB stick before use.

due to implementation oversights, there were a number of ways to prevent this operation from succeeding, such as creating a symlink to a directory, which resulted in a denial-of-service attack (the attack was recognized as such by the CA team).


This was the behavior of the original Oink/CQual++ linker.

this is too restrictive since many real-world programs do use multiple symbols with the same name.


For applications in which number of signatures that will be necessary during the lifetime of the sensor node exceeds the storage limit, the sensor node can easily switch to original OTS scheme after all preloaded signing keys are exhausted and signing keys are started to be computed in real-time.

authenticating the broadcast communication originated from the base station using pre-computed one-time signing keys is possible throughout the lifetime of the network assuming that the base has no storage as well as power constraint.


The cryptographic access control mechanism was originally designed to operate on a log-structured .le system.

the use of symmetric cryptography as a necessary optimization allows us suf.cient .exibility to use the standard Linux NFS codebase.


3.3 SOAP Response ASOAPresponseissimilartoarequest,apartfromthe fatthatitaddsaResponsesuÆxtotheelementnameused forthemethod.Forinstane,forthemethodGetQuote,the responseelementisGetQuoteResponse.Asampleresponse toourGetQuoteallofFigure2isreportedinFigure3.


The first focus on the printing failures or overall image blur of the printed photo [10].

this method will fail if the photo is of high quality.


5.4 Formal Security Model Common Criteria EAL4 does not require a formal security model to guide the design and implementation of the security features of a software product.

using a formal security model (requirement ADV SPM.1) does increase assurance as it is used in CC EAL s 6 and 7.


Guessing yes means we will not risk aborting a program that is using %n correctly.

guessing no is more secure because the white-list stays smaller.


In addition, the disambiguation of the notion of policies by partitioning it into strategic, tactical, and operational, at decreasing level of abstractions, is very useful.

semi-automatic mechanisms for transforming strategic policies to operational policies, as described in this paper, are still lacking.


a CA may update its certi.cate without necessarily updating its certi.cate pro.le.


There exist several devices such as CPU registers, apic and etc., as shown in Figure 2, which are emulated by Xen-HVM itself.

they share similar entries with those emulated by Qemu, and our implementation shows that the scaling will not consume much time for an experienced programmer.


For instance, to con.gure the host name, we have to execute hostname in-VM to update the kernel state; to remove a malicious kernel module (e.g., a detected installed rootkit), we have to execute rmmod in-VM to unload it from the OS kernel; and to stop a malicious process, we have to execute kill in-VM to remove it.

from a security perspective, the traditional program execution model has at least the following issues: (1) In-VM programs (e.g., hostname,rmmod, ps) and kernel states are directly faced by user level, as well as kernel level malware, and they can often be attacked.


In many conditions, this text is su.cient to uniquely identify the widget.


However, the relationship between administrative powers and administrative roles are encoded in newly introduced relations.

oracle handles this quite well by using the same mechanism for managing system privileges and roles.


Stealth memory induces a weak form of constant-time, called S-constant-time, which encompasses some widely used cryptographic implementations.

there is no rigorous analysis of stealth memory and S-constant-time, and no tool support for checking if applications are S-constant-time.


On the Security of Wireless Network Access with Enhancements Lein Harn and Wen-Jung Hsin University of Missouri -Kansas City Kansas City, MO 64110 ABSTRACT The security of the current 3G wireless protocols addresses the problems faced by the 2G systems, in addition to ful.lling the higher 3G security requirements mandated from operating in IP networks as well as voice networks.

the approach adopted by the two most popular 3G mobile system forerunners, UMTS and cdma2000, leaves many areas for improvement.


For example, Al-Fahoum [20] proposed a quality measure by decomposition of the signal into sub-bands based on comparing the PQRSTUV complex features of an ECG signal and allocating a weighted score according to diagnostic significance of the sub-bands.

this requires the use of the original signal.


In the CardSpace framework, the claims to be asserted in the RP Security Policy are represented as attributes of an Attribute Statement, that is contained within SAMLAssertion requests and responses exchanged before the security token can be retrieved from the IdP.

in the Liberty ID-FF, the IdP does not expect any SAML Attribute Statements in the AuthenticationRequestEnvelope,  i.e.


This limits them to newer processors mostly less than 1-2 years old.

sMM rootkits are more likely to exist on older processors containing older BIOS versions (greater than 1-2 years old as shown in Figure 7).


It is tempting to disable clflush instructions altogether in PaaS applications to prevent side-channel attacks.

as clflush is a nonprivileged instruction, trapping its execution to mitigate its e.ect in the privileged software layer, i.e., operating system, is di.cult without hardware modi.cation.


Performance of our classi.er was lower than the classi.er built based on users web page clicks.

prediction of male users showed a close precision value only at a 10% drop in recall.


Canonicalization is necessary since some elements are used as inputs to hash functions, and it also simplifies parsing.

when a  is used within an XML document, it does not need to be in canonical form, as long as it is canonicalized before hashing.


For example, it means that the person met whom and did what and had certain the propensity to consume and dealt with somebody and had a disease etc.

illegal attacker behind development that uses better tools gives rise to side effects.


When we focus on photos where the friend was absent, and no other faces were contained either, the results remain almost identical.

the simple and medium photos that were .agged as NotUseful present a measurable decrease (6.5%, 16.3%).


Intuitively, by eliminating function calls, the transition relation refers only to system calls.

for the purpose of maintaining control .ow integrity, it is crucial to maintain information related to function call sites and return sites.


Indeed, (H)MQV is commonly viewed as nearly optimal in the integrity of security and protocol e.ciency, and even a minor e.ciency improvement (while preserving provable security) is desirable and can be challenging.

kEA and OPACITY enjoy the advantages of optimal online e.ciency and honest-player deniability (HP-deniability).


Aftersight [6] applies this approach by directly recording the data .ows from the devices to CPU and redelivering them to CPU during replay.

performance is trade o. for the bypass of the device emulation incompatibility.


A user can collect certi.cates and later provide them to a remote party as veri.able proof of her location at a speci.c time.

the applicability of these infrastructurebased approaches for mobile sensing is limited as cooperating infrastructure may not be present in remote or hostile environments of particular interest to some applications.


Since a function usually uses the %ebp register to reference the stack relative to the frame base, and our cookie is located below the frame base, references to the stack local variables remain unchanged.

references to function parameters which are stored below the frame base, and therefore below our cookie, need to be adjusted by 4 bytes.


It can provide valuable inputs to (external) security analysts.

it does not understand semantics of these di.erences.


For example, in the case of a malicious campaign that infects websites using always the same web page name, the domain names of the infected pages will be di.erent for di.erent URLs.

other parts of these URLs will be the same.


As decoy sets are chosen at random without cooperation between the di.erent services there may be some overlap.

this is small and there is no hint for the attacker to determine the existence of overlap or its size.


Recall from Table 3 that we saw 178 CSS resources that lacked a Content-Type header in our survey.

as shown in Table 4, most browsers with the notable exception of Opera do accept cross-origin style sheets if they lack a Content-Type header, even in standards mode.


The above a series of interactions seem complicated because the scenario includes dynamic acquisition of delegation assertions and user consents.

some optimization is possible for accomplishing better performance in actual implementation.


Adding to this the Probe overhead of RSN IE maximum size of 255 octets, we get a total number of octets overhead as 2416 octets or 19.328 kbits.

if the MAC payload is greater than 2312 octets (18.496 kb), the overhead per frame is added, albeit the percentage overhead dropping down.


They were investigating these as possible source of weakness in AES.

we use these invariances for CED to protect the AES against random faults and malicious attacks.


They use PKI for mutual authentication and distribution of health data, and use of symmetric encryption to preserve the con.dentiality of the health data.

in their system, the trust and security management is delegated to the medical provider much like in a paper-based EHR.


The literature on clouds often points out security and privacy challenges as the main obstacles, and proposes solutions and guidelines to avoid them.

most of these works deal with either malicious cloud providers or customers, but ignore the severe threats caused by unaware users.


ACCESS CONTROL AT THE NAME RES-OLUTION SERVICE The GNRS supports mobility by enabling a host to inform others the change of its location as well as to query others locators.

this service currently does not protect the mapping from being queried by illegitimate users.


However, this added accuracy may not be fully useful, since enforcement of PDA models would require secure interception of all function calls made by a program, which is not possible for arbitrary binaries.

one important advantage PDA have over FSA is their modularity, i.e., the PDA model of one procedure in a program does not depend on the models of other procedures invoked by it.


Thus, passive participation of encrypted or authenticated messages is only possible if multiple nodes share the keys used for encryption and authentication.

if a pairwise shared key is used for encrypting or authenticating a message, it e.ectively precludes passive participation in the sensor network.


Useful noise is only produced in that nodes will appear as dummies in a random number of other users public lists.

this noise term is Gaussian and is based on a large number of samples (~|..|), giving it a very low variance and making this an ine.ectual approach for slowing down inference of high-degree nodes.


Prior schemes such as [1, 7, 9] have prevented this by ensuring that n is a safeprime product and then made sure that all elements are cast into QRn.

proving that a modulus is a safe-prime product is rather ine.cient [11] and hence the setup of these schemes is not really practical.


Many of these areas overlap and are all part of a reliable database system.

if one just looks at reliability, it is sometimes easy to overlook some of the .ner details of security.


SISO redirects the user s attention during the login process.

in addition to usability issues [12, 7], redirection exposes users to phishing attacks [24, 7, 27] and makes IdP tracking possible [26].


In the standard Rasch model, failure is represented by 0 and success by 1.

threats may in.ict di.erent amounts of damage upon assets, and when the amount of damage is considered, intermediate values would be needed.


As much as one wants to make difficult undertakings enjoyable sometimes this is just not achievable.

in some cases educational games seem to work very well [3] [4] [18].


McCamant and Morrisett, as part of their x86 Software Fault Isolation (SFI) design [19], propose an instruction alignment scheme that does this.

their scheme has some downsides: .rst, code compiled for their scheme cannot call libraries not so compiled, so the switch must be all-or-nothing; second, the nop padding allows less code to .t in the instruction cache and the andl $0x...f0, (%esp); ret idiom imposes a data dependency that may introduce slowdowns that might be unacceptable in generalpurpose software as opposed to the traditional, more limited SFI usage scenarios.4 We stress, however, that while countermeasures of this sort would impede our attack, they would not necessarily prevent it.


If every deployed zone had this size, the zone deployment process would be too slow and the amount of data to store and transmit too high to be usable in practice.

it is clear that almost every zone will need a base installation (GUI extension, text editor, common libraries) plus some smaller modi.cation to adapt them to the TVD use case.


Many kernel functions use data pointers as their parameters or returns, and the callers or callees may read and write the data pointed to by these pointers.

if the caller and the callee are located in di.erent address spaces, these operations will trigger alarms.