Search

Enforcing security often requires the two legitimate parties of a communication to determine if they share a secret, without disclosing information (e.g., the shared secret itself, or just the existence of such a secret) to third parties. In this paper, we propose CASSANDRA, a toolbox composed of three probabilistic protocols that allows two parties, each one having a subset of elements drawn by a pre-determined set, to compute information about the intersection of such two sets. In particular, C-void decides whether the two sets are disjoint; C-size allows to compute how many elements the intersection is composed of; and, C-set returns the identity of the elements of the intersection (if any). These protocols differ, other than in functionality, also in the degree of assurance they can provide and the degree of interactions required by the two parties. The communication cost also differs, but in any case, it is below the cost of competing solution representing the state of the art. These protocols also share some common features: that is, they are completely tunable and specifically suited for devices having constraints on energy, communication, storage, and bandwidth. Examples of these devices are portable devices (e.g., phones) handling satellite communications, or nodes of wireless sensor networks. Thorough analysis and extensive simulations support our findings. [ABSTRACT FROM AUTHOR]

Android is currently the most widespread operating system (OS) worldwide, but also the most prone to attacks. Despite the challenges faced by Industry and Academia to improve the Android OS security, it still has several vulnerabilities. Among those, the severity of the Next-Intent Vulnerability (NIV) can be immediately grasped. Android apps are made of components, which by default are private and cannot be targeted by other apps on the same phone. However, NIV allows any app to access the private components of a different app, eventually generating a crash or stealing sensitive data. NIV occurs when there is a chain of calls among different components based on the Intent messaging model and there is no control over the reliability of the first component triggering the call. NIV was first detected in 2013, but it is still an open issue. In this paper, we present Next-Intent Vulnerability Detector ( N I V D ), a novel approach to detect NIV in Android apps by relying on type systems. N I V D applies the inference rules of its type system to the app execution paths containing a sequence of calls to three NIV-related Android APIs. Compared to the state-of-the-art, N I V D is faster and more efficient, without losing precision in detecting NIV. Finally, through N I V D Google Photos was found to be vulnerable, and we disclosed the finding on the Google official bug report website (issue number 124342801). [ABSTRACT FROM AUTHOR]