Search

Your search keyword '"Tiffany Bao"' showing total 64 results
Start Over Author "Tiffany Bao" Publication Year Range Last 50 years
64 results on '"Tiffany Bao"'

43. Cyber Autonomy in Software Security: Techniques and Tactics

Author

Yan Shoshitaishvili and Tiffany Bao

Subjects
Exploit, business.industry, Computer science, media_common.quotation_subject, Offensive, Vulnerability, Context (language use), Computer security, computer.software_genre, Software, Work (electrical), Software security assurance, business, computer, Autonomy, media_common
Abstract

Software security research traditionally focuses on the development of specific offense and defense techniques on software vulnerabilities. Software security techniques are useful in practice only to the extent they can be leveraged to achieve a goal. Different parties‐individuals, companies, or nations‐implement offensive and defensive techniques as components in holistic systems, and these systems strategically interact with each other.This chapter aims to introduce to the reader cyber autonomy in software security. We will offer a holistic view on this topic by presenting both techniques and tactics in software security. This chapter will introduce the high‐level model of cyber autonomy in software security and explain how techniques and tactics co‐work in software security, discuss current software security techniques (including vulnerability discovery, exploit generation, vulnerability patching, and vulnerability ricochet) and, once the readers have gained familiarity with the background and the context in software security that serves as the prerequisites for building a game theoretical model, will introduce the autonomous computer security game, which is the core of the chapter.

Published
2021
Full Text
View/download PDF

44. CrawlPhish: Large-scale Analysis of Client-side Cloaking Techniques in Phishing

Author

Brad Wardman, Yan Shoshitaishvili, Gail-Joon Ahn, Zhibo Sun, Haehyun Cho, RC Johnson, Alexandros Kapravelos, Tiffany Bao, Adam Oest, Adam Doupé, Shaown Sarker, Ruoyu Wang, and Penghui Zhang

Subjects
Computer Networks and Communications, business.industry, Computer science, Cloaking, Evasion (network security), Client-side, Computer security, computer.software_genre, Internet security, JavaScript, Phishing, Key (cryptography), Dynamic program analysis, ComputingMilieux_COMPUTERSANDSOCIETY, Electrical and Electronic Engineering, business, Law, computer, computer.programming_language
Abstract

Phishing is a critical threat to Internet users. Although an extensive ecosystem serves to protect users, phishing websites are growing in sophistication, and they can slip past the ecosystem’s detection systems—and subsequently cause real-world damage—with the help of evasion techniques. Sophisticated client-side evasion techniques, known as cloaking, leverage JavaScript to enable complex interactions between potential victims and the phishing website, and can thus be particularly effective in slowing or entirely preventing automated mitigations. Yet, neither the prevalence nor the impact of client-side cloaking has been studied.In this paper, we present CrawlPhish, a framework for automatically detecting and categorizing client-side cloaking used by known phishing websites. We deploy CrawlPhish over 14 months between 2018 and 2019 to collect and thoroughly analyze a dataset of 112,005 phishing websites in the wild. By adapting state-of-the-art static and dynamic code analysis, we find that 35,067 of these websites have 1,128 distinct implementations of client-side cloaking techniques. Moreover, we find that attackers’ use of cloaking grew from 23.32% initially to 33.70% by the end of our data collection period. Detection of cloaking by our framework exhibited low false-positive and false-negative rates of 1.45% and 1.75%, respectively. We analyze the semantics of the techniques we detected and propose a taxonomy of eight types of evasion across three high-level categories: User Interaction, Fingerprinting, and Bot Behavior.Using 150 artificial phishing websites, we empirically show that each category of evasion technique is effective in avoiding browser-based phishing detection (a key ecosystem defense). Additionally, through a user study, we verify that the techniques generally do not discourage victim visits. Therefore, we propose ways in which our methodology can be used to not only improve the ecosystem’s ability to mitigate phishing websites with client-side cloaking, but also continuously identify emerging cloaking techniques as they are launched by attackers.

Published
2021
Full Text
View/download PDF

45. Scam Pandemic: How Attackers Exploit Public Fear through Phishing

Author

Ruoyu Wang, Penghui Zhang, Haehyun Cho, Yan Shoshitaishvili, Adam Doupé, Marzieh Bitaab, Rana Pourmohamad, Zhibo Sun, Adam Oest, Gail-Joon Ahn, Tiffany Bao, and Doowon Kim

Subjects
FOS: Computer and information sciences, Government, Computer Science - Cryptography and Security, Exploit, business.industry, Internet privacy, Phishing, Market research, Web traffic, Pandemic, Key (cryptography), The Internet, business, Cryptography and Security (cs.CR)
Abstract

As the COVID-19 pandemic started triggering widespread lockdowns across the globe, cybercriminals did not hesitate to take advantage of users' increased usage of the Internet and their reliance on it. In this paper, we carry out a comprehensive measurement study of online social engineering attacks in the early months of the pandemic. By collecting, synthesizing, and analyzing DNS records, TLS certificates, phishing URLs, phishing website source code, phishing emails, web traffic to phishing websites, news articles, and government announcements, we track trends of phishing activity between January and May 2020 and seek to understand the key implications of the underlying trends. We find that phishing attack traffic in March and April 2020 skyrocketed up to 220\% of its pre-COVID-19 rate, far exceeding typical seasonal spikes. Attackers exploited victims' uncertainty and fear related to the pandemic through a variety of highly targeted scams, including emerging scam types against which current defenses are not sufficient as well as traditional phishing which outpaced the ecosystem's collective response., 10 pages, Accepted to eCrime 2020

Published
2021

49. Cyber Deception : Techniques, Strategies, and Human Aspects

Author

Tiffany Bao, Milind Tambe, Cliff Wang, Tiffany Bao, Milind Tambe, and Cliff Wang

Subjects
Cyberspace--Security measures, Computer networks--Security measures
Abstract

This book introduces recent research results for cyber deception, a promising field for proactive cyber defense. The beauty and challenge of cyber deception is that it is an interdisciplinary research field requiring study from techniques and strategies to human aspects. This book covers a wide variety of cyber deception research, including game theory, artificial intelligence, cognitive science, and deception-related technology. Specifically, this book addresses three core elements regarding cyber deception: Understanding human's cognitive behaviors in decoyed network scenarios Developing effective deceptive strategies based on human's behaviorsDesigning deceptive techniques that supports the enforcement of deceptive strategiesThe research introduced in this book identifies the scientific challenges, highlights the complexity and inspires the future research of cyber deception.Researchers working in cybersecurity and advanced-level computer science students focused on cybersecurity will find this book useful as a reference. This book also targets professionals working in cybersecurity.Chapter'Using Amnesia to Detect Credential Database Breaches'and Chapter'Deceiving ML-Based Friend-or-Foe Identification for Executables'are available open access under a Creative Commons Attribution 4.0 International License via link.springer.com.

Published
2022

Catalog

Books, media, physical & digital resources
See catalog results