Search

Cloud computing is gradually replacing traditional IT infrastructures. However, an important issue that has emerged through that revolution is the preservation of an adequate level of security for the infrastructure. Currently there are many researchers working in the area of cloud security and privacy protection, proposing several solutions that address the threats against cloud infrastructures. This paper provides a thorough review of the research work in the area presenting the solutions that have been proposed so far. [ABSTRACT FROM PUBLISHER]

Click jacking attacks are the emerging threats to websites, especially to online social networks (OSNs). In this paper, we describe some new attacks to online websites. The new Click jacking attacks cause serious damage to users by stealing their personal credentials or by sharing their personal information on social networks bringing moral degradation to them. The attacker applications are hidden behind the sensitive user interface to steal the clicks of the user and use them for the illegal purposes. To detect and prevent Click jacking attacks, we propose a browser-based solution referred to as Cursor Spoofing and Click jacking Prevention (CSCP). CSCP ensures protection Cursor spoofing attack with high effectiveness and also the Like jacking attacks, other variation of Click jacking attacks which associate malicious code to Facebook Like buttons. We have conducted our studies on 442 participants to evaluate the effectiveness of our attacks and also defenses. Results show that our attack success rate falls between 76% and 78%. [ABSTRACT FROM PUBLISHER]

Many web applications employ session management to keep track of visitors' activities across pages and over periods of time. A session is a period of time linked to a visitor, which is initiated when he/she arrives at a web application and it ends when his/her browser is closed or after a certain time of inactivity. Attackers can hijack a user's session by exploiting session management vulnerabilities by means of session fixation and cross-site request forgery attacks. Even though such session management vulnerabilities can be eliminated in the development phase of web applications, the test operator is required to have detailed knowledge on the attacks and to set up a test environment each time he/she attempts to detect vulnerabilities. We propose a technique that automatically detects session management vulnerabilities in web applications by simulating real attacks. Our technique requires the test operator to only enter a few pieces of basic information about the web application, without requiring a test environment to be set up or detailed knowledge on the web application. Our experiments demonstrated that our technique could detect vulnerabilities in five web applications deployed in the real world. [ABSTRACT FROM PUBLISHER]

We are living in the electronic age where electronic transactions such as e-mail, e-banking, e-commerce, and e-learning etc.. are becoming more and more prominent. To access online for this services, web browser is today's almost unique software used. These days' hackers know that browsers are installed into all computers, and can be used to compromise a machine by distributing malware via malicious or hacked websites. Also these sites use JavaScript to manipulate web browsers and can drive user system to failures, each web browsers have features that define theirs behaviors, unfortunately most of users are unwilling to enable or disable this features, because many of them still do not understand even basic security concepts, This paper will briefly describe some specific web browser features misconfiguration and associated risks, also we present an application that will check configuration of selected web browser in order to find all misconfigured features, and propose to student through tailored e-learning awareness program to reconfigure them securely. [ABSTRACT FROM PUBLISHER]

A Workflow Management System usually works in a specific trusted environment in practice. So it increases migrating efficiency of migrating instance by configuring some functions of the migrating instance as the services of trusted work position. In the research, we improved the light migrating instance[5] according to Emergency Information Management characteristics. We designed Emergency Information Management System based on the migrating instance. In the System, Browser/Server and Client/Server were adopted. In the paper, the improvement of migrating instance was discussed firstly. Next structure and functions of Emergency Information Management System were introduced. [ABSTRACT FROM PUBLISHER]

As the number of Internet users has grown, so have the security threats that they face online. Security warnings are one key strategy for trying to warn users about those threats; but recently, it has been questioned whether they are effective. We conducted a study in which 120 participants brought their own laptops to a usability test of a new academic article summary tool. They encountered a PDF download warning for one of the papers. All participants noticed the warning, but 98 (81.7%) downloaded the PDF file that triggered it. There was no significant difference between responses to a brief generic warning, and a longer specific one. The participants who heeded the warning were overwhelmingly female, and either had previous experience with viruses or lower levels of computing skills. Our analysis of the reasons for ignoring warnings shows that participants have become desensitised by frequent exposure and false alarms, and think they can recognise security risks. At the same time, their answers revealed some misunderstandings about security threats: for instance, they rely on anti-virus software to protect them from a wide range of threats, and do not believe that PDF files can infect their machine with viruses. We conclude that security warnings in their current forms are largely ineffective, and will remain so, unless the number of false positives can be reduced. [ABSTRACT FROM PUBLISHER]

Phishing constitutes more than half of all reported security incident son the Internet. The attacks cause users to erroneously trust websites and enter sensitive data because the email notifications and the website look familiar. Our hypothesis is that familiarity can be defined formally using history data from the user's computer, and effective presentation of the data can help users distinguishphishing messages from trustworthy messages. [ABSTRACT FROM PUBLISHER]

Current online banking scheme built on ordinary software stack, which comprises of the operating system and its applications running on it, is facing attacks including Phishing, Pharming, Malicious Software Attacks (MSW), Man in the Middle Attacks (MITM) and Key logger. Today's countermeasures either prevent only part of these attacks or have high cost on performance and usability. In this paper, we introduce the Domain Online Banking (DOBank), a novel security scheme for online banking that combines the virtual machine (VM) technology with web services. Firstly, DOBank encapsulates the banking service into a lightweight domain and protects it from any attacks caused by virus from the user's host. Secondly, the domain can access certain hardware devices exclusively against Key logger and gains nearly native performance using the pass through technology. Finally, we use the virtual Trusted Platform Module (vTPM) for the online banking domain's integrity verification as well as the SSL/TLS (Security Sockets Layer/Transport Layer Security) protocol for the confidentiality of data transaction over the internet. We show that this scheme is secure enough to prevent typical viruses that threaten the online banking. The experiments on the network throughput and the time consumed of integrity measurement show it adds little overhead to the overall system. [ABSTRACT FROM PUBLISHER]

Our research concentrates on anomaly detection techniques, which have both industrial applications such as network monitoring and protection, as well as research applications such as software behavioral analysis or malware classification. During our doctoral research, we worked on anomaly detection from three different perspective, as a complex computer infrastructure has several weak spots that must be protected. We first focused on the operating system, central to any computer, to avoid malicious code to subvert its normal activity. Secondly, we concentrated on web applications, which are the main interface to modern computing: Because of their immense popularity, they have indeed become the most targeted entry point of intrusions. Last, we developed novel techniques with the aim of identifying related events (e.g., alerts reported by intrusion detection systems) to build new and more compact knowledge to detect malicious activity on large-scale systems. During our research we enhanced existing anomaly detection tools and also contributed with new ones. Such tools have been tested over different datasets, both synthetic data and real network traffic, and lead to interesting results that were accepted for publication at main security venues. [ABSTRACT FROM PUBLISHER]

The conventional design of home security systems typically monitors only the property and lacks physical control aspects of the house itself. Also, the term security is not well defined because there is a time delay between the alarm system going on and actual arrival of the security personnel. This paper discusses the development of a home security and monitoring system that works where the traditional security systems that are mainly concerned about curbing burglary and gathering evidence against trespassing fail. The paper presents the design and implementation details of this new home control and security system based on field programmable gate array (FPGA) The user here can interact directly with the system through a web-based interface over the Internet, while home appliances like air conditioners, lights, door locks and gates are remotely controlled through a user-friendly web page. An additional feature that enhances the security aspect of the system is its capability of monitoring entry points such as doors and windows so that in the event any breach, an alerting email message is sent to the home owner instantly. [ABSTRACT FROM PUBLISHER]

This work is a survey presenting attacks on smartphones and recommending the best possible locations for deploying defensive mechanisms to mitigate those attacks. The attack vectors are categorized into three classes according to their characteristics as attacks via application layer, communication layer and operating system layer. We describe various attacks belonging to each of these classes and suggest locations where defensive mechanisms could be deployed to mitigate them. This paper does not intend to present a complete list of attacks. It rather tries to evaluate the best possible place for implementing the potential countermeasures to either prevent or to detect attacks with similar characteristics. The focus of this work is therefore to present a set of representative attacks on smartphone specific services and to identify meaningful locations where particular countermeasures available from the literature could be installed. [ABSTRACT FROM PUBLISHER]

Crawling is a necessary step for testing web applications for security. An important concept that impacts the efficiency of crawling is state equivalence. This paper proposes two techniques to improve any state equivalence mechanism. The first technique detects parts of the pages that are unimportant for crawling. The second technique helps identifying session parameters. We also present a summary of our research on crawling techniques for the new generation of web applications, so-called Rich Internet Applications (RIAs). RIAs present new security and crawling challenges that cannot be addressed by traditional techniques. Solving these issues is a must if we want to continue benefitting from automated tools for testing web applications. [ABSTRACT FROM PUBLISHER]

Malware and computer forensic researchers often communicate with malicious servers, either directly or indirectly, through the web browser or other ports utilized by malicious software. Communication with this form of adversary can sometimes necessitate the use of a proxy server in order to conceal the true origin of the researcher's traffic. Open source projects such as OpenVPN currently offer a structured method for establishing software based virtual private networks (VPNs) between arbitrary clients and servers. Likewise, paradigms exist which allow a user to proxy traffic from one end of a VPN to another, effectively masking the origin of traffic being sent to and from the client system. In this paper, we present MANTICORE -- a system that  combines ideas from VPN with the instancing functionality of a cloud computing system in order to dynamically mask and reassign the apparent IP address of a researcher's system. We also present experimental evaluation of our system on Amazon's Elastic Compute Cloud (EC2). [ABSTRACT FROM PUBLISHER]

With the rapid development of Internet and Cloud Computing, Web-based applications become more powerful. In order to fully use the Web-based applications, we design a new Operating System known as the Cloud Terminal Operating System. CTOS just runs one application which is Web browser, and the Web-based applications meet all the daily needs of users. CTOS abandons the traditional desktop applications, and makes some special design to optimize Web-based applications. This paper gives the concept of CTOS, and analyzes the other similar operating systems. This paper also gives a detailed design and implementation of CTOS which is based on the Hurd operating system. [ABSTRACT FROM PUBLISHER]

A lot of effort has been put into researching client-side attacks, including vulnerabilities like cross-site scripting, cross-site request forgery, and more recently, clickjacking. Similar to other client-side attacks, a clickjacking vulnerability can use the browser to exploit weaknesses in cross domain isolation and the same origin policy. It does this by tricking the user to click on something that is actually not what the user perceives they are clicking on. In the most extreme cases, this vulnerability can cause an unsuspecting user to have their account compromised with a single click. Although there are protections available for clickjacking, the web applications implementing these mitigations are far and in between. Additionally, although the possibility for an attacker to frame a page is easy to detect, it is much more difficult to demonstrate or assess the impact of a clickjacking vulnerability than more traditional client-side vectors. Tools do not currently exist to reliably demonstrate clickjacking exploitation, and the rare demonstrations that are done typically use custom JavaScript and HTML for each individual vulnerability. Worse, many times this esoteric code is never made public, leaving everyone to rewrite their own from scratch. BeEF, known as the Browser Exploitation Framework, is a tool designed to help professional penetration testers easily demonstrate the impact of client-side security vulnerabilities. In this paper, we present a plugin module for BeEF which provides a way for penetration testers to easily demonstrate the impact of clickjacking vulnerabilities. [ABSTRACT FROM PUBLISHER]

This paper studies a privacy vulnerability within OpenID, a distributed single sign on protocol. An OpenID system consists of three components: User Agent (UA); Relying Party - A web application that a UA would like to authenticate with using their unique identifier; and Identity Provider - A web server that provides a globally unique identifier for the UA and validates the identity of UAs on behalf of Relying Parties. The privacy vulnerability has been identified in existing literatures. However, no effective solution has been proposed to date. In this paper, we present an effective scheme to mitigate this vulnerability. In order for OpenID to gain wider acceptance, this vulnerability must be addressed with a solution that is convenient to the users of single sign on. We propose a method for mitigating this vulnerability by creating vertical levels of trust between constituents of an OpenID network through expanding the role of OpenID Identity Providers to include auditing OpenID Relying Parties for privacy vulnerabilities. In addition, Identity Providers may keep records of audits that identify Relying Parties that do not protect the privacy of OpenID users. The primary issue with this privacy vulnerability is that it is completely transparent - it occurs without the user ever being aware that it is happening. We cannot force Relying Parties to guarantee the privacy of OpenID users, nor would we like to burden individual users with browser level solutions that are often overly technical and difficult to understand. We have designed an audit solution at the level of the Identity Provider, which can accurately inform users when Relying Parties may be sharing information with third parties, therefore giving OpenID users the ability to make a conscious choice to share that information. We have performed real network experiments to validate our scheme, and the experimental results show that our scheme is effective. [ABSTRACT FROM PUBLISHER]

Security has become a major concern while browsing as the number of malicious sites keeps increasing with the cost for hosting a site decreasing. Though most of the web servers use Secure Socket Layer (SSL) over HTTP (Hyper Text Transfer Protocol) to ensure trust between consumers and providers, SSL is vulnerable to Man-In-The-Middle (MITM) attack and becoming very common these days. Phishing is another major problem, which has increased rapidly over the years. In this paper we present a novel secure web referral service using Secure Search Engine (SSE), which would resolve phishing and MITM attacks for web based applications. SSE is based on web crawling technology with a set of checking services to validate IP addresses and certificate chains. Additionally, we present a novel phishing filter that can be used to check any given URLs with minimal delay. Our solution is non-intrusive and reduces human factors, which are commonly in existing web-based services, in security verification processes. Our evaluation shows that our solutions produce less false positive and false negative than existing web browser-based anti-phishing solutions. [ABSTRACT FROM PUBLISHER]

Websites written in ASP.NET might contain security vulnerabilities that are not seen to the owner of the website. This paper describes an algorithm that aims in the detection of security vulnerabilities. The suggested algorithm performs a scanning process for all website/ application files. Our scanner tool relies on studying the source code of the application depending on ASP.NET files and the code behind files (Visual Basic VB and C sharp C#). A program written for this purpose is to generate a report that describes most leaks and vulnerabilities types (by mentioning the file name, leak description and its location). The suggested algorithm will help organization to fix the vulnerabilities and improve the overall security. [ABSTRACT FROM PUBLISHER]

In this paper, the design of the a web-based Smart Home system is introduced. The proposed system provides a web interface through which users are able to check the home status and control the domestic appliance remotely as long as they have a PC system connected to the Internet. In order to give users a more vivid way to access the Smart Home system, a web based 3D interface with virtual reality technology is proposed in this paper. The rooms, appliances and furniture are reconstructed in the web-based interface. Users can “look around” in the virtual home remotely. They are able to check the security alarms, control the appliances in the 3D virtual reality similar as they do in real homes. [ABSTRACT FROM PUBLISHER]

The modern web has become a collaboration and communications platform with the advent of social networks. Apart from attracting millions of users, the popularity of social networking communities has also attracted spammers who can abuse and misuse the rich information in these sites using sophisticated attack techniques. In this paper we have described four popular modern techniques used by attackers to spam social networking sites: clickjacking [1], malicious browser extensions via drive-by-downloads [2], URL shorteners [3] and socially engineered script injection [4]. We have analyzed click-jacking and malicious browser extensions in detail, evaluating existing solutions to detect=prevent them. We observed that the existing solutions for clickjacking fail in some common use case scenarios. Therefore, we proposed enhancements that help detecting clickjacking attacks in those failed scenarios. We also proposed a declarative security policy to prevent malicious browser extension attacks. We implemented chrome extensions to validate both of our proposals in a test bed social network, which we have setup using an open source social networking engine. We believe our proposals are helpful to strengthen the security of social networks in general and the web platform as a whole. [ABSTRACT FROM PUBLISHER]

In this paper we present an approach to add Remote Attestation capabilities to the Google Chrome OS platform. Our approach is based on the combination of two integral aspects of Chrome OS: (1) its Verified Boot procedure and (2) its extensible, app-based architecture. Verified Boot ensures the integrity of the static operating system base including firmware, kernel and user land code. The dynamic part of Chrome OS is formed by apps, that can be installed, updated and removed during runtime by the user. We propose an approach that is able to attest both the integrity of the static Chrome OS base as well as the dynamic part composed of apps installed by the user to a remote party. The static part is attested without any measurements of binaries. We detail properties of apps that are reasonable to be measured. Thus, a remote party can reason about the trustworthiness of a remote platform by knowing (1) that it is running Chrome OS and (2) by knowing certain characteristics of installed apps. [ABSTRACT FROM PUBLISHER]

Extension of web browser capability has introduced variety of security problems. Attackers exploit vulnerabilities found in internals of web browsers or plugins to compromise the system and execute arbitrary code. In this paper, we present a filtering method which blocks malicious routines from being executed. Filtering is done by keeping a blacklist of dangerous routines and arguments separately to compare with the routines being called by the web browser at runtime. To show the concept, we built a prototype by using dynamic binary instrumentation framework called Pin. Pin provides rich API that allows us to build a custom tool that inserts instrumentation codes in the program. Using this tool, we are able to block malicious instructions from being executed. [ABSTRACT FROM PUBLISHER]

Cloud Computing is arguably one of the most discussed information technologies today. It presents many promising technological and economical opportunities. However, many customers remain reluctant to move their business IT infrastructure completely to the cloud. One of their main concerns is Cloud Security and the threat of the unknown. Cloud Service Providers (CSP) encourage this perception by not letting their customers see what is behind their virtual curtain. A seldomly discussed, but in this regard highly relevant open issue is the ability to perform digital investigations. This continues to fuel insecurity on the sides of both providers and customers. Cloud Forensics constitutes a new and disruptive challenge for investigators. Due to the decentralized nature of data processing in the cloud, traditional approaches to evidence collection and recovery are no longer practical. This paper focuses on the technical aspects of digital forensics in distributed cloud environments. We contribute by assessing whether it is possible for the customer of cloud computing services to perform a traditional digital investigation from a technical point of view. Furthermore we discuss possible solutions and possible new methodologies helping customers to perform such investigations. [ABSTRACT FROM PUBLISHER]

By now, the Web has matured into a full-scale application platform and its popularity is constantly rising. However, popularity comes at a cost: theWeb is becoming more and more of a target for attackers. In this paper, we argue that the security analysis of web browsers deserves attention and the data on their security evolution is of high value. We examine the security evolution of the widely used WebKit browser engine, investigate its historical security data, and point at the alarming trends. [ABSTRACT FROM PUBLISHER]