Search

DNS dynamic updates represent an inherently vulnerable mechanism deliberately granting the potential for any host to dynamically modify DNS zone files. Consequently, this feature exposes domains to various security risks such as domain hijacking, compromise of domain control validation, and man-in-the-middle attacks. Originally devised without the implementation of authentication mechanisms, non-secure DNS updates were widely adopted in DNS software, subsequently leaving domains susceptible to a novel form of attack termed zone poisoning. In order to gauge the extent of this issue, our analysis encompassed over 353 million domain names, revealing the presence of 381,965 domains that openly accepted unsolicited DNS updates. We then undertook a comprehensive three-phase campaign involving the notification of Computer Security Incident Response Teams (CSIRTs). Following extensive discussions spanning six months, we observed substantial remediation, with nearly 54\% of nameservers and 98% of vulnerable domains addressing the issue. This outcome serves as evidence that engaging with CSIRTs can prove to be an effective approach for reporting security vulnerabilities. Moreover, our notifications had a lasting impact, as evidenced by the sustained low prevalence of vulnerable domains.

A highly recurrent traditional bottleneck in applied mathematics, for which the most popular codes (Mathematica and Matlab) do not offer a solution, is to find all the real solutions of a system of N nonlinear equations in a certain finite domain of the N-dimensional space of variables. We present an algorithm of minimum length and computational weight to solve this problem, resembling a graphical tool of edge detection in an image extended to N dimensions. Once the hypersurfaces (edges) defined by each nonlinear equation have been identified in a single, simultaneous step, the coincidence of the hypersurfaces in the vicinity of all the hyperpoints that constitute the solutions makes the final Newton-Raphson step rapidly convergent to all the solutions with the desired degree of accuracy. As long as N remains smaller than about five, which is often the case for physical systems that depend on fewer than five parameters, this approach demonstrates excellent effectiveness., Comment: 10 pages, 3 figures

Consumer IoT devices are generally assumed to lack adequate default security, thus requiring user action. However, it may not be immediately clear to users what action to take and how. This uncertainty begs the question of what the minimum is that the user-base can reliably be asked to do as a prompt to secure their devices. To explore this question, we analyze security actions advocated at a national level and how these connect to user materials for a range of specific devices. We identify four pieces of converging advice across three nation-level initiatives. We then assess the extent to which these pieces of advice are aligned with instruction materials for 40 different IoT devices across five device classes (including device manuals and manufacturer websites). We expose a disconnect between the advice and the device materials. A stunning finding is that there is not a single assessed device to which all four top pieces of converging advice can be applied. At best, the supporting materials for 36 of the 40 devices provide sufficient information to apply just two of the four pieces of advice, typically the installation and enabling of (auto)updates. As something of a contradiction, it is necessary for a non-expert user to assess whether expert advice applies to a device. This risks additional user burden and proxy changes being made without the proposed security benefits. We propose recommendations, including that governments and researchers alike should declare their own working models of IoT devices when considering the user view., Comment: 27 pages, 1 figure, 6 tables

Perception systems for ornithopters face severe challenges. The harsh vibrations and abrupt movements caused during flapping are prone to produce motion blur and strong lighting condition changes. Their strict restrictions in weight, size, and energy consumption also limit the type and number of sensors to mount onboard. Lightweight traditional cameras have become a standard off-the-shelf solution in many flapping-wing designs. However, bioinspired event cameras are a promising solution for ornithopter perception due to their microsecond temporal resolution, high dynamic range, and low power consumption. This paper presents an experimental comparison between frame-based and an event-based camera. Both technologies are analyzed considering the particular flapping-wing robot specifications and also experimentally analyzing the performance of well-known vision algorithms with data recorded onboard a flapping-wing robot. Our results suggest event cameras as the most suitable sensors for ornithopters. Nevertheless, they also evidence the open challenges for event-based vision on board flapping-wing robots.

DNS is one of the core building blocks of the Internet. In this paper, we investigate DNS resolution in a strict IPv6-only scenario and find that a substantial fraction of zones cannot be resolved. We point out, that the presence of an AAAA resource record for a zone's nameserver does not necessarily imply that it is resolvable in an IPv6-only environment since the full DNS delegation chain must resolve via IPv6 as well. Hence, in an IPv6-only setting zones may experience an effect similar to what is commonly referred to as lame delegation. Our longitudinal study shows that the continuing centralization of the Internet has a large impact on IPv6 readiness, i.e., a small number of large DNS providers has, and still can, influence IPv6 readiness for a large number of zones. A single operator that enabled IPv6 DNS resolution -- by adding IPv6 glue records -- was responsible for around 20.3% of all zones in our dataset not resolving over IPv6 until January 2017. Even today, 10% of DNS operators are responsible for more than 97.5% of all zones that do not resolve using IPv6.

We study experimentally and numerically the onset of tip streaming in an electrified droplet. The experiments show that, for a sufficiently small dimensionless conductivity, the droplet apex oscillates before ejecting a liquid jet. This effect is caused by the limited charge transfer from the bulk to the interface. This reduces the electrostatic pressure at the droplet's stretching tip, preventing liquid ejection. This reduction of electrostatic pressure is compensated for by the electric shear stress arising during the apex oscillations, which eventually leads to the jet formation. The stability limit calculated from the global stability analysis perfectly agrees with the experimental results. However, this analysis predicts non-oscillatory, non-localized instability in all the cases, suggesting that both the oscillatory behavior and the small local scale characterizing tip streaming arise during the nonlinear droplet deformation., Comment: 8 pages, 12 figures

Researchers and practitioners often face the issue of having to attribute an IP address to an organization. For current data this is comparably easy, using services like whois or other databases. Similarly, for historic data, several entities like the RIPE NCC provide websites that provide access to historic records. For large-scale network measurement work, though, researchers often have to attribute millions of addresses. For current data, Team Cymru provides a bulk whois service which allows bulk address attribution. However, at the time of writing, there is no service available that allows historic bulk attribution of IP addresses. Hence, in this paper, we introduce and evaluate our 'Back-to-the-Future whois' service, allowing historic bulk attribution of IP addresses on a daily granularity based on CAIDA Routeviews aggregates. We provide this service to the community for free, and also share our implementation so researchers can run instances themselves.

The average Rayleigh capillary breakup length of a cylindrical Newtonian viscous liquid jet moving with homogeneous velocity $\hat{U}$ (negligible external forces) must be determined by the selection of normal modes with time-independent amplitude and wavelength (invariant modes, IMs). Both positive and negative group velocity IMs exist in ample ranges of the parameter domain (Weber and Ohnesorge numbers), which explains (i) the average breakup length independence on ambient conditions (long-term resonance), and (ii) its proportionality to the inverse of the spatial growth rate of the dominant positive group velocity IM. Published experimental results since Grace (1965, PhD Thesis) confirm our proposal., Comment: 9 pages, 7 figures

Traditional techniques to detect malware infections were not meant to be used by the end-user and current malware removal tools and security software cannot handle the heterogeneity of IoT devices. In this paper, we design, develop and evaluate a tool, called NURSE, to fill this information gap, i.e., enabling end-users to detect IoT-malware infections in their home networks. NURSE follows a modular approach to analyze IoT traffic as captured by means of an ARP spoofing technique which does not require any network modification or specific hardware. Thus, NURSE provides zero-configuration IoT traffic analysis within everybody's reach. After testing NURSE in 83 different IoT network scenarios with a wide variety of IoT device types, results show that NURSE identifies malware-infected IoT devices with high accuracy (86.7%) using device network behavior and contacted destinations.

Consumer IoT devices may suffer malware attacks, and be recruited into botnets or worse. There is evidence that generic advice to device owners to address IoT malware can be successful, but this does not account for emerging forms of persistent IoT malware. Less is known about persistent malware, which resides on persistent storage, requiring targeted manual effort to remove it. This paper presents a field study on the removal of persistent IoT malware by consumers. We partnered with an ISP to contrast remediation times of 760 customers across three malware categories: Windows malware, non-persistent IoT malware, and persistent IoT malware. We also contacted ISP customers identified as having persistent IoT malware on their network-attached storage devices, specifically QSnatch. We found that persistent IoT malware exhibits a mean infection duration many times higher than Windows or Mirai malware; QSnatch has a survival probability of 30% after 180 days, whereby most if not all other observed malware types have been removed. For interviewed device users, QSnatch infections lasted longer, so are apparently more difficult to get rid of, yet participants did not report experiencing difficulty in following notification instructions. We see two factors driving this paradoxical finding: First, most users reported having high technical competency. Also, we found evidence of planning behavior for these tasks and the need for multiple notifications. Our findings demonstrate the critical nature of interventions from outside for persistent malware, since automatic scan of an AV tool or a power cycle, like we are used to for Windows malware and Mirai infections, will not solve persistent IoT malware infections.

A major fraction of the atmospheric aerosols come from the ocean spray originated by the bursting of bubbles from breaking waves. A theoretical framework that incorporates the latest knowledge on film and jet droplets from bubble bursting is proposed. Assuming that their relics constitute the ultimate origin of primary and secondary sea aerosols through a diversity of physicochemical routes, the model can be reduced to a single controlling parameter to predict the global probability density distribution (pdf) of the ocean spray. The bursting and collapse of small bubbles on the sea surface from about 10 to 100 microns produces an extreme energy focusing and the ejection of a rapid liquid spout whose size reaches the free molecular regime of the gaseous environment. In these rarefied conditions, simulations show that this spout yields a jet of sub-micrometer and nanometric scale droplets whose number and speed can be far beyond any previous estimation, overcoming by orders of magnitude alternative mechanisms recently proposed. The one-parameter model fits remarkably well published experimental measurements along five orders of magnitude of spray size, from about 5 nm to about 0.5 mm. According to this proposal, the majority of aerosols determining the life on our planet would have their extremely elusive birth in the uterus-like nano-shape of small bursting bubbles on the ocean surface at the very latest instants of collapse., Comment: 12 pages, 13 figures

We study experimentally and numerically the thinning of a Newtonian leaky-dielectric filament subject to an axial electric field. We consider moderately viscous liquids with high permittivity. The experiments show that satellite droplets are produced from the breakup of the filaments with high electrical permittivity due to the action of the electric field. Two electrified filaments with the same minimum radius thin at the same speed regardless of when the voltage was applied. The numerical simulations show that the polarization stress is responsible for the pinching delay observed in the experiments. Asymptotically close to the pinching point, the filament pinching is dominated by the diverging hydrodynamic forces. The polarization stress becomes subdominant even if this stress also diverges at this finite-time singularity.

With the emergence of remote education and work in universities due to COVID-19, the `zoomification' of higher education, i.e., the migration of universities to the clouds, reached the public discourse. Ongoing discussions reason about how this shift will take control over students' data away from universities, and may ultimately harm the privacy of researchers and students alike. However, there has been no comprehensive measurement of universities' use of public clouds and reliance on Software-as-a-Service offerings to assess how far this migration has already progressed. We perform a longitudinal study of the migration to public clouds among universities in the U.S. and Europe, as well as institutions listed in the Times Higher Education (THE) Top100 between January 2015 and October. We find that cloud adoption differs between countries, with one cluster (Germany, France, Austria, Switzerland) showing a limited move to clouds, while the other (U.S., U.K, the Netherlands, THE Top100) frequently outsources universities' core functions and services -- starting long before the COVID-19 pandemic. We attribute this clustering to several socio-economic factors in the respective countries, including the general culture of higher education and the administrative paradigm taken towards running universities. We then analyze and interpret our results, finding that the implications reach beyond individuals' privacy towards questions of academic independence and integrity., Comment: Update 3: Final version published at PETS'23/PoPETS 2023(2). Now includes data up until October 2022 and an extended discussion, as well as a new appendix comprehensively describing how DNS works

The competition between thermal fluctuations and potential forces is the foundation of our understanding of phase transitions and matter in equilibrium. Driving matter out of equilibrium allows for a new class of interactions which are neither attractive nor repulsive but transverse. The existence of such transverse forces immediately raises the question of how they interfere with basic principles of material self-organization. Despite a recent surge of interest, this question remains open. Here, we show that activating transverse forces by homogeneous rotation of colloidal units generically turns otherwise quiescent solids into a crystal whorl state dynamically shaped by self-propelled dislocations. Simulations of both a minimal model and a full hydrodynamics model establish the generic nature of the chaotic dynamics of these self-kneading polycrystals. Using a continuum theory, we explain how odd and Hall stresses conspire to destabilize chiral crystals from within. This chiral instability produces dislocations that are unbound by their self-propulsion. Their proliferation eventually leads to a crystalline whorl state out of reach of equilibrium matter.

Despite their fundamental and applied importance, a general model to predict the natural breakup length of steady capillary jets has not been proposed yet. In this work, we derive a scaling law with two universal constants to calculate that length as a function of the liquid properties and operating conditions. These constants are determined by fitting the scaling law to a large set of experimental and numerical measurements, including previously published data. Both the experimental and numerical jet lengths conform remarkably well to the proposed scaling law. This law is explained in terms of the growth of perturbations excited by the jet breakup itself., Comment: 6 pages, 7 figures

Current available data of the worldwide impact of the COVID-19 pandemic has been analyzed using dimensional analysis and self-similarity hypotheses. We show that the time series of infected population and deaths of the most impacted and unprepared countries exhibits an asymptotic power law behavior, compatible with the propagation of a signal in a fractal network. We propose a model which predicts an asymptotically self-similar expansion of deaths in time before containment, and the final death toll under total containment measures, as a function of the delay in taking those measures after the expansion is observed. The physics of the model resembles the expansion of a flame in a homogeneous domain with a fractal dimension 3.75. After containment measures are taken, the natural fractal structure of the network is drastically altered and a secondary evolution is observed. This evolution, akin to the homogeneous combustion in a static isolated enclosure with a final quenching, has a characteristic time of 20.1 days, according to available data of the pandemic behavior in China. The proposed model is remarkably consistent with available data, which supports the simplifying hypotheses made in the model. A universal formulation for a quarantine as a function of that delay is also proposed.

The transient ejection due to a bubble bursting at the interface of a liquid with a gas environment is here described using a dynamical scaling analysis along the process. We show here that the ejection of a liquid microjet requires the backfire of a vortex ring inside the liquid to preserve physical symmetry, which involves a non-trivial scaling. We present the first single uniformly valid expression for the size and speed of ejected droplets for the whole range of the Ohnesorge and Bond numbers where droplet ejection occurs. The evolution of the flow variables, the apparent singularity for a critical Ohnesorge number, and the dispersion of data around this point are explained. Our model generalizes or displaces other recently proposed ones, impacting for instance the statistical description of sea spray., Comment: 10 pages, 3 figures

Dripping, jetting and tip streaming have been studied up to a certain point separately by both fluid mechanics and microfluidics communities, the former focusing on fundamental aspects while the latter on applications. Here, we intend to review this field from a global perspective by considering and linking the two sides of the problem. In the first part, we present the theoretical model used to study interfacial flows arising in droplet-based microfluidics, paying attention to three elements commonly present in applications: viscoelasticity, electric fields and surfactants. We review both classical and current results about the stability of jets affected by these elements. Mechanisms leading to the breakup of jets to produce drops are reviewed as well, including some recent advances in this field. We also consider the relatively scarce theoretical studies on the emergence and stability of tip streaming flows. In the second part of this review, we focus on axisymmetric microfluidic configurations which can operate on the dripping and jetting modes either in a direct (standard) way or via tip streaming. We present the dimensionless parameters characterizing these configurations, the scaling laws which allow predicting the size of the resulting droplets and bubbles, as well as those delimiting the parameter windows where tip streaming can be found. Special attention is paid to electrospray and flow focusing, two of the techniques more frequently used in continuous drop production microfluidics. We aim to connect experimental observations described in this section of topics with fundamental and general aspects described in the first part of the review. This work closes with some prospects at both fundamental and practical levels., Comment: 63 pages, 55 figures

Malware family labels are known to be inconsistent. They are also black-box since they do not represent the capabilities of malware. The current state-of-the-art in malware capability assessment include mostly manual approaches, which are infeasible due to the ever-increasing volume of discovered malware samples. We propose a novel unsupervised machine learning-based method called MalPaCA, which automates capability assessment by clustering the temporal behavior in malware's network traces. MalPaCA provides meaningful behavioral clusters using only 20 packet headers. Behavioral profiles are generated based on the cluster membership of malware's network traces. A Directed Acyclic Graph shows the relationship between malwares according to their overlapping behaviors. The behavioral profiles together with the DAG provide more insightful characterization of malware than current family designations. We also propose a visualization-based evaluation method for the obtained clusters to assist practitioners in understanding the clustering results. We apply MalPaCA on a financial malware dataset collected in the wild that comprises of 1.1k malware samples resulting in 3.6M packets. Our experiments show that (i) MalPaCA successfully identifies capabilities, such as port scans and reuse of Command and Control servers; (ii) It uncovers multiple discrepancies between behavioral clusters and malware family labels; and (iii) It demonstrates the effectiveness of clustering traces using temporal features by producing an error rate of 8.3%, compared to 57.5% obtained from statistical features., Comment: Accepted as a chapter in Springer MAAIDL 2020

A general scaling of the evolution of an exploding liquid jet under an ultra short and intense X-ray pulse from a X-ray free electron laser (XFEL) is proposed. A general formulation of the conservation of energy for blasts in vacuum partially against a deformable object leads to a compact expression that governs the evolution of the gap produced by the explosion. The theoretical analysis contemplates two asymptotic stages for small and large times from the initiation of the blast. A complete dimensional analysis of the problem and an optimal collapse of experimental data reveal that the universal approximate analytical solution proposed is in remarkable agreement with experiments.

Jet droplets from bubble bursting are determined by a limited parametrical space: the liquid properties (surface tension, viscosity, and density), mother bubble size and acceleration of gravity. Thus, the two resulting parameters from dimensional analysis (usually, the Ohnesorge and Bond numbers, Oh and Bo) completely define this phenomenon when both the trapped gas in the bubble and the environment gas have negligible density. A detailed physical description of the ejection process to model both the ejected droplet radius and its initial launch speed is provided, leading to a scaling law including both Oh and Bo. Two critical values of Oh determine two limiting situations: one (Oh$_1$=0.038) is the critical value for which the ejected droplet size is minimum and the ejection speed maximum, and the other (Oh$_2$=0.0045) is a new critical value which signals when viscous effects vanish. Gravity effects (Bo) are consistently introduced from energy conservation principles. The proposed scaling laws produce a remarkable collapse of published experimental measurements collected for both the ejected droplet radius and ejection speed., Comment: 14 pages, three figures, published in 2018 in Physical Review Fluids

The nonlocal Fisher equation is a diffusion-reaction equation with a nonlocal quadratic competition, which describes the reaction between distant individuals. This equation arises in evolutionary biological systems, where the arena for the dynamics is trait space, diffusion accounts for mutations and individuals with similar traits compete, resulting in partial niche overlap. It has been found that the (non-cutoff) deterministic system gives rise to a spatially inhomogeneous state for a certain class of interaction kernels, while the stochastic system produces an inhomogeneous state for small enough population densities. Here we study the problem of front propagation in this system, comparing the stochastic dynamics to the heuristic approximation of this system by a deterministic system where the linear growth term is cut off below some critical density. Of particular interest is the nontrivial pattern left behind the front. For large population density, or small cutoff, there is a constant velocity wave propagating from the populated region to the unpopulated region. As in the local Fisher equation, the spreading velocity is much lower than the Fisher velocity which is the spreading velocity for infinite population size. The stochastic simulations give approximately the same spreading velocity as the deterministic simulation with appropriate birth cutoff. When the population density is small enough, there is a different mechanism of population spreading. The population is concentrated on clusters which divide and separate. This mode of spreading has small spreading velocity, decaying exponentially with the range of the interaction kernel.

OpenMP is a cross-platform API that extends C, C++ and Fortran and provides shared-memory parallelism platform for those languages. The use of many cores and HPC technologies for scientific computing has been spread since the 1990s, and now takes part in many fields of research. The relative ease of implementing OpenMP, along with the development of multi-core shared memory processors (such as Intel Xeon Phi) makes OpenMP a favorable method for parallelization in the process of modernizing a legacy codes. Legacy scientific codes are usually holding large number of physical arrays which being used and updated by the code routines. In most of the cases the parallelization of such code focuses on loop parallelization. A key step in this parallelization is deciding which of the variables in the parallelized scope should be private (so each thread will hold a copy of them), and which variables should be shared across the threads. Other important step is finding which variables should be synchronized after the loop execution. In this work we present an automatic pre-processor that preforms these stages - AutOMP (Automatic OpenMP). AutOMP recognize all the variables assignments inside a loop. These variables will be private unless the assignment is of an array element which depend on the loop index variable. Afterwards, AutOMP finds the places where threads synchronization is needed, and which reduction operator is to be used. At last, the program provides the parallelization command to be used for parallelizing the loop., Comment: The 7th International Supercomputing Conference in Mexico 2017

Internet security and technology policy research regularly uses technical indicators of abuse in order to identify culprits and to tailor mitigation strategies. As a major obstacle, readily available data are often misaligned with actual information needs. They are subject to measurement errors relating to observation, aggregation, attribution, and various sources of heterogeneity. More precise indicators such as size estimates are costly to measure at Internet scale. We address these issues for the case of hosting providers with a statistical model of the abuse data generation process, using phishing sites in hosting networks as a case study. We decompose error sources and then estimate key parameters of the model, controlling for heterogeneity in size and business model. We find that 84\,\% of the variation in abuse counts across 45,358 hosting providers can be explained with structural factors alone. Informed by the fitted model, we systematically select and enrich a subset of 105 homogeneous "statistical twins" with additional explanatory variables, unreasonable to collect for \emph{all} hosting providers. We find that abuse is positively associated with the popularity of websites hosted and with the prevalence of popular content management systems. Moreover, hosting providers who charge higher prices (after controlling for level differences between countries) witness less abuse. These factors together explain a further 77\,\% of the remaining variation, calling into question premature inferences from raw abuse indicators on security efforts of actors, and suggesting the adoption of similar analysis frameworks in all domains where network measurement aims at informing technology policy.