Helmholtz Center for Information Security
CISPA – Helmholtz-Zentrum für InformationssicherheitNot a member yet
3406 research outputs found
Sort by
Datenschutzrecht und Brexit
No full textDurch den „Brexit“ wird das Primär- und Sekundärrecht der Europäischen Union ab dem Datum des Austritts nicht mehr anwendbar sein. Damit gilt auch der seit Mai 2018 geltende EU-Rechtsrahmen für den Schutz personenbezogener Daten, bestehend aus der Datenschutzgrundverordnung (2016/679) und der JI-Richtlinie (2016/680), nicht mehr im Vereinigten Königreich. Gleichzeitig verliert das Vereinigte Königreich damit den Zugang zum europäischen Datenbinnenmarkt, der aufgrund gemeinsamer Datenschutzgesetzgebung und -durchsetzungsinstrumente den freien Datenfluss zwischen den EU-Mitgliedsstaaten ermöglicht. Dieser Beitrag beleuchtet die Konsequenzen des Brexit für den Datenaustausch mit dem Vereinigten Königreich und analysiert mögliche Rechtsgrundlagen und Szenarien eines fortgesetzten Datentransfers im Anwendungsbereich der DSGVO und der JI-Richtlinie nach dem Brexit
Secure Multi-Execution in Android
Get PDFMobile operating systems, such as Google’s Android, have become a fixed part of our daily lives and are entrusted with a plethora of private information. Congruously, their data protection mechanisms have been improved steadily over the last decade and, in particular, for Android, the research community has explored various enhancements and extensions to the access control model. However, the vast majority of those solutions has been concerned with controlling the access to data, but equally important is the question of how to control the flow of data once released. Ignoring control over the dissemination of data between applications or between components of the same app, opens the door for attacks, such as permission re-delegation or privacy-violating third-party libraries. Controlling information flows is a long-standing problem, and one of the most recent and practical-oriented approaches to information flow control is secure multi-execution.
In this paper, we present Ariel, the design and implementation of an IFC architecture for Android based on the secure multi-execution of apps. Ariel demonstrably extends Android’s system with support for executing multiple instances of apps, and it is equipped with a policy lattice derived from the protection levels of Android’s permissions as well as an I/O scheduler to achieve control over data flows between application instances. We demonstrate how secure multi-execution with Ariel can help to mitigate two prominent attacks on Android, permission re-delegations and malicious advertisement libraries
Up-To-Crash: Evaluating Third-Party Library Updatability on Android
Get PDFBuggy and flawed third-party libraries increase their host app’s attack surface and put the users’ privacy at risk. To avert this risk, libraries have to be kept updated to their newest versions by the app developers that integrate them into their projects. Recent researches revealed that the prevalence of outdated third-party libraries in Android apps is indeed a rampant problem, but also suggested that there is a great opportunity for drop-in replacements of outdated libraries, which would not even require cooperation by the app developers to update the libraries. However, all those conclusions are based on static app analysis, which can only provide an abstract view.
In this work, we extend the updatability analysis to the runtime of apps. We implement a solution to update third-party libraries with drop-in replacements by their newer versions. To verify the feasibility of this developer-independent update mechanism, we dynamically test 3,000 real world apps for 3 popular libraries (78 library versions) for runtime failures stemming from incompatible library updates. To investigate the updatability of libraries in-depth, exploration enhanced dynamic testing is adopted to monitor the runtime behaviors of 15 apps before and after library updating. From our test, we find that the prior reported updatability rate is under real conditions overestimated by a factor of 1.57–2.06. Through root cause analysis, we find that the underlying problems prohibiting easy updates are intricate, such as deprecated functions, changed data structures, or entangled dependencies between different libraries and even the host app. We think our results not only put a more realistic light on the library updatability problem in Android, but also provide valuable insights for future solutions that provide automatic library updates or that try to support the app developers in better maintaining their external dependencies
Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints
No full textRecent advances in Generative Adversarial Networks (GANs) have shown increasing success in generating photorealistic images. But they also raise challenges to visual forensics and model attribution. We present the first study of learning GAN fingerprints towards image attribution and using them to classify an image as real or GAN-generated. For GAN-generated images, we further identify their sources. Our experiments show that (1) GANs carry distinct model fingerprints and leave stable fingerprints in their generated images, which support image attribution; (2) even minor differences in GAN training can result in different fingerprints, which enables fine-grained model authentication; (3) fingerprints persist across different image frequencies and patches and are not biased by GAN artifacts; (4) fingerprint finetuning is effective in immunizing against five types of adversarial image perturbations; and (5) comparisons also show our learned fingerprints consistently outperform several baselines in a variety of setups
A Usability Evaluation of Let's Encrypt and Certbot: Usable Security Done Right
Get PDFThe correct configuration of HTTPS is a complex set of tasks, which many administrators have struggled with in the past. Let's Encrypt and Electronic Frontier Foundation's Certbot aim to improve the TLS ecosystem by offering free trusted certificates (Let's Encrypt) and by providing user-friendly support to configure and harden TLS (Certbot). Although adoption rates have increased, to date, there has been only a little scientific evidence of the actual usability and security benefits of this semi-automated approach. Therefore, we conducted a randomized control trial to evaluate the usability of Let's Encrypt and Certbot in comparison to the traditional certificate authority approach. We performed a within-subjects lab study with 31 participants. The study sheds light on the security and usability enhancements that Let's Encrypt and Certbot provide. We highlight how usability improvements aimed at administrators can have a large impact on security and discuss takeaways for Certbot and other security-related tasks that experts struggle with
Stop to Unlock - Improving the Security of Android Unlock Patterns
Get PDFAndroid unlock patterns are among the most common authentication mechanisms on mobile devices. They are fast
and easy to use but also lack security as user-chosen gestures
are easy to guess and easy to observe. To improve the traditional
pattern approach, we propose Stop2Unlock, a usable but more
secure modification of the traditional pattern lock. Stop2Unlock
allows users to define nodes where they stop for a limited amount
of time before swiping to the next node. We performed a lab
study (n=40) and a field study (n=14) to show that this small
change in user interaction can have a significant impact on
security with a minimal impact on usability. That is, user-selected
Stop2Unlock patterns are significantly harder to guess while being
comparable in terms of usability. Additional analysis showed that
users perceived the stop component as a rhythmic and memorable
cue which supported the selection of higher entropy patterns
ScriptProtect: Mitigating Unsafe Third-Party JavaScript Practices
Get PDFThe direct client-side inclusion of cross-origin JavaScript resources in Web applications is a pervasive practice to consume third-party services and to utilize externally provided libraries. The downside of this practice is that such external code runs in the same context and with the same privileges as the first-party code. Thus, all potential security problems in the code directly affect the including site. To explore this problem, we present an empirical study which shows that more than 25% of all sites affected by Client-Side Cross-Site Scripting are only vulnerable due to a flaw in the included third-party code. Motivated by this finding, we propose ScriptProtect, a non-intrusive transparent protective measure to address security issues introduced by external script resources. ScriptProtect automatically strips third-party code from the ability to conduct unsafe string-to-code conversions. Thus, it effectively removes the root-cause of Client-Side XSS without affecting first-party code in this respective. As ScriptProtect is realized through a lightweight JavaScript instrumentation, it does not require changes to the browser and only incurs a low runtime overhead of about 6%. We tested its compatibility on the Alexa Top 5,000 and found that 30% of these sites could benefit from ScriptProtect’s protection today without changes to their application code
RIDL: Rogue In-flight Data Load
No full textWe present Rogue In-flight Data Load
(RIDL)1
, a new class of unprivileged speculative execution attacks to leak arbitrary data across address spaces
and privilege boundaries (e.g., process, kernel, SGX,
and even CPU-internal operations). Our reverse engineering efforts show such vulnerabilities originate from
a variety of micro-optimizations pervasive in commodity (Intel) processors, which cause the CPU to speculatively serve loads using extraneous CPU-internal
in-flight data (e.g., in the line fill buffers). Contrary
to other state-of-the-art speculative execution attacks,
such as Spectre, Meltdown and Foreshadow, RIDL can
leak this arbitrary in-flight data with no assumptions
on the state of the caches or translation data structures
controlled by privileged software.
The implications are worrisome. First, RIDL attacks
can be implemented even from linear execution with
no invalid page faults, eliminating the need for exception suppression mechanisms and enabling system-wide
attacks from arbitrary unprivileged code (including
JavaScript in the browser). To exemplify such attacks,
we build a number of practical exploits that leak
sensitive information from victim processes, virtual
machines, kernel, SGX and CPU-internal components.
Second, and perhaps more importantly, RIDL bypasses
all existing “spot” mitigations in software (e.g., KPTI,
PTE inversion) and hardware (e.g., speculative store
bypass disable) and cannot easily be mitigated even
by more heavyweight defenses (e.g., L1D flushing or
disabling SMT). RIDL questions the sustainability of a
per-variant, spot mitigation strategy and suggests more
fundamental mitigations are needed to contain everemerging speculative execution attacks
HideNoSeek: Camouflaging Malicious JavaScript in Benign ASTs
Get PDFIn the malware field, learning-based systems have become popular to detect new malicious variants. Nevertheless, attackers with specific and internal knowledge of a target system may be able to produce input samples which are misclassified. In practice, the assumption of strong attackers is not realistic as it implies access to insider information. We instead propose HideNoSeek, a novel and generic camouflage attack, which evades the entire class of detectors based on syntactic features, without needing any information about the system it is trying to evade. Our attack consists of changing the constructs of malicious JavaScript samples to reproduce a benign syntax. For this purpose, we automatically rewrite the Abstract Syntax Trees (ASTs) of malicious JavaScript inputs into existing benign ones. In particular, HideNoSeek uses malicious seeds and searches for isomorphic subgraphs between the seeds and traditional benign scripts. Specifically, it replaces benign sub-ASTs by their malicious equivalents (same syntactic structure) and adjusts the benign data dependencies--without changing the AST--, so that the malicious semantics is kept. In practice, we leveraged 23 malicious seeds to generate 91,020 malicious scripts, which perfectly reproduce ASTs of Alexa top 10,000 web pages. Also, we can produce on average 14 different malicious samples with the same AST as each Alexa top 10. Overall, a standard trained classifier has 99.98% false negatives with HideNoSeek inputs, while a classifier trained on such samples has over 88.74% false positives, rendering the targeted static detectors unreliable
Laconic Conditional Disclosure of Secrets and Applications
Get PDFIn a Conditional Disclosure of Secrets (CDS)
a verifier V wants to reveal a message m to a prover P
conditioned on the fact that x is an accepting instance
of some NP-language L. An honest prover (holding the
corresponding witness w) always obtains the message
m at the end of the interaction. On the other hand,
if x ∈ L / we require that no PPT P∗ can learn the
message m. We introduce laconic CDS, a two round CDS
protocol with optimal computational cost for the verifier
V and optimal communication cost. More specifically, the
verifier’s computation and overall communication grows
with poly(|x|, λ, log(T)), where λ is the security parameter
and T is the verification time for checking that x ∈ L
(given w). We obtain constructions of laconic CDS under
standard assumptions, such as CDH or LWE.
Laconic CDS serves as a powerful tool for maliciousifying semi-honest protocols while preserving their computational and communication complexities. To substantiate
this claim, we consider the setting of non-interactive
secure computation: Alice wants to publish a short digest
corresponding to a private large input x on her web page
such that (possibly many) Bob, with a private input y,
can send a short message to Alice allowing her to learn
C(x, y) (where C is a public circuit). The protocol must be
reusable in the sense that Bob can engage in arbitrarily
many executions on the same digest. In this context we
obtain the following new implications.
1) UC Secure Bob-optimized 2PC: We obtain a UC
secure protocol where Bob’s computational cost and
the communication cost of the protocol grows with
poly(|x|, |y|, λ, d), where d is the depth of the
computed circuit C.
2) Malicious Laconic Function Evaluation: Next, we
move on to the setting where Alice’s input x is
large. For this case, UC secure protocols must have
communication cost growing with |x|. Thus, with
the goal of achieving better efficiency, we consider a
weaker notion of malicious security. For this setting,
we obtain a protocol for which Bob’s computational
cost and the communication cost of the protocol
grows with poly(|y|, λ, d), where d is the depth of
the computed circuit C