66 research outputs found
Twenty years later : evaluating the adoption of control flow integrity
No full textMemory corruption vulnerabilities still allow compromising computers through software written in a memory-unsafe language such as C/C++. This highlights that mitigation techniques to prevent such exploitations are not all widely deployed. In this article, we introduce SeeCFI, a tool to detect the presence of a memory corruption mitigation technique called Control Flow Integrity (CFI). We leverage SeeCFI to investigate to what extent the mitigation has been deployed in complex software systems such as Android and specific Linux distributions (Ubuntu and Debian). Our results indicate that the overall adoption of CFI (forward- and backward-edge) is increasing across Android versions (∼30% in Android 13) but remains the same low (1%) throughout different Linux versions. Our tool, SeeCFI, offers the possibility to identify which binaries in a system were compiled using the CFI option. This can be deployed by external security researchers to efficiently decide which binaries to prioritize when fixing vulnerabilities and how to fix them. Therefore, SeeCFI can help to make software systems more secure
Security Aspects of Cryptocurrency Wallets—A Systematic Literature Review
No full textCryptocurrencies are gaining prominence among individuals and companies alike, resulting in the growing adoption of so-called cryptocurrency wallet applications, as these simplify transactions. These wallets are available in a myriad of different forms and specifications. All of them are susceptible to various ways the attacker can exploit the vulnerabilities and steal money from victims. Cryptocurrency wallets create a unique field as they combine features of password managers, banking applications, and the need to keep their users and their transactions anonymous. We collect the findings from previous literature to provide an overview of the different attack surfaces, possible countermeasures, and further research. Existing literature focused on one of the features mentioned before, while we considered all of them. Our systematic study shows that there is a considerable variety of attack vectors, which we have divided into six subcategories, (i) Memory and Storage, (ii) Operating Systems, (iii) Software Layer, (iv) Network Layer, (v) Blockchain Protocol, and (vi) Others. We have found a large gap between the possible countermeasures and their actual adoption. Therefore, we provide a list of possible directions for future research to tackle this gap.</p
Sleeping giants : activating dormant java deserialization gadget chains through stealthy code changes
No full textJava deserialization gadget chains are a well-researched critical software weakness. The vast majority of known gadget chains rely on gadgets from software dependencies. Furthermore, it has been shown that small code changes in dependencies have enabled these gadget chains. This makes gadget chain detection a purely reactive endeavor. Even if one dependency's deployment pipeline employs gadget chain detection, a gadget chain can still result from gadgets in other dependencies. In this work, we assess how likely small code changes are to enable a gadget chain. These changes could either be accidental or intentional as part of a supply chain attack. Specifically, we show that class serializability is a strongly fluctuating property over a dependency's evolution. Then, we investigate three change patterns by which an attacker could stealthily introduce gadgets into a dependency. We apply these patterns to 533 dependencies and run three state-of-the-art gadget chain detectors both on the original and the modified dependencies. The tools detect that applying the modification patterns can activate/inject gadget chains in 26.08% of the dependencies we selected. Finally, we verify the newly detected chains. As such, we identify dormant gadget chains in 53 dependencies that could be added through minor code modifications. This both shows that Java deserialization gadget chains are a broad liability to software and proves dormant gadget chains as a lucrative supply chain attack vector
Towards the development of stylized facts on the understandability of graphical business process models
No full textThe development of theory is one of the major tasks of every scientific discipline, and thus of Information Systems Research (ISR) as well as Business Informatics (BI). While different approaches can be used to develop theory in ISR and BI, there is one “dominant” way of IS theory development which has been described by GROVER and LYYTINEN in a recent article published in MISQ as the common “epistemic script”. The authors criticize this epistemic script for promoting a quite restricted production of IS-related knowledge. Furthermore, GROVER and LYYTINEN, identify new potential ways of overcoming the common epistemic script and propose – among others – the concept of Stylized Facts (SF) as one potential way for innovative knowledge production in ISR and BI. Against the background that we – the authors of this report – have been using Stylized Facts as a research approach for some years and can confirm the potential of this approach, the following report presents the idea and the current state of a promising comprehensive dissertation project (first author of this report) using Stylized Facts in ISR and BI which started in 2014. In the following, the idea of developing Stylized Facts regarding the understandability of graphical business process models is elaborated. Besides the presentation of an approach for a transparent development of SF, a comprehensive application example will illustrate the derivation of a SF regarding the relationships of the structuredness of business process models and the resulting model understandability
Fonds Emile Prisse d'Avennes sur l'Egypte : Iconographie. Dessins, estampes, photographies (NAF 20434-20443). « Nécropole thébaine, 1 »
No full textContient : Rey (A.) d'après L'hôte (Nestor). Biban el-Molouk. Tombeau de Skhaï : Paroi d'entrée [Chasse au marais] / N. L'hôte del (1838) ; A. Rey, sc ; Guillaumot (Auguste-Alexandre) d'après Prisse d'Avennes ? Biban el-Molouk. Tombeau d'Aménouser et entrée du 2e tombeau de l'ouest / Ate Guillaumot. père. sc ; Architecture. Temple de Dandour : Plan, coupe longitudinale, porte latérale & détails de construction (Règne d'Auguste) ; Prisse d'Avennes (Emile). Biban el-Molouk. Hypogée de Ramsès III : Bouclier de Ramsès III ; Du Camp (Maxime). Philae : Village du bord, au S.S.E. de l'île ; Du Camp (Maxime). Gournah : Sépultures des castes sacerdotales et militaires ; Bonfils (Félix). Vue générale des Tombeaux des Rois à Medinet-Abou. Thèbes H E ; El-Assacif : Tombeau pyramidal ; Weidenbach (E.). Le défunt assis sur un siège avec son petit chien / Ger. o. E. Weidenbach ; Monecke (C.) d'après Erbkam (Georg Gustav). Coupe de tombe royale / Aufgen u. gez. v. G. Erbkam ; Lith. v. C. Monecke ; Nilziegelbauten im Asasifthale bei Qurna ; General Ansicht des Pylons ; Grundrifs des Pylons ; Detaillirte Vorderansicht des Thores ; Querdurchschnitt ; Monecke (C.) d'après Erbkam. Nilziegel Pyramiden bei Qurna [Tombeaux de Gournah] ; Schütze (A.). Neus Reich. Dyn. XVIII. [...] Abd el Qurna. Grab 13 [Tombeau n° 13] / Lith o. A. Schütze ; Prisse d'Avennes (Emile). El-Chatt el-Regâlâ. Choubt el-Ridjal, près de Silsileh. : (Mantouhôtep II, XIe dynastie) ; Prisse d'Avennes (Emile). Offrande à Osiris, stèle peinte sur un cercueil de momie. — Nécropole de Thèbes — XXe dynastie ; Prisse d'Avennes (Emile). Thèbes. Hommage à Aménophis III. — Tombeau de Chamhati — XVIIIe dynastie ; Prisse d'Avennes (Emile). Thèbes. Hommage à Aménophis III. — Tombeau de Chamhati — XVIIIe dynastie ; Bigand d'après Cailliaud (Frédéric). Thèbes. — Gournah : Peintures des hypogées [1 : chasses au marais ; 2 : scène agricole] / Gravé par Bigant d'après le dessin original de M. Cailliaud ; Prisse d'Avennes (Emile), d'après Weidenbach. Sarcophage de Montouhotep décoré d'une fausse-porte ; Prisse d'Avennes (Emile). Sarcophage de Montouhotep décoré d'une fausse-porte ; Thèbes. Gournah : Peintures des hypogées [ 2 : scène agricole] / Gravé par Bigant d'après le dessin original de M. Cailliaud. — (Voyage à Méroé ; Vol. II. PL. LXXV) ; Thèbes. Gournah : Peintures des hypogées [ 1 : Chasses au marais] / Gravé par Bigant d'après le dessin original de M. Cailliaud. — (Voyage à Méroé ; Vol. II. PL. LXXV) ; Prisse d'Avennes (Emile). Gournet Mourraï. Tombeau d'Amenhotep dit Houy : Vases d'argent, d'or, de khesbet & de mafek ; Prisse d'Avennes (Emile). Tombeau de Rekhmirê : Atelier des fondeurs de l'or des Rothennou. — XVIIIe dynastie ; Tombeau de Rekhmirê. Atelier des fondeurs de l'or des Rothennou. — XVIIIe dynastie ; Weidenbach (E.) d'après Georgi (Otto). Dyn XX : a. Theben. Abd el Qurna, Grab XVIII ; b. El Kâb, Grab IV [Tombeau 18 (Ramsès X) ; Tombeau 4 (Ramsès XI) : Décoration] / Gez. v. O. Georgi ; Lith. v. E. WeidenbachNumérisation effectuée à partir d'un document original.Appartient à l'ensemble documentaire : BbLevt
ShallowHRD: detection of homologous recombination deficiency from shallow whole genome sequencing
No full textInternational audienceWe introduce shallowHRD, a software tool to evaluate tumor homologous recombination deficiency (HRD) based on whole genome sequencing (WGS) at low coverage (shallow WGS or sWGS; $1X coverage). The tool, based on mining copy number alterations profile, implements a fast and straightforward procedure that shows 87.5% sensitivity and 90.5% specificity for HRD detection. shallowHRD could be instrumental in predicting response to poly(ADP-ribose) polymerase inhibitors, to which HRD tumors are selectively sensitive. shallowHRD displays efficiency comparable to most state-of-art approaches, is cost-effective, generates low-storable outputs and is also suitable for fixed-formalin paraffin embedded tissues
Germline MBD4 Mutations and Predisposition to Uveal Melanoma
No full textInternational audienceBackground: Uveal melanoma (UM) arises from malignant transformation of melanocytes in the uveal tract of the eye. This rare tumor has a poor outcome with frequent chemo-resistant liver metastases. BAP1 is the only known predisposing gene for UM. UMs are generally characterized by low tumor mutation burden, but some UMs display a high level of CpG>TpG mutations associated with MBD4 inactivation. Here, we explored the incidence of germline MBD4 variants in a consecutive series of 1093 primary UM case patients and a series of 192 UM tumors with monosomy 3 (M3). Methods: We performed MBD4 targeted sequencing on pooled germline (n ¼ 1093) and tumor (n ¼ 192) DNA samples of UM patients. MBD4 variants (n ¼ 28) were validated by Sanger sequencing. We performed whole-exome sequencing on available tumor samples harboring MBD4 variants (n ¼ 9). Variants of unknown pathogenicity were further functionally assessed. Results: We identified 8 deleterious MBD4 mutations in the consecutive UM series, a 9.15-fold (95% confidence interval ¼ 4.24-fold to 19.73-fold) increased incidence compared with the general population (Fisher exact test, P ¼ 2.00 Â 10-5 , 2-sided), and 4 additional deleterious MBD4 mutations in the M3 cohort, including 3 germline and 1 somatic mutations. Tumors carrying deleterious MBD4 mutations were all associated with high tumor mutation burden and a CpG>TpG hypermutator phenotype. Conclusions: We demonstrate that MBD4 is a new predisposing gene for UM associated with hypermutated M3 tumors. The tumor spectrum of this predisposing condition will likely expand with the addition of MBD4 to diagnostic panels. Tumors arising in such a context should be recognized because they may respond to immunotherapy
- …
