1,720,983 research outputs found
Tarnhelm: Isolated, transparent and confidential execution of arbitrary code in ARM’s TrustZone
No full text
Recommended from our members
Protecting Smart Devices from the Bottom-Up
Get PDFModern systems are mainly composed of IoT devices and Smartphones. Most of these devices use ARM processors, which, along with flexible licensing, have new security architecture features, such as ARM TrustZone, that enables execution of a secure application in an untrusted environment. Furthermore, with well-supported, extensible, open-source embedded operating systems like Android allows the manufactures to quickly customize their operating system with device drivers, thus reducing the time-to-market. Unfortunately, the proliferation of device vendors and race to the market has resulted in poor quality device drivers containing critical security vulnerabilities. Furthermore, the patches for these vulnerabilities get merged into the end-products with a significant delay resulting in the Patch Gap, which causes privacy and security of billions of users to be at risk. In this dissertation, I will show how the new architecture features can lead to security issues by introducing new attack vectors. Second, I will show that the existing techniques are inadequate to find the security issues in Linux kernel drivers and how, with certain well-defined optimizations, we can precisely find security issues. Third, I will present my solution to the problem of Patch Gap by showing a principled approach to automatically port patches to vendor product repositories. Finally, I will present our on-going work to automatically port C to Checked C, which provides a low overhead, backward-compatible, and memory-safe C alternative that could be used on resource-constrained modern systems to prevent security vulnerabilities. Through this work, I presented effective ways to find, fix, propagate, and prevent vulnerabilities in modern system software, thus improving modern systems security
GitRDone : enabling fast patch propagation in related software repositories
Get PDFLAUREA MAGISTRALENonostante gli sforzi degli sviluppatori software, le patch che vengono applicate ad un progetto open-source, sul suo repository principale, non vengono solitamente propagate in maniera rapida anche su tutti i progetti connessi ad esso (ad esempio, su tutte le fork del repository principale). Studi recenti mostrano che la stessa cosa vale anche per le patch di sicurezza, e in questi casi il problema risulta ancora più critico. Per velocizzare la propagazione delle patch di sicurezza sono nati dei database di vulnerabilità (ad esempio, quello contenente le CVE). Tuttavia, le patch che correggono CVE vengono tuttora propagate con un ritardo significativo e, in aggiunta, alcune vulnerabilità non sono presenti nei suddetti database.
In questa ricerca siamo i primi a dare una definizione di patch non dannose. Una patch è non dannosa se preserva le funzionalità originali del programma; in tal caso potrebbe essere applicata ad altri progetti in maniera rapida e senza bisogno di testarne meticolosamente gli effetti. La maggior parte delle patch di sicurezza rientra in questa categoria. In aggiunta, presentiamo una tecnica che può essere utilizzata per identificare patch non dannose e mostriamo i dettagli della progettazione e dello sviluppo di GitRDone: un programma basato sulla suddetta tecnica.
Abbiamo testato GitRDone su 39,191 patch, estratte da 10 differenti repository di progetti kernel, e su 191 patch che correggono CVE su Android e Linux. I risultati mostrano che GitRDone è in grado di identificare patch non dannose con una precisione del 96% e che la maggior parte delle patch che correggono CVE sono non dannose. In aggiunta, GitRDone ha identificato alcune istanze di patch che correggono vulnerabilità per le quali non esistono CVE; 5 di queste sono tuttora presenti, non corrette, in diversi kernel proprietari basati su Linux.Despite the efforts of software maintainers, patches on open-source repositories are propagated from the main codebase to all the related projects (e.g., forks) with a significant delay. Previous work shows that this is true also for security patches, for which it represents a critical problem. Vulnerability databases (e.g., CVEs) were born to speed up the diffusion of critical patches; however, CVE patches are still applied with a delay and some security fixes
lack corresponding CVE entries. Because of this, project maintainers could miss security patches when upgrading software, which is a huge problem.
In this paper we are the first to provide a definition of non-disruptive patches (ndps). An ndp is a patch that should not disrupt the original functionality of the program, meaning that it can be applied with a minimal testing effort; we argue that most of the security fixes fall into this category. Furthermore, we show a technique to identify ndps and implement GitRDone, a tool based on such a technique that works just by analyzing the source code of the original and patched versions of a file.
We run GitRDone on 39,191 patches, spanning over 10 different kernels repositories, and on 191 Android and Linux CVE patches. Results show that it can identify ndps with 96.00% precision and that most of the CVE patches are ndps. In addition, GitRDone identified patches that fix vulnerabilities that lack a CVE; 5 of these are still unpatched in different vendor kernels
Going Beyond Counting First Authors in Author Co-citation Analysis
Get PDFThe present study examines one of the fundamental aspects of author co-citation analysis (ACA) - the way co-citation
counts are defined. Co-citation counting provides the data on which all subsequent statistical analyses and mappings
are based, and we compare ACA results based on two different types of co-citation counting - the traditional type that
only counts the first one among a cited work's authors on the one hand and a non-traditional type that takes into
account the first 5 authors of a cited work on the other hand. Results indicate that the picture produced through this non-traditional author co-citation counting contains more coherent author groups and is therefore considerably clearer. However, this picture represents fewer specialties in the research field being studied than that produced through the traditional first-author co-citation counting when the same number of top-ranked authors is selected and analyzed. Reasons for these effects are discussed
Variations on the Author
Get PDF“Variations on the Author” discusses two of Eduardo Coutinho’s recent films (Um Dia na Vida, from 2010, and Últimas Conversas, posthumously released in 2015) and their contribution to the general question of documentary authorship. The director’s filmography is characterized by a consistent yet self-effacing form of authorial self-inscription: Coutinho often features as an interviewer that rather than express opinions propels discourses; an interviewer that is good at listening. This mode of self-inscription characterizes him as an author who is not expressive but who is nonetheless markedly present on the screen. In Um Dia na Vida, however, Coutinho is completely absent form the image, while Últimas Conversas, on the contrary, includes a confessional prologue that moves the director from the margins to the center of his films. This article examines the ways in which these works stand out in the filmography of a director who offers new insights into the notion of cinematic authorship
Appropriate Similarity Measures for Author Cocitation Analysis
Get PDFWe provide a number of new insights into the methodological discussion about author cocitation analysis. We first argue that the use of the Pearson correlation for measuring the similarity between authors’ cocitation profiles is not very satisfactory. We then discuss what kind of similarity measures may be used as an alternative to the Pearson correlation. We consider three similarity measures in particular. One is the well-known cosine. The other two similarity measures have not been used before in the bibliometric literature. Finally, we show by means of an example that our findings have a high practical relevance.information science;Pearson correlation;cosine;similarity measure;author cocitation analysis
- …
