DOCSLIB.ORG

Defense in Depth of Resource-Constrained Devices

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Defense in Depth of Resource-Constrained Devices Dartmouth College Dartmouth Digital Commons Dartmouth College Ph.D Dissertations Theses and Dissertations 5-1-2020 Defense in Depth of Resource-Constrained Devices Ira Ray Jenkins Dartmouth College Follow this and additional works at: https://digitalcommons.dartmouth.edu/dissertations Part of the Computer Sciences Commons Recommended Citation Jenkins, Ira Ray, "Defense in Depth of Resource-Constrained Devices" (2020). Dartmouth College Ph.D Dissertations. 59. https://digitalcommons.dartmouth.edu/dissertations/59 This Thesis (Ph.D.) is brought to you for free and open access by the Theses and Dissertations at Dartmouth Digital Commons. It has been accepted for inclusion in Dartmouth College Ph.D Dissertations by an authorized administrator of Dartmouth Digital Commons. For more information, please contact [email protected]. Defense in Depth of Resource-Constrained Devices Dartmouth Computer Science Technical Report TR2020-879 A Thesis Submitted to the Faculty in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science by Ira Ray Jenkins Guarini School of Graduate and Advanced Studies Dartmouth College Hanover, New Hampshire May 2020 Examining Committee: (chair) Sean W. Smith Sergey Bratus Xia Zhou Guerney D. H. Hunt F. Jon Kull, Ph.D. Dean of the Guarini School of Graduate and Advanced Studies c 2020 Ira Ray Jenkins Abstract The emergent next generation of computing, the so-called Internet of Things (IoT), presents significant challenges to security, privacy, and trust. The devices commonly used in IoT scenarios are often resource-const- rained with reduced computational strength, limited power consumption, and stringent availability requirements. Additionally, at least in the con- sumer arena, time-to-market is often prioritized at the expense of quality assurance and security. An initial lack of standards has compounded the problems arising from this rapid development. However, the explosive growth in the number and types of IoT devices has now created a mul- titude of competing standards and technology silos resulting in a highly fragmented threat model. Tens of billions of these devices have been deployed in consumers’ homes and industrial settings. From smart toast- ers and personal health monitors to industrial controls in energy deliv- ery networks, these devices wield significant influence on our daily lives. They are privy to highly sensitive, often personal data and responsible for real-world, security-critical, physical processes. As such, these internet- connected things are highly valuable and vulnerable targets for exploita- tion. Current security measures, such as reactionary policies and ad hoc patching, are not adequate at this scale. This thesis presents a multi-layered, defense in depth, approach to pre- venting and mitigating a myriad of vulnerabilities associated with the above challenges. To secure the pre-boot environment, we demonstrate a hardware-based secure boot process for devices lacking secure mem- ory. We introduce a novel implementation of remote attestation backed by blockchain technologies to address hardware and software integrity concerns for the long-running, unsupervised, and rarely patched systems found in industrial IoT settings. Moving into the software layer, we present a unique method of intraprocess memory isolation as a barrier to several prevalent classes of software vulnerabilities. Finally, we exhibit work on network analysis and intrusion detection for the low-power, low-latency, and low-bandwidth wireless networks common to IoT applications. By targeting these areas of the hardware–software stack, we seek to establish a trustworthy system that extends from power-on through application runtime. ii Acknowledgments This work represents seven years of foot-dragging and kicking at the goads: mental toil, insomnia, emotional conflict, and perseverance. However, the effort is not mine alone, but rests upon a foundation built by countless others, for me, over the last three decades. A wholly separate dissertation would be required to thank everyone who has supported, encouraged, and contributed to this work and my success through the years. I can only express my sincere gratitude and continuing debt. However, there are those, without which this could not have been accomplished, who deserve abounding thanks for their help. Chief among these is my advisor, Sean Smith, for asking me to TA for him during our first meeting, adopting me into the Trust Lab, and for his assistance, instruction, and willingness to indulge my ideas. Sean is an exceptional advisor but a better human being. He has shown me that it is possible to be intelligent, humble, curious, gracious, as well as faithful. I would also like to express my most profound appreciation to the other members of my committee—Sergey Bratus, Xia Zhou, and Guerney Hunt—for their patience, support, and thoughtful advice. A special thanks to Sergey for inviting me into the Trust Lab and the world of security research. Aside from the many Russian parables, Sergey introduced me to the hacker community and culture, sent me all over the world, and taught me that plenty of good folks make significant security contributions outside of the ivory tower. My graduate studies have blessed me with remarkable mentors. I am deeply in- debted to Charles and Elaine Palmer for their personal interest and great faith in me. Charles has become like a Southern uncle to me in the frigid North. His wisdom, encouragement, and backing have been indispensable to my pursuits. Elaine opened the door for my two internships at IBM’s Thomas J. Watson Research Center. Her knowledge and supervision were instrumental in substantial portions of this thesis. iii I am also grateful to the excellent researchers with which I worked in the Systems and Cloud Security group—particularly, Kenneth Goldman, David Safford, and Mimi Zohar—for many great conversations, debates, and ideas. During my time at Dartmouth and in the Trust Lab, I have had the privilege and honor of working with excellent and talented colleagues and, now, several gener- ations of labbies—Anya Shubina, Peter Johnson, Rebecca Shapiro, Jason Reeves, Ryan Speers, Vijay Kothari, Prashant Anantharaman, Pete Brady, and numerous others, including those outside the lab, like Travis Goodspeed and Jacob Torrey. I am particularly grateful to Tim Pierson as a dependable wingman, champion of my ideas and abilities, as well as a friend. I appreciate all of the yak shaving, grousing, commiserating, and pontificating that we all shared. My work has been made better through their insights and collaborations. I also want to thank Bill Nisen and the Institute for Security, Technology, and Society for facilitating the many lab lunches, lectures, and discussions that contributed to my nourishment and edification. I am tremendously thankful for the Dartmouth Woodshop and the (probably too much) time I spent there. Greg Elder and Janet Collins provided the tools and knowledge I needed to furnish my home, as well as realize and sustain a creative passion outside of research. To my lifelong friends—Mark Hodge, Chuck Bryant, and Trey Paul—maybe we should have played less, but I could not ask for more. Most of all, to my family, I cannot begin to express my gratitude for the years of love, encouragement, prayers, and laughs. To Nana Bo, the surest of hind catchers, I can never repay all she has given. My sons, Judah and Sweet Baby J, have taught me a love I did not know and given me a reason I could not imagine. Lastly, my wife Candice endured the trials of graduate school by my side with an indomitable grace and faith in me when I had none. She deserves all the honor worthy of her sacrifices because, without her, none of this would have been possible. I love you all. This research was supported in part by the United States Department of Energy Office of Electricity Delivery and Energy Reliability and the Department of Homeland Security Science and Technology Directorate under Award Numbers DE-OE0000097 and DE-OE0000780. The views and opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof. iv Contents Abstract ii Acknowledgments iii List of Figures viii List of Tables x List of Code xi 1 Introduction 1 1.1 Contributions . .3 1.2 Outline . .4 1.3 Previous Publications . .5 1.4 Prerequisites . .6 2 Background 9 2.1 Introduction . .9 2.2 System Security . 11 2.3 Defense in Depth . 17 2.4 Trusted Computing . 18 2.5 Laws and Regulations . 22 2.6 Conclusions . 27 3 Secure Boot 28 3.1 Introduction . 28 3.2 Related Work . 29 3.2.1 Bootstrapping . 29 3.2.2 Pre-boot Vulnerabilities . 30 v 3.2.3 Secure Boot . 31 3.2.4 Trusted Platform Module . 35 3.3 OpenPOWER Bootstrapping . 37 3.3.1 Security Domains . 40 3.3.2 Firmware Secure Boot on OpenPOWER . 41 3.4 Secure Boot Without Secure Memory . 42 3.4.1 OS Secure Boot Key Management . 43 3.5 Conclusions . 50 4 Remote Attestation 51 4.1 Introduction . 51 4.2 Background . 52 4.2.1 Trusted Computing . 52 4.2.2 Blockchain . 53 4.2.3 IoT Challenges . 55 4.3 Distributed Attestation via Blockchain . 56 4.3.1 System Model . 56 4.3.2 Threat Model . 56 4.3.3 System Design . 57 4.3.4 Use Cases . 60 4.4 Implementation . 62 4.5 Evaluation . 63 4.5.1 Quantitative Analysis . 63 4.5.2 Qualitative Analysis . 65 4.6 Discussion . 68 4.7 Related Work . 69 4.8 Conclusions . 71 5 Intraprocess Memory Isolation 72 5.1 Introduction . 72 5.2 Related Work . 73 5.2.1 Reinventing the Privilege Drop . 74 5.2.2 Executable and Linkable Format . 76 5.2.3 ELF-based access control . 77 5.2.4 Memory Architecture . 79 5.2.5 How ELFbac interacts with the Architecture .
Load more

Recommended publications
  • Security and Hardening Guide Security and Hardening Guide SUSE Linux Enterprise Desktop 15 SP2
    SUSE Linux Enterprise Desktop 15 SP2 Security and Hardening Guide Security and Hardening Guide SUSE Linux Enterprise Desktop 15 SP2 Introduces basic concepts of system security, covering both local and network security aspects. Shows how to use the product inherent security software like AppArmor, SELinux, or the auditing system that reliably collects information about any security-relevant events. Supports the administrator with security-related choices and decisions in installing and setting up a secure SUSE Linux Enterprise Server and additional processes to further secure and harden that installation. Publication Date: September 24, 2021 SUSE LLC 1800 South Novell Place Provo, UT 84606 USA https://documentation.suse.com Copyright © 2006– 2021 SUSE LLC and contributors. All rights reserved. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation License”. For SUSE trademarks, see https://www.suse.com/company/legal/ . All other third-party trademarks are the property of their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its aliates. Asterisks (*) denote third-party trademarks. All information found in this book has been compiled with utmost attention to detail. However, this does not guarantee complete accuracy. Neither SUSE LLC,
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • Efficiently Mitigating Transient Execution Attacks Using the Unmapped Speculation Contract Jonathan Behrens, Anton Cao, Cel Skeggs, Adam Belay, M
    Efficiently Mitigating Transient Execution Attacks using the Unmapped Speculation Contract Jonathan Behrens, Anton Cao, Cel Skeggs, Adam Belay, M. Frans Kaashoek, and Nickolai Zeldovich, MIT CSAIL https://www.usenix.org/conference/osdi20/presentation/behrens This paper is included in the Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation November 4–6, 2020 978-1-939133-19-9 Open access to the Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation is sponsored by USENIX Efficiently Mitigating Transient Execution Attacks using the Unmapped Speculation Contract Jonathan Behrens, Anton Cao, Cel Skeggs, Adam Belay, M. Frans Kaashoek, and Nickolai Zeldovich MIT CSAIL Abstract designers have implemented a range of mitigations to defeat transient execution attacks, including state flushing, selectively Today’s kernels pay a performance penalty for mitigations— preventing speculative execution, and removing observation such as KPTI, retpoline, return stack stuffing, speculation channels [5]. These mitigations impose performance over- barriers—to protect against transient execution side-channel heads (see §2): some of the mitigations must be applied at attacks such as Meltdown [21] and Spectre [16]. each privilege mode transition (e.g., system call entry and exit), To address this performance penalty, this paper articulates and some must be applied to all running code (e.g., retpolines the unmapped speculation contract, an observation that mem- for all indirect jumps). In some cases, they are so expensive ory that isn’t mapped in a page table cannot be leaked through that OS vendors have decided to leave them disabled by de- transient execution. To demonstrate the value of this contract, fault [2, 22].
    [Show full text]
  • Defeating Invisible Enemies:Firmware Based
    Defeating Invisible Enemies: Firmware Based Security in OpenPOWER Systems — Linux Security Summit 2017 — George Wilson IBM Linux Technology Center Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation Agenda Introduction The Case for Firmware Security What OpenPOWER Is Trusted Computing in OpenPOWER Secure Boot in OpenPOWER Current Status of Work Benefits of Open Source Software Conclusion Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation 2 Introduction Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation 3 Disclaimer These slides represent my views, not necessarily IBM’s All design points disclosed herein are subject to finalization and upstream acceptance The features described may not ultimately exist or take the described form in a product Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation 4 Background The PowerPC CPU has been around since 1990 Introduced in the RS/6000 line Usage presently spans embedded to server IBM PowerPC servers traditionally shipped with the PowerVM hypervisor and ran AIX and, later, Linux in LPARs In 2013, IBM decided to open up the server architecture: OpenPOWER OpenPOWER runs open source firmware and the KVM hypervisor with Linux guests Firmware and software designed and developed by the IBM Linux Technology Center “OpenPOWER needs secure and trusted boot!” Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation 5 The Case for Firmware Security Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation 6 Leaks Wikileaks Vault 7 Year 0 Dump NSA ANT Catalog Linux Security Summit / Defeating Invisible Enemies / September 14, 2017 / © 2017 IBM Corporation 7 Industry Surveys UEFI Firmware Rootkits: Myths and Reality – Matrosov Firmware Is the New Black – Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities – Branco et al.
    [Show full text]
  • Class-Action Lawsuit
    Case 3:20-cv-00863-SI Document 1 Filed 05/29/20 Page 1 of 279 Steve D. Larson, OSB No. 863540 Email: [email protected] Jennifer S. Wagner, OSB No. 024470 Email: [email protected] STOLL STOLL BERNE LOKTING & SHLACHTER P.C. 209 SW Oak Street, Suite 500 Portland, Oregon 97204 Telephone: (503) 227-1600 Attorneys for Plaintiffs [Additional Counsel Listed on Signature Page.] UNITED STATES DISTRICT COURT DISTRICT OF OREGON PORTLAND DIVISION BLUE PEAK HOSTING, LLC, PAMELA Case No. GREEN, TITI RICAFORT, MARGARITE SIMPSON, and MICHAEL NELSON, on behalf of CLASS ACTION ALLEGATION themselves and all others similarly situated, COMPLAINT Plaintiffs, DEMAND FOR JURY TRIAL v. INTEL CORPORATION, a Delaware corporation, Defendant. CLASS ACTION ALLEGATION COMPLAINT Case 3:20-cv-00863-SI Document 1 Filed 05/29/20 Page 2 of 279 Plaintiffs Blue Peak Hosting, LLC, Pamela Green, Titi Ricafort, Margarite Sampson, and Michael Nelson, individually and on behalf of the members of the Class defined below, allege the following against Defendant Intel Corporation (“Intel” or “the Company”), based upon personal knowledge with respect to themselves and on information and belief derived from, among other things, the investigation of counsel and review of public documents as to all other matters. INTRODUCTION 1. Despite Intel’s intentional concealment of specific design choices that it long knew rendered its central processing units (“CPUs” or “processors”) unsecure, it was only in January 2018 that it was first revealed to the public that Intel’s CPUs have significant security vulnerabilities that gave unauthorized program instructions access to protected data. 2. A CPU is the “brain” in every computer and mobile device and processes all of the essential applications, including the handling of confidential information such as passwords and encryption keys.
    [Show full text]
  • 2014 International Conference on Green Computing Communication and Electrical Engineering
    2014 International Conference on Green Computing Communication and Electrical Engineering (ICGCCEE 2014) Coimbatore, India 6-8 March 2014 Pages 1-875 IEEE Catalog Number: CFP1460X-POD ISBN: 978-1-4799-4981-6 1/2 TABLE OF CONTENTS VOLUME 1 A NOVEL ROBUST & FAULT TOLERANCE FRAMEWORK FOR WEBSERVICES USING WS- I* SPECIFICATION.............................................................................................................................................................1 Pandey, Akhilesh Kumar ; Kumar, Abhishek ; Zade, Farahnaz Rezaeian A SURVEY OF SELF ORGANIZING TRUST METHOD TO AVOID MALICIOUS PEERS FROM PEER TO PEER NETWORK ..............................................................................................................................................6 Samuvelraj, G. ; Nalini, N. CONTRIVANCE OF ENERGY EFFICIENT ROUTING ALGORITHM IN WIRELESS BODY AREA NETWORK.............................................................................................................................................................. 10 Sridharan, Srivatsan ; Jammalamadaka, Sridhar EFFECTIVE DEFENDING AGAINST FLOOD ATTACK USING STREAM-CHECK METHOD IN TOLERANT NETWORK................................................................................................................................................... 17 Kuriakose, Divya ; Daniel, D. ANONYMOUS ROUTING TECHNIQUE IN MANET FOR SECURE TRANSMISSION: ART .............................. 21 Vijayan, Aleesha ; Yamini, C. DEFINING THE FRAMEWORK FOR WIRELESS-AMI SECURITY IN SMART GRID.......................................
    [Show full text]
  • Bank of Chile Affected by Cyber-Attack Malware Found Pre
    JUNE 2018 Bank of Chile Affected By Cyber-Attack On May 28, 2018, the Bank of Chile, the largest bank operating in the country, declared in a public statement that a virus presumably sent from outside of the country affected the bank’s operations. According to the announcement, the virus was discovered by internal IT experts on May 24. It impacted workstations, executives’ terminals, and cashier personnel, causing difficulties in office services and telephone banking. After the emergency, the Bank of Chile activated its contingency protocol by disconnecting some workstations and suspending normal operations to avoid the propagation of the virus. Although the virus severely affected the quality of banking services, the institution assured that the security of transactions, as well as client information and money remained safe at all times. Pinkerton assesses that cyber-attacks targeting financial institutions and international banks form part of a trend that is likely to continue increasing in 2018. So far, Pinkerton Vigilance Network sources had identified Mexico and Chile as the two most impacted by cyber-crimes in Latin America; however, Pinkerton finds that no nation is exempt from becoming a target. Clients are encouraged to review the standard regulations on cyber- security for their banks and its contingency protocols in the event of cyber-attacks. Any unrecognized banking operation or phishing scam should be reported as soon as possible to the Bank of Chile emergency phone line (600) 637 3737. For further information concerning security advise from the Bank of Chile, the following website can be consulted: https://ww3.bancochile.cl/wps/wcm/connect/personas/portal/seguridad/inicio-seguridad#Tab_ Acorden_Respon3.
    [Show full text]
  • PCI PIN Transaction Security (PTS) Point of Interaction (POI)
    Payment Card Industry (PCI) PIN Transaction Security (PTS) Point of Interaction (POI) Modular Security Requirements Version 4.0 June 2013 Document Changes Date Version Description February 2010 3.x RFC version April 2010 3.0 Public release October 2011 3.1 Clarifications and errata, updates for non-PIN POIs, encrypting card readers February 2013 4.x RFC version June 2013 4.0 Public release Payment Card Industry PTS POI Security Requirements v4.0 June 2013 Copyright 2013 PCI Security Standards Council LLC Page 1 Table of Contents Document Changes ................................................................................................................. 1 About This Document .............................................................................................................. 4 Purpose .................................................................................................................................. 4 Scope of the Document .......................................................................................................... 4 Main Differences from Previous Version ................................................................................. 5 PTS Approval Modules Selection ........................................................................................... 6 Foreword .................................................................................................................................. 7 Evaluation Domains ...............................................................................................................
    [Show full text]
  • An Empirical Evaluation of Misconfiguration in Internet Services
    TECHNISCHE UNIVERSITÄT BERLIN FAKULTÄT FÜR ELEKTROTECHNIK UND INFORMATIK LEHRSTUHL FÜR INTELLIGENTE NETZE UND MANAGEMENT VERTEILTER SYSTEME UND LEHRSTUHL FÜR SECURITY IN TELECOMMUNICATIONS An Empirical Evaluation of Misconfguration in Internet Services vorgelegt von Tobias Fiebig geb. Wrona, MSc Geboren in Dissen am Teutoburger Wald Fakultät IV – Elektrotechnik und Informatik der Technischen Universität Berlin zur Erlangung des akademischen Grades DOKTOR DER INGENIEURWISSENSCHAFTEN (DR.-ING.) Promotionsausschuss: Vorsitzender: Prof. Dr.-Ing. Sebastian Möller, TU Berlin Gutachterin: Prof. Anja Feldmann, Ph. D., TU Berlin Gutachter: Prof. Dr. Jean-Pierre Seifert, TU Berlin Gutachter: Prof. Dr. Steve Uhlig, Queen Mary University of London Tag der wissenschaftlichen Aussprache: 16. Juni 2017 Berlin 2017 Für meinen Opa. I Abstract Within the past thirty years we have seen computers rise from room sized niche equipment to handy pocket sized devices found in every household. At the same time there has been a signifcant increase in the research effort on computer security. The literature is full of sophisticated attacks to obtain confdential information from computer systems, compro- mise them, or prevent them from being used at all. Simultaneously, mitigations to these attacks are as well studied. Technically, current attacks could be mitigated by deploying these techniques. In fact, there is a constant stream of new, complex techniques to ensure the confdentiality, integrity, and availability of data and systems. However, even the recent past has not been short of security incidents affecting billions of people. Yet, these incidents are usually neither enabled nor mitigated by these complex techniques. On the contrary, we fnd that these breaches are usually caused by something far more simple: Human error in deploying and running network services, e.g., delayed software updates, or, no authentication and authorization being confgured even though it would have been available.
    [Show full text]
  • LVI-LFB: Scenarios 3 & 4
    WHITEPAPER Security Load Value Injection in the Line Fill Buffers: How to Hijack Control Flow without Spectre www.bitdefender.com Contents Abstract .............................................................................................................................3 Introduction .......................................................................................................................3 Recap – Meltdown, Spectre & MDS .................................................................................4 Meltdown .................................................................................................................................4 Spectre ..................................................................................................................................... 4 Microarchitectural Data Sampling .......................................................................................... 5 Load Value Injection in the Line Fill Buffers ....................................................................5 Exploiting LVI-LFB: scenarios 3 & 4..................................................................................7 Real-life exploit ..................................................................................................................7 Mitigations .........................................................................................................................8 Conclusions .......................................................................................................................9
    [Show full text]
  • İSTİHBARATIN TEŞKİLATLANMA Ve YÖNETİM SORUNSALI: A.B.D. ÖRNEĞİ
    T.C. İSTANBUL ÜNİVERSİTESİ SOSYAL BİLİMLER ENSTİTÜSÜ SİYASET BİLİMİ VE KAMU YÖNETİMİ ANABİLİM DALI YÜKSEK LİSANS TEZİ İSTİHBARATIN TEŞKİLATLANMA ve YÖNETİM SORUNSALI: A.B.D. ÖRNEĞİ Fatih TÜRK 2501110836 TEZ DANIŞMANI DOÇ. DR Pelin Pınar GİRİTLİOĞLU İSTANBUL - 2019 ÖZ İSTİHBARATIN TEŞKİLATLANMA ve YÖNETİM SORUNSALI: A.B.D. ÖRNEĞİ Fatih TÜRK Günümüzde teknolojinin gelişimi ve küreselleşme dünyayı uçtan uca değiştirdi. Toplumlar ve ülkeler birbiri ile etkileşime geçtikçe bireysel özgürlükler ve demokrasi konusunda hassas alanlar giderek artmaktadır. Bu etkileşim ülkelerin güvenliğini ve bireysel özgürlük alanlarınıda etkilemektedir. Bu hızlı değişime karşın ülkeler geçmişin soğuk savaş anlayışı ve güvenlik hassasiyetlerini de aynı zamanda taşımaya devam etmektedirler. Gelişmiş demokrasilere sahip ülkelerin başında gelen Amerika Birleşik Devletleri’nde (ABD) mevcut güvenlik ve istihbarat anlayışı, faaliyetleri ve denetimi işte bu çatışmanın uzun sürede meydana geldiği denge üzerine kuruludur. ABD açısından istihbarat teşkilatlanma süreci yeni problemler, hak arayışları, çatışma ve çözümler doğurmaktadır. Tüm bunların ışığında bu tezin temel amacı istihbarat problemlerini ABD istihbarat teşkilatlanma süreci üzerinden analiz edip karşılaşılan problemleri neden sonuç ilişkisi içerisinde tespit etmektir. Bu çalışmada Amerika Birleşik Devletleri’nde istihbaratın yönetim modeli, teşkilatlanması ve hukuki alt yapısı incelenmiştir. Birinci bölümde kavramsal anlamda istihbarat incelemesi literatüre önemli bir katkı olarak görülebilir. İkinci bölümde
    [Show full text]
  • Covering PCI and PA DSS)
    Monetra® Payment Software Secure Implementation Guide (Covering PCI and PA DSS) Revision: 3.0b3 Publication date November, 2012 Copyright © 2012 Main Street Softworks, Inc. Secure Implementation Guide: (Covering PCI and PA DSS) Main Street Softworks, Inc. Revision: 3.0b3 Publication date November, 2012 Copyright © 2012 Main Street Softworks, Inc. Legal Notice The information contained herein is provided As Is without warranty of any kind, express or implied, including but not limited to, the implied warranties of merchantability and fitness for a particular purpose. There is no warranty that the information or the use thereof does not infringe a patent, trademark, copyright, or trade secret. Main Street Softworks, Inc. shall not be liable for any direct, special, incidental, or consequential damages resulting from the use of any information contained herein, whether resulting from breach of contract, breach of warranty, negligence, or otherwise, even if Main Street has been advised of the possibility of such damages. Main Street reserves the right to make changes to the information contained herein at anytime without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Main Street Softworks, Inc. Table of Contents 1. Monetra Security Validation (PA-DSS) ......................................................................... 1 1.1. Do Not Retain Sensitive Data ...........................................................................
    [Show full text]