Web Cache Entanglement: Novel Pathways to Poisoning
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Nvme-Based Caching in Video-Delivery Cdns
NVMe-Based Caching In Video-Delivery CDNs Thomas Colonna 1901942 Double Degree INSA Rennes Supervisor: Sébastien Lafond Faculty of Science and Engineering Åbo Akademi University 2020 In HTTP-based video-delivery CDNs (content delivery networks), a critical compo- nent is caching servers that serve clients with content obtained from an origin server. These caches store the content they obtain in RAM or onto disks for serving additional clients without fetching them from the origin. For most use cases, access to the disk remains the limiting factor, thus requiring a significant amount of RAM to avoid these accesses and achieve good performance, but increasing the cost. In this master’s thesis, we benchmark various approaches to provide storage such as regular disks and NVMe-based SSDs. Based on these insights, we design a caching mod- ule for a web server relying on kernel-bypass, implemented using the reference framework SPDK. The outcome of the master’s thesis is a caching module leveraging specific proper- ties of NVMe disks, and benchmark results for the various types of disks with the two approaches to caching (i.e., regular filesystem based or NVMe-specific). Contents 1 Introduction 1 2 Background 3 2.1 Caching in the context of CDNs . .3 2.2 Performances of the different disk models . .4 2.2.1 Hard-Disk Drive . .4 2.2.2 Random-Access Memory . .5 2.2.3 Solid-State Drive . .6 2.2.4 Non-Volatile Main Memory . .6 2.2.5 Performance comparison of 2019-2020 storage devices . .6 2.3 Analysing Nginx . .7 2.3.1 Event processing . -
Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts
Enter the Hydra: Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts Lorenz Breidenbach, Cornell Tech, IC3, ETH Zurich; Philip Daian, Cornell Tech, IC3; Florian Tramer, Stanford; Ari Juels, Cornell Tech, IC3, Jacobs Institute https://www.usenix.org/conference/usenixsecurity18/presentation/breindenbach This paper is included in the Proceedings of the 27th USENIX Security Symposium. August 15–17, 2018 • Baltimore, MD, USA 978-1-939133-04-5 Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX. Enter the Hydra: Towards Principled Bug Bounties and Exploit-Resistant Smart Contracts∗ Lorenz Breidenbach Philip Daian Florian Tramer` Ari Juels [email protected] [email protected] [email protected] [email protected] Cornell Tech, IC3,† Cornell Tech, IC3† Stanford Cornell Tech, IC3,† ETH Zurich¨ Jacobs Institute Abstract ble security problem. Vulnerability reward programs— bug bounties Bug bounties are a popular tool to help prevent soft- a.k.a. —have become instrumental in orga- ware exploits. Yet, they lack rigorous principles for set- nizations’ security assurance strategies. These programs ting bounty amounts and require high payments to attract offer rewards as incentives for hackers to disclose soft- economically rational hackers. Rather than claim boun- ware bugs. Unfortunately, hackers often prefer to exploit ties for serious bugs, hackers often sell or exploit them. critical vulnerabilities or sell them in gray markets. We present the Hydra Framework, the first general, The chief reason for this choice is that the bugs eli- principled approach to modeling and administering bug gible for large bounties are generally weaponizable vul- bounties that incentivize bug disclosure. -
Tinkertool System 7 Reference Manual Ii
Documentation 0642-1075/2 TinkerTool System 7 Reference Manual ii Version 7.5, August 24, 2021. US-English edition. MBS Documentation 0642-1075/2 © Copyright 2003 – 2021 by Marcel Bresink Software-Systeme Marcel Bresink Software-Systeme Ringstr. 21 56630 Kretz Germany All rights reserved. No part of this publication may be redistributed, translated in other languages, or transmitted, in any form or by any means, electronic, mechanical, recording, or otherwise, without the prior written permission of the publisher. This publication may contain examples of data used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. This publication could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. The publisher may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Make sure that you are using the correct edition of the publication for the level of the product. The version number can be found at the top of this page. Apple, macOS, iCloud, and FireWire are registered trademarks of Apple Inc. Intel is a registered trademark of Intel Corporation. UNIX is a registered trademark of The Open Group. Broadcom is a registered trademark of Broadcom, Inc. Amazon Web Services is a registered trademark of Amazon.com, Inc. -
ICP and the Squid Web Cache* 1 Introduction
ICP and the Squid Web Cache Duane Wessels k cla y August 13, 1997 Abstract We describ e the structure and functionality of the Internet Cache Proto col ICP and its implementation in the Squid Web Caching software. ICP is a lightweight message format used for communication among Web caches. Caches exchange ICP queries and replies to gather information to use in selecting the most appropriate lo cation from which to retrieve an ob ject. We present background on the history of ICP, and discuss issues in ICP deployment, e- ciency, security, and interaction with other asp ects of Web trac b ehavior. We catalog successes, failures, and lessons learned from using ICP to deploy a global Web cache hierarchy. 1 Intro duction Ever since the World-Wide Web rose to p opularity around 1994, much e ort has fo cused on reducing latency exp erienced by users. Sur ng the Web can b e slow for many reasons. Server systems b ecome slow when overloaded, esp ecially when hot sp ots suddenly app ear. Congestion can also o ccur at network exchange p oints or across links, and is esp ecially prevalent across trans-o ceanic links that often cost millions of dollars p er month. A common, alb eit exp ensiveway to alleviate such problems is to upgrade the overloaded resource: get a faster server, another E1, a bigger switch. However, this approach is not only often eco- nomically infeasible, but p erhaps more imp ortantly, it also fails to consider the numerous parties involved in even a single, simple Web transaction. -
Squirrel: a Decentralized Peer-To-Peer Web Cache
To appear in the 21th ACM Symposium on Principles of Distributed Computing (PODC 2002) Squirrel: A decentralized peer-to-peer web cache ∗ Sitaram Iyer Antony Rowstron Peter Druschel Rice University Microsoft Research Rice University 6100 Main Street, MS-132 7 J J Thomson Close 6100 Main Street, MS-132 Houston, TX 77005, USA Cambridge, CB3 0FB, UK Houston, TX 77005, USA [email protected] [email protected] [email protected] ABSTRACT There is substantial literature in the areas of cooperative This paper presents a decentralized, peer-to-peer web cache web caching [3, 6, 9, 20, 23, 24] and web cache workload char- called Squirrel. The key idea is to enable web browsers on acterization [4]. This paper demonstrates how it is possible, desktop machines to share their local caches, to form an ef- desirable and efficient to adopt a peer-to-peer approach to ficient and scalable web cache, without the need for dedicated web caching in a corporate LAN type environment, located hardware and the associated administrative cost. We propose in a single geographical region. Using trace-based simula- and evaluate decentralized web caching algorithms for Squir- tion, it shows how most of the functionality and performance rel, and discover that it exhibits performance comparable to of a traditional web cache can be achieved in a completely a centralized web cache in terms of hit ratio, bandwidth us- self-organizing system that needs no extra hardware or ad- age and latency. It also achieves the benefits of decentraliza- ministration, and is fault-resilient. The following paragraphs tion, such as being scalable, self-organizing and resilient to elaborate on these ideas. -
Performance Guide 3.7.0.123608
Vizrt Community Expansion Performance Guide 3.7.0.123608 Copyright © 2010-2012 Vizrt. All rights reserved. No part of this software, documentation or publication may be reproduced, transcribed, stored in a retrieval system, translated into any language, computer language, or transmitted in any form or by any means, electronically, mechanically, magnetically, optically, chemically, photocopied, manually, or otherwise, without prior written permission from Vizrt. Vizrt specifically retains title to all Vizrt software. This software is supplied under a license agreement and may only be installed, used or copied in accordance to that agreement. Disclaimer Vizrt provides this publication “as is” without warranty of any kind, either expressed or implied. This publication may contain technical inaccuracies or typographical errors. While every precaution has been taken in the preparation of this document to ensure that it contains accurate and up-to-date information, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information contained in this document. Vizrt’s policy is one of continual development, so the content of this document is periodically subject to be modified without notice. These changes will be incorporated in new editions of the publication. Vizrt may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time. Vizrt may have patents or pending patent applications covering subject matters in this document. The furnishing of this document does not give you any license to these patents. Technical Support For technical support and the latest news of upgrades, documentation, and related products, visit the Vizrt web site at www.vizrt.com. -
Exploring Coordinated Disclosure SHEDDING LIGHT on PERCEPTIONS and EXPERIENCES in HOW SOFTWARE VULNERABILITIES ARE REPORTED
Exploring Coordinated Disclosure SHEDDING LIGHT ON PERCEPTIONS AND EXPERIENCES IN HOW SOFTWARE VULNERABILITIES ARE REPORTED COMMISSIONED BY SEPTEMBER 2019 ©COPYRIGHT 2019 451 RESEARCH. ALL RIGHTS RESERVED. About this paper A Black & White paper is a study based on primary research survey data that assesses the market dynamics of a key enterprise technology segment through the lens of the “on the ground” experience and opinions of real practitioners — what they are doing, and why they are doing it. ABOUT THE AUTHOR DAN KENNEDY RESEARCH DIRECTOR, VOICE OF THE ENTERPRISE: INFORMATION SECURITY Daniel Kennedy is the Research Director for Information Security for 451 Research’s Voice of the Enterprise (VoTE) quantitative research product, where he is responsible for managing all phases of the research process. He is an experienced information security professional who has written for both Forbes online and Ziff Davis, has provided commentary to numerous news outlets including The New York Times and The Wall Street Journal, and his personal blog Praetorian Prefect was recognized as one of the top five technical blogs in information security by the RSA 2010 Conference. COMMISSIONED BY VERACODE 2 Table of Contents Executive Summary 4 Key Findings 4 Methodology 5 Brief History of Vulnerability Disclosure 5 Today’s Perceptions of Disclosure 8 Figure 1: Vulnerability disclosure preferences � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � 8 Vulnerability Disclosure as a Public Good 8 Solicited Versus Unsolicited Testing 9 Disclosure -
Penetration Testing of Web Applications in a Bug Bounty Program
Penetration Testing of Web Applications in a Bug Bounty Program Pascal Schulz Faculty of Health, Science and Technology Computer Science 15hp Leonardo Martucci Donald F. Ross 140604 Penetration Testing of Web Applications in a Bug Bounty Program PASCAL SCHULZ Department of Mathematics and Computer Science Abstract Web applications provide the basis for the use of the "World-Wide-Web", as people know it nowadays. These software solutions are programmed by a numerous amount of devel- opers all over the world. For all this software, it is not possible to guarantee a 100 percent security. Therefore, it is desirable that every application should be evaluated using penetra- tion tests. A new form of security testing platforms is provided by bug bounty programs, which encourage the community to help searching for security breaches. This work intro- duces the currently leading portal for bug bounties, called Bugcrowd Inc. In addition, web applications, which were part of the program, were tested in order to evaluate their security level. A comparison is made with statistics provided by leading penetration testing compa- nies, showing the average web application security level. The submission process, to send information about vulnerabilities, has been evaluated. The average time it takes, to receive an answer regarding a submission has been reviewed. In the end, the findings are retested, to evaluate, if the bug bounty program is a useful opportunity to increase security and if website operators take submissions serious by patching the software flaws. Keywords: Penetration Testing, Bug-Bounty Program, Web Application Analysis. iii This thesis is submitted in partial fulfillment of the requirements for the Bachelor’s degree in Computer Science. -
Byos Bug Bounty Program: Las Vegas 2019
Byos Bug Bounty Program: Las Vegas 2019 White Paper Document version: 1.0 August 21st, 2019 Byos Bug Bounty Program - Las Vegas 2019 White Paper - © 2019 Mkit North America Inc. All rights reserved - byos.io Page 1 of 14 1.0 - Introduction 3 2.0 - Findings 5 2.1 - Critical Vulnerabilities 5 2.1.1 - Timing ARP Spoof attack 5 2.2 - High Vulnerabilities 6 2.2.1 - SQL Injection 6 2.2.2 - Authentication bypass (JWT) 7 2.2.3 - Authentication Bypass (Remember Me) 8 2.3 - Medium Vulnerabilities 9 2.3.1 - Persistent XSS 9 2.4 - Low Vulnerabilities 10 2.4.1 - Unicode in SSID 10 2.4.2 - CSRF 11 2.4.3 - Outdated libraries 12 3.0 - Conclusion 12 4.0 - Footnotes 14 Byos Bug Bounty Program - Las Vegas 2019 White Paper - © 2019 Mkit North America Inc. All rights reserved - byos.io Page 2 of 14 1.0 - Introduction 1.1 - Summary Over the course of 3 days, more than 20 security researchers from North America, South America, and Europe participated in our company’s first bug bounty event. The event was by invitation only. 1.2 - Objective The overall objective of the bug bounty program is to validate the security claims of the Byos Portable Secure Gateway and to discover any existing vulnerabilities in the product and its features. Additional benefits include: ● Practising the company’s internal vulnerability handling process ● Increasing our security team’s awareness of how attackers approach the security mechanisms of the product ● Learning and validating security development best practices by having active feedback from researchers ● Gathering external expert opinions on the product’s feature-set, benefits and use-cases 1.3 - Time and Location The Bug Bounty took place during August 8-9-10, 2019, in Las Vegas, NV (USA). -
Ubuntu Server Guide Basic Installation Preparing to Install
Ubuntu Server Guide Welcome to the Ubuntu Server Guide! This site includes information on using Ubuntu Server for the latest LTS release, Ubuntu 20.04 LTS (Focal Fossa). For an offline version as well as versions for previous releases see below. Improving the Documentation If you find any errors or have suggestions for improvements to pages, please use the link at thebottomof each topic titled: “Help improve this document in the forum.” This link will take you to the Server Discourse forum for the specific page you are viewing. There you can share your comments or let us know aboutbugs with any page. PDFs and Previous Releases Below are links to the previous Ubuntu Server release server guides as well as an offline copy of the current version of this site: Ubuntu 20.04 LTS (Focal Fossa): PDF Ubuntu 18.04 LTS (Bionic Beaver): Web and PDF Ubuntu 16.04 LTS (Xenial Xerus): Web and PDF Support There are a couple of different ways that the Ubuntu Server edition is supported: commercial support and community support. The main commercial support (and development funding) is available from Canonical, Ltd. They supply reasonably- priced support contracts on a per desktop or per-server basis. For more information see the Ubuntu Advantage page. Community support is also provided by dedicated individuals and companies that wish to make Ubuntu the best distribution possible. Support is provided through multiple mailing lists, IRC channels, forums, blogs, wikis, etc. The large amount of information available can be overwhelming, but a good search engine query can usually provide an answer to your questions. -
Cached and Confused: Web Cache Deception in the Wild
Cached and Confused: Web Cache Deception in the Wild Seyed Ali Mirheidari, University of Trento; Sajjad Arshad, Northeastern University; Kaan Onarlioglu, Akamai Technologies; Bruno Crispo, University of Trento, KU Leuven; Engin Kirda and William Robertson, Northeastern University https://www.usenix.org/conference/usenixsecurity20/presentation/mirheidari This paper is included in the Proceedings of the 29th USENIX Security Symposium. August 12–14, 2020 978-1-939133-17-5 Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX. Cached and Confused: Web Cache Deception in the Wild Seyed Ali Mirheidari Sajjad Arshad∗ Kaan Onarlioglu University of Trento Northeastern University Akamai Technologies Bruno Crispo Engin Kirda William Robertson University of Trento & Northeastern University Northeastern University KU Leuven Abstract In particular, Content Delivery Network (CDN) providers Web cache deception (WCD) is an attack proposed in 2017, heavily rely on effective web content caching at their edge where an attacker tricks a caching proxy into erroneously servers, which together comprise a massively-distributed In- storing private information transmitted over the Internet and ternet overlay network of caching reverse proxies. Popular subsequently gains unauthorized access to that cached data. CDN providers advertise accelerated content delivery and Due to the widespread use of web caches and, in particular, high availability via global coverage and deployments reach- the use of massive networks of caching proxies deployed ing hundreds of thousands of servers [5,15]. A recent scien- by content distribution network (CDN) providers as a critical tific measurement also estimates that more than 74% of the component of the Internet, WCD puts a substantial population Alexa Top 1K are served by CDN providers, indicating that of Internet users at risk. -
A Two-Level Intelligent Web Caching Scheme with a Hybrid Extreme Learning Machine and Least Frequently Used 725
A Two-Level Intelligent Web Caching Scheme with a Hybrid Extreme Learning Machine and Least Frequently Used 725 A Two-Level Intelligent Web Caching Scheme with a Hybrid Extreme Learning Machine and Least Frequently Used Phet Imtongkhum1, Chakchai So-In1, Surasak Sanguanpong2, Songyut Phoemphon1* 1 Department of Computer Science, Faculty of Science, Khon Kaen University, Thailand 2 Department of Computer Engineering, Faculty of Engineering, Kasetsart University, Thailand [email protected], [email protected], [email protected], [email protected] Abstract [4-5]. Consequently, many studies and applications have The immense increase in data traffic has created been developed to not only evaluate policy-based several issues for the Internet community, including long approaches of multi-tier ISPs but also efficiently use delays and low throughput. Most Internet user activity the existing Internet infrastructure, particularly from occurs via web access, thus making it a major source of the user perspective, including factors such as the Internet traffic. Due to a lack of effective management throughput and delay, which contribute to the quality schemes, Internet usage is inefficient. Advances in of accessible web objects. Web proxies (web caching) caching mechanisms have led to the introduction of web have been developed to address this issue. The key proxies that have improved real-time communication and concept that underlies proxy/caching is similar to that cost savings. Although several traditional caching polices of traditional caching of the memory hierarchical have been implemented to increase speed and simplicity, structure of a CPU, including the CPU cache, RAM, cache replacement accuracy remains a key limitation due and hard disk [6].