DOCSLIB.ORG

A Temporal Logic Approach to Information-Flow Control

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Temporal Logic Approach to Information-Flow Control R S V E I T I A N S U S S A I R S A V I E N A Temporal Logic Approach to Information-flow Control Thesis for obtaining the title of Doctor of Natural Science of the Faculty of Natural Science and Technology I of Saarland University by Markus N. Rabe Saarbrücken February, 2016 Dean of the Faculty Prof. Dr. Markus Bläser Day of Colloquium January 28, 2016 Chair of the Committee Prof. Dr. Dr. h.c. Reinhard Wilhelm Reviewers Prof. Bernd Finkbeiner, Ph.D. Prof. David Basin, Ph.D. Prof. Sanjit A. Seshia, Ph.D. Academic Assistant Dr. Swen Jacobs i Abstract Information leaks and other violations of information security pose a severe threat to individuals, companies, and even countries. The mechanisms by which attackers threaten information security are diverse and to show their absence thus proved to be a challenging problem. Information-flow control is a principled approach to prevent security incidents in programs and other tech- nical systems. In information-flow control we define information-flow proper- ties, which are sufficient conditions for when the system is secure in a particu- lar attack scenario. By defining the information-flow property only based on what parts of the executions of the system a potential attacker can observe or control, we obtain security guarantees that are independent of implementa- tion details and thus easy to understand. There are several methods available to enforce (or verify) information-flow properties once defined. We focus on static enforcement methods, which automatically determine whether a given system satisfies a given information-flow property for all possible inputs to the system. Most enforcement approaches that are available today have one problem in common: they each only work for one particular programming language or information-flow property. In this thesis, we propose a temporal logic approach to information-flow control to provide a simple formal basis for the specification and enforcement of information-flow properties. We show that the approach can be used to enforce a wide range of information-flow properties with a single algorithm. The main challenge is that the standard temporal logics are unable to ex- press information-flow properties. They lack the ability to relate multiple executions of a system, which is essential for information-flow properties. We thus extend the temporal logics LTL and CTL∗ by the ability to quantify over multiple executions and to relate them using boolean and temporal operators. The resulting temporal logics HyperLTL and HyperCTL∗ can express many information-flow properties of interest. The extension of temporal logics com- pels us to revisit the algorithmic problem to check whether a given system (model) satisfies a given specification in HyperLTL or HyperCTL∗; also called the model checking problem. On the technical side, the main contribution is a model checking algorithm for HyperLTL and HyperCTL∗ and the detailed complexity analysis of the model checking problem: We give nonelementary lower and upper bounds for its computational complexity, both in the size of the system and the size of the specification. The complexity analysis also reveals a class of specification, which includes many of the commonly consid- ered information-flow properties and for which the algorithm is efficient (in NLOGSPACE in the size of the system). For this class of efficiently checkable properties, we provide an approach to reuse existing technology in hardware model checking for information-flow control. We demonstrate along a case study that the temporal logic approach to information-flow control is flexible and effective. We further provide two case studies that demonstrate the use of HyperLTL and HyperCTL∗ for proving properties of error resistant codes and distributed protocols that have so far only been considered in manual proofs. ii iii Zusammenfassung Informationssicherheit stellt eine immer größere Bedrohung für einzelne Per- sonen, Firmen und selbst ganze Länder dar. Ein grundlegender Ansatz zur Vorbeugung von Sicherheitsproblemen in technischen Systemen, wie zum Beispiel Programmen, ist Informationsflusskontrolle. In der Informationsfluss- kontrolle definieren wir zunächst sogenannte Informationsflusseigenschaf- ten, welche hinreichende Bedingungen für die Sicherheit des gegebenen Sys- tems in einem Sicherheitsszenario darstellen. Indem wir Informationsfluss- eigenschaften nur auf Basis der möglichen Beobachtungen eines Angreifers über das System definieren, erhalten wir einfach zu verstehende Sicherheits- garantien, die unabhängig von Implementierungsdetails sind. Nach der Defi- nition von Eigenschaften muss sichergestellt werden, dass ein gegebenes Sys- tem seine Informationsflusseigenschaft erfüllt, wofür es bereits verschiedene Methoden gibt. Wir fokussieren uns in dieser Arbeit auf statische Metho- den, welche für ein gegebenes System und eine gegebene Informationsfluss- eigenschaft automatisch entscheiden, ob das System die Eigenschaft für alle möglichen Eingaben erfüllt, was wir auch das Modellprüfungsproblem nen- nen. Die meisten verfügbaren Methoden zum Sicherstellen der Einhaltung von Informationsflusseigenschaften teilen jedoch eine Schwäche: sie funk- tionieren nur für eine einzelne Programmiersprache oder eine einzelne Infor- mationsflusseigenschaft. In dieser Arbeit verfolgen wir einen Ansatz basierend auf Temporallogi- ken, um eine einfache theoretische Basis für die Spezifikation von Informa- tionsflusseigenschaften und deren Umsetzung zu erhalten. Wir analysieren den Zusammenhang von der Ausdrucksmächtigkeit von Spezifikationsspra- chen und dem algorithmischen Problem Spezifikationen für ein System zu überprüfen. Anhand einer Fallstudie im Bereich der Hardwaresicherheit zei- gen wir, dass der Ansatz dazu geeignet ist eine breite Palette von bekannten und neuen Informationsflusseigenschaften mittels eines einzelnen Modell- prüfungsalgorithmus zu beweisen. Das Kernproblem hierbei ist, dass wir in den üblichen Temporallogiken Informationsflusseigenschaften nicht ausdrücken können, es fehlt die Fähig- keit mehrere Ausführungen eines Systems miteinander zu vergleichen, was der gemeinsame Nenner von Informationsflusseigenschaften ist. Wir erweit- ern Temporallogiken daher um die Fähigkeit über mehrere Ausführungen zu quantifizieren und diese miteinander zu vergleichen. Der Hauptbeitrag auf der technischen Ebene ist ein Modellprüfungsalgorithmus und eine de- taillierte Analyse der Komplexität des Modellprüfungsproblems. Wir geben einen Modellprüfungsalgorithmus an und beweisen, dass der Algorithmus asymptotisch optimal ist. Die Komplexitätsanalyse zeigt auch eine Klasse von Eigenschaften auf, welche viele der üblichen Informationsflusseigenschaften beinhaltet, und für welche der gegebene Algorithmus effizient ist (in NLOG- SPACE in der Größe des Systems). Für diese Klasse von effizient überprüf- baren Eigenschaften diskutieren wir einen Ansatz bestehende Technologie zur Modellprüfung von Hardware für Informationsflusskontrolle wiederzu- iv verwenden. Anhand einer Fallstudie zeigen wir, dass der Ansatz flexibel und effektiv eingesetzt werden kann. Desweiteren diskutieren wir zwei weit- ere Fallstudien, welche demonstrieren, dass die vorgeschlagene Erweiterung von Temporallogiken auch eingesetzt werden kann, um Eigenschaften für fehlerresistente Kodierungen und verteilte Protokolle zu beweisen, welche bisher nur Abstrakt betrachtet werden konnten. v Acknowledgements It is impossible to do justice to all those wonderful people who contributed in direct and indirect ways to this thesis. Nevertheless I want to highlight several persons and groups to which I am particularly indebted. I want to start with expressing my deep gratitude to my advisor Bernd Finkbeiner. I admire his commitment to his students and his ability to provide subtle guidance. He showed a great deal of patience with me and always kept his door open. I cannot imagine a better supervisor. I want to thank my colleagues, Rayna Dimitrova, Klaus Dräger, Rüdi- ger Ehlers, Peter Faymonville, Michael Gerke, Swen Jacobs, Felix Klein, Lars Kuhtz, Andrey Kupriyanov, Hans-Jörg Peter, Christa Schäfer, Leander Ten- trup, Hazem Torfah, and Martin Zimmermann for the countless shared cof- fees and inspiring conversations. I am grateful for having worked with Sven Schewe during the first year of my PhD. Even though our common work is not directly a part of this thesis, my research is heavily influenced by him. Thanks also to my doctoral committee for their time and feedback; the exter- nal reviewers, David Basin and Sanjit A. Seshia, the committee chair Reinhard Wilhelm, and the academic staff committee member Swen Jacobs. It would take too many pages to describe what each of my friends means to me, but at least I want to mention their names here. I will always remember my flatmates with whom I shared a home for all those years: Justus, Anika, Claudia, Jana; and of course the co-founders Klaas and Matthias who also hap- pen to be two of my oldest friends. Let us enjoy more roof parties, sunny af- ternoons on the balcony, and evenings in the kitchen. I am grateful for having met so many wonderful people during conferences, summer schools, and my stay at Cambridge; in particular I want to mention Heidy Khlaaf, Christoph Wintersteiger, and Anton Stefanek. The friends I made in Saarbrücken influ- enced this thesis in so many ways; Anna Marie, Anne-Christin, Christian, Eva, Fabian, Jonas, Jörg, Kevin, Nikolai, Nora, Richard, and Verena, and also my cinema buddies Ariane and Jana. And finally I want to mention two friends who had big influence on this thesis:
Load more

Recommended publications
  • Alcatel-Lucent Security Advisory Sa0xx
    Alcatel-Lucent Security Advisory No. SA0053 Ed. 04 Information about Poodle vulnerability Summary POODLE stands for Padding Oracle On Downgraded Legacy Encryption. The POODLE has been reported in October 14th 2014 allowing a man-in-the-middle attacker to decrypt ciphertext via a padding oracle side-channel attack. The severity is not considered as the same for Heartbleed and/or bash shellshock vulnerabilities. The official risk is currently rated Medium. The classification levels are: Very High, High, Medium, and Low. The SSLv3 protocol is only impacted while TLSv1.0 and TLSv1.2 are not. This vulnerability is identified CVE- 2014-3566. Alcatel-Lucent Enterprise voice products using protocol SSLv3 are concerned by this security alert. Openssl versions concerned by the vulnerability: OpenSSL 1.0.1 through 1.0.1i (inclusive) OpenSSL 1.0.0 through 1.0.0n (inclusive) OpenSSL 0.9.8 through 0.9.8zb (inclusive) The Alcatel-Lucent Enterprise Security Team is currently investigating implications of this security flaw and working on a corrective measure, for OpenTouch 2.1.1 planned in Q4 2015, to prevent using SSLv3 that must be considered as vulnerable. This note is for informational purpose about the padding-oracle attack identified as “POODLE”. References CVE-2014-3566 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566 Advisory severity CVSS Base score : 4.3 (MEDIUM) - AV:N/AC:M/Au:N/C:P/I:N/A:N https://www.openssl.org/news/secadv_20141015.txt https://www.openssl.org/~bodo/ssl-poodle.pdf Description of the vulnerabilities Information about Poodle vulnerability (CVE-2014-3566).
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • Combat Top Security Vulnerabilities: HPE Tippingpoint Intrusion
    Business white paper Combat top security vulnerabilities HPE TippingPoint intrusion prevention system Business white paper Page 2 The year 2014 marked a new pinnacle for hackers. Vulnerabilities were uncovered in some of the most widely deployed software in the world—some of it in systems actually intended to make you more secure. HPE TippingPoint next-generation intrusion prevention system (IPS) and next-generation firewall (NGFW) customers rely on us to keep their networks safe. And when it comes to cyber threats, every second matters. So how did HPE TippingPoint do? This brief highlights the top security vulnerabilities of 2014—the ones that sent corporate security executives scrambling to protect their businesses. And it describes how HPE TippingPoint responded to keep our customers safe. Heartbleed—HPE TippingPoint intrusion prevention system stops blood flow early Any vulnerability is concerning, but when a vulnerability is discovered in software designed to assure security, it leaves businesses exposed and vulnerable. That was the case with the Heartbleed vulnerability disclosed by the OpenSSL project on April 7, 2014. They found the vulnerability in versions of OpenSSL—the open-source cryptographic library widely used to encrypt Internet traffic. Heartbleed grew from a coding error that allowed remote attackers to read information from process memory by sending heartbeat packets that trigger a buffer over-read. As a demonstration of the vulnerability, the OpenSSL Project created a sample exploit that successfully stole private cryptography keys, user names and passwords, instant messages, emails, and business-critical documents and communications. We responded within hours to protect TippingPoint customers. On April 8, we released a custom filter package to defend against the vulnerability.
    [Show full text]
  • IBM X-Force Threat Intelligence Quarterly, 1Q 2015
    IBM Security Systems March 2015 IBM X-Force Threat Intelligence Quarterly, 1Q 2015 Explore the latest security trends—from “designer vulns” to mutations in malware— based on 2014 year-end data and ongoing research 2 IBM X-Force Threat Intelligence Quarterly 1Q 2015 Contents Executive overview 2 Executive overview When we look back in history to review and understand the past year, you can be assured it will be remembered as a year of 4 Roundup of security incidents in 2014 significant change. 11 Citadel, the financial malware that continues to adapt In early January 2014, companies large and small scrambled to Are mobile application developers for Android putting their 14 better understand and analyze a major retail breach that left users at risk? them asking whether or not their own security measures would 17 Shaking the foundation: Vulnerability disclosures in 2014 survive the next storm. Before spring was barely in motion, we had our first taste of the “designer vuln”—a critical 21 About X-Force vulnerability that not only proved lethal for targeted attacks, 22 Contributors but also had a cleverly branded logo, website and call-name (or handle) that would forever identify the disclosure. 22 For more information 23 Footnotes These designer vulns appeared within long-held foundational frameworks used by the majority of websites, and they continued throughout 2014, garnering catchy name after catchy name—Heartbleed, Shellshock, POODLE, and into 2015, Ghost and FREAK. This in and of itself raises the question of what it takes for a vulnerability to merit a marketing push, PR and logo design, while the other thousands discovered throughout the year do not.
    [Show full text]
  • TLS Attacks & DNS Security
    IAIK TLS Attacks & DNS Security Information Security 2019 Johannes Feichtner [email protected] IAIK Outline TCP / IP Model ● Browser Issues Application SSLStrip Transport MITM Attack revisited Network Link layer ● PKI Attacks (Ethernet, WLAN, LTE…) Weaknesses HTTP TLS / SSL FLAME FTP DNS Telnet SSH ● Implementation Attacks ... ● Protocol Attacks ● DNS Security IAIK Review: TLS Services All applications running TLS are provided with three essential services Authentication HTTPS FTPS Verify identity of client and server SMTPS ... Data Integrity Detect message tampering and forgery, TLS e.g. malicious Man-in-the-middle TCP IP Encryption Ensure privacy of exchanged communication Note: Technically, not all services are required to be used Can raise risk for security issues! IAIK Review: TLS Handshake RFC 5246 = Establish parameters for cryptographically secure data channel Full handshake Client Server scenario! Optional: ClientHello 1 Only with ServerHello Client TLS! Certificate 2 ServerKeyExchange Certificate CertificateRequest ClientKeyExchange ServerHelloDone CertificateVerify 3 ChangeCipherSpec Finished ChangeCipherSpec 4 Finished Application Data Application Data IAIK Review: Certificates Source: http://goo.gl/4qYsPz ● Certificate Authority (CA) = Third party, trusted by both the subject (owner) of the certificate and the party (site) relying upon the certificate ● Browsers ship with set of > 130 trust stores (root CAs) IAIK Browser Issues Overview Focus: Relationship between TLS and HTTP Problem? ● Attacker wants to access encrypted data ● Browsers also have to deal with legacy websites Enforcing max. security level would „break“ connectivity to many sites Attack Vectors ● SSLStrip ● MITM Attack …and somehow related: Cookie Stealing due to absent „Secure“ flag… IAIK Review: ARP Poisoning How? Attacker a) Join WLAN, ● Sniff data start ARP Poisoning ● Manipulate data b) Create own AP ● Attack HTTPS connections E.g.
    [Show full text]
  • A Complete Bibliography of Publications in the Journal of Computer and System Sciences
    A Complete Bibliography of Publications in the Journal of Computer and System Sciences Nelson H. F. Beebe University of Utah Department of Mathematics, 110 LCB 155 S 1400 E RM 233 Salt Lake City, UT 84112-0090 USA Tel: +1 801 581 5254 FAX: +1 801 581 4148 E-mail: [email protected], [email protected], [email protected] (Internet) WWW URL: http://www.math.utah.edu/~beebe/ 26 May 2021 Version 1.04 Title word cross-reference (s; t) [1475]. 0(n) [1160]. 1 [270]. 1 − L [1371, 924]. 12n2 [450]. 2 [3525, 3184, 2191, 1048, 3402, 1500, 3364, 2034, 2993, 834, 2473, 3101]. f2; 3g [2843]. #09111 [1814]. #AM01053M 2pn 1=3 − 2 O(n ) [1862, 1877, 1904]. #better 5X8 els [1856]. 2 [2353]. 2 [445]. 2 [1977]. 3 #better 5X8 els.pdf [1856]. #BIS [3184]. [1920, 2242, 2827, 2374, 1961, 2825, 3240, · #BIS-hardness #CSP 1071, 1133]. 43 [3620]. 4 Log2N [655]. 5=4 [3184]. ∗ 0 #econdirectM [1612]. 8 [2998]. =? [1433]. [858]. [2696, 2908, 2500, 3508]. 1 ∗ NP [1893]. #HA03022M [1860, 1875]. [1625, 3418, 1085]. [1523]. [3194]. NP[O(log n)] p ⊆ PH #HA05062N [1876]. #HA05062O [2235]. [995]. 2 [2235]. [1849, 1861]. #HA06043M [1501]. 2 [3418]. H [1565]. a [426, 289]. [1892, 1871, 1889]. #HA08111M [1846]. A[P (x); 2x; x + 1] [500]. Ax = λBx [377]. b · #P [1195, 3598, 1261, 1264]. [3253]. β [3444]. [3418]. d #praise 5X8 els.pdf [1832]. [2527, 1362, 3256, 3563]. δ [3553]. `p [2154]. #sciencejobs N [1802]. [1551, 2617, 1864, 1693]. g [3312]. h [1019]. K [1320, 2756, 191, 3494, 1300, 1546, 3286, #P [1373].
    [Show full text]
  • The Software Vulnerability Ecosystem: Software Development in the Context of Adversarial Behavior
    University of Pennsylvania ScholarlyCommons Publicly Accessible Penn Dissertations 2016 The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior Saender Aren Clark University of Pennsylvania, [email protected] Follow this and additional works at: https://repository.upenn.edu/edissertations Part of the Databases and Information Systems Commons, and the Engineering Commons Recommended Citation Clark, Saender Aren, "The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior" (2016). Publicly Accessible Penn Dissertations. 2233. https://repository.upenn.edu/edissertations/2233 This paper is posted at ScholarlyCommons. https://repository.upenn.edu/edissertations/2233 For more information, please contact [email protected]. The Software Vulnerability Ecosystem: Software Development In The Context Of Adversarial Behavior Abstract Software vulnerabilities are the root cause of many computer system security fail- ures. This dissertation addresses software vulnerabilities in the context of a software lifecycle, with a particular focus on three stages: (1) improving software quality dur- ing development; (2) pre- release bug discovery and repair; and (3) revising software as vulnerabilities are found. The question I pose regarding software quality during development is whether long-standing software engineering principles and practices such as code reuse help or hurt with respect to vulnerabilities. Using a novel data-driven analysis of large databases of vulnerabilities, I show the surprising result that software quality and software security are distinct. Most notably, the analysis uncovered a counterintu- itive phenomenon, namely that newly introduced software enjoys a period with no vulnerability discoveries, and further that this “Honeymoon Effect” (a term I coined) is well-explained by the unfamiliarity of the code to malicious actors.
    [Show full text]
  • Exploit Kits, Which Seemed Nearly Dormant Last Year Following the Demise of Illicit Cryptocurrency Mining, the Hot New Thing in 2018, Appear to Be Making a Comeback
    2020 TRUSTWAVE GLOBAL SECURITY REPORT Table of Contents Introduction ........................ 3 Threat Intelligence .................22 Email Threats ......................... 23 Executive Summary ................. 4 Extortion Scams ....................... 25 Data Compromises ..................... 4 Archive Mutant Tricks .................. 28 Email Threats .......................... 6 Multi-Stage Phishing Using Web Attacks ........................... 8 Trusted Cloud Providers ................ 29 Exploits ............................... 8 Office 365 Account Phishing ............30 Malware ............................... 9 Emotet: The Threat is in the Mail ......... 33 Database and Network Security ......... 10 Web Attacks .......................... 36 Database Compromise ...............11 Humans: The Lowest Hanging Fruit ....... 38 Compromise Demographics ..............11 Exploits .............................. 39 Compromises Per Environment ...........14 Finding Insights Through Trustwave Fusion ......................44 Environments Compromised by Industry ............................15 Malware ..............................46 Compromises by Region .................17 More and More Magecart ...............50 Compromise Duration ...................18 The State of Security ............... 51 Methods of Compromise .................19 Data Security ......................... 52 Sources of Detection ...................20 Network Security ...................... 56 Contributors ....................... 59 2 Introduction Welcome to the 2020 Trustwave
    [Show full text]
  • Olson's Standard Poodles
    Sun-Golden Kennels STANDARD POODLE PUPPY PURCHASE AGREEMENT LIMITED REGISTRATION BREEDER/Seller: Mike or Sharon Long 7812 N. Longview Ct. Edgerton, WI. 53534 608-884-4000 [email protected] www.sungoldenkennels.com Definitions used herein include: "BUYER" shall herein be define as: ___________________________ BREEDER" or “SELLER” Shall herein be defined as: Mike or Sharon Long "PUPPY" shall herein be defined as “A PUPPY”, registered with the American Kennel Club (AKC) with the registered name of: SHARMIK’S________________________________ AKC Litter registration # PRXXXXXX Sire: AKC #PRXXXXXX Reg Name ____________________________________ Dam: AKC# PRXXXXXX Reg Name ___________________________________ The Sun-Golden Standard Poodle described above is sold for the sum of $1000.00 Payment to be made in full with cash or visa/mc. A pet puppy is defined here to be a Standard Poodle puppy which is in good health at the time of sale, and embodies the characteristics of the Standard Poodle breed. This puppy is purebred and the litter has been (registered) with the American Kennel Club. The Parents of this Puppy have had OFA x-rays to establish that they are free of Hip Dysplasia, Elbow disease, Heart disease and Eye disease The puppy is registered with a limited registration, which will prohibit breeding and registering offspring. The BUYER agrees this PUPPY is to be spayed/neutered at the appropriate age of (9-12 months) allowing for some sexual maturity of the pup which is necessary for their development. Veterinarian confirmation of this procedure must be supplied to the BREEDER by the time the pup is 1year of age or the contract is null and void.
    [Show full text]
  • Check-Point-2015-Security-Report
    2015 SECURITY REPORT CHECK POINT 2015 SECURITY REPORT 01 INTRODUCTION AND METHODOLOGY 04 02 UNKNOWN MALWARE: THE VAST UNKNOWN 10 03 KNOWN MALWARE: KNOWN AND DANGEROUS 18 04 MOBILE SECURITY: DON’T FENCE ME IN 32 05 APPLICATIONS: GETTING YOU WHERE IT HURTS 40 06 DATA LOSS: LIKE SAND THROUGH THE HOUR GLASS 48 07 CONCLUSION AND RECOMMENDATIONS: 56 THE PATH TO PROTECTION REFERENCES 60 CHECK POINT - 2015 SECURITY REPORT | 3 01 INTRODUCTION AND METHODOLOGY “The first time you do something, it’s science. The second time you do something, it’s engineering.” 1 –Clifford Stoll, astronomer, author, digital forensics pioneer CHECKINTRODUCTION POINT - 2015 AND SECURITY METHODOLOGY REPORT | 4 THE EVOLUTION OF MALWARE THE SECURITY LANDSCAPE | ACCELERATION OF OF MALWARE 25 YEARS AGO 20 YEARS AGO 15 YEARS AGO 10 YEARS AGO 5 YEARS AGO NOW Invention of Invention of Prevalent Use URL Filtering, NGFW Threat Intelligence, Firewall Stateful of Anti-Virus, UTM Threat Prevention, Inspection VPN, IPS Mobile Security > 1988 1994 1998 2003 2006 2010 2014 2020 Morris Worm Green Card Lottery Melissa Anonymous WikiLeaks DDoS Bitcoin IoT Everywhere Formed Attacks: Stuxnet SCADA 2000 2007 2013 2017 I Love You Zeus Trojan Dragonfly Driverless Cars Hacked? 2011 Stolen Authentication 2012 Information Flame Malware In science, it’s all about discovery—studying cause other mobile devices might not be tools, per se, but and effect. Once something is understood and can be they can be hijacked to give hackers the ability to predicted, it then becomes a process of engineering, penetrate corporate networks. to replicate. In the world of cyber threats, it’s the same.
    [Show full text]
  • Mission Accomplished? HTTPS Security After Diginotar
    Mission Accomplished? HTTPS Security after DigiNotar Johanna Amann* ICSI / LBL / Corelight Oliver Gasser* Technical University of Munich Quirin Scheitle* Technical University of Munich Lexi Brent The University of Sydney Georg Carle Technical University of Munich Ralph Holz The University of Sydney * Joint First Authorship Internet Measurement Conference (IMC) 2017 TLS/HTTPS Security Extensions • Certificate Transparency • HSTS (HTTP Strict Transport Security) • HPKP (HTTP Public Key Pinning) • SCSV (TLS Fallback Signaling Cipher Suite Value) • CAA (Certificate Authority Authorization) • DANE-TLSA (DNS Based Authentication of Named Entities) Methodology • Active & passive scans • Shared pipeline where possible • Active measurements from 2 continents • Largest Domain-based TLS scan so far • More than 192 Million domains • Passive measurements on 3 continents • More than 2.4 Billion observed TLS connections Certificate Transparency CA Issues Certificates Provides publicly auditable, append-only Log of certificates CT Log Also provides proof of inclusion Browser Verifies Proof of Inclusion Certificate Transparency CT Log CA Webserver Browser Certificate Transparency CT Log CA Certificate Webserver Browser Certificate Transparency CT Log CA Certificate Certificate Webserver Browser Certificate Transparency CT Log CA SCT Certificate Certificate Webserver Browser Certificate Transparency CT Log CA SCT Certificate Certificate Webserver Browser Certificate, SCT in TLS Ext. Certificate Transparency CT Log CA Webserver Browser Certificate Transparency Precertificate
    [Show full text]
  • Download This PDF File
    T G¨ P 2012 C N Deadline: December 31, 2011 The Gödel Prize for outstanding papers in the area of theoretical computer sci- ence is sponsored jointly by the European Association for Theoretical Computer Science (EATCS) and the Association for Computing Machinery, Special Inter- est Group on Algorithms and Computation Theory (ACM-SIGACT). The award is presented annually, with the presentation taking place alternately at the Inter- national Colloquium on Automata, Languages, and Programming (ICALP) and the ACM Symposium on Theory of Computing (STOC). The 20th prize will be awarded at the 39th International Colloquium on Automata, Languages, and Pro- gramming to be held at the University of Warwick, UK, in July 2012. The Prize is named in honor of Kurt Gödel in recognition of his major contribu- tions to mathematical logic and of his interest, discovered in a letter he wrote to John von Neumann shortly before von Neumann’s death, in what has become the famous P versus NP question. The Prize includes an award of USD 5000. AWARD COMMITTEE: The winner of the Prize is selected by a committee of six members. The EATCS President and the SIGACT Chair each appoint three members to the committee, to serve staggered three-year terms. The committee is chaired alternately by representatives of EATCS and SIGACT. The 2012 Award Committee consists of Sanjeev Arora (Princeton University), Josep Díaz (Uni- versitat Politècnica de Catalunya), Giuseppe Italiano (Università a˘ di Roma Tor Vergata), Mogens Nielsen (University of Aarhus), Daniel Spielman (Yale Univer- sity), and Eli Upfal (Brown University). ELIGIBILITY: The rule for the 2011 Prize is given below and supersedes any di fferent interpretation of the parametric rule to be found on websites on both SIGACT and EATCS.
    [Show full text]