Advanced Technological Education Program: 1995 Awards and Activities
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
New Security Threats Caused by IMS-Based SMS Service in 4G LTE Networks
New Security Threats Caused by IMS-based SMS Service in 4G LTE Networks ∗ ∗ Guan-Hua Tu Chi-Yu Li Chunyi Peng Michigan State University, National Chiao Tung Ohio State University East Lansing, MI, USA University, Columbus, OH, USA [email protected] Hsinchu City, Taiwan [email protected] [email protected] state.edu Yuanjie Li Songwu Lu University of California, University of California, Los Angeles, CA, USA Los Angeles, CA, USA [email protected] [email protected] ABSTRACT bank (e.g., Chase), apparel (e.g., A&F), courier (e.g., Fedex, UPS) SMS (Short Messaging Service) is a text messaging service for mo- and instant messaging application (e.g., Whatsapp), to name a few. bile users to exchange short text messages. It is also widely used to The success of the SMS-based approach stems from two rea- provide SMS-powered services (e.g., mobile banking). With the sons. First, the delivery of SMS messages within mobile networks rapid deployment of all-IP 4G mobile networks, the underlying protects confidentiality and integrity [21]. Though it has some se- technology of SMS evolves from the legacy circuit-switched net- curity issues (e.g., the unauthorized SMS messages sent by the work to the IMS (IP Multimedia Subsystem) system over packet- phone-side malware or the spoofed SMS messages sent from the switched network. In this work, we study the insecurity of the Internet), thanks to the efforts of research community and indus- IMS-based SMS. We uncover its security vulnerabilities and ex- try [8, 9, 15, 37, 43, 48, 49], they are well addressed in the 2G/3G ploit them to devise four SMS attacks: silent SMS abuse, SMS networks, at least for the top four largest US carriers. -
A Comparative Measurement Study of Web Tracking on Mobile and Desktop Environments
Proceedings on Privacy Enhancing Technologies ; 2020 (2):24–44 Zhiju Yang and Chuan Yue* A Comparative Measurement Study of Web Tracking on Mobile and Desktop Environments Abstract: Web measurement is a powerful approach to 1 Introduction studying various tracking practices that may compro- mise the privacy of millions of users. Researchers have Web tracking is frequently performed over the Internet built several measurement frameworks and performed by various trackers to collect the information of users’ a few studies to measure web tracking on the desk- browsing activities for various purposes including per- top environment. However, little is known about web sonalized advertisement, targeted attacks, and surveil- tracking on the mobile environment, and no tool is lance [12, 21, 32]. Traditionally, stateful HTTP cook- readily available for performing a comparative measure- ies are used as the dominant technique to track online ment study on mobile and desktop environments. In this users [27]. In recent years, advanced stateful tracking work, we built a framework called WTPatrol that allows techniques such as Flash cookies and advanced stateless us and other researchers to perform web tracking mea- tracking techniques such as browser or device finger- surement on both mobile and desktop environments. printing have also become very popular over the Inter- Using WTPatrol, we performed the first comparative net [1, 3, 24, 30]. User privacy has been keeping com- measurement study of web tracking on 23,310 websites promised by trackers that utilize these techniques. that have both mobile version and desktop version web- Web measurement is a powerful approach to study- pages. We conducted an in-depth comparison of the web ing online tracking practices and techniques. -
A Comprehensive Evaluation of Third-Party Cookie Policies
Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies Gertjan Franken, Tom Van Goethem, and Wouter Joosen, imec-DistriNet, KU Leuven https://www.usenix.org/conference/usenixsecurity18/presentation/franken This paper is included in the Proceedings of the 27th USENIX Security Symposium. August 15–17, 2018 • Baltimore, MD, USA ISBN 978-1-939133-04-5 Open access to the Proceedings of the 27th USENIX Security Symposium is sponsored by USENIX. Who Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies Gertjan Franken Tom Van Goethem Wouter Joosen imec-DistriNet, KU Leuven imec-DistriNet, KU Leuven imec-DistriNet, KU Leuven Abstract ing domain, allowing users to remain logged in to a web- site without having to re-enter their credentials. Nowadays, cookies are the most prominent mechanism Despite their significant merits, the way cookies are to identify and authenticate users on the Internet. Al- implemented in most modern browsers also introduces though protected by the Same Origin Policy, popular a variety of attacks and other unwanted behavior. More browsers include cookies in all requests, even when these precisely, because cookies are attached to every request, are cross-site. Unfortunately, these third-party cookies including third-party requests, it becomes more difficult enable both cross-site attacks and third-party tracking. for websites to validate the authenticity of a request. As a response to these nefarious consequences, various Consequently, an attacker can trigger requests with a ma- countermeasures have been developed in the form of licious payload from the browser of an unknowing vic- browser extensions or even protection mechanisms that tim. -
Giant List of Mobile Browsers
Giant List of Mobile Browsers We are quickly moving towards a mobile world, with people increasingly accessing the internet exclusively on their devices. As mobile surfing is still relatively new compared to desktop, their browser wars are just beginning. Soon the blockchain will get involved & that will open up the field even further. Pick your pony now. 1. 360 Security http://www.360securityapps.com 2. ABC Browser Pro https://play.google.com/store/apps/details?id=com.fchatnet.minibrowser 3. Aloha https://alohabrowser.com 4. Amazon Silk https://www.amazon.com/Amazon-com-Amazon-Silk-Web-Browser/dp/B01M35MQV4 5. APUS Browser https://play.google.com/store/apps/details?id=com.apusapps.browser 6. Baidu Mobile https://mobile.baidu.com 7. Best Browser https://play.google.com/store/apps/details?id=org.zbrowser.ui.activities 8. BlackBerry Access https://www.blackberry.com/us/en/products/apps/blackberry-dynamics-apps/blackberry-access/overview 9. Blazer https://play.google.com/store/apps/details?id=com.mdjsoftware.download 10. Bolt http://www.boltbrowser.com 11. Brave https://brave.com/download 12. Browser for Android https://play.google.com/store/apps/details?id=org.easyweb.browser 13. Cake https://cakebrowser.com 14. Cameleon Privacy AdBlock & Float Browser https://play.google.com/store/apps/details?id=work.ionut.browser 15. Chrome https://play.google.com/store/apps/details?id=com.android.chrome 16. Cliqz https://cliqz.com/en/mobile 17. CM Browser https://www.cmcm.com/en-us/cm-browser 18. Cosmic https://play.google.com/store/apps/details?id=com.cosmic.webbrowser 19. Cosmic Privacy https://play.google.com/store/apps/details?id=com.cosmic.privacybrowser 20. -
Privacy-Preserving Classification with Secret Vector Machines
Privacy-Preserving Classification with Secret Vector Machines Valentin Hartmann Konark Modi EPFL Cliqz [email protected] [email protected] Josep M. Pujol Robert West Cliqz EPFL [email protected] [email protected] ABSTRACT The classical way of building the necessary prediction model Today, large amounts of valuable data are distributed among mil- would be to collect the users’ data on a central server and then lions of user-held devices, such as personal computers, phones, or run a machine learning algorithm on it. But this comes with severe Internet-of-things devices. Many companies collect such data with disadvantages. First, the user has to put the necessary trust in the goal of using it for training machine learning models allowing the data-collecting entity. Even in case of trust, the relationship them to improve their services. However, user-held data is often between the two parties is very imbalanced; new regulations such as sensitive, and collecting it is problematic in terms of privacy. the European Union’s General Data Protection Regulation (GDPR) We address this issue by proposing a novel way of training a [12] and e-privacy frameworks try to rebalance the relationship supervised classifier in a distributed setting akin to the recently to be more fair. But still, even in the case of perfect regulation, proposed federated learning paradigm [26], but under the stricter the collection of user data incurs a privacy risk. There are many privacy requirement that the server that trains the model is as- ways in which privacy could be compromised: hacks leading to sumed to be untrusted and potentially malicious; we thus preserve a data breach [40], disgruntled or unethical employees that use user privacy by design, rather than by trust. -
Addressing Denial of Service Attacks on Free and Open Communication on the Internet — Interim Report 1 —
Addressing Denial of Service Attacks on Free and Open Communication on the Internet — Interim Report 1 — Antonela Debiasi, Roger Dingledine, Arthur Edelstein, Alexander Færøy, Matthew Finkel, David Goulet, Kat Hanna, Maggie Haughey, George Kadianakis, Iain R. Learmonth, Alison Macrina, and Maria Xynou [email protected] Tor Tech Report 2018-11-001 November 19, 2018 Contents 1 Introduction 2 1.1 About Tor............................................3 1.2 Tor and censorship......................................4 2 Better Pluggable Transports for Actively Censored Regimes4 2.1 Bridge distribution and pluggable transports......................4 2.1.1 Bridge distribution..................................5 2.1.2 Pluggable transports.................................5 2.1.3 Designing new pluggable transports.......................8 2.2 Tor Browser and pluggable transports..........................8 2.2.1 Tor Browser......................................8 2.2.2 Tor Browser for Android.............................. 11 3 Beyond Web Browsing 14 3.1 Existing apps that use Tor.................................. 14 3.1.1 Web browsers..................................... 14 3.1.2 Using mobile apps with the Tor network.................... 14 3.1.3 Communications................................... 14 3.1.4 Secure operating systems.............................. 15 3.1.5 Monitoring tools................................... 15 3.1.6 File sharing...................................... 15 3.2 Applications for users under censorship......................... 16 This -
Arxiv:2008.04480V1 [Cs.CR] 11 Aug 2020
Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors Umar Iqbal Steven Englehardt Zubair Shafiq The University of Iowa Mozilla Corporation University of California, Davis Abstract—Browser fingerprinting is an invasive and opaque must be continually updated to capture evolving fingerprinting stateless tracking technique. Browser vendors, academics, and and non-fingerprinting behaviors. standards bodies have long struggled to provide meaningful We propose FP-INSPECTOR, a machine learning based protections against browser fingerprinting that are both ac- curate and do not degrade user experience. We propose FP- approach to detect browser fingerprinting. FP-INSPECTOR INSPECTOR, a machine learning based syntactic-semantic ap- trains classifiers to learn fingerprinting behaviors by extracting proach to accurately detect browser fingerprinting. We show syntactic and semantic features through a combination of static that FP-INSPECTOR performs well, allowing us to detect 26% and dynamic analysis that complement each others’ limita- more fingerprinting scripts than the state-of-the-art. We show tions. More specifically, static analysis helps FP-INSPECTOR that an API-level fingerprinting countermeasure, built upon overcome the coverage issues of dynamic analysis, while FP-INSPECTOR, helps reduce website breakage by a factor of 2. We use FP-INSPECTOR to perform a measurement study dynamic analysis overcomes the inability of static analysis to of browser fingerprinting on top-100K websites. We find that handle obfuscation. browser fingerprinting is now present on more than 10% of the Our evaluation shows that FP-INSPECTOR detects fin- top-100K websites and over a quarter of the top-10K websites. We gerprinting scripts with 99.9% accuracy. We find that FP- also discover previously unreported uses of JavaScript APIs by fingerprinting scripts suggesting that they are looking to exploit INSPECTOR detects 26% more fingerprinting scripts than APIs in new and unexpected ways. -
New Security Threats Caused by IMS-Based SMS Service in 4G LTE Networks
New Security Threats Caused by IMS-based SMS Service in 4G LTE Networks ∗ ∗ Guan-Hua Tu Chi-Yu Li Chunyi Peng Michigan State University, National Chiao Tung Ohio State University East Lansing, MI, USA University, Columbus, OH, USA [email protected] Hsinchu City, Taiwan [email protected] [email protected] state.edu Yuanjie Li Songwu Lu University of California, University of California, Los Angeles, CA, USA Los Angeles, CA, USA [email protected] [email protected] ABSTRACT bank (e.g., Chase), apparel (e.g., A&F), courier (e.g., Fedex, UPS) SMS (Short Messaging Service) is a text messaging service for mo- and instant messaging application (e.g., Whatsapp), to name a few. bile users to exchange short text messages. It is also widely used to The success of the SMS-based approach stems from two rea- provide SMS-powered services (e.g., mobile banking). With the sons. First, the delivery of SMS messages within mobile networks rapid deployment of all-IP 4G mobile networks, the underlying protects confidentiality and integrity [21]. Though it has some se- technology of SMS evolves from the legacy circuit-switched net- curity issues (e.g., the unauthorized SMS messages sent by the work to the IMS (IP Multimedia Subsystem) system over packet- phone-side malware or the spoofed SMS messages sent from the switched network. In this work, we study the insecurity of the Internet), thanks to the efforts of research community and indus- IMS-based SMS. We uncover its security vulnerabilities and ex- try [8, 9, 15, 37, 43, 48, 49], they are well addressed in the 2G/3G ploit them to devise four SMS attacks: silent SMS abuse, SMS networks, at least for the top four largest US carriers. -
Browser Fingerprinting: a Survey
Browser Fingerprinting: A survey PIERRE LAPERDRIX, CNRS, Univ Lille, Inria Lille, France NATALIIA BIELOVA, Inria Sophia Antipolis, France BENOIT BAUDRY, KTH Royal Institute of Technology, Sweden GILDAS AVOINE, Univ Rennes, INSA Rennes, CNRS, IRISA, France With this paper, we survey the research performed in the domain of browser fingerprinting, while providing an accessible entry point to newcomers in the field. We explain how this technique works and where itstems from. We analyze the related work in detail to understand the composition of modern fingerprints and see how this technique is currently used online. We systematize existing defense solutions into different categories and detail the current challenges yet to overcome. CCS Concepts: • Security and privacy → Web application security; Browser security; Privacy protec- tions; Additional Key Words and Phrases: Browser fingerprinting, user privacy, web tracking 1 INTRODUCTION The web is a beautiful platform and browsers give us our entry point into it. With the introduction of HTML5 and CSS3, the web has become richer and more dynamic than ever and it has now the foundations to support an incredible ecosystem of diverse devices from laptops to smartphones and tablets. The diversity that is part of the modern web opened the door to device fingerprinting, a simple identification technique that can be used to collect a vast list of device characteristics on several layers of the system. As its foundations are rooted into the origin of the web, browser fingerprinting cannot be fixed with a simple patch. Clients and servers have been sharing device- specific information since the beginning to improve user experience.