DOCSLIB.ORG

Minicursos Do XIV Simpósio Em Segurança Da

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Minicursos Do XIV Simpósio Em Segurança Da SBSeg 2014 - Belo Horizonte, MG XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais de 3 a 6 de Novembro de 2014 – Belo Horizonte, MG MINICURSOS Editora Sociedade Brasileira de Computação – SBC Organizadores Jeroen van de Graaf, UFMG José Marcos Nogueira, UFMG Leonardo Barbosa Oliveira, UFMG Realização Universidade Federal de Minas Gerais – UFMG Promoção Sociedade Brasileira de Computação – SBC Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Copyright © 2014 Sociedade Brasileira de Computação Todos os direitos reservados Edição: Vitor Mendes Paisante Dados Internacionais de Catalogação na Publicação S612 Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais (14. : 2014 : Belo Horizonte) Minicursos / XIV Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais ; coordenação: Jeroen van de Graaf, José Marcos Nogueira, Leonardo Barbosa Oliveira — Porto Alegre: Sociedade Brasileira de Computação, 2014. vii, 204 p. il. 23 cm. Vários autores Inclui bibliografias ISBN: 978-85-7669-275-1 1. Ciência da computação. 2. Informática. 3. Segurança da informação. 4. Segurança de sistemas. I. Graaf, Jeroen. II. Nogueira, José. III. Oliveira, Leonardo. IV. Título. CDU 004(063) ii Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Sociedade Brasileira de Computação – SBC Presidência Paulo Roberto Freire Cunha (UFPE), Presidente Lisandro Zambenedetti Granville (UFRGS), Vice-Presidente Diretorias Renata de Matos Galante (UFRGS), Diretora Administrativa Carlos André Guimarães Ferraz (UFPE), Diretor de Finanças Altigran Soares da Silva (UFAM), Diretor de Eventos e Comissões Especiais Mirella Moura Moro (UFMG), Diretora de Educação José Viterbo Filho (UFF), Diretor de Publicações Claudia Lage R. da Motta (UFRJ), Diretora de Planejamento e Programas Especiais Marcelo Duduchi Feitosa (CEETEPS), Diretora de Secretarias Regionais Edson Norberto Cáceres (UFMS), Diretor de Divulgação e Marketing Diretorias Extraordinárias Roberto da Silva Bigonha (UFMG), Diretor de Relações Profissionais Ricardo de Oliveira Anido (UNICAMP), Diretor de Competições Científicas Raimundo Macêdo (UFBA), Diretor de Cooperação com Sociedades Científicas Avelino Francisco Zorzo (PUC-RS), Diretor de Articulação de Empresas Contato Av. Bento Gonçalves, 9500 Setor 4 - Prédio 43.412 - Sala 219 Bairro Agronomia 91.509-900 – Porto Alegre RS CNPJ: 29.532.264/0001-78 http://www.sbrc.org.br iii Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 •Alberto Egon Schaeffer Filho (UFRGS) Comitês do SBSeg •Aldri dos Santos (UFPR) •Altair Santin (PUC-PR) 2014 •Anderson Nascimento (UnB) •André dos Santos (UECE) Comitê de Organização •André Gregio (CTI) •Antonio Augusto de Aragão Rocha Coordenação Geral (UFF) •Jeroen van de Graaf (UFMG) •Arlindo L. Marcon Jr. (IFPR) •José Marcos Nogueira (UFMG) •Carla Merkle Westphall (UFSC) •Leonardo B. Oliveira (UFMG) •Carlos Maziero (UTFPR) •Carlos Westphall (UFSC) Coordenação do Comitê de •Célio Albuquerque (UFF) Programa •Diego de Freitas Aranha (UNICAMP) •Diego F. Aranha (UNICAMP) •Djamel Fawzi Hadj Sadok (UFPE) •Marinho P. Barcellos (UFRGS) •Eduardo Feitosa (UFAM) Coordenadores do CTD •Eduardo Souto (UFAM) •Aldri Santos (UFPR) •Emerson Ribeiro de Mello (IFSC) •Anderson do Nascimento (UNB) •Eulanda Miranda dos Santos (UFAM) Coordenador do FSC •Fernando Magno Quintao (UFMG) •Pericles Luz •Hao Chi Wong (Intel) •Jean Martina (UFSC) Coordenador de Minicursos •Jeroen van de Graaf (UFMG) •André dos Santos (UECE) •Joaquim Celestino Júnior (UECE) Coordenador de Palestras e •Joni da Silva Fraga (UFSC) Tutoriais •Julio López (UNICAMP) •Michele Nogueira (UFPR) •Lau Cheuk Lung (UFSC) Coordenadores do WFC •Leonardo B. Oliveira (UFMG) •Cinthia Freitas (PUCPR) •Lisandro Zambenedetti Granville •William Robson Schwartz (UFMG) (UFRGS) •Luciano Paschoal Gaspary (UFRGS) Coordenador do WGID •Luiz Carlos Albini (UFPR) •Marco Aurélio Amaral Henriques •Luiz Fernando Rust da Costa Carmo (UNICAMP) (UFRJ) Coordenadores do WTE •Marcos Simplicio (Poli-USP) •Diego F. Aranha (UNB) •Marinho P. Barcellos (UFRGS) •Jeroen van de Graaf (UFMG) •Mário Alvim (UFMG) Coordenador do WTICG •Michele Nogueira (UFPR) •Eduardo Souto (UFAM) •Michelle Wangham (UNIVALI) Publicidade •Paulo André da Silva Gonçalves •Mário S. Alvim (UFMG) (UFPE) •Paulo Lício de Geus (UNICAMP) •Paulo S. L. M. Barreto (Poli-USP) Comitê de Programa •Pedro Velloso (UFF) •Adriano Cansian (UNESP) •Raul Ceretta Nunes (UFSM) iv Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 •Raul Weber (UFRGS) •Ricardo Custódio (UFSC) •Ricardo Dahab (UNICAMP) •Roberto Gallo (KRYPTUS) •Routo Terada (USP) •Ruy José Guerra Barretto de Queiroz (UFPE) •Sergio de Oliveira (UFSJ) CESeg Coordenadores •Anderson C. A. Nascimento (UnB, coordenador) •Aldri L. Dos Santos (UFPR, vice) Comitê consultivo •Anderson Clayton Alves Nascimento (UnB) •Aldri Luiz dos Santos (UFPR) •Jeroen van de Graaf (UFMG) •Ricardo Dahab (UNICAMP) •Altair Santin (PUC-PR) •Eduardo Souto (UFAM) •Raul Ceretta Nunes (UFSM) •Michele Nogueira (UFPR) •Diego Aranha (UNICAMP) Colaboradores •Artur Luis (UFMG) •Júlia Terra (UFMG) •Vitor Paisante (UFMG) v Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Mensagem do Coordenador de Minicursos O Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais (SBSeg) é um evento científico promovido anualmente pela Sociedade Brasileira de Computação (SBC), o qual representa o principal fórum no país para a apresentação de pesquisas e atividades relevantes ligadas à segurança da informação e de sistemas, integrando a comunidade brasileira de pesquisadores e profissionais atuantes nessa área. Entre as principais atividades técnicas do SBSeg encontram-se os minicursos, que têm como objetivo a atualização em temas normalmente não cobertos nas grades curriculares e que despertem grande interesse entre acadêmicos e profissionais. Nesta edição do SBSeg 2014, de um total de 10 submissões de propostas de minicursos foram selecionados quatro minicursos, representando assim uma taxa de aceitação de 40%. O Comitê de Programa foi composto por 11 pesquisadores para a elaboração das revisões, sendo cada proposta avaliada por, pelo menos, 3 desses especialistas. Este livro reúne então 4 capítulos produzidos pelos autores das propostas de minicursos aceitas. O Capítulo 1 mostra o estado da arte em sistemas de armazenamento nas nuvens que sejam tolerantes a faltas e intrusões; O Capítulo 2, discute as técnicas de device fingerprint que são aquelas empregadas para identificar (ou re-identificar) um usuário ou um dispositivo através de um conjunto de atributos (tamanho da tela do dispositivo, versões de softwares instalados, entre muitos outros) e outras características observáveis durante processo de comunicação; O Capítulo 3 apresenta métodos e ferramentas de detecção de botnets; Por fim, o Capítulo 4 analisa os desafios de segurança e as principais contramedidas descritas em trabalhos acadêmicos sobre as inovações das redes veiculares. Meus sinceros agradecimentos aos membros da Comissão de Avaliação dos Minicursos do SBSeg 2014 por sua colaboração voluntária e dedicação, lembrando que o sucesso dos minicursos deve ser creditado ao trabalho conjunto desta equipe. Também gostaria de agradecer aos autores que submeteram suas propostas de minicursos e que nos motivam a realizar anualmente este evento de interesse, visibilidade e sucesso crescentes. Finalmente, não poderia de deixar de expressar também os meus sinceros agradecimentos aos coordenadores gerais do SBSeg 2014, Jeroen van de Graaf (UFMG), José Marcos Nogueira (UFMG) e Leonardo B. Oliveira (UFMG) por confiarem a mim a tarefa de conduzir os minicursos e pela disponibilidade e orientações providas ao longo do processo. vi Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Aproveito esta mensagem para saudar a todos os participantes dos Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais com os votos de um excelente curso e de uma excelente estadia em Belo Horizonte! Belo Horizonte, novembro de 2014. André Luiz Moura dos Santos (Universidade Estadual do Ceará) Coordenador dos Minicursos do SBSeg 2014 vii Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Sumário 1. Tolerância a Faltas e Intrusões para Sistemas de Armazenamento de Dados em Nuvens Computacionais Hylson Vescovi Netto Lau Cheuk Lung Rick Lopes de Souza . 2 2. Device Fingerprinting: Conceitos e Técnicas, Exemplos e Contramedidas Adriana Rodrigues Saraiva Pablo Augusto da Paz Elleres Guilherme de Brito Carneiro Eduardo Luzeiro Feitosa . 49 3. Botnets: Características e Métodos de Detecção Através do Tráfego de Rede Kaio R. S. Barbosa Gilbert B. Martins Eduardo Souto Eduardo Feitosa . 99 4. Segurança em Redes Veiculares: Inovações e Direções Futuras Michelle S. Wangham Michele Nogueira Cláudio P. Fernandes Osmarildo Paviani Benevid F. da Silva . 145 viii SBSeg 2014 — Belo Horizonte, MG XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Minicursos do XIV Simpósio Brasileiro em Segurança da Informação e de Sistemas Computacionais — SBSeg 2014 Capítulo 1 Tolerância a Faltas e Intrusões para Sistemas
Load more

Recommended publications
  • The Web Never Forgets: Persistent Tracking Mechanisms in the Wild
    The Web Never Forgets: Persistent Tracking Mechanisms in the Wild Gunes Acar1, Christian Eubank2, Steven Englehardt2, Marc Juarez1 Arvind Narayanan2, Claudia Diaz1 1KU Leuven, ESAT/COSIC and iMinds, Leuven, Belgium {name.surname}@esat.kuleuven.be 2Princeton University {cge,ste,arvindn}@cs.princeton.edu ABSTRACT 1. INTRODUCTION We present the first large-scale studies of three advanced web tracking mechanisms — canvas fingerprinting, evercookies A 1999 New York Times article called cookies compre­ and use of “cookie syncing” in conjunction with evercookies. hensive privacy invaders and described them as “surveillance Canvas fingerprinting, a recently developed form of browser files that many marketers implant in the personal computers fingerprinting, has not previously been reported in the wild; of people.” Ten years later, the stealth and sophistication of our results show that over 5% of the top 100,000 websites tracking techniques had advanced to the point that Edward employ it. We then present the first automated study of Felten wrote “If You’re Going to Track Me, Please Use Cook­ evercookies and respawning and the discovery of a new ev­ ies” [18]. Indeed, online tracking has often been described ercookie vector, IndexedDB. Turning to cookie syncing, we as an “arms race” [47], and in this work we study the latest present novel techniques for detection and analysing ID flows advances in that race. and we quantify the amplification of privacy-intrusive track­ The tracking mechanisms we study are advanced in that ing practices due to cookie syncing. they are hard to control, hard to detect and resilient Our evaluation of the defensive techniques used by to blocking or removing.
    [Show full text]
  • A the Hacker
    A The Hacker Madame Curie once said “En science, nous devons nous int´eresser aux choses, non aux personnes [In science, we should be interested in things, not in people].” Things, however, have since changed, and today we have to be interested not just in the facts of computer security and crime, but in the people who perpetrate these acts. Hence this discussion of hackers. Over the centuries, the term “hacker” has referred to various activities. We are familiar with usages such as “a carpenter hacking wood with an ax” and “a butcher hacking meat with a cleaver,” but it seems that the modern, computer-related form of this term originated in the many pranks and practi- cal jokes perpetrated by students at MIT in the 1960s. As an example of the many meanings assigned to this term, see [Schneier 04] which, among much other information, explains why Galileo was a hacker but Aristotle wasn’t. A hack is a person lacking talent or ability, as in a “hack writer.” Hack as a verb is used in contexts such as “hack the media,” “hack your brain,” and “hack your reputation.” Recently, it has also come to mean either a kludge, or the opposite of a kludge, as in a clever or elegant solution to a difficult problem. A hack also means a simple but often inelegant solution or technique. The following tentative definitions are quoted from the jargon file ([jargon 04], edited by Eric S. Raymond): 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.
    [Show full text]
  • Zeszyty T 13 2018 Tytulowa I Redakcyjna
    POLITECHNIKA KOSZALIŃSKA Zeszyty Naukowe Wydziału Elektroniki i Informatyki Nr 13 KOSZALIN 2018 Zeszyty Naukowe Wydziału Elektroniki i Informatyki Nr 13 ISSN 1897-7421 ISBN 978-83-7365-501-0 Przewodniczący Uczelnianej Rady Wydawniczej Zbigniew Danielewicz Przewodniczący Komitetu Redakcyjnego Aleksy Patryn Komitet Redakcyjny Krzysztof Bzdyra Walery Susłow Wiesław Madej Józef Drabarek Adam Słowik Strona internetowa https://weii.tu.koszalin.pl/nauka/zeszyty-naukowe Projekt okładki Tadeusz Walczak Skład, łamanie Maciej Bączek © Copyright by Wydawnictwo Uczelniane Politechniki Koszalińskiej Koszalin 2018 Wydawnictwo Uczelniane Politechniki Koszalińskiej 75-620 Koszalin, ul. Racławicka 15-17 Koszalin 2018, wyd. I, ark. wyd. 5,72, format B-5, nakład 100 egz. Druk: INTRO-DRUK, Koszalin Spis treści Damian Giebas, Rafał Wojszczyk ..................................................................................................................................................... 5 Zastosowanie wybranych reprezentacji graficznych do analizy aplikacji wielowątkowych Grzegorz Górski, Paweł Koziołko ...................................................................................................................................................... 27 Semantyczne ataki na aplikacje internetowe wykorzystujące język HTML i arkusze CSS Grzegorz Górski, Paweł Koziołko ..................................................................................................................................................... 37 Analiza skuteczności wybranych metod
    [Show full text]
  • Stuxnet : Analysis, Myths and Realities
    ACTUSÉCU 27 XMCO David Helan STUXNET : ANALYSIS, MYTHS AND REALITIES CONTENTS Stuxnet: complete two-part article on THE virus of 2010 Keyboard Layout: analysis of the MS10-073 vulnerability used by Stuxnet Current news: Top 10 hacking techniques, zero-day IE, Gsdays 2010, ProFTPD... Blogs, softwares and our favorite Tweets... This document is the property of XMCO Partners. Any reproduction is strictly prohibited. !!!!!!!!!!!!!!!!! [1] Are you concerned by IT security in your company? ACTU SÉCU 27 XMCO Partners is a consultancy whose business is IT security audits. Services: Intrusion tests Our experts in intrusion can test your networks, systems and web applications Use of OWASP, OSSTMM and CCWAPSS technologies Security audit Technical and organizational audit of the security of your Information System Best Practices ISO 27001, PCI DSS, Sarbanes-Oxley PCI DSS support Consulting and auditing for environments requiring PCI DSS Level 1 and 2 certification. CERT-XMCO: Vulnerability monitoring Personalized monitoring of vulnerabilities and the fixes affecting your Information System CERT-XMCO: Response to intrusion Detection and diagnosis of intrusion, collection of evidence, log examination, malware autopsy About XMCO Partners: Founded in 2002 by experts in security and managed by its founders, we work in the form of fixed-fee projects with a commitment to achieve results. Intrusion tests, security audits and vulnerability monitoring are the major areas in which our firm is developing. At the same time, we work with senior management on assignments providing support to heads of information- systems security, in drawing up master plans and in working on awareness-raising seminars with several large French accounts.
    [Show full text]
  • Tracking the Cookies a Quantitative Study on User Perceptions About Online Tracking
    Bachelor of Science in Computer Science Mars 2019 Tracking the cookies A quantitative study on user perceptions about online tracking. Christian Gribing Arlfors Simon Nilsson Faculty of Computing, Blekinge Institute of Technology, 371 79 Karlskrona, Sweden This thesis is submitted to the Faculty of Computing at Blekinge Institute of Technology in partial fulfilment of the requirements for the degree of Bachelor of Science in Computer Science. The thesis is equivalent to 20 weeks of full time studies. The authors declare that they are the sole authors of this thesis and that they have not used any sources other than those listed in the bibliography and identified as references. They further declare that they have not submitted this thesis at any other institution to obtain a degree. Contact Information: Author(s): Christian Gribing Arlfors E-mail: [email protected] Simon Nilsson E-mail: [email protected] University advisor: Fredrik Erlandsson Department of Computer Science Faculty of Computing Internet : www.bth.se Blekinge Institute of Technology Phone : +46 455 38 50 00 SE–371 79 Karlskrona, Sweden Fax : +46 455 38 50 57 Abstract Background. Cookies and third-party requests are partially implemented to en- hance user experience when traversing the web, without them the web browsing would be a tedious and repetitive task. However, their technology also enables com- panies to track users across the web to see which sites they visit, which items they buy and their overall browsing habits which can intrude on users privacy. Objectives. This thesis will present user perceptions and thoughts on the tracking that occurs on their most frequently visited websites.
    [Show full text]
  • PLTW Computer Science Principles
    Computer Science Virtual Learning PLTW Computer Science Principles April 29, 2020 Computer Science Principles Lesson: April 29, 2020 Learning Target: The goal of this lesson is for students to personally invest in maintaining online security and to improve their personal cybersecurity hygiene. Students focus on cybersecurity from the perspectives of the user, the software developer, businesses, the nation, and the citizen. Introduction With current health crisis, now like no other time in history, our nation has a dire need for people – as employees, citizens, and consumers–to practice good hygiene, hand washing, etc. But what does cyber-hygiene that mean? Why is it so important? What are the worst-case consequences of not practicing good cyber-hygiene? Write your thoughts in your notebook and discuss your ideas with your family and friends. Watch this Video: What is Cyber-Hygiene? Practice:Cyber-Ethics Consider the following two scenarios. In each scenario, decide if Rob has behaved unethically. If his action was unethical, explain why and describe what you think the consequences might be. If his action was ethical, describe what additional actions would have crossed the line into unethical behavior. Write your thoughts for each scenario in your notebook. Compare your answers with the links provided Practice:Cyber-Ethics Scenario 1 Rob is sitting next to Tanya, who is entering a password on a website. Rob watches her type and memorizes her password. He uses it once to see if it really was her password and immediately logs out. He never uses it again. Compare your answers here Practice:Cyber-Ethics Scenario 2 Rob is given access to a computing network.
    [Show full text]
  • On the Privacy Implications of Real Time Bidding
    On the Privacy Implications of Real Time Bidding A Dissertation Presented by Muhammad Ahmad Bashir to The Khoury College of Computer Sciences in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Science Northeastern University Boston, Massachusetts August 2019 To my parents, Javed Hanif and Najia Javed for their unconditional support, love, and prayers. i Contents List of Figures v List of Tables viii Acknowledgmentsx Abstract of the Dissertation xi 1 Introduction1 1.1 Problem Statement..................................3 1.1.1 Information Sharing Through Cookie Matching...............3 1.1.2 Information Sharing Through Ad Exchanges During RTB Auctions....5 1.2 Contributions.....................................5 1.2.1 A Generic Methodology For Detecting Information Sharing Among A&A companies..................................6 1.2.2 Transparency & Compliance: An Analysis of the ads.txt Standard...7 1.2.3 Modeling User’s Digital Privacy Footprint..................9 1.3 Roadmap....................................... 10 2 Background and Definitions 11 2.1 Online Display Advertising.............................. 11 2.2 Targeted Advertising................................. 13 2.2.1 Online Tracking............................... 14 2.2.2 Retargeted Ads................................ 14 2.3 Real Time Bidding.................................. 14 2.3.1 Overview................................... 15 2.3.2 Cookie Matching............................... 16 2.3.3 Advertisement Served via RTB.......................
    [Show full text]
  • Anti-Virus Issues, Malicious Software and Internet Attacks for Non-Technical Audiences
    Known Knowns, Known Unknowns and Unknown Unknowns: Anti-virus issues, malicious software and Internet attacks for non-technical audiences By Daniel Bilar Introduction [Heading] The risks associated with the internet have changed significantly. A recent study claims that a typical Microsoft Windows machine is subjected to autonomous infiltration attempts - not just mere pings and probes - from worms and botnets looking for clients once every six minutes.1 Stealth – not exhibitionism or hubris – characterizes this breed of attacks and concomitantly deployed malicious software. Unbeknownst even to experienced human operators, surreptitious attacks are able to insert malicious code deep within the bowels of individual computers and the wider supporting internet communication and control infrastructure such as wireless access points, home routers, and domain name servers.2 In addition to stealth, social engineering via e-mail, Instant 1 Gabor Szappanos, ‘A Day in the Life of An Average User’, Virus Bulletin, January 2009, 10-13, available at http://www.virusbtn.com/. 2 Most users do not bother to change the default passwords on home devices such as routers. Browser vulnerabilities can then be exploited by malicious software to alter the DNS settings of the router, thereby directing any name lookup query to a DNS of the attacker’s choice. This may be used to spoof a bank web site, for instance. See Sid Stamm, Zulfikar Ramzan and Markus Jakobsson, ‘Drive-By Pharming’, Lecture Notes in Computer Science 4861, (Springer, 2007), 495-506 and Hristo Bojinov, Elie Bursztein, Eric Lovett and Dan Boneh, ‘Embedded Management Interfaces: Emerging Massive Insecurity’, Blackhat Technical Briefing, Blackhat USA 2009 (Las Vegas, USA, August 2009), available at http://www.blackhat.com/presentations/bh-usa- 09/BOJINOV/BHUSA09-Bojinov-EmbeddedMgmt-PAPER.pdf.
    [Show full text]
  • Security and Privacy Implications of Third-Party Access to Online Social Networks
    Die approbierte Originalversion dieser Dissertation ist in der Hauptbibliothek der Technischen Universität Wien aufgestellt und zugänglich. http://www.ub.tuwien.ac.at The approved original version of this thesis is available at the main library of the Vienna University of Technology. http://www.ub.tuwien.ac.at/eng Security and Privacy Implications of Third-Party Access to Online Social Networks PhD THESIS submitted in partial fulfillment of the requirements of Doctor of Technical Sciences within the Vienna PhD School of Informatics by Markus Huber, M.Sc. Registration Number 0306665 to the Faculty of Informatics at the Vienna University of Technology Advisor: Privatdoz. Dipl.-Ing. Mag.rer.soc.oec. Dr.techn. Edgar Weippl Second advisor: o.Univ.Prof. Dipl.Ing. Dr. A Min Tjoa External reviewers: Assoc. Prof. Dr. Engin Kirda. Northeastern University, USA. Prof. Dr. Stefan Katzenbeisser. Technische Universität Darmstadt, Germany. Wien, 27.08.2013 (Signature of Author) (Signature of Advisor) Technische Universität Wien A-1040 Wien Karlsplatz 13 Tel. +43-1-58801-0 www.tuwien.ac.at Declaration of Authorship Markus Huber, M.Sc. Burggasse 102/8, AT-1070 Vienna, Austria I hereby declare that I have written this Doctoral Thesis independently, that I have com- pletely specified the utilized sources and resources and that I have definitely marked all parts of the work - including tables, maps and figures - which belong to other works or to the internet, literally or extracted, by referencing the source as borrowed. (Vienna, 27/08/2013) (Signature of Author) i Acknowledgements I am grateful to my supervisor Edgar R. Weippl for his excellent mentoring over the course of my postgraduate studies and for giving me the freedom to pursue my own research ideas.
    [Show full text]
  • Protecting Consumer Privacy in an Era of Rapid Change: a Proposed Framework for Businesses and Policymakers
    A PROPOSED FRAMEWORK FOR BUSINESSES AND POLICYMAKERS PRELIMINARY FTC STAFF REPORT FEDERAL TRADE COMMISSION | DECEMBER 2010 A PROPOSED FRAMEWORK FOR BUSINESSES AND POLICYMAKERS PRELIMINARY FTC STAFF REPORT DECEMBER 2010 TABLE OF CONTENTS EXECUTIVE SUMMARY...................................................... i I. INTRODUCTION .......................................................1 II. BACKGROUND ........................................................3 A. Privacy and the FTC ...............................................3 1. The FTC Approach to Fair Information Practice Principles...........6 2. Harm-Based Approach .......................................9 B. Recent Privacy Initiatives ..........................................12 1. Enforcement...............................................12 2. Consumer and Business Education .............................13 3. Policymaking and Research...................................14 4. International Activities ......................................17 III. RE-EXAMINATION OF THE COMMISSION’S PRIVACY APPROACH .........19 A. Limitations of the FTC’s Existing Privacy Models.......................19 B. Technological Changes and New Business Models ......................21 IV. PRIVACY ROUNDTABLES .............................................22 A. Description. .....................................................22 B. Major Themes and Concepts from the Roundtables ......................22 1. Increased Collection and Use of Consumer Data ..................23 2. Lack of Understanding Undermines Informed
    [Show full text]
  • PINPOINTING TARGETS: Exploiting Web Analytics to Ensnare Victims
    SPECIAL REPORT FIREEYE THREAT INTELLIGENCE PINPOINTING TARGETS: Exploiting Web Analytics to Ensnare Victims NOVEMBER 2015 SECURITY REIMAGINED SPECIAL REPORT Pinpointing Targets: Exploiting Web Analytics to Ensnare Victims CONTENTS FIREEYE THREAT INTELLIGENCE Jonathan Wrolstad Barry Vengerik Introduction 3 Key Findings 4 The Operation 5 WITCHCOVEN in Action – Profiling Computers and Tracking Users 6 A Means to a Sinister End? 8 Assembling the Pieces 9 Finding a Needle in a Pile of Needles 11 Employ the Data to Deliver Malware 13 Effective, Efficient and Stealthy 15 Likely Intended Targets: Government Officials and Executives in the U.S. and Europe 18 Focus on Eastern Europe and Russian Organizations 18 Similar Reporting 19 Collateral Damage: Snaring Unintended Victims 19 Mitigation 21 Appendix: Technical Details 22 2 SPECIAL REPORT Pinpointing Targets: Exploiting Web Analytics to Ensnare Victims INTRODUCTION The individuals behind this activity have amassed vast amounts of information on OVER web traffic and visitors to more than 100 websites—sites that the threat actors have selectively compromised to gain access to THE their collective audience. PAST we have identified suspected nation-state sponsored cyber actors engaged in a large-scale reconnaissance effort. This effort uses web analytics—the technologies to collect, analyze, and report data from the web—on compromised websites to passively collect information YEAR, from website visitors.1 The individuals behind this activity have amassed vast amounts of information on web traffic and visitors to over 100 websites—sites that the threat actors have selectively compromised to gain access to their collective audience. Web analytics is used every day in much the same way by advertisers, marketers and retailers for insight into the most effective ways to reach their customers and target audiences.
    [Show full text]
  • Chapter Malware, Vulnerabilities, and Threats
    Chapter Malware, Vulnerabilities, and 9 Threats THE FOLLOWING COMPTIA SECURITY+ EXAM OBJECTIVES ARE COVERED IN THIS CHAPTER: ✓ 3.1 Explain types of malware. ■ Adware ■ Virus ■ Spyware ■ Trojan ■ Rootkits ■ Backdoors ■ Logic bomb ■ Botnets ■ Ransomware ■ Polymorphic malware ■ Armored virus ✓ 3.2 Summarize various types of attacks. ■ Man-in-the-middle ■ DDoS ■ DoS ■ Replay ■ Smurf attack ■ Spoofing ■ Spam ■ Phishing ■ Spim ■ Vishing ■ Spear phishing ■ Xmas attack ■ Pharming ■ Privilege escalation ■ Malicious insider threat ■ DNS poisoning and ARP poisoning ■ Transitive access ■ Client-side attacks ■ Password attacks: Brute force; Dictionary attacks; Hybrid; Birthday attacks; Rainbow tables ■ Typo squatting/URL hijacking ■ Watering hole attack ✓ 3.5 Explain types of application attacks. ■ Cross-site scripting ■ SQL injection ■ LDAP injection ■ XML injection ■ Directory traversal/command injection ■ Buffer overflow ■ Integer overflow ■ Zero-day ■ Cookies and attachments; LSO (Locally Shared Objects); Flash Cookies; Malicious add-ons ■ Session hijacking ■ Header manipulation ■ Arbitrary code execution/remote code execution ✓ 3.7 Given a scenario, use appropriate tools and techniques to discover security threats and vulnerabilities. ■ Interpret results of security assessment tools ■ Tools: Protocol analyzer; Vulnerability scanner; Honeypots; honeynets; Port scanner; Passive vs. active tools; Banner grabbing ■ Risk calculations: Threat vs. likelihood ■ Assessment types: Risk; Threat; Vulnerability ■ Assessment technique: Baseline reporting; Code review; Determine attack surface; Review architecture; Review designs ✓ 4.1 Explain the importance of application security controls and techniques. ■ Cross-site scripting prevention ■ Cross-site Request Forgery (XSRF) prevention ■ Server-side vs. client-side validation As we discussed in Chapter 1, “Measuring and Weighing Risk,” everywhere you turn there are risks; they begin the minute you fi rst turn on a computer and they grow exponen- tially the moment a network card becomes active.
    [Show full text]