Month: October 2017

BadNets: Identifying vulnerabilities in the machine learning model supply chain

~ Adrian Colyer ~ 5 Comments
BadNets: Identifying vulnerabilities in the machine learning model supply chain Gu et al., ArXiv 2017 Yesterday we looked at the traditional software packages supply chain. In BadNets, Gu et al., explore the machine learning model supply chain. They demonstrate two attack vectors: (i) if model training is outsourced, then it’s possible for a hard to ... Continue Reading

CHAINIAC: Proactive software update transparency via collectively signed skipchains and verified builds

~ Adrian Colyer ~ 1 Comment
CHAINIAC: Proactive software-update transparency via collectively signed skipchains and verified builds Nikitin et al., USENIX Security ‘17 So hopefully you’ve put in place some kind of software supply chain management process that will pick up the availability of new package versions, particularly of course those with fixes for discovered vulnerabilities, and ensure those updates are ... Continue Reading

TrustBase: an architecture to repair and strengthen certificate-based authentication

~ Adrian Colyer ~ 1 Comment
TrustBase: an architecture to repair and strengthen certificate-based authentication O’Neill et al., USENIX Security 2017 We recently saw that the sorry state of DNSSEC makes it comparatively easy to be sent to the wrong address when looking up a hostname. If certificate-based authentication is messed up as well, then it’s double trouble as you can ... Continue Reading

Pretzel: email encryption and provider-supplied functions are compatible

~ Adrian Colyer ~ Leave a comment
Pretzel: email encryption and provider-supplied functions are compatible Gupta et al., SIGCOMM’17 While emails today are often encrypted in transit, the vast majority of emails are exposed in plaintext to the mail servers that handle them. Given the sensitive information often contained in email correspondence, why is this? Publicly, email providers have stated that default ... Continue Reading

Detecting credential spearphishing attacks in enterprise settings

~ Adrian Colyer ~ 2 Comments
Detecting credential spearphishing attacks in enterprise settings Ho et al., USENIX Security 2017 The Lawrence Berkeley National Laboratory (LBNL) have developed and deployed a new system for detecting credential spearphishing attacks (highly targeted attacks against individuals within the organisation). Like many anomaly detection systems there are challenges of keeping the false positive rate acceptable (not ... Continue Reading

A century of science: globalization of scientific collaborations, citations, and innovations

~ Adrian Colyer ~ Leave a comment
A century of science: globalization of scientific collaborations, citations, and innovations Dong et al., KDD’17 This is more of a general interest paper as a light-hearted way to end the week. A team at Microsoft conducted analyses on the Microsoft Academic Graph to understand the changing nature of science over the course of the last ... Continue Reading