Uncategorized

The Honey Badger of BFT protocols

~ Adrian Colyer ~ 5 Comments
The Honey Badger of BFT Protocols Miller et al. CCS 2016 The surprising success of cryptocurrencies (blockchains) has led to a surge of interest in deploying large scale, highly robust, Byzantine fault tolerant (BFT) protocols for mission critical applications, such as financial transactions. In a ‘traditional’ distributed system consensus algorithm setting we assume a relatively ... Continue Reading

Twice the bits, twice the trouble: vulnerabilities induced by migrating to 64-bit platforms

~ Adrian Colyer ~ 2 Comments
Twice the bits, twice the trouble: vulnerabilities induced by migrating to 64-bit platforms Wressnegger et al. CCS 2016 64-bit is not exactly new anymore, but many codebases which started out as 32-bit have been ported to 64-bit. In this study, Wressnegger et al. reveal how a codebase originally written for 32-bit, and which is perfectly ... Continue Reading

Acing the IOC game: toward automatic discovery and analysis of open-source cyber threat intelligence

~ Adrian Colyer ~ Leave a comment
Acing the IOC game: toward automatic discovery and analysis of open-source cyber threat intelligence Liao et al. CCS 2016 Last week we looked at a number of newly reported attack mechanisms covering a broad spectrum of areas including OAuth, manufacturing, automotive, and mobile PIN attacks. For some balance, today's paper choice looks at something to ... Continue Reading

When CSI meets public wifi: Inferring your mobile phone password via wifi signals

~ Adrian Colyer ~ 26 Comments
When CSI meets public wifi: Inferring your mobile phone password via wifi signals Li et al., CCS 2016 Not that CSI. CSI in this case stands for channel state information, which represents the state of a wireless channel in a signal transmission process. WindTalker is motivated from the observation that keystrokes on mobile devices will ... Continue Reading

On formalism in specifications

~ Adrian Colyer ~ 4 Comments
On formalism in specifications Bertrand Meyer, IEEE Software 1985 Following yesterday’s paper that used formal specification methods to resolve ambiguities and uncover potential vulnerabilities in OAuth 2.0, today’s choice is a 1980’s classic from Bertrand Meyer on the merits of formal specification and what it adds beyond natural language descriptions. With thanks once more to ... Continue Reading