Let's encrypt: an automated certificate authority to encrypt the entire web, Aas et al., CCS'19 This paper tells the story of Let's Encrypt, from it's early beginnings in 2012/13 all the way to becoming the world's largest HTTPS Certificate Authority (CA) today - accounting for more currently valid certificates than all other browser-trusted CAs combined. ... Continue Reading

"I was told to buy a software or lose my computer. I ignored it": a study of ransomware Simoiu et al., SOUPS 2019 This is a very easy to digest paper shedding light on the prevalence of ransomware and the characteristics of those most likely to be vulnerable to it. The data comes from a ... Continue Reading

Invisible mask: practical attacks on face recognition with infrared Zhou et al., arXiv’18 You might have seen selected write-ups from The Morning Paper appearing in ACM Queue. The editorial board there are also kind enough to send me paper recommendations when they come across something that sparks their interest. So this week things are going ... Continue Reading

Detecting and characterizing lateral phishing at scale Ho et al., USENIX Security Symposium 2019 This is an investigation into the phenomenon of lateral phishing attacks. A lateral phishing attack is one where a compromised account within an organisation is used to send out further phishing emails (typically to other employees within the same organisation). So ... Continue Reading

in-toto: providing farm-to-table guarantees for bits and bytes Torres-Arias et al., USENIX Security Symposium 2019 Small world with high risks did a great job of highlighting the absurd risks we’re currently carrying in many software supply chains. There are glimmers of hope though. This paper describes in-toto, and end-to-end system for ensuring the integrity of ... Continue Reading

Small world with high risks: a study of security threats in the npm ecosystem Zimmermann et al., USENIX Security Symposium 2019 This is a fascinating study of the npm ecosystem, looking at the graph of maintainers and packages and its evolution over time. It’s packed with some great data, and also helps us quantify something ... Continue Reading

Wireless attacks on aircraft instrument landing systems Sathaye et al., USENIX Security Symposium 2019 It’s been a while since we last looked at security attacks against connected real-world entities (e.g., industrial machinery, light-bulbs, and cars). Today’s paper is a good reminder of just how important it is becoming to consider cyber threat models in what ... Continue Reading

50 ways to leak your data: an exploration of apps’ circumvention of the Android permissions system Reardon et al., USENIX Security Symposium 2019 The problem is all inside your app, she said to me / The answer is easy if you take it logically / I’d like to help data in its struggle to be ... Continue Reading