The landscape of domain name typosquatting: techniques and countermeasures - Spaulding et al. arXiv upload 9 Mar 2016. We round up our series of posts on internet deceptions by looking at domain squatting. My "favourite" advanced technique is bitsquatting, which turns out to be a great demonstration of the inevitable failures that occur with sufficient ... Continue Reading

Understanding malvertising through ad-injecting browser extensions- Xing et al., WWW 2015. Be careful what browser extensions you install. Some ad networks have started to offer browser extension developers an opportunity to monetise their work, and in this study Xing et al. show that of the 292 Chrome browser extensions in their survey which inject ads, ... Continue Reading

Knowing your enemy: understanding and detecting malicious web advertising - Li at al. CCS, 2012 ... hackers and con-artists have found web ads to be a low-cost and highly effective means to conduct malicious and fraudulent activities. In this paper, we broadly refer to such ad-related malicious activities as malvertising, which can happen to any ... Continue Reading

A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks - Heartfield and Loukas 2015 This paper is concerned with semantic social engineering: the manipulation of the user-computer interface to deceive a user and ultimately breach a computer system's information security. Semantic attack exploits include phishing, file masquerading (disguising file ... Continue Reading

Capability Myths Demolished - Miller et. al 2003 Pretty much everyone is familiar with an ACL-based approach to security. Despite having been around for a very long time, the capabilities approach to security is less well-known. Today's paper choice provides an excellent introduction to the capabilities model and how it compares to ACLs. Along the ... Continue Reading

Prudent Engineering Practice for Cryptographic Protocols - Abadi & Needham, 1994 Prudent engineering practice for cryptographic protocols for most of us is not to design cryptographic protocols! Today's paper serves to highlight how even the experts can get it wrong, and presents 11 design principles for cryptographic protocols - some of which may be useful ... Continue Reading