Security

Papers relating to security, encryption, attacks and defenses.

NAVEX: Precise and scalable exploit generation for dynamic web applications

~ Adrian Colyer ~ 10 Comments
NAVEX: Precise and scalable exploit generation for dynamic web applications Alhuzali et al., USENIX Security 2018 NAVEX (https://github.com/aalhuz/navex) is a very powerful tool for finding executable exploits in dynamic web applications. It combines static and dynamic analysis (to cope with dynamically generated web content) to find vulnerable points in web applications, determine whether inputs to ... Continue Reading

Who left open the cookie jar? A comprehensive evaluation of third-party cookie policies

~ Adrian Colyer ~ 8 Comments
Who left open the cookie jar? A comprehensive evaluation of third-party cookie policies from the Franken et al., USENIX Security 2018 This paper won a ‘Distinguished paper’ award at USENIX Security 2018, as well as the 2018 Internet Defense Prize. It’s an evaluation of the defense mechanisms built into browsers (and via extensions / add-ons) ... Continue Reading

Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples

~ Adrian Colyer ~ Leave a comment
Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples Athalye et al., ICML'18 There has been a lot of back and forth in the research community on adversarial attacks and defences in machine learning. Today’s paper examines a number of recently proposed defences and shows that most of them rely on ... Continue Reading

EnclaveDB: a secure database using SGX

~ Adrian Colyer ~ 8 Comments
EnclaveDB: A secure database using SGX Priebe et al., IEEE Security & Privacy 2018 This is a really interesting paper (if you’re into this kind of thing I guess!) bringing together the security properties of Intel’s SGX enclaves with the Hekaton SQL Server database engine. The result is a secure database environment with impressive runtime ... Continue Reading

Automated localization for unreproducible builds

~ Adrian Colyer ~ 1 Comment
Automated localization for unreproducible builds Ren et al., ICSE'18 Reproducible builds are an important component of integrity in the software supply chain. Attacks against package repositories and build environments may compromise binaries and produce packages with backdoors (see this report for a recent prominent example of compromised packages on DockerHub). If the same source files ... Continue Reading