Security

Papers relating to security, encryption, attacks and defenses.

BadNets: Identifying vulnerabilities in the machine learning model supply chain

~ Adrian Colyer ~ 5 Comments
BadNets: Identifying vulnerabilities in the machine learning model supply chain Gu et al., ArXiv 2017 Yesterday we looked at the traditional software packages supply chain. In BadNets, Gu et al., explore the machine learning model supply chain. They demonstrate two attack vectors: (i) if model training is outsourced, then it’s possible for a hard to ... Continue Reading

CHAINIAC: Proactive software update transparency via collectively signed skipchains and verified builds

~ Adrian Colyer ~ 1 Comment
CHAINIAC: Proactive software-update transparency via collectively signed skipchains and verified builds Nikitin et al., USENIX Security ‘17 So hopefully you’ve put in place some kind of software supply chain management process that will pick up the availability of new package versions, particularly of course those with fixes for discovered vulnerabilities, and ensure those updates are ... Continue Reading

TrustBase: an architecture to repair and strengthen certificate-based authentication

~ Adrian Colyer ~ 1 Comment
TrustBase: an architecture to repair and strengthen certificate-based authentication O’Neill et al., USENIX Security 2017 We recently saw that the sorry state of DNSSEC makes it comparatively easy to be sent to the wrong address when looking up a hostname. If certificate-based authentication is messed up as well, then it’s double trouble as you can ... Continue Reading

Pretzel: email encryption and provider-supplied functions are compatible

~ Adrian Colyer ~ Leave a comment
Pretzel: email encryption and provider-supplied functions are compatible Gupta et al., SIGCOMM’17 While emails today are often encrypted in transit, the vast majority of emails are exposed in plaintext to the mail servers that handle them. Given the sensitive information often contained in email correspondence, why is this? Publicly, email providers have stated that default ... Continue Reading

Detecting credential spearphishing attacks in enterprise settings

~ Adrian Colyer ~ 2 Comments
Detecting credential spearphishing attacks in enterprise settings Ho et al., USENIX Security 2017 The Lawrence Berkeley National Laboratory (LBNL) have developed and deployed a new system for detecting credential spearphishing attacks (highly targeted attacks against individuals within the organisation). Like many anomaly detection systems there are challenges of keeping the false positive rate acceptable (not ... Continue Reading

ACIDRain: concurrency-related attacks on database backed web applications

~ Adrian Colyer ~ 5 Comments
ACIDRain: Concurrency-related attacks on database-backed web applications Warszawski & Bailis, SIGMOD'17 Welcome back to a new term of The Morning Paper. To kick things off, we have 'ACID Rain' - a terrific paper from SIGMOD'17 that pulls together a number of threads we've studied previously: transaction processing, anomalies, and security. What ACIDRain demonstrates is that ... Continue Reading

An experimental security analysis of an industrial robot controller

~ Adrian Colyer ~ 6 Comments
An experimental security analysis of an industrial robot controller Quarta et al., IEEE Security and Privacy 2017 This is an industrial robot: The International Federation of Robotics forecasts that, by 2018, approximately 1.3 million industrial robot units will be employed in factories globally, and the international market value for "robotized" systems is approximately 32 billion ... Continue Reading