Hijacking Bitcoin: routing attacks on cryptocurrencies

June 27, 2017 ~ Adrian Colyer ~ 13 Comments

Hijacking Bitcoin: routing attacks on cryptocurrencies Apostolaki et al., IEEE Security and Privacy 2017 The Bitcoin network has more than 6,000 nodes, responsible for up to 300,000 daily transactions and 16 million bitcoins valued at roughly $17B. Given the amount of money at stake, Bitcoin is an obvious target for attackers. This paper introduces a ... Continue Reading

SoK: Cryptographically protected database search

June 26, 2017 ~ Adrian Colyer ~ Leave a comment

SoK: Cryptographically proctected database search Fuller et al., IEEE Security and Privacy 2017 This is a survey paper (Systematization of Knowledge, SoK) reviewing the current state of protected database search (encrypted databases). As such, it packs a lot of information into a relatively small space. As we've seen before, there are a wide-variety of cryptographic ... Continue Reading

Cloak and dagger: from two permissions to complete control of the UI feedback loop

June 23, 2017 ~ Adrian Colyer ~ 1 Comment

Cloak and dagger: from two permissions to complete control of the UI feedback loop Fratantonio et al., IEEE Security and Privacy 2017 If you're using Android, then 'cloak and dagger' is going to make for scary reading. It's a perfect storm of an almost undetectable attack that can capture passwords, pins, and ultimately obtain all ... Continue Reading

IoT goes nuclear: creating a ZigBee chain reaction

June 22, 2017 ~ Adrian Colyer ~ 22 Comments

IoT goes nuclear: creating a ZigBee chain reaction Ronen et al., IEEE Security and Privacy 2017 You probably don't need another reminder about the woeful state of security in IoT, but today's paper choice may well give you further pause for thought about the implications. The opening paragraph sounds like something out of science fiction ... Continue Reading

The password reset MitM attack

June 21, 2017 ~ Adrian Colyer ~ 11 Comments

The password reset MitM attack Gelernter et al., IEEE Security and Privacy 2017 The Password Reset Man-in-the-Middle (PRMitM) attack is really very simple, but that doesn't mean it's not dangerous. It involves persuading the user to sign-up for an account for some service under the attacker's control (maybe there's an enticing free download for example), ... Continue Reading

Why your encrypted database is not secure

June 16, 2017 ~ Adrian Colyer ~ 2 Comments

Why your encrypted database is not secure Grubbs et al., HotOS'17 This is the third paper we've looked at so far in The Morning Paper on the topic of encrypted databases. The clear takeaway for me is that practical, provable security guarantees are very hard to deliver! Don't confuse better protection with unbreakable protection, and ... Continue Reading

SGXBounds: memory safety for shielded execution

June 6, 2017 ~ Adrian Colyer ~ 3 Comments

SGXBounds: memory safety for shielded execution Kuvaiskii et al., EuroSys'17 We've previously looked at a number of Intel SGX-related papers in The Morning Paper, including SCONE, which today's paper builds on. SGX comes with a memory encryption engine and seeks to protect trusted applications from an untrusted operating system, providing confidentiality and integrity guarantees. SGX, ... Continue Reading

Bolt: I know what you did last summer… in the cloud

May 24, 2017 ~ Adrian Colyer ~ 3 Comments

Bolt: I know what you did last summer... in the cloud Delimitrou & Kozyrakis, ASPLOS'17 You get your run-of-the-mill noisy neighbours - the ones who occasionally have friends round and play music a little too loud until a little too late. And then in the UK at least you get what we used to call ... Continue Reading

Who controls the Internet? Analyzing global threats using property traversal graphs

May 19, 2017 ~ Adrian Colyer ~ 7 Comments

Who controls the Internet? Analyzing global threats using property traversal graphs Simeonovski et al., WWW'17 Who controls the Internet? How much influence do they have? And what would happen if one of those parties launched an attack or was compromised and used to launch an attack? Previous works have looked at the individual core services, ... Continue Reading

The curious case of the PDF converter that likes Mozart

April 5, 2017November 11, 2019 ~ Adrian Colyer ~ 6 Comments

The curious case of the PDF converter that likes Mozart: dissecting and mitigating the privacy risk of personal cloud apps Harkous et al., PoPET '16 This is the paper that preceded "If you can't beat them, join them" we looked at yesterday, and well worth interrupting our coverage of CODASPY '17 for. Harkous et al., ... Continue Reading

the morning paper

a random walk through Computer Science research, by Adrian Colyer
Made delightfully fast by strattic

Security