When CSI meets public wifi: Inferring your mobile phone password via wifi signals

November 10, 2016November 11, 2019 ~ Adrian Colyer ~ 26 Comments

When CSI meets public wifi: Inferring your mobile phone password via wifi signals Li et al., CCS 2016 Not that CSI. CSI in this case stands for channel state information, which represents the state of a wireless channel in a signal transmission process. WindTalker is motivated from the observation that keystrokes on mobile devices will ... Continue Reading

Leave your phone at the door: side channels that reveal factory floor secrets

November 9, 2016November 11, 2019 ~ Adrian Colyer ~ 3 Comments

Leave your phone at the door: side channels that reveal factory floor secrets Hojjati et al. CCS '16 Here's another reminder of just how powerful modern phones are as espionage devices, packed full of sensors. The short version is that if you place a phone near a manufacturing device (CNC mill or 3D printer in ... Continue Reading

A comprehensive formal security analysis of OAuth 2.0

November 7, 2016November 11, 2019 ~ Adrian Colyer ~ 2 Comments

A comprehensive formal security analysis of OAuth 2.0 Fett et al. CCS '16 Formal methods may not be appropriate in all cases, but there are some places where the rigour they introduce can be a really good idea. Security is one of those places. In today's paper from CCS '16 Fett et al. create a ... Continue Reading

Preemptive intrusion detection: theoretical framework and real-world measurements

October 26, 2016November 11, 2019 ~ Adrian Colyer ~ 1 Comment

Preemptive intrusion detection: theoretical framework and real-world measurements Cao et al, HotSoS 2015 Phuong Cao (the first author of this paper) got in touch following my review of DeepDive to say "Thanks for the review on DeepDive. I was inspired by that paper to apply factor graph on detecting intrusions at an early stage..." Preemptive ... Continue Reading

Protection in programming languages

October 19, 2016November 11, 2019 ~ Adrian Colyer ~ Leave a comment

Protection in programming languages Morris Jr., CACM 1973 This is paper 5/7 on Liskov's list. Experienced programmers will attest that hostility is not a necessary precondition for catastrophic interference between programs. So what can we do to ensure that program modules are appropriately protected and isolated? We still need to allow modules to cooperate and ... Continue Reading

Reflections on trusting trust

September 9, 2016November 11, 2019 ~ Adrian Colyer ~ 3 Comments

Reflections on Trusting Trust Ken Thompson, 1984 (Turing Award Lecture) Another Turing Award lecture to close out the week, this time from Ken Thompson who asks: To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software. ... Continue Reading

AI^2: Training a big data machine to defend

June 23, 2016 ~ Adrian Colyer ~ 3 Comments

AI2: Training a big data machine to defend Veeramachaneni et al. IEEE International conference on Big Data Security, 2016 Will machines take over? The lesson of today’s paper is that we’re better off together. Combining AI with HI (human intelligence, I felt like we deserved an acronym of our own ;) ) yields much better ... Continue Reading

Hacking Blind

June 22, 2016 ~ Adrian Colyer ~ 5 Comments

Hacking Blind Bittau et al. IEEE Symposium on Security and Privacy, 2014 (With thanks to Chris Swan for pointing this paper out to me a few months ago…) The ingenuity of attackers continues to amaze. Today’s paper presents an interesting trade-off: security or availability, pick one! (*) The work you put in to make sure ... Continue Reading

Multi-context TLS (mcTLS): Enabling secure in-network functionality in TLS

June 20, 2016 ~ Adrian Colyer ~ 3 Comments

Multi-Context TLS (mcTLS): Enabling secure in-network functionality in TLS Naylor et al. SIGCOMM 2015 We're rushing to deploy HTTPS everywhere - and about time - but this has interesting implications for middleboxes since it's hard for them to do their job when traffic is encrypted end-to-end. Say you want to add caching, compression, an intrusion ... Continue Reading

Shielding applications from an untrusted cloud with Haven

June 16, 2016 ~ Adrian Colyer ~ 5 Comments

Shielding applications from an untrusted cloud with Haven Baumann et al. OSDI 2014 Our objective is to run existing server applications in the cloud with a level of trust and security roughly equivalent to a user operating their own hardware in a locked cage at a colocation facility. We're all familiar with the idea of ... Continue Reading

the morning paper

a random walk through Computer Science research, by Adrian Colyer
Made delightfully fast by strattic

Security