Monthly Archives: 六月 2016

Vetting SSL Usage in Applications with SSLINT^[1]

作者：Boyuan He (Zhejiang University)

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols have become the security backbone of the Web and Internet today. Many systems including mobile and desktop applications are protected by SSL/TLS protocols against network attacks. However, many vulnerabilities caused by incorrect use of SSL/TLS APIs have been uncovered in recent years. Such vulnerabilities, many of which are caused due to poor API design and inexperience of application developers, often lead to confidential data leakage or man-in-the-middle attacks.

Continue reading →

作者：Xinwen Fu（Department of Computer Science University of Massachusetts Lowell）

Anonymity protects the identity of a participant in a networked application. Sender anonymity protects the identity of the sender. Anonymous web browsing is such an application. Receiver anonymity protects the identity of the receiver. Broadcasting achieves receiver anonymity. Mutual anonymity guarantees that both parties of a communication remain anonymous to each other. Tor’s hidden service provides mutual anonymity [1]. One popular strategy for anonymity is pseudonyms. However, pseudonyms alone cannot achieve anonymity since traceback strategies can be applied to trace communication traffic from a pseudonym to the origin, the entity with that pseudonym. Continue reading →

Killed by Proxy: Analyzing Client-end TLS Interception Software [1]

Summarized by Mohammad Mannan

To filter SSL-protected traffic, some antivirus and parental-control applications interpose a SSL proxy in the middle of the host’s communications. However, the use of such a proxy may weaken TLS security in several ways, including:

Continue reading →

Using Hardware Features for Increased Debugging Transparency [1]

作者：Fengwei Zhang (Wayne State University)

With the rapid proliferation of malware attacks on the Internet, understanding these malicious behaviors plays a critical role in crafting effective defense. Advanced malware analysis relies on virtualization or emulation technology to run samples in a confined environment, and to analyze malicious activities by instrumenting code execution. However, virtual machines and emulators inevitably create artifacts in the execution environment, making these approaches vulnerable to detection or subversion [2].

Continue reading →