Using Spammers' Computing Resources For Volunteer Computing,
2014
Portland State University
Using Spammers' Computing Resources For Volunteer Computing, Thai Le Quy Bui
Dissertations and Theses
Spammers are continually looking to circumvent counter-measures seeking to slow them down. An immense amount of time and money is currently devoted to hiding spam, but not enough is devoted to effectively preventing it. One approach for preventing spam is to force the spammer's machine to solve a computational problem of varying difficulty before granting access. The idea is that suspicious or problematic requests are given difficult problems to solve while legitimate requests are allowed through with minimal computation. Unfortunately, most systems that employ this model waste the computing resources being used, as they are directed towards solving cryptographic problems …
Keystroke Biometrics: The User Perspective,
2014
DSO National Laboratories
Keystroke Biometrics: The User Perspective, Chee Meng Tey, Payas Gupta, Kartik Muralidaran, Debin Gao
Research Collection School Of Computing and Information Systems
Usability is an important aspect of security, because poor usability motivates users to find shortcuts that bypass the system. Existing studies on keystroke biometrics evaluate the usability issue in terms of the average false rejection rate (FRR). We show in this paper that such an approach underestimates the user impact in two ways. First, the FRR of keystroke biometrics changes for the worse under a range of common conditions such as background music, exercise and even game playing. In a user study involving 111 participants, the average penalties (increases) in FRR are 0.0360 and 0.0498, respectively, for two different classifiers. …
Ropsteg: Program Steganography With Return Oriented Programming,
2014
Georgia Institute of Technology
Ropsteg: Program Steganography With Return Oriented Programming, Kangjie Lu, Siyang Xiong, Debin Gao
Research Collection School Of Computing and Information Systems
Many software obfuscation techniques have been proposed to hide program instructions or logic and to make reverse engineering hard. In this paper, we introduce a new property in software obfuscation, namely program steganography, where certain instructions are "diffused" in others in such a way that they are non-existent until program execution. Program steganography does not raise suspicion in program analysis, and conforms to the W⊕X and mandatory code signing security mechanisms. We further implement RopSteg, a novel software obfuscation system, to provide (to a certain degree) program steganography using return-oriented programming. We apply RopSteg to eight Windows executables and evaluate …
Key-Aggregate Cryptosystem For Scalable Data Sharing In Cloud Storage,
2014
Institute for Infocomm Research, Singapore
Key-Aggregate Cryptosystem For Scalable Data Sharing In Cloud Storage, Cheng-Kang Chu, Sherman S. M. Chow, Wen-Guey Tzeng, Jiangying Zhou, Robert H. Deng
Research Collection School Of Computing and Information Systems
Data sharing is an important functionality in cloud storage. In this article, we show how to securely, efficiently, and flexibly share data with others in cloud storage. We describe new public-key cryptosystems which produce constant-size ciphertexts such that efficient delegation of decryption rights for any set of ciphertexts are possible. The novelty is that one can aggregate any set of secret keys and make them as compact as a single key, but encompassing the power of all the keys being aggregated. In other words, the secret key holder can release a constant-size aggregate key for flexible choices of ciphertext set …
Ropecker: A Generic And Practical Approach For Defending Against Rop Attack,
2014
Singapore Management University
Ropecker: A Generic And Practical Approach For Defending Against Rop Attack, Yueqiang Cheng, Zongwei Zhou, Yu Miao, Xuhua Ding, Robert H. Deng
Research Collection School Of Computing and Information Systems
Return-Oriented Programming (ROP) is a sophisticated exploitation technique that is able to drive target applications to perform arbitrary unintended operations by constructing a gadget chain reusing existing small code sequences (gadgets). Existing defense mechanisms either only handle specific types of gadgets, require access to source code and/or a customized compiler, break the integrity of application binary, or suffer from high performance overhead. In this paper, we present a novel system, ROPecker, to efficiently and effectively defend against ROP attacks without relying on any other side information (e.g., source code and compiler support) or binary rewriting. ROPecker detects an ROP attack …
Identity Based Identification From Algebraic Coding Theory,
2014
Singapore Management University
Identity Based Identification From Algebraic Coding Theory, Guomin Yang, Chik How Tan, Yi Mu, Willy Susilo, Duncan S. Wong
Research Collection School Of Computing and Information Systems
Cryptographic identification schemes allow a remote user to prove his/her identity to a verifier who holds some public information of the user, such as the user public key or identity. Most of the existing cryptographic identification schemes are based on numbertheoretic hard problems such as Discrete Log and Factorization. This paper focuses on the design and analysis of identity based identification (IBI) schemes based on algebraic coding theory. We first revisit an existing code-based IBI scheme which is derived by combining the Courtois–Finiasz–Sendrier signature scheme and the Stern zero-knowledge identification scheme. Previous results have shown that this IBI scheme is …
Hardware Components In Cybersecurity Education,
2014
Kennsaw State University
Hardware Components In Cybersecurity Education, Dan Chia-Tien Lo, Max North, Sarah North
Faculty Articles
Hardware components have been designated as required academic content for colleges to be recognized as a center of academic excellence in cyber operations by the National Security Agency (NSA). To meet the hardware requirement, computer science and information technology programs must cover hardware concepts and design skills, topics which are less emphasized in existing programs. This paper describes a new pedagogical model for hardware based on network intrusion detection taught at college and graduate levels in a National Center of Academic Excellence in Information Assurance Education Program (CAE/IAE). The curriculum focuses on the fundamental concepts of network intrusion detection mechanisms, …
12th Australian Digital Forensics Conference, 2014, Edith Cowan University: Conference Details,
2014
Edith Cowan University
12th Australian Digital Forensics Conference, 2014, Edith Cowan University: Conference Details, Security Research Institute, Edith Cowan University
Australian Digital Forensics Conference
No abstract provided.
A Forensic Overview Of The Lg Smart Tv,
2014
Edith Cowan University
A Forensic Overview Of The Lg Smart Tv, Iain Sutherland, Konstantino Xynos, Huw Read, Andy Jones, Tom Drange
Australian Digital Forensics Conference
The emerging Smart TV platform will likely replace traditional television sets over time as the entertainment and communication centrepiece in people’s homes. Given its expanded functionality and now, its online presence, there is a need to identify how they may become part of forensic investigations. The purpose of this paper is to introduce the area of Smart TVs and the potential forensic value these systems present in combination with their ever advancing functionality and capabilities. We provide an overview of Smart TV systems highlighting functionality and potential issues. We also take an initial look at two particular models, from the …
Forensic Examination And Analysis Of The Prefetch Files On The Banking Trojan Malware Incidents,
2014
Edith Cowan University
Forensic Examination And Analysis Of The Prefetch Files On The Banking Trojan Malware Incidents, Andri P. Heriyanto
Australian Digital Forensics Conference
Whenever a program runs within the operating system, there will be data or artefacts created on the system. This condition applies to the malicious software (malware). Although they intend to obscure their presence on the system with anti-forensic techniques, still they have to run on the victim’s system to acquire their objective. Modern malware creates a significant challenge to the digital forensic community since they are being designed to leave limited traces and misdirect the examiner. Therefore, every examiner should consider performing all the forensics approaches such as memory forensic, live-response and Windows file analysis in the related malware incidents …
Prerequisites For Creating Resources And Compositions For Cyber Defence,
2014
National Defence University, Finland
Prerequisites For Creating Resources And Compositions For Cyber Defence, Tuija Kuusisto, Rauno Kuusisto
Australian Information Warfare and Security Conference
The aim of this paper is to increase understanding about the prerequisites which evolving cyber society sets for actors, activities and structures of the defenders of society. The research proposes an approach for identifying, analysing and scheduling these prerequisites for decision-making. The paper presents results of two case studies where the proposed approach is applied. The case studies indicate that in the future compositions are needed for forming of joint defence cyber community and resources for joining this community in affordable and beneficial ways. These are the next steps on the strategic path to jointly defended cyber community of global …
The Bad Guys Are Using It, Are You?,
2014
Oracle Corporation, Singapore, China Public Security University, China
The Bad Guys Are Using It, Are You?, Hong-Eng Koh
Australian Security and Intelligence Conference
From Occupy Wall Street to 2011 England riots to Arab Spring to Mumbai 26/11 to the ethnic cleansing rumors in India and increasingly used by pedophiles, social media is a very powerful tool for pedophiles, troublemakers, criminals and even terrorists to target individuals and even to go against the establishment. On the other hand, social media can save lives in a disaster, and its a natural extension of community policing or engagement. Community engagement is a must-have strategy for any public safety and security agency. However, this strategy requires the removal of stovepipe processes and systems within an agency, allowing …
German Foreign Policy In The Cyber Age,
2014
DePauw University
An Efficient Similarity Digests Database Lookup -- A Logarithmic Divide And Conquer Approach,
2014
University of New Haven
An Efficient Similarity Digests Database Lookup -- A Logarithmic Divide And Conquer Approach, Frank Breitinger, Christian Rathgeb, Harald Baier
Electrical & Computer Engineering and Computer Science Faculty Publications
Investigating seized devices within digital forensics represents a challenging task due to the increasing amount of data. Common procedures utilize automated file identification, which reduces the amount of data an investigator has to examine manually. In the past years the research field of approximate matching arises to detect similar data. However, if n denotes the number of similarity digests in a database, then the lookup for a single similarity digest is of complexity of O(n). This paper presents a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(n) to O(log(n)). Our proposed approach is based …
Virtualization-Based System Hardening Against Untrusted Kernels,
2014
Singapore Management University
Virtualization-Based System Hardening Against Untrusted Kernels, Yueqiang Cheng
Dissertations and Theses Collection (Open Access)
Applications are integral to our daily lives to help us processing sensitive I/O data, such as individual passwords and camera streams, and private application data, such as financial information and medical reports. However, applications and sensitive data all surfer from the attacks from kernel rootkits in the traditional architecture, where the commodity OS that is supposed to be the secure foothold of the system is routinely compromised due to the large code base and the broad attack surface. Fortunately, the virtualization technology has significantly reshaped the landscape of the modern computer system, and provides a variety of new opportunities for …
Mobile Device Vulnerabilities & Securities,
2014
Eastern Michigan University
Mobile Device Vulnerabilities & Securities, Luke Rondeau
Senior Honors Theses and Projects
An investigation on current mobile vulnerabilities and research into security. Also, a proof of concept to show the ease of injecting an Android phone with a virus.
Listening To Botnet Communication Channels To Protect Information Systems,
2014
Auckland University of Technology
Listening To Botnet Communication Channels To Protect Information Systems, Brian Cusack, Sultan Almutairi
Australian Digital Forensics Conference
Botnets are a weapon of choice for people who wish to exploit information systems for economic advantage. A large percentage of high value commercial targets such as banking transaction systems and human customers are web connected so that access is gained through Internet services. A Botnet is designed to maximise the possibility of an economic success through the low cost of attacks and the high number that may be attempted in any small time unit. In this paper we report exploratory research into the communications of Botnets. The research question was: How do Botnets talk with the command and control …
The Zombies Strike Back: Towards Client-Side Beef Detection,
2014
Edith Cowan University
The Zombies Strike Back: Towards Client-Side Beef Detection, Maxim Chernyshev, Peter Hannay
Australian Digital Forensics Conference
A web browser is an application that comes bundled with every consumer operating system, including both desktop and mobile platforms. A modern web browser is complex software that has access to system-level features, includes various plugins and requires the availability of an Internet connection. Like any multifaceted software products, web browsers are prone to numerous vulnerabilities. Exploitation of these vulnerabilities can result in destructive consequences ranging from identity theft to network infrastructure damage. BeEF, the Browser Exploitation Framework, allows taking advantage of these vulnerabilities to launch a diverse range of readily available attacks from within the browser context. Existing defensive …
A Forensically-Enabled Iaas Cloud Computing Architecture,
2014
Plymouth University
A Forensically-Enabled Iaas Cloud Computing Architecture, Saad Alqahtany, Nathan Clarke, Steven Furnell, Christoph Reich
Australian Digital Forensics Conference
Current cloud architectures do not support digital forensic investigators, nor comply with today’s digital forensics procedures largely due to the dynamic nature of the cloud. Whilst much research has focused upon identifying the problems that are introduced with a cloud-based system, to date there is a significant lack of research on adapting current digital forensic tools and techniques to a cloud environment. Data acquisition is the first and most important process within digital forensics – to ensure data integrity and admissibility. However, access to data and the control of resources in the cloud is still very much provider-dependent and complicated …
Up-Dating Investigation Models For Smart Phone Procedures,
2014
Auckland University of Technology
Up-Dating Investigation Models For Smart Phone Procedures, Brian Cusack, Raymond Lutui
Australian Digital Forensics Conference
The convergence of services in Smart Technologies such as iPhones, Androids and multiple tablet work surfaces challenges the scope of any forensic investigation to include cloud environments, devices and service media. The analysis of current investigation guidelines suggests that each element in an investigation requires an independent procedure to assure the preservation of evidence. However we dispute this view and review the possibility of consolidating current investigation guidelines into a unified best practice guideline. This exploratory research proposes to fill a gap in digital forensic investigation knowledge for smart technologies used in business environments and to propose a better way …
