Abstract

Abstract

Abstract

Abstract

Virtualization is a powerful technology to increase the efficiency of computing services; however, besides its advantages, it also raises a number of security issues. In this paper, we provide a thorough survey of those security issues in hardware virtualization. We focus on potential vulnerabilities and existing attacks on various virtualization platforms, but we also briefly sketch some possible countermeasures. To the best of our knowledge, this is the first survey of security issues in hardware virtualization with this level of details. Moreover, the adversary model and the structuring of the attack vectors are original contributions, never published before.

Abstract

Abstract

Abstract

IT security architectures that use cryptographic elements sometimes fail, but it is rarely cryptography to blame. The reason is more often the use of cryptography in an inappropriate way, or the use of algorithms that do not really qualify as cryptographic. High quality cryptography is in fact the strongest link in the chain, and there are good reasons for that.

Abstract

Abstract

In September 2011, a European company sought our help to investigate a security incident that happened in their IT system. During the investigation, we discovered a new malware that was unknown to all mainstream anti-virus products, however, it showed striking similarities to the infamous Stuxnet worm. We named the new malware Duqu, and we carried out its rst analysis. Our ndings led to the hypothesis that Duqu was probably created by the same people who developed Stuxnet, but with a dierent purpose: unlike Stuxnet whose mission was to attack industrial equipment, Duqu is an information stealer rootkit. Nevertheless, both pieces of malware have a modular structure, and they can be re-congured remotely from a Command and Control server to include virtually any kind of functionality. In this paper, we present an abridged version of our initial Duqu analysis, which is available in a longer format as a technical report. We also describe the Duqu detector toolkit, a set of heuristic tools that we developed to detect Duqu and its variants. Finally, we discuss a number of issues that we learned, observed, or identied during our Duqu analysis project concerning the problems of preventing, detecting, and handling targeted malware attacks; we believe that solving these issues represents a great challenge to the system security community.

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Stuxnet was the first targeted malware that received worldwide attention forcausing physical damage in an industrial infrastructure seemingly isolated from the onlineworld. Stuxnet was a powerful targeted cyber-attack, and soon other malware samples were discovered that belong to this family. In this paper, we will first present our analysis of Duqu, an information-collecting malware sharing striking similarities with Stuxnet. Wedescribe our contributions in the investigation ranging from the original detection of Duquvia finding the dropper file to the design of a Duqu detector toolkit. We then continue with the analysis of the Flame advanced information-gathering malware. Flame is unique in thesense that it used advanced cryptographic techniques to masquerade as a legitimate proxyfor the Windows Update service. We also present the newest member of the family, called Gauss, whose unique feature is that one of its modules is encrypted such that it can onlybe decrypted on its target system; hence, the research community has not yet been able to analyze this module. For this particular malware, we designed a Gauss detector serviceand we are currently collecting intelligence information to be able to break its very specialencryption mechanism. Besides explaining the operation of these pieces of malware, wealso examine if and how they could have been detected by vigilant system administrators manually or in a semi-automated manner using available tools. Finally, we discuss lessonsthat the community can learn from these incidents. We focus on technical issues, and avoidspeculations on the origin of these threats and other geopolitical questions.

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Abstract

Wireless mesh networking allows network operators and service providers to offer nearly ubiquitous broadband access at a low cost to customers. In this paper, we focus on QoS-aware mesh networks operated by multiple operators in a cooperative manner. In particular, we identify the general security requirements of such networks and we give an overview on the available design options for a security architecture aiming at satisfying those requirements. More specifically, we consider the problems of mesh client authentication and access control, protection of wireless communications, securing the routing, key management, and intrusion and misbehavior detection and recovery. Our aim is to structure this rich problem domain and to prepare the grounds for the design of a practically usable security architecture.

Abstract

Abstract

Abstract

Keywords

DoS

---

Abstract

Cikkünk kriptográai protokollok szolgáltatás-megtagadásos (Denial of Service  DoS) támadások elleni védelmér®l szól. A DoS támadások modellezésére a folyamatot stratégiai játékként értelmezzük. Ebben a modellben a támadó maximalizálni kívánja a kiszolgáló elhasznált kapacitásait, míg a kiszolgáló minimalizálni próbálja az elpazarolt er®forrásokat, és megpróbálja továbbra is kiszolgálni a legitim klienseket. A játékelméleti szemléletmódot részleteiben mutatjuk be, és felhasználjuk azt a kliens oldali rejtvény technika (client-side puzzle) optimalizálására. A cikkben analizáljuk azt az esetet is, amikor a szerver optimális kevert stratégiát választ a védekezéshez.

Abstract

Abstract

Obtaining the e-mail addresses which are handled by the mail servers is the Directory Harvest Attack. The root of the problem in DHA is in the SMTP protocol itself: the e-mail servers, if they got the mail to a proper address, would not respond, simply accept it. If the server got a mail to a non-existent address, then it would give a response either immediately or later whether the post office box exists or not. This process gives information about the e-mail addresses which are upkept by the server. The attackers use this information, sending huge amount of messages to the e-mail server. The addresses from which do not arrive response (so the server accepts the e-mail without negative signal) are gathered to a list. These addresses should belong to valid user accounts, so it is worthy to send uninvited mails to it. In our presentation we would like to introduce our research, development, and show the results gained from the running of the implemented system. The implemented protection is component based developments, which are strongly coherent and use each other software elements to a high extent. Last year we presented a possible implementation plan. We have continued this work, implemented the system and run it for a long period to collect data from attackers. We would like to analyse the data collected by our system. We present which typical DHA attackers exist and whether it is possible to distinguish them unambiguously from each other based on just the attacker statistics. We compare the distribution of attackers by country in Europe. We review the Hungarian DHA situation based on internet access. With modern statistical methods we examine the question whether we can get answer for that why is DHA happening.

Keywords

virus dos rbl centralized protection

---

Abstract

In our presentation we would like to show our research plans, and achievments in the field of virus and spam protection. The planned protection methods are component based developments, close-knit methods, which use each other software components to a great extent. One of the most important methods out of the protection against SPAM is to avoid getting the e-mail addresses maintained by us on to a SPAM list. Among other methods, the attackers use the directory harvest attack (DHA), therefore I would like to show a protection method against it, which works on the recognition and centralised forbidding of the attackers. The novel in our solution is that, in other anti-SPAM methods the emphasis is not put on prevention, they just filter the incoming unsolicited mails. In contrast to this, we suggest a system consists of components, which can be built in our existent working system and prevents the directory harvest attacks. Our system can also be connected with spam-recognition softwares. The solution makes savings possible by mails, coming from known DHA attackers, are not subjected to resource consuming content filtering methods, just simply forbidden. Our system combined with other methods can improve their efficiency as well. The other important component, which can improve our system efficiency is the component developed in the VIRUSFLAGS project, which gives a solution to the problem in connection with the arriving of a virus infected mail from an falsified sender. In this case there is no point in sending a virus alert to the falsified sender, because this is just misleading. But if the virus (for example a Word macro virus) did not falsify the sender, our machine deletes the letter, but the sender is not notified, then legal problems may occur: if our business neither accepted the resignation of a contradiction, because it is infected with a macro virus, nor notified anyone, would cause a legal problem. The virus scanners may know this information, but taking into consideration the system and component theory, a system component can be more efficient which deals with only this question whether a virus falsifies the sender or not. As an add-in of the VIRUSFLAGS current software components, it make it possible to do statistical data collection about the spread of different viruses, which has the same importance level, if it was not more important. We have prototypes about the presented systems, but the utilization and reuse of the results on the modell is in progress.

Keywords

DHA, SPAM, e-mail attack, DoS

---

Abstract

In this paper the E-mail Directory Harvest Attacks (DHA) are investigated. We elaborated a method for optimizing the wordlist size used by the attacker in a resource limited environment. We analyzed the results and proved that our method is optimal. We also present an efficient countermeasure against DHA.

Abstract

http://www.cert.hu/ismert/00tanulmany/MTAsec_w1_TOC.pdf

Abstract

Az internetes virus- és spamvédelem rendszerszemléletben Az elmúlt idõszak bebizonyította, hogy a régóta ismert vírusok és kéretlen reklámlevelek olyan súlyos problémát jelentenek az Internet szereplõinek, amit nem lehet figyelmen kívül hagyni. A cégek többsége jelenleg is használ vírusvédelmi és kéretlen levelek szûrésére alkalmas eszközöket. A vírusok és férgek ennek ellenére gyakorta megelõzik, kicselezik a védelmet és bejutnak a cégek hálózatába. A kéretlen levelek elleni védelem pedig gyakorta hibázik és kiforratlannak tekinthetõ. A problémák megoldására számos kereskedelmi és ingyenesen elérhetõ szoftvertermék létezik. Hiába a megannyi szoftver, a vírusok és reklámlevelek mennyisége arányaiban és abszolút értékben is folyamatosan növekedett az elmúlt idõszakban. A növekedés oka az eszközök hatékonytalansága. A hatékonytalanság nem annak a következménye, hogy a termékek rosszak. A probléma oka az, hogy az egyes termékek, ötletek, megoldások nincsenek megfelelõ rendszere szervezve, hiányoznak a kulcs-komponensek, elfogadott jogi és etikai alapelvek, sztenderdek. A ma telepített vírusvédelmi rendszerek többsége egyszerû mintaillesztéses keresésen és heurisztikus analízisen alapul. Noha ez elfogadható lehet a végponton, az Internet szempontjából összetettebb rendszerekre van szükség. A megoldandó feladatok: az egyedi rendszerek hatékonyságának növelése, összegzett, átfogó adatok kinyerése és a kinyert adatok alapján mûködõ, elosztott Internet-szintû védelem. A megoldáshoz számos apró komponens szükségeltetik, elõadásomban ilyen ötleteket is ismertetni kívánok. Az ötletek olyan apró komponensek, mint a karanténozás segítése a járványterjedés megfigyelésével, a hálózati forgalom alapján történõ járványvizsgálatok, a vírusvédelmi rendszerek valósidejû minõségellenõrzése stb. A kéretlen reklámlevelek elleni védelem többnyire már ma is épít rendszerszemlétre: A megoldások jelentõs része nem egy algoritmust tartalmaz, hanem több metódus használatának szinergiáját használja ki. Nem mondhatjuk azonban, hogy a rendszerszemlélet teljes körû lenne: az egyedi megoldások jelentõs része támadható, és makró szinten a megoldások nem mondhatók hatékonynak a kéretlen reklámok elleni védekezésben. Elõadásomban be kívánok mutatni néhány ötletet, amellyel a védelem hatékonysága növelhetõ (külön kitérve a hazai szigorú törvényekbõl adódó lehetõségek kiaknázására), továbbá be kívánom mutatni azokat a tényezõket, amelyek miatt a védelem jelenleg makró szinten hatástalan. Elõadásom célja összegezve az, hogy bemutassa a rendszerszemlélet elengedhetetlenségét a védelmi módszerek között a jelenlegi komponensek kapcsolatai és további ötletek (és kísérleti rendszerek) bemutatása segítségével.

---
The system approach in the field of virus and spam protection The biggest infection events show that the most dangerous viruses propagate via the Internet email systems. The problem of Internet viruses and spam email messages is no longer dismissible. Multi-layer virus and spam protection reduces the number of infections but still does not eliminate the problem itself. Infected computers send out thousands of infected messages to other hosts, a large part of the Internet traffic is generated by malicious code. A wide range of commercial and free software is available to solve these problems, but along the introduction of these software components, the number of infected hosts and messages is still growing year by year. The reason of the growth is the inefficiency of our software components. This does not mean that the software used against these problems is wrong. The problem is, that the various ideas, tools, software and network components do not build up a whole system. Elaborated key-components, widely accepted standards and legal system and collaborative tools are still missing. As for improvement we do not need new statistical engine to protect a host, but we need a distributed, Internet-fashioned system with collaborative parties to evaluate the situation, to rapidly respond to unknown viruses and other threats. We propose small software components to gain information about the propagation of malicious code, to build up a efficient Internet-wide quarantine system, to monitor and check our protection systems, and to identify or inform owners about problems with their hosts. Many of theses software tools are available but unusable as collaborative tools. The small components cannot work together; we cannot build up a whole, efficient system from these components. The goal of my speech is to present how necessary is a system approach in the field of virus and spam protection. I also present of achievements (plans and prototypes) to develop software components to use in a wide-area protection system.

Abstract

Keywords

DDoS attacks, traffic analysis, network protection

---

Abstract

A method for protecting an Internet server against a bandwidth-consuming DDoS attack is proposed and analyzed. Incoming traffic is monitored continuously and ``dangerous'' traffic intensity rises are detected. Such an event activates a traffic filtering rule which pushes down the incoming aggregate traffic to an acceptable level by discarding excess packets according to the measured relative traffic levels of active sources. Compared to other studies, our method has a structurally stronger base: legitimate traffic to the server is not necessarily hindered because of the attack or the traffic suppression. The method is supported by an analysis and a simulation as well.

Abstract

The user wishes to communicate with a remote partner over an insecure network. Since the user is a human being, a terminal is needed to gain access to the network. Various cryptographic algorithms running on the terminal may provide authenticity and/or secrecy for the user’s messages. In this paper the problem of sending authentic messages from insecure or untrusted terminals is analyzed. In this case attackers are able to gain total control over the terminal, so the user must consider the terminal as a potential attacker. Smart cards are often considered the ultimate tool for secure messaging from untrusted terminals. Although they are secure tamper-resistant microcomputers with strong cryptographic powers, their lack of user interface enables man-in-the middle attack from the terminal. This paper analyzes the usability of smart cards for the above problem, and investigates various possibilities for authentic communication between the user and the smart card. Since the user is a human being with limited memory and little computational power, it is questionable that authentic communication is possible between the above two parties in practice. In the first part of our lecture, we review various solutions and protocols from literature that can aid the user in an untrusted terminal environment. In the second part of the lecture, we propose a solution, that can be implemented with smart cards that exist today, and does not need the user to perform cryptographic operations. Although the smart card cannot decide if the message came from the user or from a malicious software running on the terminal, but can still aid the user in authenticating the message. This is possible if the user sends a so-called biometric message. A biometric message could be a video or voice message. Such a message is very hard to manipulate, it may even require human interaction. In order to prevent the attack, the smart card should ensure, that the attacker has no possibility, no time to perform such a complicated attack. The smart card can be used as a secure time that can guarantee that the message was sent in a certain time frame. This way, the time the attacker has to manipulate the message can be severely limited so even simple algorithmic authenticators can provide strong security.

Keywords

virus, denial of service attack, e-mail

---

Abstract

First I will provide some introduction into the problems and solutions in both the network virus protection and the protection against Distributed Denial of Service (DDoS). I will show the usual and most workable methods in the area of virus protection: client-side virus protection, mail server / relay server protection (with the priority of open source tools) (e.g. linux, amavis, mailscanner, clamav, unix virus scanners, „mail gateway” protection software), content-filtering tools (filtering web traffic), extended file access control systems (RSBAC malware scan module). I will also introduce the problem area of DDoS protection: Different types of DDoS attacks (protocol fault („magic packet”), network bandwidth overflow, server resource consumption). I will also show the most usable techniques for the protection (error correction, firewalls, anomaly detection (SYN flood protection etc.), protection based on network analysis) and will provide some data about the recent major attacks (Ebay, SCO, anti-spam rbl providers, zombie networks). After the introduction I will show the possible DDoS problems of the network virus protection: The resource consumption of the virus protection, the possibility of flooding, the dangers of virus reports and e-mail alerts. After defining the problems I’ll show our proposed solutions: A virus protection system combined with the technique of network analysis to protect the system against DoS attacks. The incoming mails will be examined by the network analysis engine and therefore it makes possible to filter out DDoS attacks against the virus protection system. Our proposed solution might be useful against unknown (not detectable) viruses and in the area early epidemic protection. To support our method I’ll show the details of the structure of our pilot implementation.

Abstract

Abstract

DoS attacks are aimed at the loss of or the reduction in availability, which is one of the most important general security requirements in computer networks. A promising approach proposed to alleviate the problem of DoS attacks is to use client puzzles. In this paper, we study this approach using the apparatus of game theory. In our analysis, we derive the optimal strategy for the attacked server (e.g., a web server on the Internet) in all conceivable cases. We also present two new client puzzles as examples.

Abstract

Abstract

Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.

Abstract

Keywords

generation of random values, tests of randomness, good source of random data, private and authentic communication

---

Abstract

Random data in their work is collected from network time delay measurements and its quality is checked by statistical tests, and a special enhancement, the system of collector-servers is proposed and analyzed

Abstract

Abstract

Abstract

http://ebizlab.hit.bme.hu/pub/lrpasswd.html

Abstract

Abstract

Sudo 1.5 in Debian Linux 2.1 and Red Hat 6.0 allows local users to determine the existence of arbitrary files by attempting to execute the target filename as a program, which generates a different error message when the file does not exist.

Abstract