Seminar – GoSec@CS.SJTU

[2022.04.20] [OOPSLA 2021] Fully Automated Functional Fuzzing of Android Apps for Detecting Non-crashing Logic Bugs

Jun 15, 2022gossipeditorSeminar

Source: https://dl.acm.org/doi/10.1145/3485533 Authors: TING SU∗ and YICHEN YAN, East China Normal University, China JUE WANG, Nanjing University, China JINGLING SUN, YIHENG XIONG, and GEGUANG PU, East China Normal University, China KE WANG, Visa Research, USA ZHENDONG SU, ETH Zurich, Switzerland The Link of Note: https://jbox.sjtu.edu.cn/l/l1wT4l Contributor: yzy Overview 本文基于安卓软件的独立试图属性，即和一个GUI视图交互不会影响其他视图的状态，提出了一个自动化检测安卓应用程序非崩溃漏洞的工具GENIE。方法流程如下：从应用程序挖掘GUI转换模型。生成一组随机种子测试，并执行每个种子测试来推断独立的视图(Genie也可以接受来自人类或现有的测试生成工具的种子测试)。利用独立视图和转换模型指导变异试验的生成和执行。 4.比较每个种子试验及其对应的变异试验，识别属性违规。采用bug报告消减器来消除重复报告的错误和假阳性的误报，并根据错误报告的发生情况对剩余的bug报告进行排序，以供手动确认。

[2021.12.1] [Usenix Security 2022] MAGE: Mutual Attestation for a Group of Enclaves without Trusted Third Parties

Dec 13, 2021gossipeditorSeminar

Source: https://arxiv.org/pdf/2008.09501.pdf Authors: Guoxing Chen, and Yinqian Zhang. The Link of Note: https://jbox.sjtu.edu.cn/l/S1ugcT Contributor: lt. Overview Intel SGX的attestation机制支持enclave向其他enclave证明自己的身份。为了验证enclave是否可信，enclave会将信任的enclave的measurement放入初始数据中。但是，当多个enclave需要建立信任时，它们无法同时将对方的measurement放入自己的初始数据中，因为这个行为会使已放入的measurement失效。为此，作者提出了MAGE这一解决方案。

[2021.11.10] [Security and Communication Networks 2021] Blockchain as a CA: A Provably Secure Signcryption Scheme Leveraging Blockchains

Nov 17, 2021gossipeditorSeminarBlockchain, Protocol

Source: https://www.hindawi.com/journals/scn/2021/6637402/ Author: Tzung-Her Chen Ting-Le Zhu Fuh-Gwo Jeng and Chien-Lung Wang Journal: Security and Communication Networks 2021 (CCF C) Download Note: https://jbox.sjtu.edu.cn/l/x1uKe9 Contributor: PDH Introduction In the past decade, applying certificateless signcryption schemes to solve the higher cost of maintaining the certificate chain issued by a certificate authority (CA) has been studied. The concepts […]

[2021.11.17] [USENIX Security 2021] Sharing More and Checking Less: Leveraging Common Input Keywords to Detect Bugs in Embedded Systems

Nov 17, 2021gossipeditorSeminarIot，dataflow analysis

Source: https://www.usenix.org/system/files/sec21fall-chen-libo.pdf Authors: Libo Chen, Yanhao Wang, Quanpu Cai, Yunfan Zhan1, Hong Hu, JiaqiLinghu, Qinsheng Hou, Chao Zhang, Haixin Duan, Zhi Xue Download Note: https://jbox.sjtu.edu.cn/l/l1cmyY Contributor: ydh Overview IoT设备的使用越来越广泛，设备中存在的安全漏洞的影响也越来越大。IoT设备后端与用户交互往往需要通过Web，App等前端。许多嵌入式系统的漏洞都来自于Web。但是目前已有的漏洞检测方法都无法有效且高效地分析这样的web服务。这篇文章提出了一种新颖的静态污点分析的方法（SaTC），高效地检测嵌入式设备提供的web服务中的漏洞。主要检测两类IoT设备，无线路由器以及Web摄像头，这些设备为了方便管理使用往往都会有管理界面。有研究表明75%的IoT攻击都是对路由器的，Web摄像头排在第二15.2%

[2021.10.20] [NDSS 2021] Preventing and Detecting State Inference Attacks on Android

Nov 1, 2021gossipeditorSeminarAndroid

Source: http://s3.eurecom.fr/docs/ndss21_pox.pdf Author: Andrea Possemato, Dario Nisi, Yanick Fratantonio Affiliation: EURECOM Network and Distributed Systems Security (NDSS) Symposium 2021 Download https://jbox.sjtu.edu.cn/l/Q1LDjO Contributor: yzy Overview Phishing attacks : problematic for mobile platforms. because they do not provide enough information for a user to reliably distinguish a legitimate app from a malicious app spoofing the UI of […]

[2021.09.29] [EuroSys 2019] ShieldStore: Shielded In-memory Keyvalue Storage with SGX

Nov 1, 2021gossipeditorSeminar

[2021.09.14] [CCS 2019] OPERA: Open Remote Attestation for Intel’s Secure Enclaves

Oct 25, 2021gossipeditorSeminarAttestation, SGX

Author: Guoxing Chen, Yinqian Zhang, Ten-Hwang Lai Affiliation: The Ohio State University, The Ohio State University, The Ohio State University Conference: CCS 2019 Paper Link: https://dl.acm.org/doi/10.1145/3319535.3354220 Note Link: https://jbox.sjtu.edu.cn/l/S1oYKk Contributor: pdh Overview This paper presents OPERA, which is an Open Platform for Enclave Remote Attestation. Instead of completely trusting the IAS, OPERA leverage the feature […]

[2021.09.29] [EuroSys 2019] ShieldStore: Shielded In-memory Keyvalue Storage with SGX

Sep 29, 2021gossipeditorSeminarSGX

Source: http://calab.kaist.ac.kr:8080/~jhuh/papers/kim_eurosys19_shieldst.pdf Authors: Taehoon Kim, Joongun Park, Jaewook Woo Download Note: https://jbox.sjtu.edu.cn/l/aF2d4t Contributor: cyp Overview key-value数据库在云服务中非常常用，比如 Memcached和redis。key-value数据库存储key作为 index，并且支持把在内存中的data放入磁盘，进行永久的存储。利用intel SGX的技术，可以防止恶意的云厂商对内存中数据的监听和修改。但是intel SGX的最大限制就是它的容量，它的EPC（ enclave page cash )只有128M，如果放入 enclave的数据大于128M，就会进行消耗很大的paging 操作。所以这篇文章提出了一个可以基于于intel SGX的key-value设计ShieldStore，它在enclave里面加密每个key-value对，当加密完成后，此时这些key-value已经受到加密性和完整性的保护，则可以把这些 key-value放入no-enclave的区域。

[2021.09.18] [USENIX Security 2021] Breaking Through Binaries: Compiler-quality Instrumentation for Better Binary-only Fuzzing

Sep 18, 2021gossipeditorSeminarFuzzing

Source: https://www.usenix.org/system/files/sec21-nagy.pdf Slides: https://www.usenix.org/system/files/sec21_slides_nagy.pdf Authors: Stefan Nagy, Anh Nguyen-Tuong, Jason D. Hiser, Jack W. Davidson, Matthew Hick Download Note: https://jbox.sjtu.edu.cn/l/21uROA Contributor: ydh Overview 目前的二进制灰盒fuzz技术主要包括三种：硬件辅助追踪覆盖率，效率高但灵活性差；动态二进制模拟插桩，效率低；二进制代码重写，容易出错。这篇文章从基于源码fuzz的编译优化过程中汲取一些有效的方法策略运用在二进制fuzz的插桩中从而提高二进制fuzz的性能和有效性。

[2021.09.01] [MIDDLEWARE 2019] AccTEE: A WebAssembly-based Two-way Sandbox for Trusted Resource Accounting >

Sep 1, 2021gossipeditorSeminarSGX, wasm

Source: https://dl.acm.org/doi/abs/10.1145/3361525.3361541 Authors: David Goltzsche(TU Braunschweig, Germany);Manuel Nieke(TU Braunschweig, Germany);Thomas Knauth(Intel, United States);Rüdiger Kapitza(TU Braunschweig, Germany) Download Note: https://jbox.sjtu.edu.cn/l/S11yks Contributor: lty 远程计算，例如云计算、客户端的web应用和volunteer计算。这些服务的资源计算方法依赖于infrastructure provider。这些远程计算往往需要沙箱对其进行保护，理由是：隔离主机环境免受攻击；控制和限制资源使用。通常云服务器和代码提供者相互都是不信任的。 AccTEE是一个在服务器和用户之间提供资源使用可信服务的双路沙箱。SGX+WASM,在确保代码和数据的机密性和完整性的同时，使用自动代码工具进行细粒度的资源核算。