This document discusses securing web applications using data flow assertions. It begins by outlining common security issues like deputy confusion and encoding confusion. It then introduces the concept of adding labels to data and filtering output to address these issues. Labels provide context about who generated data, and filters check security policies before database changes or outputting data. The implementation in Ruby on Rails inserts labeling and filtering automatically in the stack to propagate labels and enforce security policies defined in a domain-specific language.
Protecting Facebook Account From Malicious Attacking ApplicationsIRJET Journal
This document discusses techniques for protecting Facebook accounts from malicious attacking applications. It proposes a novel rank-based image watermarking strategy that embeds a secret message into images using digital watermarking and encryption. The strategy splits images into pieces, embeds watermarks into DCT coefficients of blocks, and encrypts the secret message before combining it with the watermarks. This provides high security for secret messages shared through image watermarking while maintaining imperceptibility and robustness against attacks. The system can detect hackers who try to decrypt images with the wrong secret key by notifying an administrator.
An Anti-Phishing Framework Based on Visual CryptographyIRJET Journal
This document proposes an anti-phishing framework based on visual cryptography to address the growing issue of phishing attacks. It involves splitting an image captcha into two shares stored separately so that only when combined can the original captcha be revealed, preventing phishing sites from accessing it. During registration, a user and server each contribute keys to generate the captcha image, then split into shares. For login, the user share is combined with the stored server share to reconstruct and display the captcha for password verification. The framework aims to provide three layers of security to protect user information and detect phishing sites through image captcha validation.
This document proposes IASL, an image-based authentication system that uses CAPTCHAs (tests to distinguish humans from computers) as graphical passwords. IASL addresses security issues with traditional text passwords by requiring users to click on points in a sequence of CAPTCHA images during login. It protects against online dictionary attacks since each login requires solving a new CAPTCHA. The document discusses recognition-based and text-based IASL schemes, and explains that IASL offers protection against guessing, shoulder surfing, and relay attacks by using computationally difficult CAPTCHAs that change for each login attempt.
Instant Messaging (IM) Android applications are a trend nowadays. These applications are categorized according to their features: usability, flexibility, privacy and security. However, IM applications tend to be inflexible in terms of functionality offered. The “Dble-U” system was developed as a solution to this inflexibility, with a focus on privacy as an example use case. “Dble-U” is a configurable modular system consisting of an Android chatting application, a privacy controller application, along with a tracking server application. This modularity allows for groups of individuals to build custom features into their IM application.
A BASTION MOBILEID-BASED AUTHENTICATION TECHNIQUE (BMBAT)IJNSA Journal
Despite their proven security breaches, text passwords have been dominating all other methods of human authentication over the web for tens of years, however, the frequent successful attacks that exploit the passwords vulnerable model raises the need to enhance web authentication security. This paper proposes BMBAT; a new authentication technique to replace passwords, that leverages the pervasive user mobile
devices, QR codes and the strength of symmetric and asymmetric cryptography. In BMBAT, the user’s mobile device acts as a user identity prover and a verifier for the server; it employs a challenge-response model with a dual mode of encryption using AES and RSA keys to mutually authenticate the client to the server and vice-versa. BMBAT combats a set of attack vectors including phishing attacks, man in the middle attacks, eavesdropping and session hijacking. A prototype of BMBAT has been developed and evaluated; the evaluation results show that BMBAT is a feasible and competitive alternative to passwords.
There are lots of tools emerging that appear to give us wonderful statistics and data about Twitter and it’s hard to know which data we actually want and how we want to receive it.
As Twitter's API has been undergoing a few changes recently, we wanted to give an overview of the information that you can still get from the platform itself and then provide some guidance on the best way to measure the data.
There are four main areas of Twitter data:
1. User data - relates to the user who posted the message.
2. Friend and follower data - relates to the relationship a user has to other users.
3. Tweet data - all the details and content relating to a particular tweet.
4. Places and Geographic data - the geographic and location based aspects relating to a person or twee.
To measure the data there are also four main measurements that we use to understand the impact of activities on Twitter:
1. Impressions - aggregated users exposed to messages.
2. Reach - number of unique users exposed to a message.
3. Frequency - number of times each unique user reached is exposed to a message.
4. Relevancy - reach to specific demographics.
When it comes to the ROI of these messages it's important to think about how they compare to your other channels in terms of reach and impressions.
Take a look at the presentation below - we hope it helps to reveal some of the Twitter data you can access and ways in which you might go about measuring it.
IRJET- Review on the Simple Text Messages ClassificationIRJET Journal
This document reviews a proposed mobile application called MojoText - Text Messenger that aims to add extra functionality to simple text messaging. The key features of the proposed application include categorizing messages by personal, social, transactional or user-defined categories with color codes, searching messages by customized date, scheduling text delivery, hiding personal messages, and reminders. The document discusses the system architecture and algorithms that could be used for message categorization, including stopword removal, pattern matching, and decision trees. It concludes that the proposed application could provide convenience by allowing users to classify and organize text messages to prevent important messages from getting lost.
Private cloud computing challenges and Architecture for implementing effectiv...IJESM JOURNAL
Cloud computing is a growing area of concern in the IT security community because cloud architectures are literally popping up all over. Public clouds are available from Google.com, Amazon.com, Microsoft, Oracle/Sun, and many other vendors. Private cloud technologies, where the cloud software is loaded on local or in-house server hardware, are available from VMware, Eucalyptus, Citrix, Microsoft, and there are thousands of vendors offering private cloud with all sorts. With all of the hyperbole has come a large swell of early-adopters and developers. This paper aims to provide an architectural blueprint for implementing effective security within a private cloud environment
Protecting Facebook Account From Malicious Attacking ApplicationsIRJET Journal
This document discusses techniques for protecting Facebook accounts from malicious attacking applications. It proposes a novel rank-based image watermarking strategy that embeds a secret message into images using digital watermarking and encryption. The strategy splits images into pieces, embeds watermarks into DCT coefficients of blocks, and encrypts the secret message before combining it with the watermarks. This provides high security for secret messages shared through image watermarking while maintaining imperceptibility and robustness against attacks. The system can detect hackers who try to decrypt images with the wrong secret key by notifying an administrator.
An Anti-Phishing Framework Based on Visual CryptographyIRJET Journal
This document proposes an anti-phishing framework based on visual cryptography to address the growing issue of phishing attacks. It involves splitting an image captcha into two shares stored separately so that only when combined can the original captcha be revealed, preventing phishing sites from accessing it. During registration, a user and server each contribute keys to generate the captcha image, then split into shares. For login, the user share is combined with the stored server share to reconstruct and display the captcha for password verification. The framework aims to provide three layers of security to protect user information and detect phishing sites through image captcha validation.
This document proposes IASL, an image-based authentication system that uses CAPTCHAs (tests to distinguish humans from computers) as graphical passwords. IASL addresses security issues with traditional text passwords by requiring users to click on points in a sequence of CAPTCHA images during login. It protects against online dictionary attacks since each login requires solving a new CAPTCHA. The document discusses recognition-based and text-based IASL schemes, and explains that IASL offers protection against guessing, shoulder surfing, and relay attacks by using computationally difficult CAPTCHAs that change for each login attempt.
Instant Messaging (IM) Android applications are a trend nowadays. These applications are categorized according to their features: usability, flexibility, privacy and security. However, IM applications tend to be inflexible in terms of functionality offered. The “Dble-U” system was developed as a solution to this inflexibility, with a focus on privacy as an example use case. “Dble-U” is a configurable modular system consisting of an Android chatting application, a privacy controller application, along with a tracking server application. This modularity allows for groups of individuals to build custom features into their IM application.
A BASTION MOBILEID-BASED AUTHENTICATION TECHNIQUE (BMBAT)IJNSA Journal
Despite their proven security breaches, text passwords have been dominating all other methods of human authentication over the web for tens of years, however, the frequent successful attacks that exploit the passwords vulnerable model raises the need to enhance web authentication security. This paper proposes BMBAT; a new authentication technique to replace passwords, that leverages the pervasive user mobile
devices, QR codes and the strength of symmetric and asymmetric cryptography. In BMBAT, the user’s mobile device acts as a user identity prover and a verifier for the server; it employs a challenge-response model with a dual mode of encryption using AES and RSA keys to mutually authenticate the client to the server and vice-versa. BMBAT combats a set of attack vectors including phishing attacks, man in the middle attacks, eavesdropping and session hijacking. A prototype of BMBAT has been developed and evaluated; the evaluation results show that BMBAT is a feasible and competitive alternative to passwords.
There are lots of tools emerging that appear to give us wonderful statistics and data about Twitter and it’s hard to know which data we actually want and how we want to receive it.
As Twitter's API has been undergoing a few changes recently, we wanted to give an overview of the information that you can still get from the platform itself and then provide some guidance on the best way to measure the data.
There are four main areas of Twitter data:
1. User data - relates to the user who posted the message.
2. Friend and follower data - relates to the relationship a user has to other users.
3. Tweet data - all the details and content relating to a particular tweet.
4. Places and Geographic data - the geographic and location based aspects relating to a person or twee.
To measure the data there are also four main measurements that we use to understand the impact of activities on Twitter:
1. Impressions - aggregated users exposed to messages.
2. Reach - number of unique users exposed to a message.
3. Frequency - number of times each unique user reached is exposed to a message.
4. Relevancy - reach to specific demographics.
When it comes to the ROI of these messages it's important to think about how they compare to your other channels in terms of reach and impressions.
Take a look at the presentation below - we hope it helps to reveal some of the Twitter data you can access and ways in which you might go about measuring it.
IRJET- Review on the Simple Text Messages ClassificationIRJET Journal
This document reviews a proposed mobile application called MojoText - Text Messenger that aims to add extra functionality to simple text messaging. The key features of the proposed application include categorizing messages by personal, social, transactional or user-defined categories with color codes, searching messages by customized date, scheduling text delivery, hiding personal messages, and reminders. The document discusses the system architecture and algorithms that could be used for message categorization, including stopword removal, pattern matching, and decision trees. It concludes that the proposed application could provide convenience by allowing users to classify and organize text messages to prevent important messages from getting lost.
Private cloud computing challenges and Architecture for implementing effectiv...IJESM JOURNAL
Cloud computing is a growing area of concern in the IT security community because cloud architectures are literally popping up all over. Public clouds are available from Google.com, Amazon.com, Microsoft, Oracle/Sun, and many other vendors. Private cloud technologies, where the cloud software is loaded on local or in-house server hardware, are available from VMware, Eucalyptus, Citrix, Microsoft, and there are thousands of vendors offering private cloud with all sorts. With all of the hyperbole has come a large swell of early-adopters and developers. This paper aims to provide an architectural blueprint for implementing effective security within a private cloud environment
This document provides an overview of the key elements in Hearthstone, an online collectible card game. It discusses the top-level components like heroes, cards, decks, mana and hero powers. Cards can summon minions to the board or be weapons that a hero can equip. Minions have attack power and health and can engage in combat. The goal is to reduce the opponent's hero health to zero while defending your own hero.
The document discusses various methods for securing DNS, including restricting zone transfers to prevent enumeration of internal hosts, restricting dynamic updates to authorized sources, protecting against spoofing by disabling recursion and restricting queries, and implementing a split DNS configuration to control external visibility of internal domains. It provides configuration examples for BIND and Microsoft DNS servers to implement these security remedies.
El documento habla sobre un estudio realizado por el Laboratorio Profeco sobre diferentes marcas y presentaciones de yogur. El estudio evaluó 59 yogures considerando parámetros como información al consumidor, contenido neto, aporte nutrimental, características para ser considerado yogur, y calidad sanitaria. Los resultados mostraron que algunos productos no cumplían con los requisitos para ser considerados yogur. Se proporcionan recomendaciones de compra y consumo de yogur.
Fundamentals of Linux Privilege Escalationnullthreat
This document provides an introduction to techniques for Linux privilege escalation. It discusses exploiting vulnerabilities like kernel exploits, taking advantage of permissive file permissions like world-readable/writable files and SetUID programs, exploiting overly permissive sudo configurations, and issues that can arise from improper PATH variable configuration like executing a Trojan program. The document demonstrates finding and using exploits, identifying vulnerable configurations, and how an attacker could leverage each technique to escalate privileges on a target Linux system. It also provides recommendations for how to protect against these methods through patching, auditing permissions and configurations, and restricting what programs can be executed with elevated privileges.
PowerUp - Automating Windows Privilege EscalationWill Schroeder
This slidedeck was given as a firetalk at @BSidesBoston '14, and covers the genesis and implementation of PowerUp, a Powershell tool for Windows privilege escalation.
As organizations assess the security of their information systems, the need for automation has become more and more apparent. Not only are organizations attempting to automate their assessments, the need is becoming more pressing to perform assessments centrally against large numbers of enterprise systems. Penetration testers can use this automation to make their post-exploitation efforts more thorough, repeatable, and efficient. Defenders need to understand the techniques attackers are using once an initial compromise has occurred so they can build defenses to stop the attacks. Microsoft's PowerShell scripting language has become the defacto standard for many organizations looking to perform this level of distributed automation. In this presentation James Tarala, of Enclave Security, will describe to students the enterprise capabilities PowerShell offers and show practical examples of how PowerShell can be used to perform large scale penetration tests of Microsoft Windows systems.
Break Loose Acting To Forestall Emulation BlastIRJET Journal
This document proposes a new approach to detect phishing sites using visual cryptography, linear programming algorithms, and random pattern algorithms. The approach involves generating an image captcha during user registration by encoding a secret key into an image. This image is then split into two shares - one stored on the server and one given to the user. During login, the shares are combined to reconstruct the original image captcha, which the user must enter correctly to log in. This helps validate that the site is legitimate and not a phishing site impersonating it. The approach aims to improve online security and prevent fraud by making it difficult for phishing sites to steal users' credentials.
Enfrentando os Desafios das Ameaças Combinadas.ISH Tecnologia
Slides usados no web seminário "Enfrentando os Desafios das Ameaças Combinadas" ministrado por Ricardo Valente da Mcafee para a série de web seminários oferecidos pela ISH Tecnologia. Para conhecer mais da ISH visite http://www.ish.com.br ou siga a ISH http://twitter.com/ishtecnologia
The document discusses security requirements for a mobile email client. It identifies potential use cases and abuse cases. It then analyzes assets, threats, and security requirements. It reviews code fragments and suggests secure coding practices to address vulnerabilities. Finally, it proposes four secure design patterns to enhance security: 1) thin client pattern to process data centrally and present locally, 2) thin device pattern to limit data on devices and replicate to data centers, 3) access control pattern to restrict functionality, and 4) fail-safe defaults pattern to avoid security misconfigurations.
Connection String Parameter Pollution AttacksChema Alonso
Paper about Connection String Attacks that focus in Connection String Parameter Pollution in Web Applications. Presented in Ekoparty 2009, Black Hat DC 2010 and Troopers 2010
This document summarizes vulnerabilities in web applications and methods to protect against them. It discusses how vulnerabilities can occur from issues like format string exploits, SQL injection, and cross-site scripting. The document also describes different approaches to testing for vulnerabilities, including white-box and black-box testing. Additionally, it analyzes vulnerability information from various organization's lists of top vulnerability categories to provide a comparative overview. The goal is to help organizations identify and address vulnerabilities in their web applications.
Keystroke with Data Leakage Detection for Secure Email AuthenticationYogeshIJTSRD
The user authentication is the important factor which allows the user to use a particular software. The user authentication is also performed in various kinds of social media such as Gmail, Facebook, etc. The traditional password system is used for user authentication. But this technique has a lot of demerits in it. Some hackers also cracks the password and perform some unwanted actions in the user authentication. In order to remove the difficulties in this traditional password technique and to provide additional security in user authentication, the keystroke with data leakage detection for secure email authentication is designed. This system uses Keystroke Dynamics. This system consists of five different types of modules such as Email Framework Construction, User Enrolment, Keystroke Authentication, Data Sharing and Data Leakage Detection. This system gets the details of the user such as name and email. Then it allows to enter the password. This password is stored along with the keystroke dynamics data such as the typing speed of the password and the threshold value. Both the Keystroke dynamics data and the original password are stored in the database. When the user wants to log into the system, the user has to give the password according to the keystroke dynamics data. Then only, the user can log into the system. Hence this system can also be used in Cyber security and provide security and privacy for the user data. Mrs. V. Hemalatha | V. Boominathan | K. Harithas | P. Raj Kumar | S. Vijaya Bharathi "Keystroke with Data Leakage Detection for Secure Email Authentication" Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-5 | Issue-3 , April 2021, URL: https://www.ijtsrd.com/papers/ijtsrd39969.pdf Paper URL: https://www.ijtsrd.com/computer-science/computer-security/39969/keystroke-with-data-leakage-detection-for-secure-email-authentication/mrs-v-hemalatha
The document discusses privacy and security concerns with Web 2.0. It notes that with Web 2.0, more private information like messages, likes, and mouse movements will be collected and shared. There are questions around how this information will be used, such as employers screening job applicants via social media. Security is also a concern, with the average of 28.5 people becoming victims of identity theft each minute. Responsibility over privacy and security on Web 2.0 sites is unclear.
This document discusses a proposed framework for securing biometric templates using encryption and error correction. It begins with an introduction to biometric systems and their use of templates to identify individuals. It then discusses existing issues with transmitting biometric templates due to noise and errors. The proposed framework encrypts biometric templates using a secret key generated from braid groups before transmission. It also uses fuzzy error correction codes to detect and correct any errors introduced during transmission. The framework aims to provide both security of biometric templates and accuracy of identification by addressing noise issues.
Myths and truths, the untold story of authentication and authorizationBill GU
This document discusses authentication and authorization, specifically related to a vulnerability discovered in Microsoft Office 365 in January 2016. The vulnerability allowed an attacker to gain unrestricted access to a victim's Office 365 account. The document then discusses how SAML assertions are used for federated authentication with Office 365 and how the vulnerability was potentially exploited. It provides a timeline of events and lists some organizations that may have been impacted. The document concludes by discussing the importance of single sign-on (SSO) technologies like SAML and how Genesys Cloud implements SSO to improve the user experience and enhance security.
This document discusses email security and the FortiMail solution. It begins by outlining the business critical role of email but also how email has become a major threat vector, with threats delivered via links, attachments, and impersonation. It then introduces FortiMail as providing advanced threat protection through multi-layer security and integration with the Fortinet Security Fabric. FortiMail offers comprehensive protection, high efficacy, and industry-leading performance and cost. It provides options for on-premises, virtual, and cloud deployments to suit organizations of any size.
Add End User Sign-in, User Management, and Security to Your Mobile and Web Ap...Amazon Web Services
Ed Lima, a Solutions Architect at AWS, discusses adding user sign-in, user management, and security to mobile and web applications using Amazon Cognito. The presentation covers Amazon Cognito Identity for user authentication and authorization, Cognito User Pools for user management, and how applications can integrate with Cognito. It also demonstrates how Cognito can federate with identity providers and provides sample use cases for business to consumer, business to business, and IoT applications.
This document discusses using Carrier Ethernet for mobile broadband backhaul networks to address performance and security issues. It describes how optimizing backhaul networks through more efficient use of network resources and preventing botnet-generated traffic can help mobile operators reclaim spectrum, increase network availability, lower costs, and improve defenses against outages. The solution involves using DNS to block bot-related domains and activity as well as segregate and analyze traffic from infected users.
This document discusses an email automation system created using Java Server Pages (JSP) and SQL Server 2000. The system allows users to send and receive emails and includes features like tracking emails, reporting, adding/removing accounts. It uses a client-server architecture for storage and access. Dataflow diagrams and database tables are presented. The system provides a user-friendly interface and leverages security and recovery of the database platform. Automating email could provide significant benefits in efficiency and reduced workload compared to a manual system.
This document discusses an email automation system created using Java Server Pages (JSP) and SQL Server 2000. The system allows users to send and receive emails and includes features like tracking emails, reporting, adding/removing accounts. It uses a client-server architecture for storage and access. Dataflow diagrams and database tables are presented. The system provides a user-friendly interface and leverages security and recovery of the database platform. Automating email could provide significant benefits in efficiency and reduced workload.
This document provides an overview of the key elements in Hearthstone, an online collectible card game. It discusses the top-level components like heroes, cards, decks, mana and hero powers. Cards can summon minions to the board or be weapons that a hero can equip. Minions have attack power and health and can engage in combat. The goal is to reduce the opponent's hero health to zero while defending your own hero.
The document discusses various methods for securing DNS, including restricting zone transfers to prevent enumeration of internal hosts, restricting dynamic updates to authorized sources, protecting against spoofing by disabling recursion and restricting queries, and implementing a split DNS configuration to control external visibility of internal domains. It provides configuration examples for BIND and Microsoft DNS servers to implement these security remedies.
El documento habla sobre un estudio realizado por el Laboratorio Profeco sobre diferentes marcas y presentaciones de yogur. El estudio evaluó 59 yogures considerando parámetros como información al consumidor, contenido neto, aporte nutrimental, características para ser considerado yogur, y calidad sanitaria. Los resultados mostraron que algunos productos no cumplían con los requisitos para ser considerados yogur. Se proporcionan recomendaciones de compra y consumo de yogur.
Fundamentals of Linux Privilege Escalationnullthreat
This document provides an introduction to techniques for Linux privilege escalation. It discusses exploiting vulnerabilities like kernel exploits, taking advantage of permissive file permissions like world-readable/writable files and SetUID programs, exploiting overly permissive sudo configurations, and issues that can arise from improper PATH variable configuration like executing a Trojan program. The document demonstrates finding and using exploits, identifying vulnerable configurations, and how an attacker could leverage each technique to escalate privileges on a target Linux system. It also provides recommendations for how to protect against these methods through patching, auditing permissions and configurations, and restricting what programs can be executed with elevated privileges.
PowerUp - Automating Windows Privilege EscalationWill Schroeder
This slidedeck was given as a firetalk at @BSidesBoston '14, and covers the genesis and implementation of PowerUp, a Powershell tool for Windows privilege escalation.
As organizations assess the security of their information systems, the need for automation has become more and more apparent. Not only are organizations attempting to automate their assessments, the need is becoming more pressing to perform assessments centrally against large numbers of enterprise systems. Penetration testers can use this automation to make their post-exploitation efforts more thorough, repeatable, and efficient. Defenders need to understand the techniques attackers are using once an initial compromise has occurred so they can build defenses to stop the attacks. Microsoft's PowerShell scripting language has become the defacto standard for many organizations looking to perform this level of distributed automation. In this presentation James Tarala, of Enclave Security, will describe to students the enterprise capabilities PowerShell offers and show practical examples of how PowerShell can be used to perform large scale penetration tests of Microsoft Windows systems.
Break Loose Acting To Forestall Emulation BlastIRJET Journal
This document proposes a new approach to detect phishing sites using visual cryptography, linear programming algorithms, and random pattern algorithms. The approach involves generating an image captcha during user registration by encoding a secret key into an image. This image is then split into two shares - one stored on the server and one given to the user. During login, the shares are combined to reconstruct the original image captcha, which the user must enter correctly to log in. This helps validate that the site is legitimate and not a phishing site impersonating it. The approach aims to improve online security and prevent fraud by making it difficult for phishing sites to steal users' credentials.
Enfrentando os Desafios das Ameaças Combinadas.ISH Tecnologia
Slides usados no web seminário "Enfrentando os Desafios das Ameaças Combinadas" ministrado por Ricardo Valente da Mcafee para a série de web seminários oferecidos pela ISH Tecnologia. Para conhecer mais da ISH visite http://www.ish.com.br ou siga a ISH http://twitter.com/ishtecnologia
The document discusses security requirements for a mobile email client. It identifies potential use cases and abuse cases. It then analyzes assets, threats, and security requirements. It reviews code fragments and suggests secure coding practices to address vulnerabilities. Finally, it proposes four secure design patterns to enhance security: 1) thin client pattern to process data centrally and present locally, 2) thin device pattern to limit data on devices and replicate to data centers, 3) access control pattern to restrict functionality, and 4) fail-safe defaults pattern to avoid security misconfigurations.
Connection String Parameter Pollution AttacksChema Alonso
Paper about Connection String Attacks that focus in Connection String Parameter Pollution in Web Applications. Presented in Ekoparty 2009, Black Hat DC 2010 and Troopers 2010
This document summarizes vulnerabilities in web applications and methods to protect against them. It discusses how vulnerabilities can occur from issues like format string exploits, SQL injection, and cross-site scripting. The document also describes different approaches to testing for vulnerabilities, including white-box and black-box testing. Additionally, it analyzes vulnerability information from various organization's lists of top vulnerability categories to provide a comparative overview. The goal is to help organizations identify and address vulnerabilities in their web applications.
Keystroke with Data Leakage Detection for Secure Email AuthenticationYogeshIJTSRD
The user authentication is the important factor which allows the user to use a particular software. The user authentication is also performed in various kinds of social media such as Gmail, Facebook, etc. The traditional password system is used for user authentication. But this technique has a lot of demerits in it. Some hackers also cracks the password and perform some unwanted actions in the user authentication. In order to remove the difficulties in this traditional password technique and to provide additional security in user authentication, the keystroke with data leakage detection for secure email authentication is designed. This system uses Keystroke Dynamics. This system consists of five different types of modules such as Email Framework Construction, User Enrolment, Keystroke Authentication, Data Sharing and Data Leakage Detection. This system gets the details of the user such as name and email. Then it allows to enter the password. This password is stored along with the keystroke dynamics data such as the typing speed of the password and the threshold value. Both the Keystroke dynamics data and the original password are stored in the database. When the user wants to log into the system, the user has to give the password according to the keystroke dynamics data. Then only, the user can log into the system. Hence this system can also be used in Cyber security and provide security and privacy for the user data. Mrs. V. Hemalatha | V. Boominathan | K. Harithas | P. Raj Kumar | S. Vijaya Bharathi "Keystroke with Data Leakage Detection for Secure Email Authentication" Published in International Journal of Trend in Scientific Research and Development (ijtsrd), ISSN: 2456-6470, Volume-5 | Issue-3 , April 2021, URL: https://www.ijtsrd.com/papers/ijtsrd39969.pdf Paper URL: https://www.ijtsrd.com/computer-science/computer-security/39969/keystroke-with-data-leakage-detection-for-secure-email-authentication/mrs-v-hemalatha
The document discusses privacy and security concerns with Web 2.0. It notes that with Web 2.0, more private information like messages, likes, and mouse movements will be collected and shared. There are questions around how this information will be used, such as employers screening job applicants via social media. Security is also a concern, with the average of 28.5 people becoming victims of identity theft each minute. Responsibility over privacy and security on Web 2.0 sites is unclear.
This document discusses a proposed framework for securing biometric templates using encryption and error correction. It begins with an introduction to biometric systems and their use of templates to identify individuals. It then discusses existing issues with transmitting biometric templates due to noise and errors. The proposed framework encrypts biometric templates using a secret key generated from braid groups before transmission. It also uses fuzzy error correction codes to detect and correct any errors introduced during transmission. The framework aims to provide both security of biometric templates and accuracy of identification by addressing noise issues.
Myths and truths, the untold story of authentication and authorizationBill GU
This document discusses authentication and authorization, specifically related to a vulnerability discovered in Microsoft Office 365 in January 2016. The vulnerability allowed an attacker to gain unrestricted access to a victim's Office 365 account. The document then discusses how SAML assertions are used for federated authentication with Office 365 and how the vulnerability was potentially exploited. It provides a timeline of events and lists some organizations that may have been impacted. The document concludes by discussing the importance of single sign-on (SSO) technologies like SAML and how Genesys Cloud implements SSO to improve the user experience and enhance security.
This document discusses email security and the FortiMail solution. It begins by outlining the business critical role of email but also how email has become a major threat vector, with threats delivered via links, attachments, and impersonation. It then introduces FortiMail as providing advanced threat protection through multi-layer security and integration with the Fortinet Security Fabric. FortiMail offers comprehensive protection, high efficacy, and industry-leading performance and cost. It provides options for on-premises, virtual, and cloud deployments to suit organizations of any size.
Add End User Sign-in, User Management, and Security to Your Mobile and Web Ap...Amazon Web Services
Ed Lima, a Solutions Architect at AWS, discusses adding user sign-in, user management, and security to mobile and web applications using Amazon Cognito. The presentation covers Amazon Cognito Identity for user authentication and authorization, Cognito User Pools for user management, and how applications can integrate with Cognito. It also demonstrates how Cognito can federate with identity providers and provides sample use cases for business to consumer, business to business, and IoT applications.
This document discusses using Carrier Ethernet for mobile broadband backhaul networks to address performance and security issues. It describes how optimizing backhaul networks through more efficient use of network resources and preventing botnet-generated traffic can help mobile operators reclaim spectrum, increase network availability, lower costs, and improve defenses against outages. The solution involves using DNS to block bot-related domains and activity as well as segregate and analyze traffic from infected users.
This document discusses an email automation system created using Java Server Pages (JSP) and SQL Server 2000. The system allows users to send and receive emails and includes features like tracking emails, reporting, adding/removing accounts. It uses a client-server architecture for storage and access. Dataflow diagrams and database tables are presented. The system provides a user-friendly interface and leverages security and recovery of the database platform. Automating email could provide significant benefits in efficiency and reduced workload compared to a manual system.
This document discusses an email automation system created using Java Server Pages (JSP) and SQL Server 2000. The system allows users to send and receive emails and includes features like tracking emails, reporting, adding/removing accounts. It uses a client-server architecture for storage and access. Dataflow diagrams and database tables are presented. The system provides a user-friendly interface and leverages security and recovery of the database platform. Automating email could provide significant benefits in efficiency and reduced workload.
Evolving your Data Access with MongoDB Stitch - Drew Di PalmaMongoDB
You have valuable data in MongoDB and while it's important to use that data to empower your users and customers it can be tough to do so in a safe, secure way. In this session, you'll learn how to simply connect your users with the data they need using MongoDB Stitch.
The document discusses techniques for detecting "man in the browser" (MitB) attacks, where malware running in a user's browser is able to intercept and modify traffic between the browser and web applications. It describes shape-based tests that examine requests for unusual changes typical of malware, and content-based tests where the server embeds a random value in content and the browser verifies it was not altered to detect tampering by malware. The overall goal is to identify infected client sessions to protect businesses from the risks posed by consumers being attacked.
Network security consists of the policies and practices adopted to prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources.
The document discusses Trend Micro's Smart Protection Network for detecting and responding to malware threats. It summarizes that the threat landscape is becoming more dangerous and sophisticated as malware proliferates and evolves in complexity. The Smart Protection Network aims to provide immediate protection by correlating information from its global network, including file and web reputations, to rapidly identify and block new threats across multiple systems.
Identity based cryptography for client side security in web applications (web...eSAT Publishing House
IJRET : International Journal of Research in Engineering and Technology is an international peer reviewed, online journal published by eSAT Publishing House for the enhancement of research in various disciplines of Engineering and Technology. The aim and scope of the journal is to provide an academic medium and an important reference for the advancement and dissemination of research results that support high-level learning, teaching and research in the fields of Engineering and Technology. We bring together Scientists, Academician, Field Engineers, Scholars and Students of related fields of Engineering and Technologyis an international peer reviewed, online journal published by eSAT Publishing House for the enhancement of research in various disciplines of Engineering and Technology. The aim and scope of the journal is to provide an academic medium and an important reference for the advancement and dissemination of research results that support high-level learning, teaching and research in the fields of Engineering and Technology. We bring together Scientists, Academician, Field Engineers, Scholars and Students of related fields of Engineering and Technology
Programming Foundation Models with DSPy - Meetup SlidesZilliz
Prompting language models is hard, while programming language models is easy. In this talk, I will discuss the state-of-the-art framework DSPy for programming foundation models with its powerful optimizers and runtime constraint system.
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfChart Kalyan
A Mix Chart displays historical data of numbers in a graphical or tabular form. The Kalyan Rajdhani Mix Chart specifically shows the results of a sequence of numbers over different periods.
This presentation provides valuable insights into effective cost-saving techniques on AWS. Learn how to optimize your AWS resources by rightsizing, increasing elasticity, picking the right storage class, and choosing the best pricing model. Additionally, discover essential governance mechanisms to ensure continuous cost efficiency. Whether you are new to AWS or an experienced user, this presentation provides clear and practical tips to help you reduce your cloud costs and get the most out of your budget.
Introduction of Cybersecurity with OSS at Code Europe 2024Hiroshi SHIBATA
I develop the Ruby programming language, RubyGems, and Bundler, which are package managers for Ruby. Today, I will introduce how to enhance the security of your application using open-source software (OSS) examples from Ruby and RubyGems.
The first topic is CVE (Common Vulnerabilities and Exposures). I have published CVEs many times. But what exactly is a CVE? I'll provide a basic understanding of CVEs and explain how to detect and handle vulnerabilities in OSS.
Next, let's discuss package managers. Package managers play a critical role in the OSS ecosystem. I'll explain how to manage library dependencies in your application.
I'll share insights into how the Ruby and RubyGems core team works to keep our ecosystem safe. By the end of this talk, you'll have a better understanding of how to safeguard your code.
Best 20 SEO Techniques To Improve Website Visibility In SERPPixlogix Infotech
Boost your website's visibility with proven SEO techniques! Our latest blog dives into essential strategies to enhance your online presence, increase traffic, and rank higher on search engines. From keyword optimization to quality content creation, learn how to make your site stand out in the crowded digital landscape. Discover actionable tips and expert insights to elevate your SEO game.
Unlock the Future of Search with MongoDB Atlas_ Vector Search Unleashed.pdfMalak Abu Hammad
Discover how MongoDB Atlas and vector search technology can revolutionize your application's search capabilities. This comprehensive presentation covers:
* What is Vector Search?
* Importance and benefits of vector search
* Practical use cases across various industries
* Step-by-step implementation guide
* Live demos with code snippets
* Enhancing LLM capabilities with vector search
* Best practices and optimization strategies
Perfect for developers, AI enthusiasts, and tech leaders. Learn how to leverage MongoDB Atlas to deliver highly relevant, context-aware search results, transforming your data retrieval process. Stay ahead in tech innovation and maximize the potential of your applications.
#MongoDB #VectorSearch #AI #SemanticSearch #TechInnovation #DataScience #LLM #MachineLearning #SearchTechnology
Trusted Execution Environment for Decentralized Process MiningLucaBarbaro3
Presentation of the paper "Trusted Execution Environment for Decentralized Process Mining" given during the CAiSE 2024 Conference in Cyprus on June 7, 2024.
GraphRAG for Life Science to increase LLM accuracyTomaz Bratanic
GraphRAG for life science domain, where you retriever information from biomedical knowledge graphs using LLMs to increase the accuracy and performance of generated answers
5th LF Energy Power Grid Model Meet-up SlidesDanBrown980551
5th Power Grid Model Meet-up
It is with great pleasure that we extend to you an invitation to the 5th Power Grid Model Meet-up, scheduled for 6th June 2024. This event will adopt a hybrid format, allowing participants to join us either through an online Mircosoft Teams session or in person at TU/e located at Den Dolech 2, Eindhoven, Netherlands. The meet-up will be hosted by Eindhoven University of Technology (TU/e), a research university specializing in engineering science & technology.
Power Grid Model
The global energy transition is placing new and unprecedented demands on Distribution System Operators (DSOs). Alongside upgrades to grid capacity, processes such as digitization, capacity optimization, and congestion management are becoming vital for delivering reliable services.
Power Grid Model is an open source project from Linux Foundation Energy and provides a calculation engine that is increasingly essential for DSOs. It offers a standards-based foundation enabling real-time power systems analysis, simulations of electrical power grids, and sophisticated what-if analysis. In addition, it enables in-depth studies and analysis of the electrical power grid’s behavior and performance. This comprehensive model incorporates essential factors such as power generation capacity, electrical losses, voltage levels, power flows, and system stability.
Power Grid Model is currently being applied in a wide variety of use cases, including grid planning, expansion, reliability, and congestion studies. It can also help in analyzing the impact of renewable energy integration, assessing the effects of disturbances or faults, and developing strategies for grid control and optimization.
What to expect
For the upcoming meetup we are organizing, we have an exciting lineup of activities planned:
-Insightful presentations covering two practical applications of the Power Grid Model.
-An update on the latest advancements in Power Grid -Model technology during the first and second quarters of 2024.
-An interactive brainstorming session to discuss and propose new feature requests.
-An opportunity to connect with fellow Power Grid Model enthusiasts and users.
TrustArc Webinar - 2024 Global Privacy SurveyTrustArc
How does your privacy program stack up against your peers? What challenges are privacy teams tackling and prioritizing in 2024?
In the fifth annual Global Privacy Benchmarks Survey, we asked over 1,800 global privacy professionals and business executives to share their perspectives on the current state of privacy inside and outside of their organizations. This year’s report focused on emerging areas of importance for privacy and compliance professionals, including considerations and implications of Artificial Intelligence (AI) technologies, building brand trust, and different approaches for achieving higher privacy competence scores.
See how organizational priorities and strategic approaches to data security and privacy are evolving around the globe.
This webinar will review:
- The top 10 privacy insights from the fifth annual Global Privacy Benchmarks Survey
- The top challenges for privacy leaders, practitioners, and organizations in 2024
- Key themes to consider in developing and maintaining your privacy program
HCL Notes and Domino License Cost Reduction in the World of DLAUpanagenda
Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-and-domino-license-cost-reduction-in-the-world-of-dlau/
The introduction of DLAU and the CCB & CCX licensing model caused quite a stir in the HCL community. As a Notes and Domino customer, you may have faced challenges with unexpected user counts and license costs. You probably have questions on how this new licensing approach works and how to benefit from it. Most importantly, you likely have budget constraints and want to save money where possible. Don’t worry, we can help with all of this!
We’ll show you how to fix common misconfigurations that cause higher-than-expected user counts, and how to identify accounts which you can deactivate to save money. There are also frequent patterns that can cause unnecessary cost, like using a person document instead of a mail-in for shared mailboxes. We’ll provide examples and solutions for those as well. And naturally we’ll explain the new licensing model.
Join HCL Ambassador Marc Thomas in this webinar with a special guest appearance from Franz Walder. It will give you the tools and know-how to stay on top of what is going on with Domino licensing. You will be able lower your cost through an optimized configuration and keep it low going forward.
These topics will be covered
- Reducing license cost by finding and fixing misconfigurations and superfluous accounts
- How do CCB and CCX licenses really work?
- Understanding the DLAU tool and how to best utilize it
- Tips for common problem areas, like team mailboxes, functional/test users, etc
- Practical examples and best practices to implement right away
leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...alexjohnson7307
Predictive maintenance is a proactive approach that anticipates equipment failures before they happen. At the forefront of this innovative strategy is Artificial Intelligence (AI), which brings unprecedented precision and efficiency. AI in predictive maintenance is transforming industries by reducing downtime, minimizing costs, and enhancing productivity.
Digital Marketing Trends in 2024 | Guide for Staying AheadWask
https://www.wask.co/ebooks/digital-marketing-trends-in-2024
Feeling lost in the digital marketing whirlwind of 2024? Technology is changing, consumer habits are evolving, and staying ahead of the curve feels like a never-ending pursuit. This e-book is your compass. Dive into actionable insights to handle the complexities of modern marketing. From hyper-personalization to the power of user-generated content, learn how to build long-term relationships with your audience and unlock the secrets to success in the ever-shifting digital landscape.
4. Motivation
Today’s Web applications are complex
• Complex applications -> Modules
• Modules -> Separate Teams
• Separate Teams -> No unified security model
Security is a cross-cutting concern; we need an
abstraction for expressing policies and
enforcing them across the entire application
7. Deputy Confusion in Web Apps
John’s Browser Cloud Application
App John
String
Logic
App Jane
Jane’s Browser
App
Backend Server E-mail Server Database
8. Deputy Confusion at Facebook
Test your privacy settings by displaying your
profile as it is shown to your friends
10. Deputy Confusion at Facebook
Victor Victor
Instant
Nickolai’s Profile: Victor Feed:
Victor’s Profile: Nickolai Victor
Chat:
Victor
Victor’s Feed: Victor’s Friends:
Nickolai Nickolai
11. Deputy Confusion at Facebook
“Facebook Chat is now down for maintenance. The feature was
presumably disabled following a report that exposed a Facebook security
bug that allowed users to access and view friends’ live chats, friend
requests and friends in common.
The report indicates that access to this personal information was
accessible via Facebook’s privacy settings, with the Preview My Profile
feature creating the loophole to access the private live chats of friends.
With Preview My Profile, users can view how their profile appears to any
given Facebook friend. The bug apparently let those users see the live
chats and friend requests of the friend in question.
Unfortunately for the company, this is not the first time users’ personal
information has been exposed without consent. Earlier this year, user e-
mail addresses were exposed in a hiccup following a site update.”
12. Deputy Confusion in Web Apps
John’s Browser Cloud Application
App John
String
Logic
App Jane
Jane’s Browser
App
Backend Server E-mail Server Database
13. Encoding Confusion in Web Apps
• name: pwnall • name: pwnall
• password: • password:
awesome awesome ” OR “”=“
Correct login query: Password-less login query:
SELECT * FROM users SELECT * FROM users
WHERE name=“pwnall” WHERE name=“pwnall”
AND AND
password=“awesome” password=“awesome” OR
LIMIT 1 “”=“” LIMIT 1
15. Encoding Confusion in Web Apps
Browser Application Server
HTML View
CSS JavaScript String
Model
String
HTTP Request Controller
Form Cookies String
Text SQL
Backend Server E-mail Server Database
16. Encoding Confusion in Web Apps
params[:user]
Field Value
email costan@mit.edu
password mit
password2 mit
email password admin @user = User.new(params[:user])
costan@mit mit false
@user.save
it@mit secret true
…
17. Encoding Confusion in Web Apps
params[:user]
Field Value
email costan@mit.edu
password mit
password2 mit
admin true
email password admin @user = User.new(params[:user])
costan@mit mit true
@user.save
it@mit secret true
…
18. Encoding Confusion at GitHub
"The root cause of the vulnerability was a failure to properly check incoming
form parameters, a problem known as the mass-assignment vulnerability,"
GitHub co-founder Tom Preston-Werner wrote in a blog post on Sunday. "In
parallel to the attack investigation we initiated a full audit of the GitHub
codebase to ensure that no other instances of this vulnerability were
present.”
There is little doubt that the vulnerability was serious. As Homakov himself
noted on his blog, it gave him access to wipe any post in the Rails project and
even "pull/commit/push in any repository on GitHub". He said "lots of Rails
apps" were similarly vulnerable.
20. Eliminate the Confusion!
Add Labels to Data Filter Output Data
Labels address deputy confusion
• Prevent deputy confusion
This text was typed by Victor
– Check security policies before
Only show this to Victor’s friends making database changes
– Check privacy policies before
Labels address encoding confusion outputting data to the user
Unsafe text supplied by users • Prevent encoding confusion
Safe to splice in a HTML page – Only output HTML-safe pages
Safe to splice in a SQL query – Only issue SQL-safe database
queries
21. Encoding Confusion in Web Apps
params[:user]
Field Value
email costan@mit.edu
password mit
password2 mit
admin true
email password admin @user = User.new(params[:user])
costan@mit mit true
@user.save
it@mit secret true
…
22. Eliminating Encoding Confusion
params[:user]
Field Value
email costan@mit.edu
password mit
password2 mit
admin true
email password admin @user = User.new(params[:user])
costan@mit not created No security policy
Blocked for user dictionaries
it@mit secret true
…
23. Eliminating Deputy Confusion
params[:user]
Field Value
email costan@mit.edu
password mit
password2 mit
admin true
@user = User.new(params[:user])
Field Policy
email Users can edit their own
@user.save
password Users can edit their own Security policy: only admins
Blocked
admin Admins can edit any can write the admin field
26. Data Flow Assertions in Rails
• Labeling and Filtering
– Inserted automatically in the Rails stack
• Label propagation
– Hard to do without changing the interpreter
• API for security policies
– Domain-Specific Language (DSL) for model code
27. Labels and Filters in Rails
Database
Request
Model
Controller
Rack
Response View
29. Labels and Filters in Rails
Database
Filter Label
queries results
Request Label
input
Security policies
Response Filter
output
30. Labels and Filters in Rails
Database
Filter Label
queries results
Request Label
input
Model
Controller Security policies
Rack
Response View
Filter
output
31. Label Propagation:
Only show this to Victor’s friends
Unsafe text supplied by users
Safe to splice in a HTML page
(646) 434-8887
<dl>
<dt>Phone number:</dt>
<dd>(646) 434-8887</dd>
</dl>
<dl>
<dt>Phone number:</dt>
<dd><%= phone %></dd>
</dl>
Privacy labels (for deputy confusion) propagate automatically
32. Label Propagation:
Only show this to Victor’s friends
Unsafe text supplied by users
Safe to splice in a HTML page
(646) 434-8887
<dl>
<dt>Phone number:</dt>
<dd>(646) 434-8887</dd>
</dl>
<dl>
<dt>Phone number:</dt>
<dd><%= phone %></dd>
</dl>
Unsafe text labels propagate automatically
Other encoding labels do not propagate automatically
33. Label Propagation:
(646) 434-8887 Only show this to Victor’s friends
Unsafe text supplied by users
HTML escape Safe to splice in a HTML page
(646) 434-8887
<dl>
<dt>Phone number:</dt>
<dd>(646) 434-8887</dd>
</dl>
<dl>
<dt>Phone number:</dt>
<dd><%= phone %></dd>
</dl>
Unsafe text labels propagate automatically
Other encoding labels do not propagate automatically
34. Label Propagation:
Only show this to Victor’s friends
Unsafe text supplied by users
Safe to splice in a HTML page
(646) 434-8887
<dl>
<dt>Phone number:</dt>
<dd>(646) 434-8887</dd>
</dl>
<dl>
<dt>Phone number:</dt>
<dd><%= phone %></dd>
</dl>
Operations on labeled data are non-trivial, and
making them fast is challenging.
35. Label Propagation:
(646) 434-8887 Only show this to Victor’s friends
Unsafe text supplied by users
HTML escape Safe to splice in a HTML page
(646) 434-8887
<dl>
<dt>Phone number:</dt>
<dd>(646) 434-8887</dd>
</dl>
<dl>
<dt>Phone number:</dt>
<dd><%= phone %></dd>
</dl>
Operations on labeled data are non-trivial, and
making them fast is challenging.
Shows of hands: “Who used the Internet in 1995? How about 2005? Who uses Facebook now? You’ve gotta admit, we’ve come a long way. Look at how many things you can do with this Web application.How do you build something this complex without having it crash millions of times a day? Use modularization, as you would to build any other complex software system. Break down the application into modules, and have different people in the development team work on different modules. If you try to break down Facebook’s page into modules…
…you’ll see that if “comes apart” quite easily. The modules are disjoint, so developers can work on their own features without stepping on each other’s toes. Very efficient!
However, this efficiency has its price. The applications we build are so complex that no programmer’s can understand the entire application in detail. We have security experts, or entire teams devoted to security. But this means that all the other programmers don’t concern themselves with security!
Most security issues in cloud applications stem from two issues that we call deputy confusion and language confusion. I’d like to explain these issues, so I can show you what we’re doing to mitigate them.
A cloud application stores and processes data on behalf of its users, but uses a single set of credentials to access the database.This means that the database fully trusts every request that It receives from the application. So there is no mechanism to protect against a malicious user that manages to trick the application into sending a dangerous request to the database. We say that the database is a confused deputy, because it processes requests without knowing on whose behalf it’s doing the work.Furthermore, since the database is not aware of the application’s multiple users, the application code is responsible for keeping track of data ownership, as well as of any security requirements. This means that every line in the application code must be written with security in mind, which is really hard and error-prone.Last but not least, we have a similar situation on the browser side: the browser fully trusts all the JavaScript code received from the application, and executes it with the application’s credentials.
The confused deputy problem is not relegated to the application’s interfaces with the database and browser. Large applications, such as Facebook, are broken into loosely coupled models. Now each module is prone to deputy confusion, and all it takes is one tiny mistake at the interface between two modules.Did you know Facebook has a feature that shows you someone else’s view of your profile, so you can check your privacy settings? Show of hands: how many of you used this?
Here’s what the feature looks like. In this example, I’m making sure that Nickolai, my professor, doesn’t get to see any pictures of me drinking beer. Please look at each module, and think -- which user does it represent? Which modules should use my credentials, and which modules should use Nickolai’s credential?
Here’s a my answer. Did you get all of them right?If you couldn’t solve this right away, think of the poor guy that had to code this up! One single mistake means private information leakage, and front-page news coverage!
Yup. Exactly. Front page news coverage. Facebook’s engineers messed up when they coded this feature!We could say that Facebook has bad engineers and move on. But, let’s face it, Facebook is quite wealthy, and does attract good coders.So we must accept that programmers make mistakes. We can’t fight this problem by asking application developers to “pay more attention”, we have to give them better tools!
That was a rather extreme example. Most applications look like this, not like Facebook, so let’s go back to the interfaces between the cloud application, the browser, and the database. When discussing confused deputies, I said “if a malicious user tricks the application into sending a dangerous query to the database”… how does that happen? Why would an application send a bad query to the server?
Requests sent from the cloud application to the database use a language called SQL. I have a couple examples up here. As you can see, SQL is a text-based language. It turns out that the easiest way of creating SQL requests is to take the user’s input, and stick it straight into a template.Look at this login example: a user provides a name and a password, and the application checks them against its database. If the name and password match, the user is allowed in.See how the application takes the user strings, and combines them with a pre-defined query string? Now look on the right – a clever user can take advantage of this and log in without a password!The problem here is that the application combines the name and password strings with the query string, as if they were all SQL strings. If all the strings were pieces of SQL, they could be combined together like this. But the truth is, the name and password strings are free-form text, so they have to be SQL-escaped, which makes them SQL strings, before they can be combined with other SQL strings.
This sort of attack is called a SQL injection attack, and it used to be so common that there’s an Web comic dedicated to it!
By the way, this isn’t a database layer problem! Web development consists entirely of string-based languages, and the problem I mentioned spans all these languages.For example, the user interfaces that you see in the browser are HTML, combined with CSS and JavaScript. All these are text-based languages, which means they’re prone to the same issue as SQL queries. In fact, if you Google for “cross-site scripting attack”, you’ll find that a lot of companies had this issue.The story doesn’t stop here, for complicated applications! Want to send e-mail? Your application needs to talk to an e-mail server, using SMTP, another text-based language. And so on, so forth.
Let’s look at a more complex case of language confusion. This is a user sign-up form. You give it an e-mail address and a password, and it makes an account for you. Let’s take a look at what happens behind the scenes.When you click that “Create Account” button, your browser sends all the data you filled out to the application, as a gob of text. Rails, the application framework that I’m working with, takes this text, and turns it into a dictionary of key-value pairs, for convenient access. You can see the dictionary in the top-right. Then there is some code – actually, there’s very little code – that takes the values in this dictionary, and puts them into a new User object. Then the user is saved to the database. Very nice and simple, right?
Well, suppose a bad user guesses that our users have an “admin” field in the database, and makes his browser send *these* values to the application. Can you guess what happens? … Oh, I already gave that away. The code will work exactly like before – it will take the input values, and put them into a new User object. So the attacker is now an administrator in our application. That can’t be a good thing!How do we solve this problem? We can’t go around saying “don’t use this feature”, because then we’d be asking programmers to give up productivity for security, and that’s not going to happen. The real problem here is that the dictionary created from the user’s input looks just like a dictionary produced by the application code, which *should* be completely trusted.
I’m sorry for talking about mass-assignment, it’s a bit too much for a morning presentation! But I really wanted to explain it to you, so you can understand this.GitHub is an application that stores source code in the cloud, and helps programmers collaborate. They’re the best at what they do. And yet, less than a month ago, a security researcher uncovered a vulnerability that would have let a malicious user modify anyone else’s code. It turns out that one piece of GitHub was vulnerable to the mass-assignment attack that I’ve described earlier. And one piece is all it takes!
So, writing secure Web applications is really really hard. But don’t worry, we’re going to make all the problems go away! So let me tell you *how* we’re going to make the problems go away.
Do you know this joke, some guy goes to the doctor and says “hey, doctor, if I twist my leg like this, it hurts”, and the doctor says “then stop twisting your leg like that!”In our case, the advice would be “stop being confused!” So let’s start tracking the information that we need to avoid deputy confusion and encoding confusion! Let’s call this additional information “labels”. The left side of this slide has some labels that might be useful. The first two are labels solve deputy confusion by tracking the data’s owner, and his security requirements. The labels on the bottom solve encoding confusion
Let’s see how labels work to prevent the mass-assignment attack that I described earlier. Remember, the problem was that a malicious user guessed the name of a sensitive field in our application, and took advantage of a convenience feature in Rails, which takes any input coming to the application, and saves it to the database.
Now here’s what happens when the application uses our plug-in. The Rails framework still creates a dictionary out of the data, but this time the dictionary is labeled to reflect that its content is controlled by a user. That label will not allow Rails to create a User object out of the dictionary data. The user’s will be told an internal error ocurred, and the database will remain unchanged.Does this mean we disabled mass-asignment? Not quite, the application developer can get that convenience back by declaring a security policy for the User model.
After our application’s developer puts a security policy in place, the Rails code will filter the dictionary containing user input, and remove any fields that aren’t covered by the security policy. Before the User object is written to the database, a filter checks the security policy, which is shown on the bottom-left.In this example, the name, password, and admin values are all labeled to indicate that they were provided by the new user. The labels are checked against the security policy before the new user is saved to the database. This triggers an error, because the admin value is supplied by the new user, but the security policy says only administrators can set that value.
Alright, demo time!
Time permitting, let me talk a little bit about how we’re going to code this up.
Here’s what we need to do to get the functionality that I just described. First, we need to decide where we’re going to label and filter the data. Next, we need to add magic to the programming language, so the labels are automatically propagated. Last, we need to come up with a language that lets programmers describe the security policies.
This is what a Rails application looks like. At the front of the application, there’s Rack, turning HTTP requests into Ruby objects, and Ruby objects into HTTP responses. Then there’s controller code, which is responsible for putting together all the bits and pieces of data needed by the response. The controller achieves this by coordinating across models, which implement the application’s business logic and interface with the database. Last, the controller hands off the data to the view code, which is responsible for formatting it in a nice way that will make the user happy.Let’s see how labels and filters fit in this picture.
Here’s a neat trick: abstraction! We look at the entire Rails application as a system, a big black box.
Data coming into the system must be labeled. Data that’s about to leave the system must be filtered, to make sure that it meets the security policies specified by the application.
And that’s about it! It turns out that Rack needs labeling and filtering, since it interacts with the user, and the model needs labeling and filtering, since it interacts with the database. Security policy descriptions belong in the model, because
From a programming standpoint, label propagation is the most difficult part. Propagation is essential to the system, because it lets people write their code without worrying about security. Let’s take a look at a couple of examples.The box with green text on the top-left is my phone number. I only want to show my phone number to my friends, so there’s a privacy label associated with it. The box below is a template for a HTML page that shows my phone number. Now suppose someone goes to the page displaying my phone number, so the Web application has to produce an HTML fragment with my phone number. It will do that by combining the template with my actual phone number, and get the HTML fragment on the right.How do we label that? Show of hands – who thinks it’s private information? Who thinks it’s not private information? Hey, as far as I’m concerned, it has my phone number in it, so it’s private! So, some labels propagate automatically, which is a fancy way of saying that they “stick” with the data they’re labeling, as it is processed by the application.
Let’s look at the same process from a different perspective. We still have the same phone number and an HTML template on the left, and the same HTML fragment on the right. But this time, we care about encoding.The phone number is something I typed into the Web application, so it’s unsafe. The template on the bottom is part of the application’s source code, so we know it’s safe HTML. What happens when we combine the two? Show of hands – who thinks the result is safe HTML? Who thinks it’s not? Well, my phone number isn’t safe HTML, it might contain a cross-site scripting attack, and that makes the whole result unsafe.The take-away is that encoding labels should not propagate automatically. If you start out with safe HTML and change it, chances are the result will not be safe HTML anymore.
By the way, the right thing to do, in this case, is to HTML-escape the phone number, which produces a string that can be safely included in HTML pages. After HTML escaping, the result is labeled as safe HTML, so the HTML fragment coming from the “plus” operation would also be safe HTML that can be sent to the user.
And, just for completeness, here’s how the labels look like when the phone number is HTML-escaped correctly.