Proceedings Front Matter: Cover, Copyright, ISBN | Title Page, Organizers, Reviewers | Table of Contents | Message from the Program Chair

Complete Proceedings (20.8 MB) | Proceedings Errata Slip (rev. 8/11/10)

NEW! E-Book Proceedings: Read the proceedings on the go in iPad-friendly EPUB format or Kindle-friendly Mobipocket format. (See the Proceedings Errata Slip in EPUB format or Mobipocket format.)

Thurgood Marshall North East

Opening Remarks, Awards, and Keynote Address

Program Chair: Ian Goldberg, University of Waterloo

Proving Voltaire Right: Security Blunders Dumber Than Dog Snot

Roger G. Johnston, Vulnerability Assessment Team, Argonne National Laboratory

View the video

Voltaire famously said (sort of) that the main problem with common sense is that it is not all that common. Security is certainly a case in point. As vulnerability assessors, we repeatedly encounter security devices, systems, and programs with little or no security (or security thought) built in. We witness well-designed security products used stupidly, ill-conceived security rules that make security worse, organizations with security cultures beyond pathological, and security programs heavily mired in Security Theater, groupthink, bureaucracy, and wishful thinking.

This talk gives examples of common design blunders, easy-to-exploit vulnerabilities, poor usage, and sloppy thinking associated with various electronic devices involving physical security, including locks, tags, tamper-indicating seals, GPS, RFIDs, biometrics and other access control devices, and electronic voting machines. Common blunders in how organizations think about security and how they deal with the Insider Threat, IT vulnerabilities, and vulnerability assessments will also be discussed.

I'll conclude by proposing some reasons why common sense and security are so often alien to each other and suggest possible countermeasures—some of which involve examining what cyber security and physical security could learn from each other.

REFEREED PAPERS

Thurgood Marshall North East

Protection Mechanisms

Session Chair: Micah Sherr, University of Pennsylvania

Adapting Software Fault Isolation to Contemporary CPU Architectures
David Sehr, Robert Muth, Cliff Biffle, Victor Khimenko, Egor Pasko, Karl Schimpf, Bennet Yee, and Brad Chen, Google, Inc.

Read the Abstract | Full paper

View the video

Making Linux Protection Mechanisms Egalitarian with UserFS
Taesoo Kim and Nickolai Zeldovich, MIT CSAIL

Read the Abstract | Full paper

View the video

Awarded Best Student Paper!
Capsicum: Practical Capabilities for UNIX
Robert N.M. Watson and Jonathan Anderson, University of Cambridge; Ben Laurie and Kris Kennaway, Google UK Ltd.

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Toward an Open and Secure Platform for Using the Web
Will Drewry, Software Security Engineer, Google

View the presentation slides

View the video

As users spend more of their computing time in the highly interconnected world of the Internet, their software and data are exposed to attackers at an increasing rate. Web browser developers are pursuing features to mitigate this exposure, but these mechanisms are primarily restricted to the browser itself. Google Chrome OS is an open source, lightweight operating system built for simplicity, speed, and security for Web-focused users. Its security functionality extends beyond the benefits of the browser, Google Chrome, to the core operating system environment. This talk will explore the design and implementation of that functionality and the challenges that lie ahead.

REFEREED PAPERS

Thurgood Marshall North East

Privacy

Session Chair: Tara Whalen, Office of the Privacy Commissioner of Canada

Structuring Protocol Implementations to Protect Sensitive Data
Petr Marchenko and Brad Karp, University College London

Read the Abstract | Full paper

View the video

PrETP: Privacy-Preserving Electronic Toll Pricing
Josep Balasch, Alfredo Rial, Carmela Troncoso, Bart Preneel, and Ingrid Verbauwhede, IBBT-K.U. Leuven, ESAT/COSIC; Christophe Geuens, K.U. Leuven, ICRI

Read the Abstract | Full paper

View the video

An Analysis of Private Browsing Modes in Modern Browsers
Gaurav Aggarwal and Elie Bursztein, Stanford University; Collin Jackson, CMU; Dan Boneh, Stanford University

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Windows 7 Security from a UNIX Perspective
Crispin Cowan, Senior Program Manager, Windows Core Security, Microsoft, Inc.

View the video

UNIX advocates, including me, have long mocked Windows for having a fundamentally insecure computing model. Issues have included the lack of separation of privilege between the user and the TCB, an over-eager willingness to execute code from untrusted sources, and a plethora of buffer overflow vulnerabilities. However, most of these criticisms pertain to Windows XP, a system that is now almost a decade old, or the even older Windows 9X series. Much has changed between Windows XP and Windows 7. This talk will compare and contrast the security of Windows and UNIX, at both technological and cultural levels, with results that may surprise members of both Windows and UNIX communities.

REFEREED PAPERS

Thurgood Marshall North East

Detection of Network Attacks

Session Chair: Niels Provos, Google, Inc.

BotGrep: Finding P2P Bots with Structured Graph Analysis
Shishir Nagaraja, Prateek Mittal, Chi-Yao Hong, Matthew Caesar, and Nikita Borisov, University of Illinois at Urbana-Champaign

Read the Abstract | Full paper

View the video

Fast Regular Expression Matching Using Small TCAMs for Network Intrusion Detection and Prevention Systems
Chad R. Meiners, Jignesh Patel, Eric Norige, Eric Torng, and Alex X. Liu , Michigan State University

Read the Abstract | Full paper

View the video

Searching the Searchers with SearchAudit
John P. John, University of Washington and Microsoft Research Silicon Valley; Fang Yu and Yinglian Xie, Microsoft Research Silicon Valley; Martín Abadi, Microsoft Research Silicon Valley and University of California, Santa Cruz; Arvind Krishnamurthy, University of Washington

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Docile No More: The Tussle to Redefine the Internet
James Lewis, Senior Fellow and Program Director at the Center for Strategic and International Studies

View the video

The Internet and its technologies were largely designed by Americans, and thus mirror the values and beliefs of these pioneers: open, non-hierarchical, non-governmental, and self-organizing. Other nations with different beliefs want to change this. They want a larger role for governments and an end to America's "technological hegemony." Their motives are commercial and political, and they reflect a general annoyance with a laissez-faire approach to governance that works against security and that foreign observers believe is just a plot to provide advantages to U.S. companies and "control" to the U.S. government. Other governments want to reshape the principles baked into the rules and technology of the Internet. This in itself is interesting, but it may be more interesting to ask—now that the age of Internet pioneers is over and change is inevitable—what values and beliefs will guide it.

Thurgood Marshall South West

Symposium Reception

Thurgood Marshall North East

Rump Session

Rump Session Chair: Carrie Gates, CA Labs

• Work in progress
• Work that you haven't had time to start
• Work that you will do if you ever get some free time
• Work that should not be started at all

REFEREED PAPERS

Thurgood Marshall North East

Dissecting Bugs

Session Chair: David Lie, University of Toronto

Toward Automated Detection of Logic Vulnerabilities in Web Applications
Viktoria Felmetsger, Ludovico Cavedon, Christopher Kruegel, and Giovanni Vigna, University of California, Santa Barbara

Read the Abstract | Full paper

View the video

Baaz: A System for Detecting Access Control Misconfigurations
Tathagata Das, Ranjita Bhagwan, and Prasad Naldurg, Microsoft Research India

Read the Abstract | Full paper

View the video

Cling: A Memory Allocator to Mitigate Dangling Pointers
Periklis Akritidis, Niometrics, Singapore, and University of Cambridge, UK

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Staying Safe on the Web Yesterday, Today, and Tomorrow
Sid Stamm, Security & Privacy Nut at Mozilla

View the presentation slides

Listen in MP3 format

The World Wide Web is rapidly evolving, and its corresponding security and privacy problems are changing, too. More than ever before, user agents such as Firefox are being relied upon to provide a safe browsing experience, and so we must adapt to the ever-changing state of the Web. Sid will recount some stories of security problems in Mozilla's past and will examine the current state of security and privacy in Firefox. Finally, he will describe the future of the Web browser, covering Mozilla's plans for upcoming releases and examining some questions in Web security and privacy that don't yet have answers.

REFEREED PAPERS

Thurgood Marshall North East

Cryptography

Session Chair: Hovav Shacham, University of California, San Diego

ZKPDL: A Language-Based System for Efficient Zero-Knowledge Proofs and Electronic Cash
Sarah Meiklejohn, University of California, San Diego; C. Chris Erway and Alptekin Küpçü, Brown University; Theodora Hinkle, University of Wisconsin—Madison; Anna Lysyanskaya, Brown University

Read the Abstract | Revised full paper (6/18/10)

View the video

P4P: Practical Large-Scale Privacy-Preserving Distributed Computation Robust against Malicious Users
Yitao Duan, NetEase Youdao, Beijing, China; John Canny, University of California, Berkeley; Justin Zhan, National Center for the Protection of Financial Infrastructure, South Dakota, USA

Read the Abstract | Full paper

View the video

SEPIA: Privacy-Preserving Aggregation of Multi-Domain Network Events and Statistics
Martin Burkhart, Mario Strasser, Dilip Many, and Xenofontas Dimitropoulos, ETH Zurich, Switzerland

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

The Evolution of the Flash Security Model
Peleus Uhley, Senior Security Researcher, Adobe

View the video

The Adobe Flash Player security model must address several complex challenges. Flash Player must meet the needs of enterprise administrators, end users, Web site owners, and content creators. The model must adapt and scale as improvements are made to Web standards. As a technology, it is deployed across multiple browsers on multiple operating systems. Those operating systems may be installed on desktop PCs, mobile devices, tablets, or digital home devices. Most important, Flash Player must provide a security model that is consistent for everyone regardless of the combination of browser, OS, and device they are using.

This presentation will discuss how Adobe is addressing some of these complex challenges through real-world case studies. It will begin with a few past events that resulted in significant changes to the security model. The discussion will then progress to our more recent changes and what factors are currently influencing us. The presentation will close with some thoughts on the challenges that lie ahead as the Web expands from the desktop onto mobile devices, tablets, and TVs.

REFEREED PAPERS

Thurgood Marshall North East

Internet Security

Session Chair: Steven M. Bellovin, Columbia University

Dude, Where's That IP? Circumventing Measurement-based IP Geolocation
Phillipa Gill and Yashar Ganjali, University of Toronto; Bernard Wong, Cornell University; David Lie, University of Toronto

Read the Abstract | Full paper

View the video

Idle Port Scanning and Non-interference Analysis of Network Protocol Stacks Using Model Checking
Roya Ensafi, Jong Chun Park, Deepak Kapur, and Jedidiah R. Crandall, University of New Mexico

Read the Abstract | Full paper

View the video

Building a Dynamic Reputation System for DNS
Manos Antonakakis, Roberto Perdisci, David Dagon, Wenke Lee, and Nick Feamster, Georgia Institute of Technology

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Understanding Scam Victims: Seven Principles for Systems Security
Frank Stajano, Senior Lecturer at the University of Cambridge, UK

Listen in MP3 format

The success of many attacks on computer systems can be traced back to the security engineers not understanding the psychology of the system users they meant to protect. Paul Wilson and I examined a variety of scams and short cons that were investigated, documented, and recreated for the BBC TV programme The Real Hustle and we extracted from them some general principles about the recurring behavioral patterns of victims that hustlers have learnt to exploit. We argue that an understanding of these inherent human vulnerabilities, and the necessity of taking them into account during design rather than naively shifting the blame onto the gullible users, is a fundamental paradigm shift for the security engineer which, if adopted, will lead to stronger and more resilient systems security.

REFEREED PAPERS

Thurgood Marshall North East

Real-World Security

Session Chair: Bill Cheswick, AT&T Labs—Research

Scantegrity II Municipal Election at Takoma Park: The First E2E Binding Governmental Election with Ballot Privacy
Richard Carback, UMBC CDL; David Chaum; Jeremy Clark, University of Waterloo; John Conway, UMBC CDL; Aleksander Essex, University of Waterloo; Paul S. Herrnson, UMCP CAPC; Travis Mayberry, UMBC CDL; Stefan Popoveniuc; Ronald L. Rivest and Emily Shen, MIT CSAIL; Alan T. Sherman, UMBC CDL; Poorvi L. Vora, GW

Read the Abstract | Full paper

View the video

Acoustic Side-Channel Attacks on Printers
Michael Backes, Saarland University and Max Planck Institute for Software Systems (MPI-SWS); Markus Dürmuth, Sebastian Gerling, Manfred Pinkal, and Caroline Sporleder, Saarland University

Read the Abstract | Full paper

View the video

Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire Pressure Monitoring System Case Study
Ishtiaq Rouf, University of South Carolina, Columbia; Rob Miller, Rutgers University; Hossen Mustafa and Travis Taylor, University of South Carolina, Columbia; Sangho Oh, Rutgers University; Wenyuan Xu, University of South Carolina, Columbia; Marco Gruteser, Wade Trappe, and Ivan Seskar, Rutgers University

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Vulnerable Compliance
Dan Geer, In-Q-Tel

View the presentation slides

View the video

If a basic interoperability constraint, such as a core, standardized network protocol, has a flaw, then everyone who is standards-compliant will be vulnerable. What, then, does one do? If the flaw is long-standing, then by now it is pervasive, embedded in robotics, and likely to be in silicon. If the protocol is touchy, then seamless updates may not be possible. If a repair is possible but field deployment can be expected to have a half-life measured in months if not years, what does that imply for security policy? In the particular case of embedded systems, does this mean that remote upgradability—with all the risk such a capability entails—is a wise design choice? In the case of core Internet protocols, does that mean that Jon Postel's famous Robustness Principle, viz., to be conservative in what you send and liberal in what you accept, is no longer consistent with security? Is there an analog to perfect forward secrecy when it comes to planning for protocol failure the way we already (can) plan for key loss? With luck, this talk will at least ask the right questions.

Thurgood Marshall South West

Poster Session & Happy Hour

Poster Session Chair: Patrick Traynor, Georgia Institute of Technology

Don't miss the cool new ideas and the latest preliminary research on display at the Poster Session. Take part in discussions with your colleagues over complimentary drinks and snacks. Check out the list of accepted posters.

REFEREED PAPERS

Thurgood Marshall North East

Web Security

Session Chair: Helen Wang, Microsoft Research

Awarded Best Paper!
VEX: Vetting Browser Extensions for Security Vulnerabilities
Sruthi Bandhakavi, Samuel T. King, P. Madhusudan, and Marianne Winslett, University of Illinois at Urbana-Champaign

Read the Abstract | Full paper

View the video

Securing Script-Based Extensibility in Web Browsers
Vladan Djeric and Ashvin Goel, University of Toronto

Read the Abstract | Full paper

View the video

AdJail: Practical Enforcement of Confidentiality and Integrity Policies on Web Advertisements
Mike Ter Louw, Karthik Thotta Ganesh, and V.N. Venkatakrishnan, University of Illinois at Chicago

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

How Cyber Attacks Will Be Used in International Conflicts
Scott Borg, Chief Economist, US Cyber Consequences Unit

View the presentation slides

Every international dispute, if it becomes intense enough, is now likely to have a cyber component. Civilian cyber militias have become a regular part of regional conflicts. The resulting cyber campaigns now have the potential to escalate dangerously, to spread across multiple countries, and to disrupt global supply chains. Meanwhile, governments have become increasingly aware of the contributions cyber attacks can make to military operations. Drawing on a detailed examination of recent cyber conflicts, this session will attempt to survey all the ways cyber attacks are likely to be used in international conflicts in the near future. It will explore the pros and cons of each option for both civilian and military efforts, all the way down to the operational level. It will present some novel analytic methods that allow many of the choices to be quantified. Finally, the session will identify some of the ways these developments are likely to change the world in which we all will be operating.

REFEREED PAPERS

Thurgood Marshall North East

Securing Systems

Session Chair: Alex Halderman, University of Michigan

Realization of RF Distance Bounding
Kasper Bonne Rasmussen and Srdjan Capkun, ETH Zurich

Read the Abstract | Full paper

View the video

The Case for Ubiquitous Transport-Level Encryption
Andrea Bittau and Michael Hamburg, Stanford; Mark Handley, UCL; David Mazières and Dan Boneh, Stanford

Read the Abstract | Full paper

View the video

Automatic Generation of Remediation Procedures for Malware Infections
Roberto Paleari, Università degli Studi di Milano; Lorenzo Martignoni, Università degli Studi di Udine; Emanuele Passerini, Università degli Studi di Milano; Drew Davidson and Matt Fredrikson, University of Wisconsin; Jon Giffin, Georgia Institute of Technology; Somesh Jha, University of Wisconsin

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

Grid, PhD: Smart Grid, Cyber Security, and the Future of Keeping the Lights On
Kelly Ziegler, Chief Operating Officer, National Board of Information Security Examiners

View the presentation slides

View the video

As technology developments continue to make the electric grid "smarter," many believe security–and particularly cyber security–has become an afterthought in many respects. What does this mean to those trying to keep the lights on? What kinds of threats face the grid today? What makes the grid unique from a critical infrastructure perspective? What are the regulatory and policy drivers behind the push to make the grid smarter and more secure? This discussion will attempt to answer these questions and shed light on the current state of smart grid developments and grid cyber security throughout North America.

REFEREED PAPERS

Thurgood Marshall North East

Using Humans

Session Chair: Lucas Ballard, Google, Inc.

Re: CAPTCHAs—Understanding CAPTCHA-Solving Services in an Economic Context
Marti Motoyama, Kirill Levchenko, Chris Kanich, Damon McCoy, Geoffrey M. Voelker, and Stefan Savage, University of California, San Diego

Read the Abstract | Full paper

View the video

Chipping Away at Censorship Firewalls with User-Generated Content
Sam Burnett, Nick Feamster, and Santosh Vempala, Georgia Tech

Read the Abstract | Full paper | Slides

View the video

Fighting Coercion Attacks in Key Generation using Skin Conductance
Payas Gupta and Debin Gao, Singapore Management University

Read the Abstract | Full paper

View the video

INVITED TALKS

Thurgood Marshall West

End-to-End Arguments: The Internet and Beyond
David P. Reed, MIT Media Laboratory

View the presentation slides

View the video

A key factor supporting the Internet's evolution and growth is the use of "end-to-end arguments" to decide where to place functionality in the overall architecture as it evolved. There are many today who assert that the end-to-end arguments are no longer applicable to the Internet—that the Internet in its maturity must now begin to lock in specialized functions for mobile phones, television and video conferencing, functions to enable cyberwarfare, and functions that are required to ensure adequate profits to the operators and equipment vendors who must have incentives to invest in the Internet. At the same time, we are seeing vastly more complex interoperable architectures built around the Internet emerging in the form of cloud-style computing and mobile interaction.

Dr. Reed, who is one of the three authors who articulated the end-to-end argument as a principle of design, will argue that the end-to-end argument is not dead—it is more important than ever. In passing, he will explain some of the misconceptions about the end-to-end argument that have emerged from its friends and its foes.