Differentially private zeroth-order optimization (DPZO in short) has shown promise in fine-tuning large language models (LLMs) while protecting record-level privacy. Compared with classical first-order methods, such as DPSGD, the main difference is that DPZO replaces the exact first-order gradients that are computed via back-propagation with its random zeroth-order approximations that are computed via querying the model's losses. However, DPZO still lags in the resulting model utility compared to existing methods, indicating that further work is needed to fully realize its potential. In this paper, we make a solid step towards designing a better differentially private algorithm for fine-tuning LLMs based on zeroth-order optimization. Our design is centered around the major performance issue of differentially private optimization for large models caused by artificial clipping, which creates biases in the model updates. Using our method called DP-AggZO, we theoretically prove that this issue can be mitigated, leading to an improved convergence rate over the prior DP-ZO methods and better model utility under the same privacy constraints. We back up our theory with extensive experiments, validating the performance improvement of DP-AggZO. Surprisingly, our DP-AggZO even outperforms the state-of-the-art method DP-AdamW significantly on some benchmark settings.
One of the principles in cryptocurrency tracing is putting a name to an address - a process called attribution. Attribution is key for both law enforcement and compliance professionals. Blockchain intelligence companies sell attribution as a service by leveraging pseudonymous blockchains, clustering heuristics, and labeling of addresses. In this paper, we perform a case study on Chainalysis, the market leader, and evaluate its attribution by comparing it against ground-truth data on three seized illicit services - BestMixer, Hansa Market, and Wall Street Market. To design the evaluation, we interview front-line law enforcement professionals and learn how they trace cryptocurrencies using blockchain intelligence providers. We identify three evaluation techniques - i.e., address overlap, money flows, and address roles - that realistically measure attribution in line with law enforcement use cases. Using these techniques, we show that for our three illicit services, Chainalysis provides a reliable lower bound (24.54 to 94.85 percent accurate), and produces very few false positives (less than 0.5 percent). Also, we find that coverage changes over time. We reason about factors that influence attribution and demonstrate the importance of attributing certain key addresses to achieve high coverage, and with that, show that when including a second blockchain intelligence provider, the difficulties in generalizing results.
Hardware security is crucial for ensuring trustworthy computing systems. However, the growing complexity of hardware designs has introduced new vulnerabilities that are challenging and expensive to address after fabrication. Hardware fuzz testing, particularly whitebox fuzzing, is promising for scalable and adaptable hardware vulnerability detection. Despite its potential, existing hardware fuzzers face significant challenges, including the complexity of input semantics, limited feedback utilization, and the need for extensive test cases. To address these limitations, we propose GenHuzz, a novel white-box hardware fuzzing framework that reframes fuzzing as an optimization problem by optimizing the fuzzing policy to generate more subtle and effective test cases for vulnerability and bug detection. GenHuzz utilizes a language model-based fuzzer to intelligently generate RISC-V assembly instructions, which are then dynamically optimized through a Hardware-Guided Reinforcement Learning framework incorporating real-time feedback from the hardware. GenHuzz is uniquely capable of understanding and exploiting complex interdependencies between instructions, enabling the discovery of deeper bugs and vulnerabilities. Our evaluation of three RISC-V cores demonstrates that GenHuzz achieves significantly higher hardware coverage with fewer test cases than four state-of-the-art fuzzers. GenHuzz detects all known bugs reported in existing studies with fewer test cases. Furthermore, it uncovers 10 new vulnerabilities, 5 of which are the most severe hardware vulnerabilities ever detected by a hardware fuzzer targeting the same cores, with CVSS v3 severity scores exceeding 7.3 out of 10.
Privacy and regulation are a long-lasting conflict in modern instant messaging, where the security community attempts to bridge this gap from a technological perspective. End-to-end encryption (E2EE) is a mathematically guaranteed privacy policy that has been widely built into commercial instant messaging applications. On the other hand, regulatory designs compatible with E2EE privacy are severely restricted, i.e., content auditing is (almost) impossible on ciphertext. For this reason, the community develops perceptual hash matching (PHM) as a regulation policy, where content-aware hash codes for media are computed prior to E2EE and matched against known criminal media, e.g., child pornography images, on the server side. In this paper, we systematically reveal a range of adversarial threats to such E2EE-PHM systems, leading to regulatory failures. Unlike previous case studies, our attack is a more realistic threat - uniformly fooling the famous pHash, Facebook PDQ, Microsoft PhotoDNA, and Apple NeuralHash, even with higher success rates and less training rounds. Here, we validate the above proposition in both scenarios of escaping and triggering regulation. Our main contribution is a new idea of multiresolution perturbation, where each perturbation element can affect image regions of adjustable scales. With this new idea and its well- formalized design, our attack encapsulates previous attacks as special cases - in some scenarios, it exhibits a huge leap in convergence efficiency compared to previous ones. Based on the above technical insights, we also discuss possible counter-measures and recommendations for social good.
Common Vulnerabilities and Exposures (CVE) IDs serve as unique identifiers for security-relevant bugs, facilitating clear communication and tracking of affected products. Originally intended solely for identification, the CVE system has faced increasing criticism due to the misconception that assigning a CVE implies a serious security issue. Notably, academic works on security vulnerabilities often claim CVEs, presumably to demonstrate the practical impact of their methods. We systematically study the use of CVEs in academic papers to better understand the correlation of academic CVEs with real-world implications. To this end, we present the trends we identified through quantitative analysis, qualitative review of published papers, and a user survey. We observe a clear shift towards more frequent use of CVEs in academic papers over the last 25 years, especially in certain research areas. Our qualitative review of 1,803 CVEs claimed in papers published in the past five years reveals that 34 % have not been publicly confirmed or were disputed by the main-tainers of the affected software, challenging the notion of real-world effects. Our survey of 103 academic reviewers and authors reveals widespread misconceptions about the CVE system and an explicit preference for reporting CVE numbers, but without indicating any implicit bias in the review process. We advise caution on using CVEs as a proxy for real-world impact and provide actionable recommendations for the academic security community and practitioners.
Virtual Machine Introspection (VMI) is an essential technique for monitoring the runtime state of a virtual machine. VMI systems are widely used by major cloud providers as they enable a range of applications, such as malware detection. Unfortunately, existing VMI systems suffer from several shortcomings: they either compete with the introspected VMs for shared CPU resources or report poor performance. Further, they cannot introspect hypervisors or bare metal machines. We propose BlueGuard, a system that leverages the physically isolated Data Processing Unit (DPU) commonly found on data center servers to efficiently run full system introspection by both host and guest introspection (HGI). BlueGuard facilitates the creation of hardware-accelerated HGI applications and frees the CPU while providing performance isolation. As a beneficial side effect, BlueGuard is capable of introspecting even bare metal servers that are usually out of scope for VMI systems. Furthermore, BlueGuard abstracts the DPU accelerators and provides kernel bypassing, non-blocking memory access, and user-level threading to achieve mu s-scale introspection latency. Finally, we introduce delta introspection to accelerate the detection of state changes with BlueGuard and demonstrate the ability to isolate infected machines on a network layer. We implement and extensively evaluate BlueGuard on an NVIDIA BlueField-2 DPU. Our system achieves a 4.3x detection speedup compared to prior work and is capable of monitoring tens of VMs concurrently without hindering the host performance.
The growing privacy risks posed by hidden WiFi cameras have prompted increasing interest in their detection and localization. However, existing localization solutions suffer from several limitations, such as requiring substantial user effort, large activity spaces, predefined parameters, and pre-collected training data. In this paper, we present DIFFLOC, a novel and low-cost system that localizes hidden WiFi cameras by leveraging the fundamental physical principle of electromagnetic diffraction. When an obstacle passes through the direct path between a transmitter and a receiver, it causes a distinctive signal attenuation pattern. We theoretically analyze the feasibility of using this phenomenon for localization, identifying two critical requirements for building an unbiased diffraction localization model: symmetry and observability. To meet these requirements, DIFFLOC introduces a controllable diffraction generation method. By precisely rotating a small metal plate around a passive WiFi receiver (e.g., a Raspberry Pi), the system produces a consistent and predictable diffraction "shadowing" effect. We then construct an unbiased localization model that maps this effect to the azimuth of the hidden camera. Implemented using commercially available off-the-shelf hardware, DIFFLOC achieves an average angular error of 14.82 degrees across six diverse environments and eleven different camera models, demonstrating its effectiveness. Code, implementation details, and demo are available at: https://github.com/CamLoPA/DiffLoc.
Medical devices become increasingly connected and thus require security measures to ensure patient safety and data protection. However, such connected medical devices are often reported to lack basic security and to run on unpatched and outdated software. Thus, there is an increasing push to deliver security patches faster and more regularly to devices in the field. In this work, we empirically study current practices of patching connected medical devices by conducting 23 semi-structured interviews with participants from nine healthcare delivery organizations (HDOs) and three medical device manufacturers, also capturing data on actual updating practices for 25 specific medical devices. We find that delivering software updates to medical devices is an laborious and costly process for HDOs and manufacturers, as operational demands for medical use and an increasing need for infrastructure management put significant strain on involved stakeholders, thus rendering it questionable if conventional security patching will actually work in the healthcare sector without overwhelming it operationally and financially.
Product managers play a key role in defining and prioritizing requirements overall, yet little is known about how they approach security requirements (SRs). To address this gap, we conducted a study with 50 participants in product management roles. Our 60-minute online study consisted of a requirement-writing task, followed by a questionnaire. Our analysis shows that, while security is not the top priority for our participants, only 10% did not include any SRs, and only 4% did not identify any security risks in their tasks. Most participants viewed SRs as a shared responsibility that should be discharged in collaboration with other roles - security experts, architects, and development teams - but without a clear assignment or process. There is an assumption that security will be taken care of, somehow, in the process, with 54% believing that security will be addressed, even when not explicitly stated in the requirements. To mitigate the concern of "diffusion of responsibility" for security, we identified a number of recommendations to involve stakeholders to address security throughout the development process.
Human-subjects researchers are increasingly expected to deidentify and publish data about research participants. However, de-identification is difficult, lacking objective solutions for how to balance privacy and utility, and requiring significant time and expertise. To understand researchers' approaches, we interviewed 18 practitioners who have de-identified data for publication and 6 curators who review data submissions for repositories and funding organizations. We find that researchers account for the kinds of risks described by k-anonymity, but they address them through manual and social processes and not through systematic assessments of risk across a dataset. This allows for nuance but may leave published data vulnerable to re-identification. We explore why researchers take this approach and highlight three main barriers to more rigorous de-identification: threats seem unrealistic, stronger standards are not incentivized or supported, and tools do not meet researchers' needs. We conclude with takeaways for repositories, funding agencies, and privacy experts.
Software Composition Analysis (SCA) is an important part in the software security lifecycle. Establishing the individual software components and versions that make up an application allows for identifying and remediating vulnerabilities. However, SCA tools have not kept up with the ever growing number of new vulnerabilities each year. Developers are flooded with vulnerability alerts and often struggle to quickly remediate critical issues with external components. We conducted 20 interviews with developers to investigate their processes and challenges around using SCA in their software projects. Interviews covered how SCA tools are integrated into workflows, how reports are interpreted and acted upon, and what challenges were encountered. We find that SCA tools are most often integrated into build pipelines and that users report that information in SCA alerts is too generic and lack context, specifically context on infrastructure, network configurations, reachability, and exploitability. Based on our findings we conclude that context matters throughout the SCA process, including for evaluating impact, when to trigger SCA scan runners, and how to integrate and communicate tool findings.
Vulnerabilities in open-source software (OSS) projects can potentially impact millions of users and large parts of the software supply chain. Rigorous secure design practices, such as threat modeling (TM), can help identify threats and determine and prioritize mitigations early in the development lifecycle. However, there is limited evidence regarding how OSS developers consider threats and mitigations and whether they use established TM methods. Our research is the first to fill this gap by investigating OSS developers' TM practices and experiences. Using semi-structured interviews with 25 OSS developers, we explore participants' threat finding and mitigation practices, their challenges and reasons for adopting their practices, as well as desired support for implementing TM in their open-source projects. Because OSS development is often a volunteer effort, decentralized, and lacking security expertise, more structured TM methods introduce additional costs and are perceived as having limited benefit. Instead, we find almost all OSS developers conduct TM practices in an ad hoc manner due to the ease-of-use, flexibility, and low overhead of this approach. Based on our findings, we provide recommendations for the OSS community to better support TM processes in OSS.
Signature schemes are a fundamental component of cyber-security infrastructure. While they are designed to be mathematically secure against cryptographic attacks, they are vulnerable to Rowhammer fault-injection attacks. Since all existing attacks are ad-hoc in that they target individual parameters of specific signature schemes, it remains unclear about the impact of Rowhammer on signature schemes as a whole. In this paper, we present Achilles, a formal framework that aids in leaking secrets in various real-world signature schemes via Rowhammer. Particularly, Achilles can be used to find potentially more vulnerable parameters in schemes that have been studied before and also new schemes that are potentially vulnerable. Achilles mainly describes a formal procedure where Rowhammer faults are induced to key parameters of a generalized signature scheme, called G-sign, and a post-Rowhammer analysis is then performed for secret recovery on it. To illustrate the viability of Achilles, we have evaluated six signature schemes (with five CVEs assigned to track their respective Rowhammer vulnerability), covering traditional and post-quantum signatures with different mathematical problems. Based on the analysis with Achilles, all six schemes are proved to be vulnerable, and two new vulnerable parameters are identified for EdDSA. Further, we demonstrate a successful Rowhammer attack against 3 of these schemes, using recent cryptographic libraries including wolfssl, relic, and liboqs.
Advanced Persistent Threats (APTs) are sophisticated and targeted threats that demand significant effort from analysts for detection and attribution. Researchers have developed various techniques to support these efforts. However, security practitioners' perceptions and challenges in analyzing APT-level threats are not yet well understood. To address this gap, we conducted semi-structured interviews with 15 security practitioners across diverse roles and expertise. From the interview responses, we identify a three-layer approach to APT attribution, each having its own goals and challenges. We find that practitioners typically prioritize understanding the adversary's tactics, techniques, procedures (TTPs), and motivations over identifying the specific entity behind an attack. We also find challenges in existing tools and processes mostly stemming from their inability to handle diverse and complex data and issues with both internal and external collaboration. Based on these findings, we provide four recommendations for improving attribution approaches and discuss how these improvements can address the identified challenges.
WebXR is a standard web interface for extended reality that offers virtual environments and immersive 3D interactions, distinguishing it from the traditional web. However, these novel UI properties also introduce potential avenues for dark design exploitation. For instance, the absence of iframe-like elements in WebXR can be exploited by third parties, such as ad service providers, to inject JavaScript scripts and induce unintentional clicks or extract sensitive user information. In this work, our objective is to identify and analyze the UI properties of WebXR vulnerable to exploitation by both first and third parties and to understand their impact on user experience. First, we examine vulnerable UI properties and propose five novel attack techniques that exploit one or more of these properties. We systematically categorize both existing and newly identified attacks within the advertising domain, to create a comprehensive taxonomy. Second, we design a user study framework to evaluate the impact of these attack categories employing dark designs on user experience. We develop a logging system to collect spatial data from 3D user interactions and integrate it with different WebXR applications that have different interaction needs. Additionally, we develop a set of metrics to derive meaningful insights from user interaction logs and assess how dark designs affect user behavior. Finally, we conduct a 100-participant between-subjects study using our user-study framework and survey. Our findings suggest that most of these dark patterns go largely unnoticed by users while effectively achieving their intended goals. However, the impact of these designs varies depending on their category and application type. Our comprehensive taxonomy, logging framework, metrics, and user study results help developers review and improve their practices and inspire researchers to develop more robust defense mechanisms to protect user data in immersive platforms.
To bridge the ever-increasing gap between the fast execution speed of modern processors and the long latency of memory accesses, CPU vendors continue to introduce newer and more advanced optimizations. While these optimizations improve performance, research has repeatedly demonstrated that they may also have an adverse impact on security. In this work, we identify that recent Apple M- and A-series processors implement a load value predictor (LVP), an optimization that predicts the contents of memory that the processor loads before the contents are actually available. This allows processors to alleviate slowdowns from Read-After- Write dependencies, as instructions can now be executed in parallel rather than sequentially. To evaluate the security impact of Apple's LVP implementation, we first investigate the implementation, identifying the conditions for prediction. We then show that although the LVP cannot directly predict 64-bit values (e.g., pointers), prediction of smaller-size values can be leveraged to achieve arbitrary memory access. Finally, we demonstrate end-to-end attack exploit chains that build on the LVP to obtain a 64-bit read primitive within the Safari and Chrome browsers.
