Net Trust is a fraud-detection application that enhances security while protecting privacy. Net Trust identifies fraudulent Web sites by aggregating individual opinions, user-selected browsing histories, and third-party information. In this paper, we examine the security properties intrinsic to the implementation of the Net Trust ratings system. The ratings system protects against attacks by limiting diffusion of information to those with whom there is an off-line trust relationship. We also propose a richclient/ thin-server implementation architecture and examine the privacy properties of this architecture. The privacy properties function not only to prevent the compromising of user confidentiality, but also to make the ratings system more robust. By utilizing trusted off-line social networks, Net Trust enhances the security and privacy of the ratings data. The implementation architecture maintains high data availability while empowering browser-history owners with final control over data access. The Net Trust analysis we present illustrates the mutual reinforcement of individual privacy (defined as user control over personal information) and security (defined as the resiliency of data confidentiality and the efficacy of the rating system).

Publisher Summary This chapter describes the importance of understanding the human factor of security and detail the findings from a study on deceit. Computer science has a long-term tradition of studying and understanding security threats, such as identity theft; the human component of the problem is traditionally ignored. Identity theft is commonly defined as unwanted appropriation of access credentials that allows creation and access of accounts and that allows the aggressor to pose as the victim. Phishing is a type of identity theft that is perpetrated on the Internet and that typically relies on social engineering to obtain the access credentials of the victim. Similar deceit techniques are becoming increasingly common in the context of crimeware. For identity theft, the attacker's aim is to make the victim perform some action he would not have wanted to perform had he understood the consequences. Attackers leverage preexisting trust between victims and the chosen false identities to spur dubious actions (illegally transferring money, remailing stolen goods, installing malware on computers, and recommending fraudulent services to friends).

A practical algorithm that recovers AES key schedules from decayed memory images is presented. Halderman et al. [1] established this recovery capability, dubbed the cold-boot attack, as a serious vulnerability for several widespread software-based encryption packages. Our algorithm recovers AES-128 key schedules tens of millions of times faster than the original proof-of-concept release. In practice, it enables reliable recovery of key schedules at 70% decay, well over twice the decay capacity of previous methods. The algorithm is generalized to AES-256 and is empirically shown to recover 256-bit key schedules that have suffered 65% decay. When solutions are unique, the algorithm efficiently validates this property and outputs the solution for memory images decayed up to 60%.

Engineering is an interactive process that requires intelligent interaction at many levels. My thesis [1] advances an engineering discipline for high-level synthesis and architectural decomposition that integrates perspicuous representation, designer interaction, and mathematical rigor. Starfish, the software prototype for the design method, implements a table-centric transformation system for reorganizing control-dominated system expressions into high-level architectures. Based on the digital design derivation (DDD) system a designer-guided synthesis technique that applies correctness preserving transformations to synchronous data flow specifications expressed as co- recursive stream equations Starfish enhances user interaction and extends the reachable design space by incorporating four innovations: behavior tables, serialization tables, data refinement, and operator retiming. Behavior tables express systems of co-recursive stream equations as a table of guarded signal updates. Developers and users of the DDD system used manually constructed behavior tables to help them decide which transformations to apply and how to specify them. These design exercises produced several formally constructed hardware implementations: the FM9001 microprocessor, an SECD machine for evaluating LISP, and the SchemEngine, garbage collected machine for interpreting a byte-code representation of compiled Scheme programs. Bose and Tuna, two of DDD s developers, have subsequently commercialized the design derivation methodology at Derivation Systems, Inc. (DSI). DSI has formally derived and validated PCI bus interfaces and a Java byte-code processor; they further executed a contract to prototype SPIDER-NASA's ultra-reliable communications bus. To date, most derivations from DDD and DRS have targeted hardware due to its synchronous design paradigm. However, Starfish expressions are independent of the synchronization mechanism; there is no commitment to hardware or globally broadcast clocks. Though software back-ends for design derivation are limited to the DDD stream-interpreter, targeting synchronous or real-time software is not substantively different from targeting hardware.

This study is a large scale investigation of trust manipulation tactics used by phishing web sites and email messages. The experiment focuses on media authenticity evaluations, rather than content credibility with the assumption that its authors are known. It tests the effect of features ranging from URL plausibility to trust endorsement graphics on a population of 398 subjects. The experiment presents these trust indicators in a variety of stimuli since reactions will vary according to context. In addition to testing specific features, the test gauges the potential of a phishing tactic that spoofs third party program administrators rather than a brand itself. The results show that indeed graphic design can change authenticity evaluations and that their impact varies with context. We expected that authenticity inspiring design changes would have the opposite effect when paired with an unreasonable request, however our data suggest that narrative strength – rather than underlying legitimacy – limits the impact of graphic design on trust and that these authenticity-inspiring design features improve trust in both genuine and forged media.

Behavior tables are a visual formalism for representing synchronous systems of communicating processes. Although behavior tables arose from hardware modeling methods, they operate on arbitrarily abstract data-types. Originally conceived as an aid for imposing architecture on behaviorally oriented specifications, behavior tables inherited a structural algebra from the Digital Design Derivation (DDD) system. This thesis extends the algebra in three ways. It incorporates a transformation for retiming operations. It adds serialization by extending the notion of correctness to include stuttering alignments. It introduces mechanisms for declaring and refining abstract data types. This thesis further contributes serialization tables—a complementary behavior table form—for assisting interactive construction of schedules. A prototype tool, Starfish, implements these technologies. Two medium-scale examples—an SECD machine derivation and an abstract signal factorization for a hardware garbage collector—demonstrate feasibility of these techniques in non-trivial systems.

Behavior tables are a design formalization intended to make a derivational style of hardware design more efficient by illuminating transformation opportunities. Previously we developed a transformational algebra for direct equivalence of tables rather than some intermediate representation. A design tool is illustrated for system factorization; its core implements the fore-mentioned table manipulations

The Net Trust toolbar embeds social context in Internet browsing by analyzing peer web-histories and opinions over user-selected social networks. The reputation metric bundles these socially relevant ratings with user-chosen external red/green lists to signal trust in browsing sessions. This usability study applies the think-aloud methodology to qualitatively assess how effectively Net Trust expresses ratings and how easily participants can customize their social networks and third-party ratings. The growth of phishing, a short-term scam that recruits victims via email to fraudulent web sites masquerading as legitimate institutions whereupon many visitors will disclose sensitive information (passwords, account IDs, etc.), is well documented by the Anti-Phishing Working Group [1], Symantec [12], and others. Net Trust attacks the more general problem of identifying untrustworthy web sites, however phishing’s short-term nature [9] prevents such fraudulent servers from gaining the reputation accorded to legitimate institutions. Since web browsers are the point of entry to spoofed web sites, anti-phishing toolbars which dynamically rate content have become prevalent [3, 4, 8, 10, 11]. Some toolbars detect phishing by analyzing real-time information such as links, images, SSL certificates and other document features, while others depend upon centralized databases of known fraudulent and legitimate web sites; all of these solutions suffer from high false-positive rates, high false-negative rates, or both [2]. In contrast, Net Trust detects fraud by distilling aggregate data from the browsing histories of self-chosen peers and external third-party ratings (e.g., the FDIC, BBB, etc.). For example, suppose a Net Trust user, Alice, conducts online banking at the domain mylocalbank.com. Her regular visits will improve the web site score. Some of Alice’s friends, who share geographic similarity, are online clients of the same local bank. Since Net Trust displays the mean of positive ratings, mylocalbank.com will be highly rated. If a phishing message should direct her to a fraudulent web

1 Net Trust is a distributed reputation system that identifies fraudulent web sites by aggregating individual opinions and browsing histories over user-selected social networks. This paper examines the security properties intrinsic to any correct implementation of Net Trust’s ratings system and the privacy properties arising from the paper’s proposed rich-client/thin-server implementation architecture. The ratings system protects against Sybil attacks, corruption by en masse bogus ratings distribution, and distinguishes fraudulent web sites from the trustworthy ones by leveraging the browsing behavior in trusted social networks rather than link topology of third-parties. The implementation architecture maintains high data availability while empowering browser-history owners with final control over data access. This paper analyzes Net Trust’s participants, attackers, security and privacy goals, and implementation choices.

This paper reports the highlights of a user study which gauges reactions to a variety of common “trust indicators” – such as logos, third party endorsements, and padlock icons – over a selection of authentic and phishing stimuli. In the course of the think-aloud protocol, participants revealed different sensitivities to email messages and web pages. Our principal result is the analysis of what makes phishing emails and web pages appear authentic. This is not only of interest from a pure scientific point of view, but can also guide the design of legitimate material to avoid unnecessary risks. A second result of ours are observations of what makes legitimate content appear dubious to consumers. This is a result with obvious applications to online advertising.

An all too real threat to the privacy offered by a mix network is that individual mix administrators may volunteer partial tracing information to a coercer. While this threat can never be eliminated - coerced mix servers could simply be forced to reveal all their secret data - we can deter administrators from succumbing to coercive attacks by raising the stakes. We introduce the notion of a trace-deterring mix permutation to guarantee privacy, and show how it ensures that a collateral key (used for an arbitrary purpose) be automatically revealed given any end-to-end trace from input to output elements. However, no keying material is revealed to a party who simply knows what input element corresponds to what output element. Our techniques are sufficiently efficient to be deployed in large-scale elections, thereby providing a sort of publicly verifiable privacy guarantee. Their impact on the size of the anonymity set-while quantifiable - are not of practical concern

ABSTRACT In this article we introduce the notion of warkitting as the drive-by subversion of wireless home routers through unauthorized access by mobile WiFi clients. We describe how such attacks can be performed, evaluate the vulnerability of currently deployed wireless routers based on experimental data, and examine the impact of these attacks on Internet fraud. Our analysis shows that it is possible in practice to carry out warkitting attacks with low-cost equipment widely available today and that the volume of credential theft possible through warkitting exceeds current estimates of credential theft due to phishing. We discuss how to detect a warkitting attack in progress and show how to analyze warkitted routers for evidence linking it to the attackers.

This short paper describes an attack that exploits the online marketplace’s susceptibility to covert fraud, opaqueness of embedded software, and social engineering to hijack account access and ultimately steal money. The attacker introduces a fatal security flaw into a trusted embedded system (e.g. computer motherboard, network interface card, network router, cell phone), distributes it through the online marketplace at a plausible bargain, and then exploits the security flaw to steal information. Unlike conventional fraud, consumer risk far exceeds the price of the good. As proof of concept, the firmware on a wireless home router is replaced by an open source embedded operating system. Once installed, its DNS server is reconfigured to selectively spoof domain resolution. This instance of malicious embedded software is discussed in depth, including implementation details, attack extensions, and countermeasures.

Design derivation, a correct-by-construction system design method, specifies behavior with abstract datatypes. Refining these abstract datatypes is necessary for architectural decomposition. A new transformation primitive enables data refinement by generalizing term level injective homomorphisms to system equivalence.

Behavior tables are a design formalization intended to support interactive design derivation for hardware and embedded systems. It is a reformulation of the DDD transformation system, bridging behavioral and architectural forms of expression. The tabular representations aid in visualizing design aspects that are subject to interactive refinement and optimization. These ideas are illustrated for system factorization, an import class of decompositions used in design derivation. A series of examples shows how features seen in the behavior tables determine the course of a factorization and how the rules of a core behavior table algebra compose into the more large scale transformations done at the interactive level.

A design formalization based on behavior tables was presented at Lfm97. This paper describes ongoing work on a supporting tool, now in development. The goal is to make design derivation, the interactive construction of correct implementations, more natural and visually palatable while preserving the benefits of formal manipulation. We review the syntax and semantics of behavior tables, introducing some new syntactic elements. We present a core algebra for architectural refinement, including new notational conventions for expressing such rules.