Research in enterprise system security has largely focused on the development of theoretical models capable of demonstrating mathematically that they possess desired security properties. However, recent results confirm that many of these models cannot be applied in practice because of the unpredictability of human participants' behavior in business processes. Moreover, while malicious attacks remain a significant problem, the majority of user-caused information leaks in Enterprise Systems are unintentional (or have many unintentional components) and could potentially be prohibited if explicitly recognized and appropriately modeled. In this paper we argue that approaches for achieving information flow security in enterprises need to combine process and policy understandability with usability of the enforcement mechanisms. We present a modeling approach that allows security policies to be formulated in such a way that (1) they are aligned to the business processes executed in an enterprise, (2) are understandable by all relevant stakeholders, and (3) can be semi-automatically transformed into run-time enforcement mechanisms.

Exploits that successfully attack computers are typically based on some form of shellcode, i.e., illegitimate code that is injected by the attacker to take control of the system. Detecting and gathering such code is the first step to its detailed analysis. The amount and sophistication of modern malware calls for automated mechanisms that perform such detection and extraction. In this paper, we present a novel generic and fully automatic approach to detect the execution of illegitimate code and extract such code upon detection. The basic idea is to flag certain memory pages as non-executable and utilize a modified page fault handler to react on the attempt to execute code from them. Our modified page fault handler detects if legitimate code is about to be executed or if the code originates from an untrusted location. In such a case, the corresponding memory content is extracted and execution is continued to retrieve more illegitimate code for analysis. We present an implementation of the approach for the Windows platform called CWXDetector, which involved reverse-engineering the proprietary memory management system of this operating system. Evaluation results using a large corpus of malicious PDF documents show that our system produces no false positives and has a very low false negative rate. To further demonstrate the universality of our approach, we also used it to detect shellcode execution in Flash Player, RealVNC client, and VideoLan Client.

Current disk encryption techniques store necessary keys in RAM and are therefore susceptible to attacks that target volatile memory, such as Firewire and cold boot attacks. We present TRESOR, a Linux kernel patch that implements the AES encryption algorithm and its key management solely on the microprocessor. Instead of using RAM, TRESOR ensures that all encryption states as well as the secret key and any part of it are only stored in processor registers throughout the operational time of the system, thereby substantially increasing its security. Our solution takes advantage of Intel's new AES-NI instruction set and exploits the x86 debug registers in a non-standard way, namely as cryptographic key storage. TRESOR is compatible with all modern Linux distributions, and its performance is on a par with that of standard AES implementations.

A failure detector is a fundamental abstraction in distributed computing. This article surveys this abstraction through two dimensions. First we study failure detectors as building blocks to simplify the design of reliable distributed algorithms. In particular, we illustrate how failure detectors can factor out timing assumptions to detect failures in distributed agreement algorithms. Second, we study failure detectors as computability benchmarks. That is, we survey the weakest failure detector question and illustrate how failure detectors can be used to classify problems. We also highlight some limitations of the failure detector abstraction along each of the dimensions.

During the last few years there has been an increasing number of people-centric sensing projects. These combine location information with sensors available on mobile phones, giving birth to a different dimension in sensing our environment and providing us with new opportunities to create collective intelligence systems to address urban-scale problems auch as air pollution, noise, and traffic. However, as people are directly involved in the collection process, they often inadvertently reveal information about themselves, raising new and important privacy concerns. While standard privacy enhancing technologies exist, they do not fully cover the many peculiarities of these new pervasive applications. The ubiquitous nature of the communication and the storage of location traces compose a complex set of threats on privacy, which we overview in this article. Then we go through the latest advances in security and privacy protection strategies, and discuss how they fit with this new paradigm of people-centric sensing applications. We hope this work will better highlight the need for privacy in urban sensing applications and spawn further research in this area.

Sensor networks are highly vulnerable to attacks due to the nature of the wireless media. There are several proposed protocols for authentication and encryption that prevent unauthorized nodes from accessing the network and the transferred information. However, a second line of defense is needed, as a broad range of attacks can be launched from compromised nodes that appear as legitimate members of the network. An intrusion detection system (IDS) can detect the misbehavior of such nodes and notify other nodes in the network to take necessary measurements. In this chapter, we discuss the general design principles of such systems for sensor networks, their requirements, and available approaches. Then, we present an architecture of a distributed IDS, in which, even though nodes do not have a global view of the network, they can still collaborate with each other and successfully detect an intrusion. Finally, we show how such a system can be implemented in TinyOS, which components and interfaces are needed, and what is the resulting overhead imposed.

We study an active underground economy that trades stolen digital credentials. In particular, we investigate keylogger-based stealing of credentials via dropzones, anonymous collection points of illicitly collected data. Based on the collected data from more than 70 dropzones, we present an empirical study of this phenomenon, giving many first-hand details about the attacks that were observed during a seven-month period between April and October 2008. We found more than 33 GB of keylogger data, containing stolen information from more than 173,000 victims. Analyzing this data set helps us better understand the attacker's motivation and the nature and size of these emerging underground marketplaces.

A botnet is a network of compromised machines under the control of an attacker. Botnets are the driving force behind several misuses on the Internet, for example spam mails or automated identity theft. In this paper, we study the most prevalent peer-to-peer botnet in 2009: Waledac. We present our in ltration of the Waledac botnet, which can be seen as the successor of the Storm Worm botnet. To achieve this we implemented a clone of the Waledac bot named Walowdac. It implements the communication features of Waledac but does not cause any harm, i.e., no spam emails are sent and no other commands are executed. With the help of this tool we observed a minimum daily population of 55,000 Waledac bots and a total of roughly 390,000 infected machines throughout the world. Furthermore, we gathered internal information about the success rates of spam campaigns and newly introduced features like the theft of credentials from victim machines.

We consider the problem of cooperative intrusion detection in wireless sensor networks where the nodes are equipped with local detector modules and have to identify the intruder in a distributed fashion. The detector modules issue suspicions about an intrusion in the sensor's neighborhood. We formally define the problem of intrusion detection and identify necessary and sufficient conditions for its solvability. Based on these conditions we develop a generic algorithm for intrusion detection and present simulations and experiments which show the effectiveness of our approach.

We study the problem of consensus in the general omission failure model, i.e., in systems where processes can crash and omit messages while sending or receiving. This failure model is motivated from a smart card-based security framework in which certain security problems can be reduced to consensus in that model. We propose an algorithm that solves consensus based on very weak timing assumptions. More precisely, we show that consensus is solvable using an eventual bisource and a majority of fault-free processes. An eventual bisource is a fault-free process that can eventually communicate with all other processes in a timely manner. In contrast to previous work, we use timing assumptions directly in the algorithm and do not employ the notion of a failure detector. We argue that this is helpful in reducing the message complexity, a critical aspect of algorithms which run on smart cards.

In a public wireless sensor network (WSN), the presence of adversaries that can completely take over some sensor nodes must be taken into account. The adversary may try to use the compromised nodes to inject his own queries or to influence results of legitimate queries, when they are propagated to the network's sink during data concast. Because of the commonly used paradigm of in-network processing, a compromised node can manipulate all passing data easily. Hence, the authenticity of both, query and result, must be verified. However, providing authenticity needs additional effort, which increases energy-consumption. We present AQF+ESAWN, the (to our knowledge) first attempt to provide an integrated solution for authentic query processing and data concast in WSNs in an energy-efficient, configurable way. Before describing the benefits of this demonstration, we shortly sketch the two protocols AQF and ESAWN and the energy-authenticity trade-off provided.

We investigate how wireless sensor networks can be attacked in practice. From this we develop a generic adversary model that allows to classify adversaries according to two dimensions of power: presence and intervention. Thus, we provide a framework for realistic security analysis in wireless sensor networks.

Botnets, i.e., networks of compromised machines under a common control infrastructure, are commonly controlled by an attacker with the help of a central server: all compromised machines connect to the central server and wait for commands. However, the first botnets that use peer-to-peer (P2P) networks for remote control of the compromised machines appeared in the wild recently. In this paper, we introduce a methodology to analyze and mitigate P2P botnets. In a case study, we examine in detail the Storm Worm botnet, the most wide-spread P2P botnet currently propagating in the wild. We were able to infiltrate and analyze in-depth the botnet, which allows us to estimate the total number of compromised machines. Furthermore, we present two different ways to disrupt the communication channel between controller and compromised machines in order to mitigate the botnet and evaluate the effectiveness of these mechanisms.

Energy-efficient query dissemination plays an important role for the lifetime of sensor networks. In this work, we consider probabilistic flooding for query dissemination and develop an analytical framework which enables the base station to predict the energy consumed and the nodes reached according to the rebroadcast probability. Furthermore, we devise a topology discovery protocol that collects the structural information required for the framework. Our analysis shows that the energy savings exceed the energy spent to obtain the required information after a small number of query disseminations in realistic settings. We verified our results both with simulations and experiments using the SUN Spot nodes.

We investigate the problem of detecting termination of a distributed computation in systems where processes can fail by crashing. Specifically, when the communication topology is fully connected, we describe a way to transform any termination detection algorithm A that has been designed for a failure-free environment into a termination detection algorithm B that can tolerate process crashes. Our transformation assumes the existence of a perfect failure detector. We show that a perfect failure detector is in fact necessary to solve the termination detection problem in a crash-prone distributed system even if at most one process can crash.Let mu(n, M) and delta(n, M) denote the message complexity and detection latency, respectively, of A when the system has it processes and the underlying computation exchanges M application messages. The message complexity of B is O(n + mu(n, 0)) messages per failure more than the message complexity of A. Also, its detection latency is mu(n, 0)) per failure more than that of A. Furthermore, application message size increases by at most log(f + 1) bits, where f is the actual number of processes that fail during an execution. We show that, when the communication topology is fully connected, under certain realistic assumption, any fault-tolerant termination detection algorithm can be forced to exchange Omega(nf) control messages in the worst-case even when at most one process may be active initially and the underlying computation does not exchange any application messages. This implies that our transformation is optimal in terms of message complexity when mu(n, 0) = O(n).The fault-tolerant termination detection algorithm resulting from the transformation satisfies three desirable properties. First, it can tolerate the failure of up to n-1 processes. Second, it does not impose any overhead on the fault-sensitive termination detection algorithm until one or more processes crash. Third, it does not block the application at any time. Further, using our transformation, we derive a fault-tolerant termination detection algorithm that is the most efficient fault-tolerant termination detection algorithm that has been proposed so far to our knowledge. Our transformation can be extended to arbitrary communication topologies provided process crashes do not partition the system. (c) 2008 Elsevier Inc. All rights reserved.

Problem Setting. One of the most popular failure models for asynchronous fault-tolerant distributed systems is called crash-stop, which allows that a certain number of processes stops executing steps during the computation. Despite its theoretical interest, crash-stop is not expressive enough to model many realistic scenarios. In practice, processes crash but their processors reboot and the crashed process is restarted from a recovery point and rejoins the computation. This behavior is formalized as a failure model called crash-recovery, in which the processes can crash and recover multiple times.

We investigate the problem of detecting termination of a distributed computation in an asynchronous message-passing system where processes may crash and recover. We show that it is impossible to solve the termination detection problem in this model. We identify necessary and sufficient conditions under which it is possible to solve the stabilizing version of the problem in which a termination detection algorithm is allowed to make finite number of mistakes. Finally, we present an algorithm to solve the stabilizing termination detection problem under these conditions.

In case the data which is stored and processed in a sensor network has some value, it needs to be protected from unauthorized access through a security mechanism. The idea of evasive data storage is that data moves around the sensor network instead of remaining at a fixed location. In this way, an adversary, who has once (through node capture) had access to the data stored at some particular node, must compromise more sensors in order to maintain his illegitimate access to the sensor data. We refine the previously published simple evasive data storage techniques in two ways: (1) we improve the efficiency of data retrieval by bounding the area in which data may move, (2) we introduce data splitting as a technique to protect against sleeper attacks in which the adversary simply takes over a subset of nodes and waits for valuable data to pass by. We demonstrate the effectiveness of our approach using extensive simulations.

Malware is notoriously difficult to combat because it appears and spreads so quickly. In this article, we describe the design and implementation of CWSandbox, a malware analysis tool that fulfills our three design criteria of automation, effectiveness, and correctness for the Win32 family of operating systems