Attackers regularly use SSH (Secure SHell) to compromise systems, e.g., via brute-force attacks, establishing persistence by deploying SSH public keys. This ranges from IoT botnets like Mirai, over loader and dropper systems, to the back-ends of malicious operations. Identifying compromised systems at the Internet scale would be a major break-through for combatting malicious activity by enabling targeted clean-up efforts. In this paper, we present a method to identify compromised SSH servers at scale. For this, we use SSH's behavior to only send a challenge during public key authentication, to check if the key is present on the system. Our technique neither allows us to access compromised systems (unlike, e.g., testing known attacker passwords), nor does it require access for auditing. With our methodology used at an Internet-wide scan, we identify more than 21,700 unique systems (1,649 ASes, 144 countries) where attackers installed at least one of 52 verified malicious keys provided by a threat intelligence company, including critical Internet infrastructure. Furthermore, we find new context on the activities of malicious campaigns like, e.g., the 'fritzfrog' IoTbotnet, malicious actors like 'teamtnt', and even the presence of state-actor associated keys within sensitive ASes. Comparing to honeypot data, we find these to under-/over-represent attackers' activity, even underestimating some APTs' activities. Finally, we collaborate with a national CSIRT and the Shadowserver Foundation to notify and remediate compromised systems. We run our measurements continuously and automatically share notifications.

On July 19th, 2024, CrowdStrike rolled out a faulty update for their endpoint protection software, reportedly affecting over eight million Windows devices. The effects were diverse and global. Most notably, workplace infrastructure was disrupted and multiple airlines grounded their airplanes. The outage exhibited unique characteristics, affecting seemingly unrelated services all over the world, while the network continued to work as expected. Considering the widespread effect on IT systems, the outage should have effects on Internet traffic. However, it is not clear how these effects have substantiated. Indeed, the effects of large service outages on global traffic patterns have not been systematically studied. In this paper, we use data from four European ISPs and one IXP to study the effects of the CrowdStrike incident on Internet traffic. Despite the scale of the outage, we find that aggregate network-level metrics fail to capture the outage effectively. However, by correlating DNS traces with flow data, we show considerable effects on the application layer, including secondary effects, such as airline customers checking for flight cancellations. We find that, despite the large scale of the outage, effects on global Internet traffic were geographically and temporally bounded and quickly remediated. Furthermore, our analysis shows that application-level monitoring can be a valuable tool to better understand service-level outages.

The General Data Protection Regulation (GDPR) has significantly reshaped how organisations handle personal data, yet its impact on universities' privacy policies within the European Union remains under-explored. Universities process large volumes of personal data - from student records to research participant information necessitating strict GDPR compliance. This paper adopts a mixed-methods approach, combining qualitative content analysis (QCA) to assess transparency, compliance with GDPR principles and the framing of user rights with quantitative analysis to track textual modifications across word, sentence, and paragraph levels. Our findings reveal that institutional privacy policies often rely on vague and broad language, creating ambiguity around data purposes and retention. Additionally, practices such as outsourcing responsibility and embedding third-party tools challenge core GDPR principles like purpose limitation and data protection by design.

Email has been a cornerstone of online communication for decades, but its lack of built-in confidentiality has left it vulnerable to various attacks. To address this issue, two key protocols are being used: MTA-STS (Mail Transfer Agent Strict Transport Security) and DANE (DNS-based Authentication of Named Entities). While DANE was introduced first, MTA-STS has been actively adopted by major email providers like Google and Microsoft, as it does not require the complex DNSSEC chain that poses a significant challenge in deploying and managing DANE. However, despite its significance, there has been limited research on how MTA-STS is deployed and managed in practice. In this study, we present a thorough, longitudinal investigation of the MTA-STS ecosystem. We base our analysis on a dataset capturing over 87 million domains from DNS scans collected across four TLDs over 31 months, along with 10 months of additional component scanning such as TLS certificates, thereby offering a broad perspective on MTA-STS adoption and its management. Our analysis uncovers a concerning trend of misconfigurations and inconsistencies in MTA-STS setups. In our most recent snapshot, out of ~68K domains with MTA-STS record, 29.6% of domains were incorrectly configured, while 3.2% of these should encounter email delivery failure from MTA-STS supporting senders. To gain insights into the challenges faced by email administrators, we surveyed 117 operators. While awareness of MTA-STS was high (94.7%), many cited operational complexity (48.8%) and a preference for DANE (45.4%) as reasons for not deploying the protocol. Our study not only highlights the growing importance of MTA-STS but also reveals the significant challenges in its deployment and management.

Cloud-hosted environments are increasingly being adopted in both industry and academia alike, with marketing material and popular belief holding a myriad of conjectures as to why this adoption progresses. There is, however, a limited understanding of the factors that influence the decision to move to the cloud and the challenges encountered on this migration journey, grounded in data, specifically in the context of higher education. To address this gap, we perform an in-depth qualitative investigation to better understand the human factors of cloud adoption in universities. We engaged with 18 participants via semi-structured interviews and analysed the data using thematic analysis. We present our findings around three main themes-the decision matrix, the people-centric transition and the guardians of data-to comprehend the landscape of cloud migration (cloudscape) in higher education. Our findings highlight that cloud migrations go beyond a technical transformation. While they regularly encompass shifts in people's roles and mindsets, cloud adoption in the absence of such a shift may lead to patterns that triggered the move away from self-hosted and on-premise solutions in the first place. Furthermore, we find interaction effects between the technical depth of decision makers in contrast to necessary risk acceptance in the context of cloud adoption, thereby further adding to the broader discussion regarding the place of academia in monopolistic markets.

The Domain Name System (DNS) is a cornerstone of the Internet. As such, it is often the subject or the means of network measurement studies. Over the past decades, the Internet measurement community gathered many lessons-learned and captured them in widely available measurement toolchains such as ZDNS and OpenINTEL as well as many papers. However, for feasibility, these tools often restrict DNS tree exploration, use caching, and other intricate methods for reducing query load. This potentially hides many corner cases and unforeseen problems. In this paper, we present a system capable of exploring the full DNS tree. We gather 87 TB of DNS data covering 812M domains with over 85B queries over 40 days. Using this data, we replicate four earlier studies that used feasibility and time-optimized DNS datasets. Our results demonstrate the need for care in selecting which limitations regarding the perspective on DNS can be accepted for a given research question and which may alter findings and conclusions.

Since its inception in the 1970s, email has emerged as an irreplaceable medium for global communication. Despite its ubiquity, the system is plagued by security vulnerabilities, such as email spoofing. Among the various countermeasures, the Sender Policy Framework (SPF) remains a seminal and commonly deployed solution, working by specifying a list of authorized IP addresses for sending email. While SPF might seem simple on the surface, the practical management of its records proves to be challenging; for example, although syntactical errors are uncommon (0.4%), evaluation-phase challenges are prevalent (7.7%), leading to potential disruptions in email delivery. In our paper, we conduct a comprehensive study on the SPF extension, drawing from 17 months of weekly data snapshots that span 176 million domains across four top-level domains; we delve into the reasons behind such prevalent evaluation errors. Simultaneously, we undertake an ethical methodology to explore how SMTP servers validate SPF records and evaluate the effectiveness of widely-used software implementations. Our study unveils potential attack vectors that could be exploited for DNS amplification attacks or disrupt mail distribution; for instance, we demonstrate how an attacker could temporarily impede email reception by exploiting flaws in SPF validation mechanisms. We also conduct a qualitative study among email administrators to gain insights into the practical implementation and usage of SPF and SPF validators. Based on our findings, we provide recommendations designed to reconcile these discrepancies and bolster the SPF ecosystem's overall security.

As the entry point to the DNS hierarchy, the DNS root zone, served by the DNS root server system, is essential for the Internet. It consists of 13 deployments managed by 12 independent root server operators. Due to its importance, the root zone deserves special scrutiny, which it has received from researchers and operators alike. In this study, we measure all root servers over a period of 174 days from 675 vantage points in 523 networks and 62 countries using IPv4 and IPv6. Using this data, we first investigate the co-location between root servers, finding that almost 70% of clients observe co-location of at least two servers. Second, we monitor the integrity of zone transfers, finding rare issues like bitflips or stale zone files. Finally, by enriching our data with passive ISP and IXP data, we quantify the role of IPv6 for performance and behavior under change, finding that even seemingly similar subsets of root servers can differ considerably.

In just a few years, the issue of "digital sovereignty" has emerged as an important security issue for governments across the globe, reflecting a growing unease about the security risks associated with government services that depend on foreign service providers for digital infrastructure and traffic routing. This work investigates to which extent government services and communication with citizens relies on infrastructure outside their own juris-diction for six countries facing sensitive or sometimes even antagonistic relations with neighbors: India, the Netherlands, Pakistan, Taiwan, Ukraine, and the United Kingdom. By combining various methods (traceroute measurements, passive DNS data and geolocation), we determine where and how domains are hosted, as well as the network paths taken by citizens' traffic to them. We uncover different strategies and degrees of autonomy, as well as difficult tradeoffs between different risks to autonomy, some of which might be larger than the risks associated with the dependency on foreign providers. This includes transnational providers being used by all countries, with geopolitical rivals even being tenants on the same network and traffic between citizens and governments regularly traversing international borders. Furthermore, we compared our empirical findings to stated governmental policies and find that they are not always consistent.

Researchers and practitioners often face the issue of having to attribute an IP address to an organization. For current data this is comparably easy, using services like whois or other databases. Similarly, for historic data, several entities like the RIPE NCC provide websites that provide access to historic records. For large-scale network measurement work, though, researchers often have to attribute millions of addresses. For current data, Team Cymru provides a bulk whois service which allows bulk address attribution. However, at the time of writing, there is no service available that allows historic bulk attribution of IP addresses. Hence, in this paper, we introduce and evaluate our 'Back-to-the-Future whois' service, allowing historic bulk attribution of IP addresses on a daily granularity based on CAIDA Routeviews aggregates. We provide this service to the community for free, and also share our implementation so researchers can run instances themselves.

Personal software configurations, known as dotfiles, are increasingly being shared in public repositories. To understand the security and privacy implications of this phenomenon, we conducted a large-scale analysis of dotfiles repositories on GitHub. Furthermore, we surveyed repository owners to understand their motivations for sharing dotfiles, and their awareness of the security implications. Our mixed-method approach consisted of two parts: (1) We mined 124,230 public dotfiles repositories and inductively searched them for security and privacy flaws. (2) We then conducted a survey of repository owners (n=1,650) to disclose our findings and learn more about the problems and implications. We found that 73.6 % of repositories leak potentially sensitive information, most commonly email addresses (of which we found 1.2 million), but also RSA private keys, API keys, installed software versions, browsing history, and even mail client inboxes. In addition, we found that sharing is mainly ideological (an end in itself) and to show off ("ricing"), in addition to easing machine setup. Most users are confident about the contents of their files and claim to understand the security implications. In response to our disclosures, a small minority (2.2%) will make their repositories private or delete them, but the majority of respondents will continue sharing their dotfiles after taking appropriate actions. Dotfiles repositories are a great tool for developers to share knowledge and communicate – if done correctly. We provide recommendations for users and platforms to make them more secure. Specifically, tools should be used to manage dotfiles. In addition, platforms should work on more sophisticated tests, to find weaknesses automatically and inform the users or control the damage.

Network measurements are a necessary component of assessing real-world protocol use to inform the development of new and improvement of old protocols and standards. However, especially active measurements, i.e., measurements in which probes are sent to remote devices to illicit a response, face ethical challenges, are difficult to execute reliably, and may cause unintended harm.

DNS is one of the core building blocks of the Internet. In this paper, we investigate DNS resolution in a strict IPv6-only scenario and find that a substantial fraction of zones cannot be resolved. We point out, that the presence of an AAAA resource record for a zone's nameserver does not necessarily imply that it is resolvable in an IPv6-only environment since the full DNS delegation chain must resolve via IPv6 as well. Hence, in an IPv6-only setting zones may experience an effect similar to what is commonly referred to as lame delegation. Our longitudinal study shows that the continuing centralization of the Internet has a large impact on IPv6 readiness, i.e., a small number of large DNS providers has, and still can, influence IPv6 readiness for a large number of zones. A single operator that enabled IPv6 DNS resolution -- by adding IPv6 glue records -- was responsible for around 20.3% of all zones in our dataset not resolving over IPv6 until January 2017. Even today, 10% of DNS operators are responsible for more than 97.5% of all zones that do not resolve using IPv6.

Network measurements are a necessary component of assessing real-world protocol use to inform the development of new and improvement of old protocols and standards. However, especially active measurements, i.e., measurements in which probes are sent to remote devices to illicit a response, face ethical challenges, are difficult to execute reliably, and may cause unintended harm. In this paper, we reflect on the connection between the Internet's growing complexity, the practicalities of academic research, and the likelyhood of reliability issues and unintended harm occurring in active measurements. We argue that communal infrastructure providing measurement services to the academic community could be a path forward to improve reliability and accessibility, while reducing the potential for unintended harm, and enabling PhD students to more easily draw from the experience of industry professionals.

The Web PKI ecosystem provides an underlying layer of security to many Internet protocols used today. By relying on Certificate Authorities (CAs), communication can be authenticated and encrypted based on a chain of trust. Unfortunately, this chain of trust has been broken in the past. For instance, in 2011, adversaries managed to issue fraudulent certificates on behalf of the DigiNotar CA, resulting in a loss of trust in DigiNotar. To better detect fraudulent certificates, Google introduced the concept of Certificate Transparency (CT), which is based on append-only logs that allow one to monitor and detect wrongly issued X.509 certificates.In this work, we investigate the potential of these logs as a data source for target reconnaissance. Concretely, we divide our study into two parts: First, we deploy several honeypot web servers over a period of 200 days to study the effect on incoming scanning traffic after pushing a certificate to one or more CT logs. We find that adding a certificate to a CT log leads to incoming network probes, just seconds after publishing the entry. This suggests that CT logs are used as input for web scans. In the IPv6 address space, our web server received 2,700 packets after pushing our certificate to a CT log, compared to 0 packets in our control group.Second, we use large-scale active measurements to find potentially vulnerable domains from CT log data. Using certificate issuance and renewal patterns, we identify websites that are either at the beginning or at the end of their life cycle. Our results show that freshly deployed websites are not more likely to contain a known CVE compared to websites that just renewed their certificate. On the other side of the spectrum, however, we find that websites with an expired certificate, yet still deployed in the wild, tend to contain more outdated software, and hence more known CVEs. As such, CT logs can indeed function as a data source for target reconnaissance.

Email, since its invention, has become the most widely used communication system and SMTP is the standard for email transmission on the Internet. However, SMTP lacks built-in security features, such as sender authentication, making it vulnerable to attacks, including sender spoofing. To address the threat of spoofing, several security extensions, such as SPF or DKIM, have been proposed. Domain-based Message Authentication Reporting and Conformance (DMARC) was introduced in 2012 as a way for domain name owners to publish desired actions for email receivers to take through a DNS record if SPF or DKIM validation fails. The DMARC record can also request email receivers to send machine-generated reports back to the specified addresses to aid domain name owners in detecting and evaluating the risk of spoofed emails. However, DMARC's complexity creates opportunities for mismanagement that can be exploited by attackers. This paper presents a large-scale and comprehensive measurement study of DMARC reporting deployment and management. We collected data for all second-level domains under the .com, .net, .org, and .se TLDs over 13 months to analyze deployment and management from the domain name owner's perspective. Additionally, we investigated 7 popular email hosting services and 2 open-source DMARC reporting software to understand their reporting practices. Our study reveals pervasive mismanagement and missing security considerations in DMARC reporting. For example, we found that a single email from an attacker can make a victim SMTP server receive a large number of reports with a high amplification factor (e.g., 1,460×) by exploiting misconfigured SMTP servers. Based on our findings of several operational misconfigurations for DMARC reporting, we provide recommendations for improvement.

In the system and network administration domain, gender diversity remains a distant target. The experiences and perspectives of sysadmins who belong to marginalized genders (non cis-men) are not well understood beyond the fact that sysadmin work environments are generally not equitable. We address this knowledge gap in our study by focusing on the ways in which sysadmins from marginalized genders manage their work in men-dominated sysadmin work spaces and by understanding what an inclusive workplace would look like. Using a feminist research approach, we engaged with a group of 16 sysadmins who are not cis-men via six online focus groups. We found that managing the impact of gender identity in the sysadmin workplace means demonstrating excellence and going above and beyond in system administration tasks, and also requires performing additional care work not expected from cis men. Furthermore, our participants handle additional layers of work due to gender considerations and to actively find community in the workplace. We found that sysadmins manage by going above and beyond in their tasks, performing care work and doing extra layers of work because of gender considerations, and finding community in the workplace. To mitigate this additional workload, we recommend more care for care work. For future research, we recommend the use of feminist lenses when studying sysadmin work in order to provide more equitable solutions that ultimately contribute to improving system security by fostering a just workplace.