Abstract We present an analysis system for studying Windows application installers. The analysis system is fully automated from installer download to execution and data collection. The system emulates the behavior of a lazy user who wants to finish the installation dialogs with the default options and with as few clicks as possible. The UI automation makes use of image recognition techniques and heuristics. During the installation, the system collects data about the system modification and network access. The analysis system is scalable and can run on bare-metal hosts as well as in a data center. We use the system to analyze 792 freeware application installers obtained from popular download portals. In particular, we measure how many of them drop potentially unwanted programs (PUP) such as browser plugins or make other unwanted system modifications. We discover that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks. We also find, that while popular download portals are not used for blatant malware distribution, nearly 10% of the analyzed installers come with a third-party browser or a browser extension.

Abstract Controlling when and how a process runs is essential to the security of a system. In virtualized environments, an out-of-guest approach to process control is attractive because it allows fine-grained in-guest inspection and enforcement from the relative safety of the hypervisor, which makes in-guest misconfiguration by users or deliberate interference by malware more difficult. However, prior work in this area is incomplete, either lacking policy enforcement, missing certain types of malicious code due to insufficient coverage, or being unable to scale to many simultaneous guests. This work introduces Goalkeeper , a hypervisor-based security system that focuses on asynchronous, stateless, and lightweight Virtual Machine Introspection (VMI) techniques to enforce comprehensive guest process security policies at scale across tens to hundreds of guests per hypervisor. Running beneath each guest, Goalkeeper uses policy rules to ensure only whitelisted guest processes are allowed to execute, and terminates policy violators using a customizable set of VMI-based process termination techniques. In an evaluation across a population of 100 Linux virtual desktops, Goalkeeper is shown to catch malicious code that is missed by prior work while imposing a comparable performance overhead.

Abstract Centralized management is typically applied in modern operating system (OS) architecture; however, such systems are prone to crash when any certain component of the OS is explicitly damaged. The basic reason is that these OSes can rarely support a thoroughly secure or isolated environment either between OS kernel-mode components or between user-mode softwares. To mitigate this issue, we propose vmOS, an operating system that aims at improving the security of desktop computing environment. vmOS applies isolation technique to reduce attack surface, virtualization and mandatory access control to provide isolated environment among system components, application software and user privacy. We implement vmOS by adopting hardware-supported virtualization technology and modifying several well-known open source softwares, which aim to provide run-time efficiency of integrated system. Finally, we evaluate the security and performance by some vulnerability exploits and benchmark tools, showing that vmOS is capable of assuring the overall security of users' desktop computing with less overhead.

Each public key infrastructure needs an efficient certificate status validation method to exclude the revoked certificates from network. In this paper, we present a novel certificate validation scheme called E-ADOPT or Enhanced-ADOPT which utilizes a new kind of certificate status information. In this solution, we modify the OCSP response messages to carry information about the accusations issued against the certificate and this additional security information helps the client nodes to tune the OCSP results refresh rate more intelligently. As a result, client node can mitigate the certificate status information inconsistency problem with lower overheads and conduct more effective certificate status validations in MANET. Simulation results demonstrate that by appending accusation-related information to the OCSP responses, our solution achieves better results.

Abstract Public and private organizations face the challenges of protecting their networks from cyber-attacks, while reducing the amount of time and money spent on Information Technology. Organizations can reduce their expenditures by reusing server, switch and router hardware, but they must use reliable and efficient methods of sanitizing these devices before they can be redeployed. The sanitization process removes proprietary, sensitive or classified data, as well as persistent malware from a device prior to reuse. The Johns Hopkins University Applied Physics Laboratory has developed an automated, rapid, and secure method for sanitizing servers, switches and routers. This sanitization method was implemented and tested on several different types of network devices during the Cyber Measurement & Analysis Center project, which was funded under Phases I and II of the DARPA (2008) National Cyber Range program. The performance of the automated sanitization system was excellent with an order of magnitude reduction in the time required to sanitize servers, routers and switches, and a significant improvement in the effectiveness of the sanitization process through the addition of persistent malware removal.

A Delay Tolerant Network (DTN) is a network where nodes can be highly mobile, with long message delay times, forming dynamic and fragmented networks. Conventional centralised network security mechanisms are unsuitable in such networks, therefore distributed security solutions are more desirable in DTN implementations. Establishing effective trust in distributed systems with no centralised Public Key Infrastructure (PKI) such as the Pretty Good Privacy (PGP) scheme, usually requires human intervention. In this paper, we build and compare different decentralised trust systems for autonomous DTN. We utilise a public key distribution model based on the Web of Trust principle, and employ a simple Leverage of Common Friends (LCF) trust system to establish initial trust in autonomous DTN. We compare this system with two other scenarios (no trust and random trust) for autonomous establishment of initial trust. Comparisons are based on the time it takes to disperse the trust and resilience of the system against a malicious node distributing malicious and False Public Keys. Our results show that the LCF trust system mitigates the distribution of false malicious public keys by 40%. LCF takes 44% longer to distribute 50% of the public keys compared when using no trust system, but is 16% faster in comparison to the random trust method.

In Computers & Security 32 (2013) 1-18, the authors proposed a new network mobility management protocol named NeMHIP which was based on the HIP. What's more, the authors had demonstrated the security of NeMHIP. However, there are two simple but vital mistakes in the NeMHIP. Fortunately, we propose solutions to solve these mistakes. In this note, we will present a corrected NeMHIP.

Many peer-to-peer security protocols in mobile communications utilise shared secrets. Synchronous storage of shared secrets is imperative for the successful operation of security protocols, as asyn...