Understanding of Adversary Behavior and Security Threats in Public Key Infrastructures

Public Key Infrastructure (PKI) is designed to guarantee the authenticity and integrity of digital assets such as messages, executable binaries, etc. In PKIs, there are two representative applications: 1) the Web PKI and 2) the Code-Signing PKI. 1) The Web PKI enables entities (e.g., clients and web service providers) to securely communicate over untrusted networks such as the Internet, and 2) the Code-Signing PKI helps protect clients from executing files of unknown origin. However, anecdotal evidence has indicated that adversaries compromised and abused the PKIs, which poses security threats to entities. For example, CAs have mis-issued digital certificates to adversaries due to their failed vetting processes. Moreover, private keys that are supposed to be securely kept were stolen by adversaries. Such mis-issued certificates or stolen private keys were used to launch impersonation attacks. In this regard, we need to have a sound understanding of such security threats and adversaries' behaviors in the PKIs to mitigate them and further to enhance the security of the PKIs. In this dissertation, we conduct a large-scale measurement study in the two representative applications---the Web PKI and the Code-Signing PKI---to better understand adversaries' behaviors and the potential security threats. First, in 1) the Web PKI, we mainly focus on phishing websites served with TLS certificates. From the measurement study, we observe that certificate authorities (CAs) often fail in their vetting process and mis-issue TLS certificates to adversaries (i.e., phishing attackers). Also, CAs rarely revoke their issued TLS certificates that have been compromised. Second, in 2) the Code-Signing PKI, we characterize the weaknesses of the three actors (i.e., CAs, software publishers, and clients) that adversaries can exploit to compromise the Code-Signing PKI. Moreover, we measure the effectiveness of the primary defense, revocation, against the Code-Signing PKI abuses. We find that erroneous revocations (e.g., wrong effective revocation date setting) can pose additional security threats to clients who execute binaries because the revocations become ineffective. Such security threats stem from an inherent challenge of setting an effective revocation date in the Code-Signing PKI and CAs' misunderstanding of the PKI. These findings help Anti-Virus companies and a CA fix their flaws

Vision-Based Automated Hole Assembly System with Quality Inspection

Automated manufacturing, driven by rising demands for mass-produced products, calls for efficient systems such as the peg-in-hole assembly. Traditional industrial robots perform these tasks but often fall short in speed during pick-and-place processes. This study presents an innovative mechatronic system for peg-in-hole assembly, integrating a novel peg insertion tool, assembly mechanism and control algorithm. This combination achieves peg insertion with a 200 µm tolerance without the need for pick-and-place, meeting the requirements for high precision and rapidity in modern manufacturing. Dual cameras and computer vision techniques, both traditional and machine learning (ML)-based, are employed to detect workpiece features essential for assembly. Traditional methods focus on image enhancement, edge detection and circular feature recognition, whereas ML verifies workpiece positions. This research also introduces a novel statistical quality inspection, offering an alternative to standard ML inspections. Through rigorous testing on varied workpiece surfaces, the robustness of the methods is affirmed. The assembly system demonstrates a 99.00% success rate, while the quality inspection method attains a 97.02% accuracy across diverse conditions, underscoring the potential of these techniques in automated assembly, defect detection and product quality assurance

Structure and Property Correlations of Surface-Active Agents in the Control of Colloidal Behavior in Home/Personal Care and Biochemical Systems

Complexity in Home and Personal Care appears in several forms – the product, the substrate, and their interactions. The aim of this thesis is to investigate strategies for selecting effective surface-active agents (surfactants) that can be used in combination with other active ingredients in industry-relevant formulations deployed in the personal care sector. This thesis is composed of three parts, each of which involves a study of a complex natural system as it is affected by the addition of a complex chemical mixture. This is done in an effort to expose key features of the design rules for engineering the chemical mixture to enhance baseline performance via synergistic interactions of the formulation components and the natural system components. The first topic is an investigation on how the effectiveness of surface-active agents for removing a mixture of hydrophobic and hydrophilic soils from fabrics is related to the surfactants' physical-chemical features. The second topic is an exploration of compatible surfactant-enzyme systems that can be used in various industrial applications, where the behavior at a variety of interfaces is concomitantly important. Here, the focus is on the effect of surfactant structure and properties on enzyme function (i.e., activity), structural mobility and stability. The third topic is an investigation on the usefulness of micro-Raman spectroscopy for determining in situ chemical information that relates to the effects of a variety of surfactants on the mechanical and textural features of skin

Evaluating the Effectiveness and Robustness of Visual Similarity-based Phishing Detection Models

Phishing attacks pose a significant threat to Internet users, with cybercriminals elaborately replicating the visual appearance of legitimate websites to deceive victims. Visual similarity-based detection systems have emerged as an effective countermeasure, but their effectiveness and robustness in real-world scenarios have been unexplored. In this paper, we comprehensively scrutinize and evaluate state-of-the-art visual similarity-based anti-phishing models using a large-scale dataset of 450K real-world phishing websites. Our analysis reveals that while certain models maintain high accuracy, others exhibit notably lower performance than results on curated datasets, highlighting the importance of real-world evaluation. In addition, we observe the real-world tactic of manipulating visual components that phishing attackers employ to circumvent the detection systems. To assess the resilience of existing models against adversarial attacks and robustness, we apply visible and perturbation-based manipulations to website logos, which adversaries typically target. We then evaluate the models' robustness in handling these adversarial samples. Our findings reveal vulnerabilities in several models, emphasizing the need for more robust visual similarity techniques capable of withstanding sophisticated evasion attempts. We provide actionable insights for enhancing the security of phishing defense systems, encouraging proactive actions. To the best of our knowledge, this work represents the first large-scale, systematic evaluation of visual similarity-based models for phishing detection in real-world settings, necessitating the development of more effective and robust defenses.Comment: 12 page

An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection

Large Language Models (LLMs) have transformed code completion tasks, providing context-based suggestions to boost developer productivity in software engineering. As users often fine-tune these models for specific applications, poisoning and backdoor attacks can covertly alter the model outputs. To address this critical security challenge, we introduce CodeBreaker, a pioneering LLM-assisted backdoor attack framework on code completion models. Unlike recent attacks that embed malicious payloads in detectable or irrelevant sections of the code (e.g., comments), CodeBreaker leverages LLMs (e.g., GPT-4) for sophisticated payload transformation (without affecting functionalities), ensuring that both the poisoned data for fine-tuning and generated code can evade strong vulnerability detection. CodeBreaker stands out with its comprehensive coverage of vulnerabilities, making it the first to provide such an extensive set for evaluation. Our extensive experimental evaluations and user studies underline the strong attack performance of CodeBreaker across various settings, validating its superiority over existing approaches. By integrating malicious payloads directly into the source code with minimal transformation, CodeBreaker challenges current security measures, underscoring the critical need for more robust defenses for code completion.Comment: To appear in USENIX Security '2

A comparative study of the arbitral award system in korean and french law

Une étude comparative approfondie en matière d’arbitrage entre le droit coréen et le droit français n’avait jamais été effectuée en France. Surtout, du point de vue comparatiste coréen, le droit de l’arbitrage français a un intérêt particulier dans l’optique des possibles transformations à venir du droit de l’arbitrage coréen. En effet, depuis la réforme de 1999, les juristes coréens portent leur attention, y compris après la récente révision de 2016, sur la réglementation étrangère de l’arbitrage, et s’intéressent au rayonnement international du système français d’arbitrage. Il apparaît dès lors pertinent de présenter l’évolution des deux droits de l’arbitrage en mettant l’accent sur les réformes qui apportent des solutions aux problèmes soulevés par l’application des règles antérieures. Ainsi, la question est de savoir si la législation coréenne actuelle est suffisante pour faire face aux exigences de la communauté internationale et pour promouvoir sur le plan international le système coréen d’arbitrage commercial. Si tel n’est pas le cas, le droit français pourrait-il constituer une source d’inspiration pour une réforme des pratiques et du droit de l’arbitrage ? Pour répondre à ces questions, il apparaît intéressant de comparer notamment le régime de la sentence arbitrale en droit coréen et en droit français. Cette analyse comparative s’attachera donc à expliquer les raisons des différences entre les solutions apportées par ces deux droits, tant au plan législatif qu’au plan juridictionnel, afin de guider les juristes coréens et de mettre en évidence une évolution susceptible de rassurer les parties étrangères envisageant de se soumettre à un arbitrage en Corée du Sud.An in-depth comparative study of arbitration between Korean and French law has never been considered in France. From the Korean comparative point of view, French arbitration law is of particular interest for the next possible directions of Korean arbitration law. For this reason, since the 1999 reform, even after the 2016 revision, Korean jurists have been paying attention to foreign arbitration regulations, especially with regard to the international influence of the French arbitration system. Therefore, it seems relevant to present the evolution of the two arbitration laws by focusing on several reforms that provide solutions to the problems raised by the application of the previous rules. Thus, the question is whether the current Korean legislation is sufficient to meet the requirements of the international community and to promote the Korean commercial arbitration system internationally. If not, should French law be used as an inspiration to define new directions for arbitration practices and laws ? In this respect, it seems interesting to compare in particular the regime of the arbitral award in Korean law and in French law. This comparative analysis will therefore seek to explain the reasons of the differences in the solutions provided by these two laws, on a legislative and jurisdictional level, in order to guide the Korean doctrine and legislator and to highlight developments likely to reassure foreign parties considering arbitration in South Korea

Porous Gold-Silver Alloy Nanoparticles for Photoacoustic Signal Enhancement

"Photoacoustic (PA) imaging is an emerging tool that can solve the traditional problems of optical imaging such as imaging depth and resolution. Using the acoustic waves generated in response to the absorption of pulsed laser light, PA imaging can provide non-invasive images of live species. In addition, PA imaging shows several centimeters of penetration depth and a few hundred micrometers of resolution, due to lower scattering of acoustic waves in tissue than photons. In this work, we synthesized colloidal porous AuAg alloyed nanoparticles (pAuAg NPs) for enhanced PA imaging.pAuAg NPs were synthesized by galvanic replacement of silver nanocubes. The pAuAg NPs have a 50-nm exteriorsize, and about half of their entire inner space consists of voids that have a bimodal pore distribution with peaksat 21 nm and 8.3 nm. In aqueous in vitro experiments, pAuAg NPs showed 8.9 times higher PA signals than the same number of Au NRs, and 11.7 times higher PA signals than the same number of metal atoms. The PA signal of pAuAg NPs was detected even under 4.5-cm-thick chicken tissue; this result promises a capability for deep-tissue imaging. In whole-body in vivo experiments using a BALB/c mouse, the PA signal of pAuAg NPs showed up to 2.7 times brighter than those of Au NRs under an additional load of 0.8-cm-thick chicken tissue. To further boost the PA signal, silica layers were coated onto pAuAg NPs; these layers increased their PA signals by up to 1.8 times compared to uncoated pAuAg NPs. pAuAg NPs provide strong PA imaging contrast with relatively small dosage. Their inner voids may also permit cargos such as drugs, and their outer surfaces be easily tethered by other functional moieties for applications such as targeting and sensing."2