Protect sensitive information against channel state information based attacks

Channel state information (CSI) has been recently shown to be useful in performing security attacks in public WiFi environments. By analyzing how CSI is affected by the finger motions, CSI-based attacks can effectively reconstruct text-based passwords and locking patterns. This paper presents WiGuard, a novel system to protect sensitive on-screen gestures in a public place. Our approach carefully exploits the WiFi channel interference to introduce noise into the attacker's CSI measurement to reduce the success rate of the attack. Our approach automatically detects when a CSI-based attack happens. We evaluate our approach by applying it to protect text-based passwords and pattern locks on mobile devices. Experimental results show that our approach is able to reduce the success rate of CSI attacks from 92% to 42% for text-based passwords and from 82% to 22% for pattern lock

Protect sensitive information against channel state information based attacks

Channel state information (CSI) has been recently shown to be useful in performing security attacks in public WiFi environments. By analyzing how CSI is affected by the finger motions, CSI-based attacks can effectively reconstruct text-based passwords and locking patterns. This paper presents WiGuard, a novel system to protect sensitive on-screen gestures in a public place. Our approach carefully exploits the WiFi channel interference to introduce noise into the attacker's CSI measurement to reduce the success rate of the attack. Our approach automatically detects when a CSI-based attack happens. We evaluate our approach by applying it to protect text-based passwords and pattern locks on mobile devices. Experimental results show that our approach is able to reduce the success rate of CSI attacks from 92% to 42% for text-based passwords and from 82% to 22% for pattern lock

A secure HEVC video watermarking scheme for authentication and copyright purposes

High-Efficiency Video Coding (HEVC) becomes one of the widely deployed standards for multimedia applications. However, HEVC streams can be easily tampered by any third party, which negatively affects the authentication and copyright protection. Existing watermarking schemes used for copyright purpose are not able to protect the copyright information, especially if the hosting video encountered some intentional and/or unintentional attacks, such as recompression attack, lossy channel attacks, signal processing attacks, frame deletion attack, and image processing attacks. In addition, existing watermarking schemes used for authentication purpose are mostly suffering from the inability to detect recompression attack, especially if it uses the same quantisation parameters as the original compression. Further, existing watermarking schemes are suffering from the inability to locate tampering in videos. Moreover, some of those schemes could allow unauthorized access over an insecure channel, which is considered a serious security issue. In order to solve these issues, two HEVC video watermarking schemes are proposed; (1) a zero-fragile watermarking scheme based on sensitive watermarking zone and (2) a robust watermarking based on invariant watermarking zone. Additionally, the error correction code and cryptography techniques are applied to the watermark information to increase robustness and security over insecure channels. The first proposed scheme shows enough sensitivity to successfully detect video tampering, distinguish between intentional and unintentional attacks, and differentiate between first and second video compression at different bitrate, with accuracy improvement up to 42% compared to the-state-of-the-art schemes. Moreover, the second proposed scheme shows significant improvement; up to 8.23% of robustness against recompression attack, 95% against channel noise attacks, and 5.37% against frame deletion attack compared to the state�of-the-art schemes. Additionally, both proposed schemes are capable to maintain high visual quality, minimum bitrate increase, and high embedding capacity. Furthermore, both proposed schemes can localise tampering and prevent unauthorized access to watermarked information even over insecure channels

DR.SGX: Hardening SGX Enclaves against Cache Attacks with Data Location Randomization

Recent research has demonstrated that Intel's SGX is vulnerable to various software-based side-channel attacks. In particular, attacks that monitor CPU caches shared between the victim enclave and untrusted software enable accurate leakage of secret enclave data. Known defenses assume developer assistance, require hardware changes, impose high overhead, or prevent only some of the known attacks. In this paper we propose data location randomization as a novel defensive approach to address the threat of side-channel attacks. Our main goal is to break the link between the cache observations by the privileged adversary and the actual data accesses by the victim. We design and implement a compiler-based tool called DR.SGX that instruments enclave code such that data locations are permuted at the granularity of cache lines. We realize the permutation with the CPU's cryptographic hardware-acceleration units providing secure randomization. To prevent correlation of repeated memory accesses we continuously re-randomize all enclave data during execution. Our solution effectively protects many (but not all) enclaves from cache attacks and provides a complementary enclave hardening technique that is especially useful against unpredictable information leakage

Policy-agnostic programming on the client-side

Browser security has become a major concern especially due to web pages becoming more complex. These web applications handle a lot of information, including sensitive data that may be vulnerable to attacks like data exfiltration, cross-site scripting (XSS), etc. Most modern browsers have security mechanisms in place to prevent such attacks but they still fall short in preventing more advanced attacks like evolved variants of data exfiltration. Moreover, there is no standard that is followed to implement security into the browser. A lot of research has been done in the field of information flow security that could prove to be helpful in solving the problem of securing the client-side. Policy- agnostic programming is a programming paradigm that aims to make implementation of information flow security in real world systems more flexible. In this paper, we explore the use of policy-agnostic programming on the client-side and how it will help prevent common client-side attacks. We verify our results through a client-side salary management application. We show a possible attack and how our solution would prevent such an attack

CYCLOSA: Decentralizing Private Web Search Through SGX-Based Browser Extensions

By regularly querying Web search engines, users (unconsciously) disclose large amounts of their personal data as part of their search queries, among which some might reveal sensitive information (e.g. health issues, sexual, political or religious preferences). Several solutions exist to allow users querying search engines while improving privacy protection. However, these solutions suffer from a number of limitations: some are subject to user re-identification attacks, while others lack scalability or are unable to provide accurate results. This paper presents CYCLOSA, a secure, scalable and accurate private Web search solution. CYCLOSA improves security by relying on trusted execution environments (TEEs) as provided by Intel SGX. Further, CYCLOSA proposes a novel adaptive privacy protection solution that reduces the risk of user re- identification. CYCLOSA sends fake queries to the search engine and dynamically adapts their count according to the sensitivity of the user query. In addition, CYCLOSA meets scalability as it is fully decentralized, spreading the load for distributing fake queries among other nodes. Finally, CYCLOSA achieves accuracy of Web search as it handles the real query and the fake queries separately, in contrast to other existing solutions that mix fake and real query results