No abstract

The massive payment card industry (PCI) involves various entities such as merchants, issuer banks, acquirer banks, and card brands. Ensuring security for all entities that process payment card information is a challenging task. The PCI Security Standards Council requires all entities to be compliant with the PCI Data Security Standard (DSS), which specifies a series of security requirements. However, little is known regarding how well PCI DSS is enforced in practice. In this paper, we take a measurement approach to systematically evaluate the PCI DSS certification process for e-commerce websites. We develop an e-commerce web application testbed, Bug-gyCart, which can flexibly add or remove 35 PCI DSS related vulnerabilities. Then we use the testbed to examine the capability and limitations of PCI scanners and the rigor of the certification process. We find that there is an alarming gap between the security standard and its real-world enforcement. None of the 6 PCI scanners we tested are fully compliant with the PCI scanning guidelines, issuing certificates to merchants that still have major vulnerabilities. To further examine the compliance status of real-world e-commerce websites, we build a new lightweight scanning tool named Pci-CheckerLite and scan 1,203 e-commerce websites across various business sectors. The results confirm that 86% of the websites have at least one PCI DSS violation that should have disqualified them as non-compliant. Our in-depth accuracy analysis also shows that PciCheckerLite's output is more precise than w3af. We reached out to the PCI Security Council to share our research results to improve the enforcement in practice.

Spring security is tremendously popular among practitioners for its ease of use to secure enterprise applications. In this paper, we study the application framework misconfiguration vulnerabilities in the light of Spring security, which is relatively understudied in the existing literature. Towards that goal, we identify 6 types of security anti-patterns and 4 insecure vulnerable defaults by conducting a measurementbased approach on 28 Spring applications. Our analysis shows that security risks associated with the identified security antipatterns and insecure defaults can leave the enterprise application vulnerable to a wide range of high-risk attacks. To prevent these high-risk attacks, we also provide recommendations for practitioners. Consequently, our study has contributed one update to the official Spring security documentation while other security issues identified in this study are being considered for future major releases by Spring security community.

Recent findings revealed that certain viruses encoded microRNA-like small RNAs using the RNA interference machinery in the host cells. However, the function of these virusencoded microRNA-like small RNAs remained unclear, and whether these microRNAlike small RNAs were involved in the replication of the virus and viral infection was still disputable. In this chapter, the negative-sense RNA genome of Ebola virus (EBOV) was scanned using bioinformatics tools to predict the EBOV-encoded microRNA-like small RNAs. Then, the potential influence of viral microRNA-like small RNAs on the viral immune evasion, host cellular signaling pathway, and epigenetic regulation of antiviral defense mechanism were also detected by the reconstructed regulatory network of target genes associated with viral encoded microRNA-like small RNAs. In this analysis, EBOV-encoded microRNA-like small RNAs were proposed to inhibit the host immune response factors, probably facilitating the evasion of EBOV from the host defense mechanisms. In conclusion, systematic investigation of microRNA-like small RNAs in EBOV genome may shed light on the underlying molecular mechanisms of the pathological process of Ebola virus disease (EVD).

No abstract