Investigating System Operators' Perspective on Security Misconfigurations

Dietrich, Constanze; Krombholz, Katharina; Borgolte, Kevin; Fiebig, Tobias

doi:10.1145/3243734.3243794

Cited by 71 publications

(57 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We also posted ads on online communities like Reddit. Dietrich et al showed online chatrooms and forums are useful for recruiting security professionals, since participants are reached in a more natural setting where they are more likely to be receptive [70].…”

Section: Recruitment and Participantsmentioning

confidence: 99%

An Observational Investigation of Reverse Engineers' Process and Mental Models

Votipka

Rabin

Micinski

et al. 2019

Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

Reverse engineering is a complex process essential to software-security tasks such as vulnerability discovery and malware analysis. Significant research and engineering effort has gone into developing tools to support reverse engineers. However, little work has been done to understand the way reverse engineers think when analyzing programs, leaving tool developers to make interface design decisions based only on intuition.This paper takes a first step toward a better understanding of reverse engineers' processes, with the goal of producing insights for improving interaction design for reverse engineering tools. We present the results of a semi-structured, observational interview study of reverse engineers (N=16). Each observation investigated the questions reverse engineers ask as they probe a program, how they answer these questions, and the decisions they make throughout the reverse engineering process. From the interview responses, we distill a model of the reverse engineering process, divided into three phases: overview, sub-component scanning, and focused experimentation. Each analysis phase's results feed the next as reverse engineers' mental representations become more concrete. We find that reverse engineers typically use static methods in the first two phases, but dynamic methods in the final phase, with experience playing large, but varying, roles in each phase. Based on these results, we provide five interaction design guidelines for reverse engineering tools.

show abstract

Section: Recruitment and Participantsmentioning

confidence: 99%

An Observational Investigation of Reverse Engineers' Process and Mental Models

Votipka

Rabin

Micinski

et al. 2019

Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems

View full text Add to dashboard Cite

show abstract

“…Concerning the certificate themselves, RFC 4398 proposed a specific CERT RR to store certificates, but to our knowledge the effort has been abandoned, and the small number of certificates we observe does not indicate that TXT is commonly used for this purpose. While publishing certificates via TXT records is not a security risk in itself, the fact that we found private keys accompanying requests still suggests securityrelevant configuration mistakes [24] are being made.…”

Section: Mistakes With a Security Implicationmentioning

confidence: 89%

“…Finally, we note that the remaining 99.54% of the TXT records might not necessarily be secure. Our regular expressions explicitly accommodate for typos which we commonly see in the data ('sfp' instead of 'spf', for example), a common issue in IT operations [24]. The consequence of these human errors might be severe, since they might lead to a false sense of security or, e.g., broken email delivery.…”

Section: Discussionmentioning

confidence: 99%

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

Toorn

Rijswijk-Deij

Fiebig

et al. 2020

2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

Self Cite

View full text Add to dashboard Cite

The DNS TXT resource record is the one with the most flexibility for its contents, as it is a largely unstructured. Although it might be the ideal basis for storing any form of text-based information, it also poses a security threat, as TXT records can also be used for malicious and unintended practices. Yet, TXT records are often overlooked in security research. In this paper, we present the first structured study of the uses of TXT records, with a specific focus on security implications. We are able to classify over 99.54% of all TXT records in our dataset, finding security issues including accidentally published private keys and exploit delivery attempts. We also report on our lessons learned during our large-scale, systematic analysis of TXT records.

show abstract

“…Related work has extensively studied how and why attackers compromise websites through the exploitation of software vulnerabilities [16,18], misconfigurations [23], inclusion of third-party scripts [48], and advertisements [75]. Traditionally, the attackers' goals ranged from website defacements [17,42], over enlisting the website's visitors into distributed denial-of-service (DDoS) attacks [53], to the installation of exploit kits for drive-by download attacks [30,55,56], which infect visitors with malicious executables.…”

Section: Related Workmentioning

confidence: 99%

MineSweeper

Konoth

Vineti

Moonsamy

et al. 2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

101

View full text Add to dashboard Cite

A wave of alternative coins that can be effectively mined without specialized hardware, and a surge in cryptocurrencies' market value has led to the development of cryptocurrency mining (cryptomining) services, such as Coinhive, which can be easily integrated into websites to monetize the computational power of their visitors. While legitimate website operators are exploring these services as an alternative to advertisements, they have also drawn the attention of cybercriminals: drive-by mining (also known as cryptojacking) is a new web-based attack, in which an infected website secretly executes JavaScript code and/or a WebAssembly module in the user's browser to mine cryptocurrencies without her consent. In this paper, we perform a comprehensive analysis on Alexa's Top 1 Million websites to shed light on the prevalence and profitability of this attack. We study the websites affected by drive-by mining to understand the techniques being used to evade detection, and the latest web technologies being exploited to efficiently mine cryptocurrency. As a result of our study, which covers 28 Coinhive-like services that are widely being used by drive-by mining websites, we identified 20 active cryptomining campaigns. Motivated by our findings, we investigate possible countermeasures against this type of attack. We discuss how current blacklisting approaches and heuristics based on CPU usage are insufficient, and present MineSweeper, a novel detection technique that is based on the intrinsic characteristics of cryptomining code, and, thus, is resilient to obfuscation. Our approach could be integrated into browsers to warn users about silent cryptomining when visiting websites that do not ask for their consent. CCS CONCEPTS • Security and privacy → Browser security; Malware and its mitigation; • Social and professional topics → Computer crime;

show abstract

Investigating System Operators' Perspective on Security Misconfigurations

Cited by 71 publications

References 36 publications

An Observational Investigation of Reverse Engineers' Process and Mental Models

An Observational Investigation of Reverse Engineers' Process and Mental Models

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

MineSweeper

Contact Info

Product

Resources

About