Security Reading Group

The security reading group meets Wednesdays during the semester typically at 12:30 in the CITP Conference Room (Sherrerd Hall, 3rd floor). Sushi lunch is provided. Each week participants read and discuss a technical paper.

To find out about upcoming meetings, join the security-reading list.

For specific times, locations, and readings, see the CITP online calendar: XML ICAL HTML

Upcoming Events

Today
Oct. 21		 A Micro-Payment Scheme Encouraging Collaboration in Multi-Hop Cellular Networks. M. Jakobsson, J.-P. Hubaux, L. Buttyán. Financial Cryptography 2003.

Interested readers may also wish to examine:

A Charging and Rewarding Scheme for Packet Forwarding in Multi-Hop Cellular Networks. N. B. Salem, L. Buttyán, J.-P. Hubaux, M. Jakobsson. 2003 ACM International Symposium on Mobile Ad Hoc Networking and Computing.

Past Events

Fall 2009

Oct. 14 VPriv: Protecting Privacy in Location-Based Vehicular Services. R. A. Popa, H. Balakrishnan, A. J. Blumberg. USENIX Security 2009.
Oct. 7 Privads: Privacy Preserving Targeted Advertising. V. Toubiana, A. Narayanan, D. Boneh, H. Nissenbaum, S. Barocas. 2009.
Sep. 30 Privacy-Preserving Genomic Computation Through Program Specialization. R. Wang, X. Wang, Z. Li, H. Tang, M. Reiter, Z. Dong. ACM CCS 2009.
Sep. 23 Vanish: Increasing Data Privacy with Self-Destructing Data. R. Geambasu, T. Kohno, A. A. Levy, H. M. Levy. USENIX Security 2009.

Interested participants may also wish to check out:
Experiences Building Security Applications on DHTs. R. Geambasu, J. Falkner, P. Gardner, T. Kohno, A. Krishnamurthy, H. M. Levy. 2009.

Spring 2009

May 6 Your Botnet is My Botnet: Analysis of a Botnet Takeover. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, G. Vigna. 2009.

Know Your Enemy: Containing Conficker (To Tame A Malware). F. Leder, T. Werner. 2009.
Apr. 29 Secure Content Sniffing for Web Browsers or How to Stop Papers from
Reviewing Themselves. A. Barth, J. Caballero, D. Song. Oakland 2009.
Apr. 22 input type=”password” must die!. D. R. Sandler and D. S. Wallach. W2SP 2008.
Apr. 8 On the Effectiveness of Address-Space Randomization. H. Shacham, M. Page, B. Pfaff, E.-J. Goh, N. Modadugu, D. Boneh. ACM CCS 2004.
Apr. 1 The Snooping Dragon: Social-Malware Surveillance of the Tibetan Movement. S. Nagaraja, R. Anderson. 2009.
Mar. 25 Detecting In-Flight Page Changes with Web Tripwires. C. Reis, S. D. Gribble, T. Kohno, N. C. Weaver. NSDI 2009.
Mar. 11 Optical DNA. D. Vijaywargiy, D. Lewisz, D. Kirovski. Financial Cryptography 2009.
Mar. 4 Instead of our usual format, we will be attending the new crypto seminar this week.
Feb. 25 BootJacker: Compromising Computers using Forced Restarts. E. M. Chan, J. C. Carlyle, F. M. David, R. Farivar, R. H. Campbell. ACM CCS 2008.
Feb. 18 We will be reviewing a draft paper written by several members of the Princeton CS department.
Feb. 11 MD5 considered harmful today: Creating a rogue CA certificate. Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, Benne de Weger. 2008

Fall 2008

Dec. 17 Native Client: A Sandbox for Portable, Untrusted x86 Native Code. B. Yee, D. Sehr, G. Dardyk, J. B. Chen, R. Muth, T. Ormandy, S. Okasaka, N. Narula, N. Fullagar. 2008.
Dec. 10 Information Leaks in Structured Peer-to-Peer Anonymous Communication Systems. P. Mittal, N. Borisov. ACM CCS 2008.
Dec. 3 Towards Practical Biometric Key Generation with Randomized Biometric Templates. L. Ballard, S. Kamara, F. Monrose, M. K. Reiter.
Nov. 19 Rootkit-Resistant Disks. K. Butler, S. McLaughlin, P. McDaniel. ACM CCS 2008.
Nov. 12 Spamalytics: An Empirical Analysis of Spam Marketing Conversion. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, S. Savage. ACM CCS 2008.
Oct. 22 A. Barth, C. Jackson, C. Reis, Google Chrome Team. The Security Architecture of the Chromium Browser. 2008.
Oct. 15 Sequences of Games: A Tool for Taming Complexity in Security Proofs. V. Shoup. January 2006.
Oct. 8 Designing Games with a Purpose. L. von Ahn, L. Dabbish. Communications of the ACM, August 2008.

reCAPTCHA: Human-Based Character Recognition via Web Security Measures. L. von Ahn, B. Maurer, C. McMillen, D. Abraham, M. Blum. Science, September 12, 2008.
Oct. 1 Secure Web Browsing with the OP Web Browser. C. Grier, S. Tang, S. T. King. IEEE Symposium on Security and Privacy, 2008.
Sep. 24 Arvind Narayanan (visiting from the University of Texas, Austin) will present his recent work on privacy in social networks.

Spring 2008

May 7 The Practical Subtleties of Biometric Key Generation. L. Ballard, S. Kamara, M. K. Reiter. USENIX Security 2008 (Note: we are reading a preliminary version, not the conference-ready version, which is not yet available).
Apr. 30 All Your iFRAMEs Point to Us. N. Provos, P. Mavrommatis, M. A. Rajab, F. Monrose. USENIX Security 2008 (Note: we are reading a preliminary version, not the conference-ready version, which is not yet available).
Apr. 23 Application-Specific Attacks: Leveraging the ActionScript Virtual Machine. M. Dowd. April 2008.
Apr. 16 A World Wide Web Without Walls. M. Krohn, A. Yip, M. Brodsky, R. Morris, M. Walfish. 6th ACM Workshop on Hot Topics in Networking (Hotnets). 2007.
Apr. 9 Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses. D. Halperin, T. S. Heydt-Benjamin, B. Ransford, S. S. Clark, B. Defend, W. Morgan, K. Fu, T. Kohno, W. H. Maisel. IEEE Symposium on Security and Privacy, 2008.
Apr. 2 SybilLimit: A Near-Optimal Social Network Defense against Sybil Attacks. H. Yu, P. B. Gibbons, M. Kaminsky, F. Xiao. IEEE Symposium on Security and Privacy, 2008.
Mar. 26 The State of Elliptic Curve Cryptography. N. Koblitz, A. Menezes, S. Vanstone. Designs, Codes and Cryptography. 2000.
Mar. 5 Thinking inside the Box: System-Level Failures of Tamper Proofing. S. Drimer, S. J. Murdoch, R. Anderson. IEEE Symposium on Security and Privacy, 2008.
Feb. 27 Secure Conjunctive Keyword Search over Encrypted Data. P. Golle, J. Staddon, B. Waters. Second International Conference on Applied Cryptography and Network Security (ACNS-2004).
Feb. 22 Wherefore Art Thou R3579X? Anonymized Social Networks, Hidden Patterns, and Structural Steganography. L. Backstrom, C. Dwork, J. Kleinberg. WWW 2007.
Feb. 13 Silicon Physical Random Functions. B. Gassend, D. Clarke, M. van Dijky, S. Devadas. ACM CCS 2002.

Fall 2007

Dec. 19 Harvesting Verifiable Challenges from Oblivious Online Sources.. J. Alex Halderman, B. Waters. ACM CCS 2007.
Dec. 12 Practical Techniques for Searches on Encrypted Data.. D. X. Song, D. Wagner, A. Perrig. 2000 IEEE Symposium on Security and Privacy.

Optional:
Secure Conjunctive Keyword Search over Encrypted Data. P. Golle, J. Staddon, B. Waters. Second International Conference on Applied Cryptography and Network Security (ACNS-2004).
Dec. 5 An Independent Audit Framework for Software Dependent Voting Systems. S. Garera, A. D. Rubin. ACM CCS 2007.
Nov. 21 Protecting Browsers from DNS Rebinding Attacks. C. Jackson, A. Barth, A. Bortz, W. Shao, D. Boneh. ACM CCS 2007.

Optional:
Java Security: From HotJava to Netscape and Beyond. D. Dean, E. W. Felten, D. S. Wallach. 1999 IEEE Symposium on Security and Privacy.
Nov. 14 Dynamic Pharming Attacks and the Locked Same-Origin Policies for Web Browsers. C. Karlof, U. Shankar, J.D. Tygar, D. Wagner. ACM CCS 2007.

Optional:
Protecting Browsers from DNS Rebinding Attacks. C. Jackson, A. Barth, A. Bortz, W. Shao, D. Boneh. ACM CCS 2007.
Nov. 7 Cryptanalysis of the Windows Random Number Generator. L. Dorrendorf, Z. Gutterman, B. Pinkas. CCS 2007.
Oct. 17 Hardware-rooted Trust for Secure Key Management and Transient Trust. J. S. Dwoskin, R. B. Lee. CCS 2007.
Oct. 10 Language Identification of Encrypted VoIP Traffic: Alejandra y Roberto or Alice and Bob? C. V. Wright, L. Ballard, F. Monrose, G. M. Masson. USENIX Security 2007.
Oct. 3 SubVirt: Implementing Malware with Virtual Machines. S. T. King, P. M. Chen, Y.-M. Wang, C. Verbowski, H. J. Wang, J. R. Lorch. IEEE Security and Privacy 2006.
Compatibility is Not Transparency: VMM Detection Myths and Realities. T. Garfinkel, K. Adams, A. Warfield, J. Franklin. HotOS 2007.
Sep. 26 On Web Browsing Privacy in Anonymized NetFlows. S. E. Coull, M. P. Collins, C. V. Wright, F. Monrose, M. K. Reiter. USENIX Security 2007.
Sep. 19 Cross-Site Request Forgeries: Exploitation and Prevention. W. Zeller and E. W. Felten. In preparation.

Spring 2007

May 2 Secret Handshakes with Dynamic and Fuzzy Matching. G. Ateniese, J. Kirsch, M. Blanton. NDSS 07.
Apr. 25 The Anatomy of Clickbot.A. N. Daswani, M. Stoppelman, Google Click Quality & Security Teams. HotBots 2007.
Apr. 18 Control Flow Integrity: Principles, Implementations, and Applications. M. Abadi, M. Budiu, Ú. Erlingsson, J. Ligatti. CCS 2005.
Apr. 11 Bill Zeller presents new work on CSRF vulnerabilities.
Apr. 4 A Privacy-Protecting Voting Protocol with Double-Vote Identification. H. Yu and E. W. Felten. In preparation.
Mar. 28 Low-Resource Routing Attacks Against Anonymous Systems. K. Bauer, D. McCoy, D. Grunwald, T. Kohno, D. Sicker. 2007.
Mar. 14 Automatically Generating Malicious Disks using Symbolic Execution. J. Yang, C. Sar, P. Twohey, C. Cadar, D. Engler. IEEE Security and Privacy ‘06.
Mar. 7 One Laptop per Child. Bitfrost Platform Specification.
Mitigating Attacks on Open Functionality in SMS-Capable Cellular Networks. P. Traynor, W. Enck, P. McDaniel, T. La Porta. MobiCom ‘06.
Feb. 21 A Platform for RFID Security and Privacy Administration. M. R. Rieback, G. N. Gaydadjiev, B. Crispo, R. F.H. Hofman, A. S Tanenbaum. LISA 06.
Feb. 7 Botnets as a Vehicle for Online Crime. N. Ianelli, A. Hackworth. CERT, 2005.
A Multifaceted Approach to Understanding the Botnet Phenomenon. M. A. Rajab, J. Zarfoss, F. Monrose, A. Terzis. IMC 2006.

Fall 2006

Dec. 13 Secure Human Identification Protocols. N. J. Hopper, M. Blum. ASIACRYPT 2001.
Dec. 6 Target Collisions for MD5 and Colliding X.509 Certificates for Different Identities. M. Stevens, A. Lenstra, and B. de Weger. Cryptology ePrint Archive, Report 2006/360. 2006.
Nov. 29 Finding Collisions in the Full SHA-1. X. Wang, Y. L. Yin, H. Yu. Crypto ‘05.
Nov. 22 Cross Site Reference Forgery. J. Burns. 2005.
Preventing Cross-Site Scripting Vulnerability. D. Hu. 2004.
Nov. 15 An Introduction to Punchscan. S. Popoveniuc, B. Hosp. VSRW 06, WOTE 2006.
Punchscan: Introduction and System Definition of a High-Integrity Election System. K. Fisher, R. Carback, A. T. Sherman. WOTE 2006.
Nov. 8 Keyboards and Covert Channels. G. Shah, A. Molina, M. Blaze. USENIX Security 2006.