Analysis of Privacy and Security Exposure in Mobile Dating Applications
|
|
|
- Kristina Cross
- 5 years ago
- Views:
Transcription
1 Analysis of Privacy and Security Exposure in Mobile Dating Applications Constantinos Patsakis, Athanasios Zigomitros and Agusti Solanas International Conference on Mobile, Secure and Programmable Networking (MSPN'2015) June 16, 2015
2 Dating applications Dating applications are not novel, they can be found on the Internet in different forms since the early beginnings. Only recently did they become location-aware.
3 Why they use location-awareness? The location awareness of these applications create hope" for lonely people (Their other half might be only 500m away!) People feel that the other users are more real" and not just dummy profiles. They can see them moving".
4 Research questions How accurate are these distances? Do these applications allow location-based attacks? Could we locate people from the reported distances? If so, with what accuracy? What kind of data are they sending? How do they send this data? What others can infer?
5 Numbers...
6 Possible Impact One should understand that these applications are used by millions of users world wide. Furthermore, the dating/sexual nature of these applications is likely to attract many perverts. Trivial scenario: Assume the case of a cyber-stalker...
7 Trilateration attack
8 Trilateration attack Q. Qin, C. Patsakis, M. Bouroche Playing Hide and Seek with Mobile Dating Applications, 29th IFIP SEC 2014 International Conference ICT Systems on Security and Privacy Protection, pp , Marrakech, Morocco, 2-4 June 2014
9 Before the attack Bob has to find how accurate the distances are. To do this he uses two accounts controlled by him and records the reported distances to find possible patterns. We created two accounts for each app, one for the attacker and one for the victim. By setting a fake location for both of these two users, we were able to know simultaneously the reported and their actual distance. Q. Qin, C. Patsakis, M. Bouroche Playing Hide and Seek with Mobile Dating Applications, 29th IFIP SEC 2014 International Conference ICT Systems on Security and Privacy Protection, pp , Marrakech, Morocco, 2-4 June 2014
10 Results The user can be traced within max 5m in POF, SKOUT, WeChat, MoMo. Q. Qin, C. Patsakis, M. Bouroche Playing Hide and Seek with Mobile Dating Applications, 29th IFIP SEC 2014 International Conference ICT Systems on Security and Privacy Protection, pp , Marrakech, Morocco, 2-4 June 2014
11 Let's dive deeper... So can we find more juicy information? Let's use a proxy to grab the packages...
12 Setup
13 Singles Around Me Sends the exact location of other users in the packet. Photos are sent over HTTP with some of them being dynamic links and others being static. However, the received packet contains an additional field: users' s. Exposes users as URLs contain the IDs that a user has been watching.
14 ChatOn Uses HTTPS for all its traffic. Let's look at the URL of the API it sends model, operating system version, IMEI, IMSI, telephone number, user ID and app version. The app sends the telephone numbers of all user's contacts to Samsung, and the received packets contain additional information like contacts' birthday and s. The RESTful API that is used exposes users actions and the profiles that they visit.
15 Grindr The API that is called from the mobile app might allow eavesdroppers to extract the actual user location and his/her application ID from the sniffed URL. Additionally, the URL discloses the user's activity and his/her device OS. Moreover, exchanged packets contain the distance only for users that consented and the application might display the relative user distance. However, the messages contain the actual users' location.
16 Hornet Hornet encrypts its traffic using HTTPS, but sends the distance with 10m accuracy. Photos are static links sent over HTTP. The API calls allow an adversary to deduce user activity, e.g. chatting, browsing profiles, etc simply by capturing the URLs that users request.
17 I.Am Authentication: HTTPS, everything else HTTP! User's URL contains his location... Exact distance is sent to other users in the packet along with their birthday in the app displays only the age.
18 LOVOO All traffic sent over HTTPS, apart from photos (dynamic links). The actual distance between users is sent with a rounding of 100m, along with their relative (x; y) coordinates! The API calls expose in the URLs that are requested the user location, his/her preferences and his/her overall activity.
19 MeetMe MeetMe uses mixed HTTP/HTTPS traffic. The user location and his/her preferences are visible in the URL. The actual location of the user is included in the packet if other users are nearby, otherwise their distance is given in km. Photos are shared over HTTP, and user commands can be seen in the URL.
20 MoMo HTTPS to exchange messages with the server, it does not hide users location. More precisely, the packets that are received from the app contain fine-grained distance information from other users. URLs contain the visited profiles as well as the current user ID and photos are sent over HTTP by using static links.
21 PoF It uses HTTP but all messages are encrypted, which most likely means that the app contains a local key to decrypt the contents. On the bad side, photos are sent over HTTP as static links.
22 SayHi It uses Facebook for its authentication and then sends everything in clear text. Packets include the fine-grained location of other users and their activity can be seen in the requested URLs. An eavesdropper could also intercept user conversations. Photos are sent over HTTP using static links...
23 SKOUT SKOUT uses HTTPS only for its authentication but the rest of the traffic is sent over HTTP. It sends the exact distance to other users in the packets and then obfuscates it in the frontend of the app. The API of SKOUT exposes the user activity because it shows whether the user is typing a message, visiting a profile, etc.
24 Tagged All traffic is sent over HTTP
25 Tango Tango transmits over HTTP and all messages can be intercepted. The API exposes user's activity as well as his/her phone number and preferences.
26 Tinder Tinder uses HTTPS traffic but the messages contain the Facebook ID of the users. Packets include the actual distance to other users. Photos are sent over HTTP as static links.
27 Tingle Messages contain other users' s, a device tag. They display the actual location of the user in the URL and contain users' queries. Photos are sent over HTTP as static links.
28 Waplog Waplog transmits over HTTP, exposes s of other users.
29 WeChat WeChat uses HTTP for all its traffic and sends all information in an encrypted file...
30 Zoosk It uses HTTPS for its traffic. The requested URLs expose the phone model and its OS as well as the user activity. Finally, photos are sent as static links over HTTPS.
31 To summarize
32 Disclosing the vulnerabilities Let's contact all of them to notify them before disclosing anything... Only 5 companies responded! 1 company said we know the problem (2 years ago), hasn't made anything to fix it 1 of them responded we are stopping the product so... 2 apps have been withdrawn.
33 Conclusions Vulnerable to simple sniffing attack which can reveal very sensitive personal information such as sexual orientation, preferences, s, degree of interaction between users etc. GPS coordinates or actual distances that are in URL or in the packets exposes user s location. The users of the apps can be victims of user profiling, blackmailing, stalking, defamation, and even identity theft. Most of the detected vulnerabilities have very simple solutions that do not require much effort to fix.
34 Thanks for your time and your attention Any Questions?
Online Threats. This include human using them!
Online Threats There are many dangers from using the web (and computer in general). One should watch out for malware, automated programs designed to cause harm to you, your data, and your system. You are
Definition. Quantifying Anonymity. Anonymous Communication. How can we calculate how anonymous we are? Who you are from the communicating party
Definition Anonymous Communication Hiding identities of parties involved in communications from each other, or from third-parties Who you are from the communicating party Who you are talking to from everyone
Playing Hide and Seek with Mobile Dating Applications
Playing Hide and Seek with Mobile Dating Applications Guojun Qin, Constantinos Patsakis, Mélanie Bouroche To cite this version: Guojun Qin, Constantinos Patsakis, Mélanie Bouroche. Playing Hide and Seek
PrecisionAccess Trusted Access Control
Data Sheet PrecisionAccess Trusted Access Control Defeats Cyber Attacks Credential Theft: Integrated MFA defeats credential theft. Server Exploitation: Server isolation defeats server exploitation. Compromised
Web Security 2 https://www.xkcd.com/177/ http://xkcd.com/1323/ Encryption basics Plaintext message key secret Encryp)on Func)on Ciphertext Insecure network Decryp)on Func)on Curses! Foiled again! key Plaintext
Zimperium Global Threat Data
Zimperium Global Threat Report Q2-2017 700 CVEs per Year for Mobile OS 500 300 100 07 08 09 10 11 12 13 14 15 16 17 Outdated ios Outdated ANDROID 1 of 4 Devices Introduces Unnecessary Risk 1 out of 50
SOLUTION BRIEF REMOTE ACCESS: WEBSHELLS SEE EVERYTHING, FEAR NOTHING
REMOTE ACCESS: WEBSHELLS SEE EVERYTHING, FEAR NOTHING RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS A WEBSHELL? A WebShell is a piece of code or a script
GSM security country report: Thailand
GSM security country report: Thailand GSM Map Project gsmmap@srlabs.de Security Research Labs, Berlin February 2013 Abstract. GSM networks differ widely in their protection capabilities against common
Mobile network security report: Ukraine
Mobile network security report: Ukraine GSM Map Project gsmmap@srlabs.de Security Research Labs, Berlin June 2017 Abstract. Mobile networks differ widely in their protection capabilities against common
GSM security country report: Estonia
GSM security country report: Estonia GSM Map Project gsmmap@srlabs.de Security Research Labs, Berlin September 2014 Abstract. GSM networks differ widely in their protection capabilities against common
The telephone supports 2 SIM cards. All functions are available for both SIM cards and have independent settings.
Samsung C6112 telephone for protection of conversations against control via a GSM service provider as well as via active and semi-active GSM interception complexes, catchers. The telephone supports 2 SIM
Copyright
1 Security Test EXTRA Workshop : ANSWER THESE QUESTIONS 1. What do you consider to be the biggest security issues with mobile phones? 2. How seriously are consumers and companies taking these threats?
Anonymous Connections and Onion Routing
Anonymous Connections and Onion Routing David Goldschlag, Michael Reed, and Paul Syverson Center for High Assurance Computer Systems Naval Research Laboratory Washington, D.C. 1 Who is Talking to Whom?
Privacy Based Protection Mechanism for Location Data with an Accurate Service
Privacy Based Protection Mechanism for Location Data with an Accurate Service K. Spatika #1 # Vellore Institute of Technology, India Abstract Location based service are suitable for the user based services.
Karaoke. Distributed Private Messaging Immune to Passive Traffic Analysis. David Lazar, Yossi Gilad, Nickolai Zeldovich
Karaoke Distributed Private Messaging Immune to Passive Traffic Analysis David Lazar, Yossi Gilad, Nickolai Zeldovich 1 Motivation: Report a crime without getting fired You re Fired if you talk to the
Security Device Roles
Kennesaw State University DigitalCommons@Kennesaw State University KSU Proceedings on Cybersecurity Education, Research and Practice 2017 KSU Conference on Cybersecurity Education, Research and Practice
Outline More Security Protocols CS 239 Computer Security February 6, 2006
Outline More Security Protocols CS 239 Computer Security February 6, 2006 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and Authentication
Anonymous communications: Crowds and Tor
Anonymous communications: Crowds and Tor Basic concepts What do we want to hide? sender anonymity attacker cannot determine who the sender of a particular message is receiver anonymity attacker cannot
Hackproof Your Cloud Responding to 2016 Threats
Hackproof Your Cloud Responding to 2016 Threats Aaron Klein, CloudCheckr Tuesday, June 30 th 2016 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Changing Your Perspective Moving
Title: Planning AWS Platform Security Assessment?
Title: Planning AWS Platform Security Assessment? Name: Rajib Das IOU: Cyber Security Practices TCS Emp ID: 231462 Introduction Now-a-days most of the customers are working in AWS platform or planning
CS526: Information security
Cristina Nita-Rotaru CS526: Information security Anonymity systems. Based on slides by Chi Bun Chan 1: Terminology. Anonymity Anonymity (``without name ) means that a person is not identifiable within
FACEBOOK SAFETY FOR JOURNALISTS. Thanks to these partners for reviewing these safety guidelines:
FACEBOOK SAFETY FOR JOURNALISTS Thanks to these partners for reviewing these safety guidelines: 10 STEPS TO KEEP YOURSELF SAFE Journalists are using Facebook in innovative ways to do their jobs, tell stories,
Online Dangers. According to the National Center for Missing and Exploited Children.
Online Dangers One in five youths say they have received a sexual approach or solicitation. One in 33 had received an aggressive sexual solicitation. One in four had unwanted exposure to sexually explicit
Network Security: Anonymity. Tuomas Aura T Network security Aalto University, Nov-Dec 2012
Network Security: Anonymity Tuomas Aura T-110.5241 Network security Aalto University, Nov-Dec 2012 Outline 1. Anonymity and privacy 2. High-latency anonymous routing 3. Low-latency anonymous routing Tor
CyberP3i Course Module Series
CyberP3i Course Module Series Spring 2017 Designer: Dr. Lixin Wang, Associate Professor Firewall Configuration Firewall Configuration Learning Objectives 1. Be familiar with firewalls and types of firewalls
Anonymous Communications
Anonymous Communications Andrew Lewman andrew@torproject.org December 05, 2012 Andrew Lewman andrew@torproject.org () Anonymous Communications December 05, 2012 1 / 45 Who is this guy? 501(c)(3) non-profit
Public or Private (1)
Pi Day: 3.14 Public or Private (1) CCST9015 14 Mar, 2012 Dr. Hayden Kwok-Hay So Department of Electrical and Electronic Engineering 3.1415926535 8979323846 2643383279 5028841971 6939937510 5820974944 5923078164
PRIVACY POLICY Let us summarize this for you...
PRIVACY POLICY Let us summarize this for you... We promise to never sell your personal information. This site collects usage information to provide a better web experience for our users. If you purchase
Outline. More Security Protocols CS 239 Security for System Software April 22, Needham-Schroeder Key Exchange
Outline More Security Protocols CS 239 Security for System Software April 22, 2002 Combining key distribution and authentication Verifying security protocols Page 1 Page 2 Combined Key Distribution and
Information Flow Control and Privacy. Dennis Chen Ming Chow
Information Flow Control and Privacy Dennis Chen Dennis.Chen@tufts.edu Ming Chow Abstract With the rise of technology and the worry of protecting private user information, a new security practice must
SECURITY TESTING. Towards a safer web world
SECURITY TESTING Towards a safer web world AGENDA 1. 3 W S OF SECURITY TESTING 2. SECURITY TESTING CONCEPTS 3. SECURITY TESTING TYPES 4. TOP 10 SECURITY RISKS ate: 2013-14 Few Security Breaches September
Onion Routing. Varun Pandey Dept. of Computer Science, Virginia Tech. CS 6204, Spring
Onion Routing Varun Pandey Dept. of Computer Science, Virginia Tech 1 What is Onion Routing? a distributed overlay network to anonymize TCP based routing Circuit based (clients choose the circuit) Each
Decision Computer Group
Decision Computer Group E-Detective System (Wireless) Moving forward with the security of networking and computer forensics Agenda Introduction of Wireless E-Detective System Wireless E-Detective system
Symmetric Cryptography
CSE 484 (Winter 2010) Symmetric Cryptography Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for sample slides and materials...
Kaspersky Mobile Security 9. Reviewer s Guide
Kaspersky Mobile Security 9 Reviewer s Guide The purpose of this document is to provide an introduction to Kaspersky Mobile Security 9 (KMS 9). KMS 9 is a product that has been designed to protect the
Network Security: Anonymity. Tuomas Aura T Network security Aalto University, Nov-Dec 2010
Network Security: Anonymity Tuomas Aura T-110.5240 Network security Aalto University, Nov-Dec 2010 Outline 1. Anonymity and privacy 2. High-latency anonymous routing 3. Low-latency anonymous routing Tor
Best Practical Response against Ransomware
Best Practical Response against Ransomware AhnLab MDS: Holistic Response on Both Networks and Endpoints 2016. 02. 09 Table of Contents Overview... 3 Ransomware and Advanced Malware: Different, Yet Similar...
ICT 6541 Applied Cryptography. Hossen Asiful Mustafa
ICT 6541 Applied Cryptography Hossen Asiful Mustafa Basic Communication Alice talking to Bob Alice Bob 2 Eavesdropping Eve listening the conversation Alice Bob 3 Secure Communication Eve listening the
Executive Summary on. Privacy Awareness Survey on Smartphones. and Smartphone Apps
Executive Summary on Privacy Awareness Survey on Smartphones and Smartphone Apps Submitted to Office of the Privacy Commissioner for Personal Data By Centre for the Advancement of Social Sciences Research
Privacy and cookie policy
Privacy and cookie policy http://www.ferrybookings.com/ (Website) and the Burger Ferry Agencies BV App (APP) is brought to you by Burger Ferry Agencies BV, a company incorporated and registered in Rotterdam,
Symmetric-Key Cryptography Part 1. Tom Shrimpton Portland State University
Symmetric-Key Cryptography Part 1 Tom Shrimpton Portland State University Building a privacy-providing primitive I want my communication with Bob to be private -- Alice What kind of communication? SMS?
OWASP Top 10 Risks. Many thanks to Dave Wichers & OWASP
OWASP Top 10 Risks Dean.Bushmiller@ExpandingSecurity.com Many thanks to Dave Wichers & OWASP My Mom I got on the email and did a google on my boy My boy works in this Internet thing He makes cyber cafes
Privacy and Security in Online Social Networks Department of Computer Science and Engineering Indian Institute of Technology, Madras
Privacy and Security in Online Social Networks Department of Computer Science and Engineering Indian Institute of Technology, Madras Lecture 07 Tutorial 2 Part 1 Facebook API Hi everyone, welcome to the
Inferring the Source of Encrypted HTTP Connections. Michael Lin CSE 544
Inferring the Source of Encrypted HTTP Connections Michael Lin CSE 544 Hiding your identity You can wear a mask, but some distinguishing characteristics are visible: Height Weight Hair Clothing Even if
5G-ENSURE. Privacy Enablers. (Project Number )
5G-ENSURE (Project Number 671562) Privacy Enablers madalina.baltatu@telecomitalia.it luciana.costa@telecomitalia.it dario.lombardo@telecomitalia.it Privacy enhanced identity protection Privacy Enablers
Survey of Cyber Moving Targets. Presented By Sharani Sankaran
Survey of Cyber Moving Targets Presented By Sharani Sankaran Moving Target Defense A cyber moving target technique refers to any technique that attempts to defend a system and increase the complexity of
Man in the middle. Bởi: Hung Tran
Man in the middle Bởi: Hung Tran INTRODUCTION In today society people rely a lot on the Internet for studying, doing research and doing business. Internet becomes an integral part of modern life and many
SYN Flood Attack Protection Technology White Paper
Flood Attack Protection Technology White Paper Flood Attack Protection Technology White Paper Keywords: flood, Cookie, Safe Reset Abstract: This document describes the technologies and measures provided
Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
EasyCrypt passes an independent security audit
July 24, 2017 EasyCrypt passes an independent security audit EasyCrypt, a Swiss-based email encryption and privacy service, announced that it has passed an independent security audit. The audit was sponsored
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003
Firewalls Network Security: Firewalls and Virtual Private Networks CS 239 Computer Software March 3, 2003 A system or combination of systems that enforces a boundary between two or more networks - NCSA
SEARCHING FOR FRIENDS
Step One In the top right hand corner, click on the Find Friends link. You will be redirected to a new page. In the bottom left hand side of the page you will see a text box labeled Search for People.
Logging. Steven M. Bellovin December 6,
Logging Steven M. Bellovin December 6, 2009 1 Shadow Hawk Shadow Hawk Busted Again As many of you know, Shadow Hawk (a/k/a Shadow Hawk 1) had his home searched by agents of the FBI... When he was tagged
HIPAA and Social Media and other PHI Safeguards. Presented by the UAMS HIPAA Office August 2016 William Dobbins
HIPAA and Social Media and other PHI Safeguards Presented by the UAMS HIPAA Office August 2016 William Dobbins Social Networking Let s Talk Facebook More than 1 billion users (TNW, 2014) Half of all adult
Privacy Challenges in Big Data and Industry 4.0
Privacy Challenges in Big Data and Industry 4.0 Jiannong Cao Internet & Mobile Computing Lab Department of Computing Hong Kong Polytechnic University Email: csjcao@comp.polyu.edu.hk http://www.comp.polyu.edu.hk/~csjcao/
FAQ: Privacy, Security, and Data Protection at Libraries
FAQ: Privacy, Security, and Data Protection at Libraries This FAQ was developed out of workshops and meetings connected to the Digital Privacy and Data Literacy Project (DPDL) and Brooklyn Public Library
SmartSiren: Virus Detection and Alert for Smartphones. Jerry Cheung, Starsky Wong, Hao Yang and Songwu Lu MOBISYS 2007
SmartSiren: Virus Detection and Alert for Smartphones Jerry Cheung, Starsky Wong, Hao Yang and Songwu Lu MOBISYS 2007 Premise Smartphones have become increasingly popular. So have viruses for smartphones
WEBSITE INSTRUCTIONS
Table of Contents WEBSITE INSTRUCTIONS 1. How to edit your website 2. Kigo Plugin 2.1. Initial Setup 2.2. Data sync 2.3. General 2.4. Property & Search Settings 2.5. Slideshow 2.6. Take me live 2.7. Advanced
Wireless Network Security Spring 2013
Wireless Network Security 14-814 Spring 2013 Patrick Tague Class #19 Location Privacy & Tracking Agenda Location privacy and tracking Implications / risks of location information Location privacy and anonymity
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company
The Invisible Threat of Modern Malware Lee Gitzes, CISSP Comm Solutions Company November 12, 2014 Malware s Evolution Why the change? Hacking is profitable! Breaches and Malware are Projected to Cost $491
communication Claudia Díaz Katholieke Universiteit Leuven Dept. Electrical Engineering g ESAT/COSIC October 9, 2007 Claudia Diaz (K.U.
Introduction to anonymous communication Claudia Díaz Katholieke Universiteit Leuven Dept. Electrical Engineering g ESAT/COSIC October 9, 2007 Claudia Diaz (K.U.Leuven) 1 a few words on the scope of the
Aguascalientes Local Chapter. Kickoff
Aguascalientes Local Chapter Kickoff juan.gama@owasp.org About Us Chapter Leader Juan Gama Application Security Engineer @ Aspect Security 9+ years in Appsec, Testing, Development Maintainer of OWASP Benchmark
Exploring the potential of Mobile Connect: From authentication to identity and attribute sharing. Janne Jutila, Head of Business Development, GSMA
Exploring the potential of Mobile Connect: From authentication to identity and attribute sharing Janne Jutila, Head of Business Development, GSMA Fragility of passwords No matter what you tell them, users
LOCKHEED MARTIN CYBERQUEST COMPETITION
LOCKHEED MARTIN CYBERQUEST COMPETITION 2018 CHALLENGES & SKILLS OVERVIEW LOCKHEED MARTIN PROPRIETARY INFORMATION WHAT MAY YOU ENCOUNTER? Challenges may include: Web-based attacks Common vulnerabilities
SECURING APACHE : ATTACKS ON SESSION MANAGEMENT
SECURING APACHE : ATTACKS ON SESSION MANAGEMENT In this part of the series, we are going to concentrate on attacks on session management. Application-level attacks on the session is about obtaining or
1 Hitachi ID Mobile Access. 2 The BYOD challenge. Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications
1 Hitachi ID Mobile Access Managing the User Lifecycle Across On-Premises and Cloud-Hosted Applications Secure Access to On-Premise IAM from Devices. 2 The BYOD challenge Users Want to access everything
Facebook API Breach. Jake Williams Rendition Infosec
Facebook API Breach Jake Williams (@MalwareJake) Rendition Infosec www.rsec.us @RenditionSec Facebook View As Facebook allows users/developers to see what a profile page looks like from another user s
RouterCheck Installation and Usage
RouterCheck Installation and Usage February 16, 2015 No part of this document may be reproduced, copied, or distributed in any fashion without the express written permission of Sericon Technology Inc.
CUNY John Jay College of Criminal Justice MATH AND COMPUTER SCIENCE
Instructor: Prof Aftab Ahmad Office: NB 612 Telephone No. (212)393-6314 Email Address: aahmad@jjay.cuny.edu Office Hours: By appointment TEXT & REFERENCE MATERIAL Text Notes from instructor posted on Blackboard
CS Paul Krzyzanowski
Computer Security 17. Tor & Anonymous Connectivity Anonymous Connectivity Paul Krzyzanowski Rutgers University Spring 2018 1 2 Anonymity on the Internet Often considered bad Only criminals need to hide
Facebook Basics (for individuals)
P a g e 1 Facebook Basics (for individuals) ABOUT THIS CLASS This class is designed to give a basic introduction into Facebook Basics. Throughout the class, we will progress from learning how to create
Beam Technologies Inc. Privacy Policy
Beam Technologies Inc. Privacy Policy Introduction Beam Technologies Inc., Beam Dental Insurance Services LLC, Beam Insurance Administrators LLC, Beam Perks LLC, and Beam Insurance Services LLC, (collectively,
Onion services. Philipp Winter Nov 30, 2015
Onion services Philipp Winter pwinter@cs.princeton.edu Nov 30, 2015 Quick introduction to Tor An overview of Tor Tor is a low-latency anonymity network Based on Syverson's onion routing......which is based
CS 494/594 Computer and Network Security
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers
CYBER ATTACKS EXPLAINED: PACKET SPOOFING
CYBER ATTACKS EXPLAINED: PACKET SPOOFING Last month, we started this series to cover the important cyber attacks that impact critical IT infrastructure in organisations. The first was the denial-of-service
OWASP Thailand. Proxy Caches and Web Application Security. OWASP AppSec Asia October 21, Using the Recent Google Docs 0-Day as an Example
Proxy Caches and Web Application Security Using the Recent Google Docs 0-Day as an Example Tim Bass, CISSP Chapter Leader, Thailand +66832975101, tim@unix.com AppSec Asia October 21, 2008 Thailand Worldwide
Public or Private (1)
100% Results from Tutorial 2012 Public or Private (1) 90% 80% 70% 60% CCST9015 20 Mar, 2013 Dr. Hayden Kwok-Hay So Department of Electrical and Electronic Engineering 50% 40% 30% 20% 10% 0% No Depends
Stop Cyber Threats With Adaptive Micro-Segmentation. Jeff Francis Regional Systems Engineer
Stop Cyber Threats With Adaptive Micro-Segmentation Jeff Francis Regional Systems Engineer Who is This Guy, and Why is He Here? Jeff Francis Regional Systems Engineer Northwestern United States Datacenter
Frequently Asked Questions WPA2 Vulnerability (KRACK)
Frequently Asked Questions WPA2 Vulnerability (KRACK) Release Date: October 20, 2017 Document version: 1.0 What is the issue? A research paper disclosed serious vulnerabilities in the WPA and WPA2 key
Solutions Business Manager Web Application Security Assessment
White Paper Solutions Business Manager Solutions Business Manager 11.3.1 Web Application Security Assessment Table of Contents Micro Focus Takes Security Seriously... 1 Solutions Business Manager Security
Preparing for the Cross Site Request Forgery Defense
Preparing for the Cross Site Request Forgery Defense By Chuck Willis chuck.willis@mandiant.com Presented at Black Hat Briefings DC 2008 on February 20, 2008 Slides available at www.blackhat.com. Abstract:
Meeting 39. Guest Speaker Dr. Williams CEH Networking
Cyber@UC Meeting 39 Guest Speaker Dr. Williams CEH Networking If You re New! Join our Slack ucyber.slack.com Feel free to get involved with one of our committees: Content, Finance, Public Affairs, Outreach,
Why Hackers Love ehealth Applications
Downloaded from orbit.dtu.dk on: Nov 17, 2017 Why Hackers Love ehealth Applications Goyal, Rohit; Dragoni, Nicola Published in: Proceedings of the 3rd EAI International Conference on IoT Technologies for
Learning and Development. UWE Staff Profiles (USP) User Guide
Learning and Development UWE Staff Profiles (USP) User Guide About this training manual This manual is yours to keep and is intended as a guide to be used during the training course and as a reference
Crowds Anonymous Web Transactions. Why anonymity?
Why anonymity? The web contains a wealth of information on topics that you might want to explore privately Support groups victims of crime private health concerns Job search don t want to inform current
CS 6324: Information Security More Info on Key Establishment: RSA, DH & QKD
ERIK JONSSON SCHOOL OF ENGINEERING & COMPUTER SCIENCE Cyber Security Research and Education Institute CS 6324: Information Security Dr. Junia Valente Department of Computer Science The University of Texas
Cyber Hygiene Guide. Politicians and Political Parties
Cyber Hygiene Guide Politicians and Political Parties Canadian Election Integrity Initiative Design by ccm.design Cover Image by Songquan Deng Helping to Safeguard the Integrity of the Electoral Process
COMMUNICATING WITH PROSPECTIVE STUDENTS IS SIMPLE, YET MANY GET IT WRONG. How, What & When to Do It
COMMUNICATING WITH PROSPECTIVE STUDENTS IS SIMPLE, YET MANY GET IT WRONG How, What & When to Do It PRESENTERS Rachel Rollins Marketing Coordinator rrollins@envisageinternational.com Michelle Kowalsky Director
Detailed instructions for adding (or changing) your Avatar (profile picture next to your
Detailed instructions for adding (or changing) your Avatar (profile picture next to your name) on Ustream (disclaimer this is how it works for me using Internet Explorer it may look slightly different
Attackers Process. Compromise the Root of the Domain Network: Active Directory
Attackers Process Compromise the Root of the Domain Network: Active Directory BACKDOORS STEAL CREDENTIALS MOVE LATERALLY MAINTAIN PRESENCE PREVENTION SOLUTIONS INITIAL RECON INITIAL COMPROMISE ESTABLISH
Conventional Protection Mechanisms in File Systems
Steganographic File Systems 1 Conventional Protection Mechanisms in File Systems User Access Control The operating system is fully trusted to enforce the security policy. Is it good enough? Operating System
Spree Privacy Policy
Spree Privacy Policy Effective as at 21 November 2018 Introduction Spree respects your privacy and it is important to us that you have an enjoyable experience buying and selling with us but also that you
Zero-Knowledge Proofs of Knowledge
Zero-Knowledge Proofs of Knowledge Stéphanie Delaune September 6, 2013 Stéphanie Delaune () Proofs of Knowledge September 6, 2013 1 / 16 Proofs of knowledge Proof of knowledge are often used to prove one
Guess Who s Texting You?
TelcoSecDay @ Troopers 3/20/12 Heidelberg, Germany Guess Who s Texting You? Evaluating the Security of Smartphone Messaging Applications Sebastian Schrittwieser SBA Research, Vienna, Austria Source: path.com
Palo Alto Networks PAN-OS
RSA Security Analytics Ready Implementation Guide Partner Information Last Modified: November 24 th, 2014 Product Information Partner Name Palo Alto Networks Web Site www.paloaltonetworks.com Product Name
Eavesdropping on Fine-Grained User Activities Within Smartphone Apps Over Encrypted Network Traffic
Eavesdropping on Fine-Grained User Activities Within Smartphone Apps Over Encrypted Network Traffic Brendan Saltaformaggio, Hongjun Choi, Kristen Johnson, Yonghwi Kwon, Qi Zhang, Xiangyu Zhang, Dongyan
Eagles Charitable Foundation Privacy Policy
Eagles Charitable Foundation Privacy Policy Effective Date: 1/18/2018 The Eagles Charitable Foundation, Inc. ( Eagles Charitable Foundation, we, our, us ) respects your privacy and values your trust and
TLSnotary - a mechanism for independently audited https sessions
TLSnotary - a mechanism for independently audited https sessions September 10, 2014 1 Abstract TLSnotary allows a client to provide evidence to a third party auditor that certain web traffic occurred between
Release Version 7.14: UFED Physical Analyzer, UFED Logical Analyzer & Reader
Release Version 7.14: UFED Physical Analyzer, UFED Logical Analyzer & Reader January 2019 Now supporting: 27,141 device profiles App versions: 7,447 HIGHLIGHTS App support First time access to the popular
Pivoting ( Metasploit )
Pivoting ( Metasploit ) - Anurag Srivastava Email - Linkedin - theanuragsrivastava@gmail.com https://in.linkedin.com/in/hexachordanu Exploit-db Author page https://www.exploit-db.com/author/?a=9053 Greetz