<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>657</id>
    <completedYear>2018</completedYear>
    <publishedYear>2018</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>20 Seiten</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject</type>
    <publisherName>Springer</publisherName>
    <publisherPlace>Cham</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2019-07-30</completedDate>
    <publishedDate>2018-12-29</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Local Storage on Steroids: Abusing Web Browsers for Hidden Content Storage and Distribution</title>
    <abstract language="eng">Analysing security assumptions taken for the WebRTC and postMessage APIs led us to find a novel attack abusing the browsers' persistent storage capabilities. The presented attack can be executed without the website's visitor knowledge, and it requires neither browser vulnerabilities nor additional software on the browser's side. To exemplify this, we study how can an attacker use browsers to create a network for persistent storage and distribution of arbitrary data.  &#13;
&#13;
In our proof of concept, the total storage of the network, and therefore the space used within each browser, grows linearly with the number of origins delivering the malicious JavaScript code. Further, data transfers between browsers are not restricted by the Same Origin Policy, which allows for a unified cross-origin browser network, regardless of the origin from which the script executing the functionality is loaded from. &#13;
&#13;
In the course of our work, we assess the feasibility of a real-life deployment of the network by running experiments using Linux containers and browser automation tools. Moreover, we show how security mechanisms against third-party tracking, cross-site scripting and click-jacking can diminish the attack's impact, or even prevent it.</abstract>
    <parentTitle language="eng">International Conference on Security and Privacy in Communication Systems</parentTitle>
    <identifier type="isbn">978-3-030-01704-0</identifier>
    <identifier type="doi">10.1007/978-3-030-01704-0_19</identifier>
    <identifier type="urn">urn:nbn:de:bvb:739-opus4-6572</identifier>
    <licence>Standardbedingung laut Einverständniserklärung</licence>
    <author>Juan D. Parra Rodriguez</author>
    <author>Joachim Posegga</author>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Web Security</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>WebRTC</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>postMessage</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Browser Security</value>
    </subject>
    <collection role="ddc" number="000">Informatik, Informationswissenschaft, allgemeine Werke</collection>
    <collection role="open_access" number="">open_access</collection>
    <collection role="institutes" number="">Fakultät für Informatik und Mathematik</collection>
    <thesisPublisher>Universität Passau</thesisPublisher>
    <file>https://opus4.kobv.de/opus4-uni-passau/files/657/camera-ready-securecomm-open-access.pdf</file>
  </doc>
  <doc>
    <id>656</id>
    <completedYear>2017</completedYear>
    <publishedYear>2018</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>3 Seiten</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject</type>
    <publisherName>ACM</publisherName>
    <publisherPlace>New York, NY, USA</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2019-07-30</completedDate>
    <publishedDate>2018-03-13</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">CSP &amp; Co. Can Save Us from a Rogue Cross-Origin Storage Browser Network! But for How Long?</title>
    <abstract language="eng">We introduce a new browser abuse scenario where an attacker uses local storage capabilities without the website's visitor knowledge to create a network of browsers for persistent storage and distribution of arbitrary data. We describe how security-aware users can use mechanisms such as the Content Security Policy (CSP), sandboxing, and third-party tracking protection, i.e., CSP &amp; Company, to limit the network's effectiveness. From another point of view, we also show that the upcoming Suborigin standard can inadvertently thwart existing countermeasures, if it is adopted.</abstract>
    <parentTitle language="eng">Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy</parentTitle>
    <identifier type="isbn">978-1-4503-5632-9</identifier>
    <identifier type="doi">10.1145/3176258.3176951</identifier>
    <identifier type="urn">urn:nbn:de:bvb:739-opus4-6561</identifier>
    <licence>Standardbedingung laut Einverständniserklärung</licence>
    <author>Juan D. Parra Rodriguez</author>
    <author>Joachim Posegga</author>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Web Security</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>WebRTC</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>PostMessage</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Browser Security</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Parasitic Computing</value>
    </subject>
    <collection role="ddc" number="004">Datenverarbeitung; Informatik</collection>
    <collection role="open_access" number="">open_access</collection>
    <collection role="institutes" number="">Fakultät für Informatik und Mathematik</collection>
    <thesisPublisher>Universität Passau</thesisPublisher>
    <file>https://opus4.kobv.de/opus4-uni-passau/files/656/codaspy.pdf</file>
  </doc>
  <doc>
    <id>655</id>
    <completedYear>2018</completedYear>
    <publishedYear>2018</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>[14] Seiten</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject</type>
    <publisherName>ACM</publisherName>
    <publisherPlace>New York, NY, USA</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2019-07-30</completedDate>
    <publishedDate>2018-12-03</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">RAPID: Resource and API-Based Detection Against In-Browser Miners</title>
    <abstract language="eng">Direct access to the system's resources such as the GPU, persistent storage and networking has enabled in-browser crypto-mining. Thus, there has been a massive response by rogue actors who abuse browsers for mining without the user's consent. This trend has grown steadily for the last months until this practice, i.e., CryptoJacking, has been acknowledged as the number one security threat by several antivirus companies.&#13;
&#13;
Considering this, and the fact that these attacks do not behave as JavaScript malware or other Web attacks, we propose and evaluate several approaches to detect in-browser mining. To this end, we collect information from the top 330.500 Alexa sites. Mainly, we used real-life browsers to visit sites while monitoring resource-related API calls and the browser's resource consumption, e.g., CPU.&#13;
&#13;
Our detection mechanisms are based on dynamic monitoring, so they are resistant to JavaScript obfuscation. Furthermore, our detection techniques can generalize well and classify previously unseen samples with up to 99.99\% precision and recall for the benign class and up to 96\% precision and recall for the mining class. These results demonstrate the applicability of detection mechanisms as a server-side approach, e.g., to support the enhancement of existing blacklists.  &#13;
&#13;
Last but not least, we evaluated the feasibility of deploying prototypical implementations of some detection mechanisms directly on the browser. Specifically, we measured the impact of in-browser API monitoring on page-loading time and performed micro-benchmarks for the execution of some classifiers directly within the browser. In this regard, we ascertain that, even though there are engineering challenges to overcome, it is feasible and beneficial for users to bring the mining detection to the browser.</abstract>
    <parentTitle language="eng">Proceedings of the 34th Annual Computer Security Applications Conference</parentTitle>
    <identifier type="isbn">978-1-4503-6569-7</identifier>
    <identifier type="urn">urn:nbn:de:bvb:739-opus4-6550</identifier>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">true</enrichment>
    <licence>Standardbedingung laut Einverständniserklärung</licence>
    <author>Juan D. Parra Rodriguez</author>
    <author>Joachim Posegga</author>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Web Security</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>WebRTC</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>postMessage</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Browser Security</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Content Security Policy</value>
    </subject>
    <collection role="ddc" number="004">Datenverarbeitung; Informatik</collection>
    <collection role="open_access" number="">open_access</collection>
    <collection role="institutes" number="">Fakultät für Informatik und Mathematik</collection>
    <thesisPublisher>Universität Passau</thesisPublisher>
    <file>https://opus4.kobv.de/opus4-uni-passau/files/655/acsac_camera_ready.pdf</file>
  </doc>
  <doc>
    <id>654</id>
    <completedYear>2017</completedYear>
    <publishedYear>2017</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>[10] Seiten</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <type>conferenceobject</type>
    <publisherName>IEEE Xplore</publisherName>
    <publisherPlace>Heraklion, Greece</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2017-04-27</completedDate>
    <publishedDate>2017-04-27</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Addressing  Data-Centric Security Requirements for IoT-Based Systems</title>
    <abstract language="eng">Allowing users to control access to their data is paramount for the success of the Internet of Things; therefore, it is imperative to ensure it, even when data has left the users' control, e.g. shared with cloud infrastructure. Consequently, we propose several state of the art mechanisms from the security and privacy research fields to cope with this requirement. &#13;
&#13;
To illustrate how each mechanism can be applied, we derive a data-centric architecture providing access control and privacy guaranties for the users of IoT-based applications. Moreover, we discuss the limitations and challenges related to applying the selected mechanisms to ensure access control remotely. Also, we validate our architecture by showing how it empowers users to control access to their health data in a quantified self use case.</abstract>
    <parentTitle language="eng">2016 International Workshop on Secure Internet of Things (SIoT)</parentTitle>
    <identifier type="isbn">978-1-5090-5091-8</identifier>
    <identifier type="doi">10.1109/SIoT.2016.007</identifier>
    <identifier type="urn">urn:nbn:de:bvb:739-opus4-6546</identifier>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">true</enrichment>
    <licence>Standardbedingung laut Einverständniserklärung</licence>
    <author>Juan D. Parra Rodriguez</author>
    <author>Daniel Schreckling</author>
    <author>Joachim Posegga</author>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Internet of Things</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Security Architecture</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Data-Centric Security</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Differential Privacy</value>
    </subject>
    <subject>
      <language>eng</language>
      <type>uncontrolled</type>
      <value>Secure Cloud Storage</value>
    </subject>
    <collection role="ddc" number="004">Datenverarbeitung; Informatik</collection>
    <collection role="open_access" number="">open_access</collection>
    <collection role="institutes" number="">Fakultät für Informatik und Mathematik</collection>
    <thesisPublisher>Universität Passau</thesisPublisher>
    <file>https://opus4.kobv.de/opus4-uni-passau/files/654/iot-gateway-security-openaccess.pdf</file>
  </doc>
</export-example>
