SystemsSec 2016W Lecture 23 - Revision history

Nicholas Laws: /* Paper: Android Permissions Remystified */

2016-04-06T04:30:19Z

Paper: Android Permissions Remystified

← Older revision		Revision as of 04:30, 6 April 2016
Line 63:		Line 63:

	===Paper: Android Permissions Remystified===		===Paper: Android Permissions Remystified===
	~~- Placeholder~~		• Applications access private information more than the user expects
	• Applications access private information more than the user expects		• Appls should stay within context, ex. A map application can have the user’s location, but only when the user is actively using it, not when it is in the background.
	• Appls should stay within context, ex. A map application can have the user’s location, but only when the user is actively using it, not when it is in the background.		• Bad practice to just ask user for permission once on install/first run, contexts change.
	• Bad practice to just ask user for permission once on install/first run, contexts change.		• Some students found it surprising that 30% of the people from the user survery didn’t care how their info was used/misused
	• Some students found it surprising that 30% of the people from the user survery didn’t care how their info was used/misused		• One student expressed views that user studies were not trustworthy and that they refused to look a tthem.
	• One student expressed views that user studies were not trustworthy and that they refused to look a tthem.		• Why are user studies important?
	• Why are user studies important?		o Security Engineers keep building tools users cannot use (or cannot use properly)
	o Security Engineers keep building tools users cannot use (or cannot use properly)		o They are a “club” to hit people with when they think they know the user’s needs better than the user does
	o They are a “club” to hit people with when they think they know the user’s needs better than the user does		o Studies used to prove that “X” is a good/bad idea
	o Studies used to prove that “X” is a good/bad idea		o Used to backup claims / results
	o Used to backup claims / results		• Do application developers want suers to properly understand how permissions work?
	• Do application developers want suers to properly understand how permissions work?		o No. They make more add revenue in the current system.
	o No. They make more add revenue in the current system.

	===Anil: "Where the research is"===		===Anil: "Where the research is"===

Nicholas Laws: /* Anil: "Where the research is" */

2016-04-06T04:29:31Z

Anil: "Where the research is"

← Older revision		Revision as of 04:29, 6 April 2016
Line 78:		Line 78:

	===Anil: "Where the research is"===		===Anil: "Where the research is"===
	~~- Placeholder~~
	• Basing a security system on reference monitors or raw cryptography is silly		• Basing a security system on reference monitors or raw cryptography is silly
	o The concept of reference monitors is broken		o The concept of reference monitors is broken

Nicholas Laws: /* Anil: "Where the research is" */

2016-04-06T04:29:24Z

Anil: "Where the research is"

← Older revision		Revision as of 04:29, 6 April 2016
Line 79:		Line 79:
	===Anil: "Where the research is"===		===Anil: "Where the research is"===
	- Placeholder		- Placeholder
			• Basing a security system on reference monitors or raw cryptography is silly
			o The concept of reference monitors is broken
			o Cryptography is “fragile”
			• Idea of diverse implementations so that 1 threat or attack does not compromise all systems
			o Proof of Concept: Living Systems
			• Computers CANNOT blindly trust anyone.
			• Security is a trade off with functionality

Nicholas Laws: /* Midterm Discussion */

2016-04-06T04:28:02Z

Midterm Discussion

← Older revision		Revision as of 04:28, 6 April 2016
Line 16:		Line 16:
	• Example System: A Man carrying a suitcase full of cash		• Example System: A Man carrying a suitcase full of cash
	o Threat #1: Someone will steal the case		o Threat #1: Someone will steal the case
	 Defense: Get a bodyguard		- Defense: Get a bodyguard
	• Vulnerability: Guard could be bribed or could abandon you		• Vulnerability: Guard could be bribed or could abandon you
	o Threat #2: Hyperinflation reduces value of case contents to nothing		o Threat #2: Hyperinflation reduces value of case contents to nothing
	 Defense: Banks/Mints		- Defense: Banks/Mints
	• Vulnerability: Currency minting plates get stolen		• Vulnerability: Currency minting plates get stolen
	• General Comment: FOLLOW THE FULL INSTRUCTIONS, BE SPECIFIC.		• General Comment: FOLLOW THE FULL INSTRUCTIONS, BE SPECIFIC.

Nicholas Laws: /* Midterm Discussion */

2016-04-06T04:27:10Z

Midterm Discussion

@@ Line 23: / Line 23: @@
    • General Comment: FOLLOW THE FULL INSTRUCTIONS, BE SPECIFIC.
    • Concerns of time pressure leading to Anil thinking of 4 questions for the final
 ===Paper: Boxify===

Nicholas Laws: /* Paper: Android Permissions Remystified */

2016-04-06T04:25:46Z

Paper: Android Permissions Remystified

@@ Line 48: / Line 48: @@
 ===Paper: Android Permissions Remystified===
    - Placeholder
 ===Anil: "Where the research is"===
    - Placeholder

Nicholas Laws: /* Paper: Boxify */

2016-04-06T04:25:20Z

Paper: Boxify

@@ Line 25: / Line 25: @@
 ===Paper: Boxify===
-   - Placeholder
 ===Paper: Android Permissions Remystified===

Nicholas Laws: /* Midterm Discussion */

2016-04-06T04:22:06Z

Midterm Discussion

@@ Line 8: / Line 8: @@
 ===Midterm Discussion===
-   - Placeholder
+   • Midterms almost all marked
 ===Paper: Boxify===

Nicholas Laws at 22:20, 5 April 2016

2016-04-05T22:20:25Z

← Older revision		Revision as of 22:20, 5 April 2016
Line 1:		Line 1:
	~~placeholder~~		==Topics and Readings==
			*Boxify
			**Michael Backes et al., ''[https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/backes Boxify: Full-fledged App Sandboxing for Stock Android]'' (USENIX Security 2015)
			*Android Permissions
			**Primal Wijesekera et al., ''[https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/wijesekera Android Permissions Remystified: A Field Study on Contextual Integrity]'' (USENIX Security 2015)

			==Notes==

			===Midterm Discussion===
			- Placeholder

			===Paper: Boxify===
			- Placeholder

			===Paper: Android Permissions Remystified===
			- Placeholder

			===Anil: "Where the research is"===
			- Placeholder

Nicholas Laws: Created page with "placeholder"

2016-04-05T22:08:52Z

Created page with "placeholder"

New page

placeholder