Contemporary blogs receive comments and TrackBacks, which result in cross-references between blogs.
We conducted a longitudinal study of TrackBack spam, collecting and analyzing almost 10 million samples from a massive spam campaign over a one-year period. Unlike common delivery of email spam, the spammers did not use bots, but took advantage of an official Chinese site as a relay.

Based on our analysis of TrackBack misuse found in the wild, we propose an authenticated TrackBack mechanism that
defends against TrackBack spam even if attackers use a very large number of different source addresses and generate unique URLs for each TrackBack blog.

Presented by Eric at CCSW
slides
Paper

We study the security of embedded web servers used in consumer electronic devices, such as security cameras and photo frames, and for IT infrastructure, such as wireless access points and lights-out management systems. All the devices we examine turn out to be vulnerable to a variety of web attacks, including cross site scripting (XSS) and cross site request forgery (CSRF). In addition, we show that consumer electronics are particularly vulnerable to a nasty form of persistent XSS where a non-web channel such as NFS or SNMP is used to inject a malicious script. This script is later used to attack an unsuspecting user who connects to the device’s web server. We refer to web attacks which are mounted through a non-web channel as cross channel scripting (XCS). We propose a client-side defense against certain XCS which we implement as a browser extension.

Presented by Hristo at CCS’09 Chicago USA
Paper

CAPTCHA tests aim at preventing attackers from performing automatic registration. In this paper we show that our prototype Decaptcha is able to successfully break 75% of eBay audio captchas. We compare its performance with the state of the art, readily
available speech recognition system Sphinx and discuss the implications for eBay security.

Presented at Woot’09, montréal Canada

Paper (PDF)
presentation slides (PDF)

Over the last few years, attack graphs have became a well recognized tool to analyze and model complex network attack. The most advanced evolution of attack graphs, called anticipation games, is based on game theory. However even if anticipation games allow to model time, collateral effects and player interactions with the network, there is still key aspects of the network security that cannot be modeled in this framework. Theses aspects are network cooperation to fight unknown attack, the cost of attack based on its duration and the introduction of new attack over the time. In this paper we address these needs, by introducing a three-fold extension to anticipation games. We prove that this extension does not change the complexity of the framework. We illustrate the usefulness of this extension by presenting how it can be used to find a defense strategy against 0 days that use an honey net. Finally, we have implemented this extension into a prototype, to show that it can be used to analyze large networks security.

Presented at FAST’08, Malaga, Spain

Full paper (PDF)

NetQi is a freely available model-checker designed to analyze network incidents such as intrusion. This tool is an implementation of the anticipation game framework, a variant of timed game tailored for network analysis.
The main purpose of NetQi is to find, given a network initial state and a set of rules, the best strategy that fulfills player objectives by model-checking the anticipation game and comparing the outcome of each play that fulfills strategy constraints. For instance, it can be used to find the best patching strategy.
NetQi has been successfully used to analyze service failure due to hardware, network intrusion, worms and multiple-site intrusion defense cooperation.

Presented at ATVA 2008 (Automated Technology for Verification and Analysis) Seoul, Korea

Full article (PDF)

Slides (PDF)

Published at WISTP 2008 and Awarded Best Paper

With the growing use of protocols obfuscation techniques, protocol identification for Q.O.S enforcement, traffic prohibition, and intrusion detection has became complex task. This paper address this issue with a probabilistic identification analysis that combines multiples advanced identification techniques and returns an ordered list of probable protocols. It combines a payload analysis with a classifier based on several discriminators, including packet entropy and size.
We show with its implementation, that it overcomes the limitations of traditional port-based protocol identification when dealing with hard to classify protocol such as peer to peer protocols. We also details how it deals with tunneled session and covert channel.

Author Version (PDF)

Accepted paper at ASIAN 2007 at Carnegie Mellon University in Qatar.

Abstract

We present a logic-based framework to evaluate the resilience of computer networks in the face of incidents, i.e., attacks from malicious intruders as well as random faults. Our model uses a two-layered presentation of dependencies between files and services, and of timed games to represent not just incidents, but also the dynamic responses from administrators and their respective delays. We demonstrate that a variant TATL$\Diamond$ of timed alternating-time temporal logic is a convenient language to express several desirable properties of networks, including several forms of survivability. We illustrate this on a simple redundant Web service architecture, and show that checking such timed games against the so-called TATL$\Diamond$ variant of the timed alternating time temporal logic TATL is EXPTIME-complete.

Files

Incident Logic author version (PDF)

This work was presented at NordSec 2007: The 12th Nordic Workshop on Secure IT Systems as short paper.

In this paper we introduce a new technique to count the number of hosts behind a NAT. This technique based on TCP timestamp option, works with Linux and BSD system and therefore is complementary to the previous one base on IPID than does not work for those systems. Our implementation demonstrates the practicability of this method.

Time has something to tell us about Network Address Translation (PDF Version)

@InProceedings{ Bursztein2007_1,
title = “Time has something to tell us about Network Address Translation”,
booktitle = “NordSec 2007″,
author = “E. Bursztein”,
month = “Nov.”,
year = “2007″
}

Intrusion Detection Systems (IDS) are used to discover several kinds of attacks. Commercial solutions are, generally centralized and suffer from significant limitations when used in high speed networks. This is one of our major motivations to use distributed model based on agent platform. We believe that agent facilities will help collecting efficent and useful informations for IDS. We also propose to use a combined analysis by invoking speciallized agents. The idea is to have a signature based agent, temporal analysis agent and behavior analysis agent. By combining three ananlysis, our IDS will be able to detect several kinds of attacks and intrusions. Before introducing our global agent IDS architecture, we need to validate the agent palteforme use and verify a set of security features. The first step is to choose a platforme which can offer security mechanisms needed by IDS solutions. In this paper, we first sum up IDS security needs, we introduce a set of comparison criteria and we present a security feautures study of agent platforme. After studying Concordia, JADE, Aglet, Voyager, Agent-TCL , MAP and JATLite platformes, we introduce our agent IDS by presenting the global architecture and future works.

Toward Agent IDS: agent platform security features study abstract

Toward Agent IDS: agent platform security features study slides

This tutorial focus on the techniques used to scout a network, from host probing to advance fingerprint identification. It also present the methods that can be used to deceive scouting attempts.

Network scouting techniques : utilisation and prevention slides

Network scouting techniques : utilisation and prevention article french

Network scouting techniques : utilisation and prevention article english