Theses supervised by Yrd. Doç. Dr. Ali Aydın Selçuk
11 theses · İhsan Doğramacı Bilkent University
Windows işletim sistemi için ghostware ve rootkit yakalama teknikleri
Spyware is a signiï¬cant problem for most computer users. In public, the termspyware is used with the same meaning as adware, a kind of malicious softwareused for showing advertisements to the user against his will. Spyware programsare also known for their tendency to hide their presence, but advanced stealthtechniques used to be either nonexistent or relatively primitive in terms of eï¬ec-tiveness. In other words, most of the spyware programs were eï¬cient at spyingbut not very eï¬cient at hiding. This made spyware easily detectable with sim-ple ï¬le-scanning and registry-scanning techniques. New spyware programs havemerged with rootkits and gained stealth abilities, forming spyware with advancedstealth techniques. In this work we focus on this important subclass of spyware,namely ghostware. Ghostware programs hide their resources from the Operat-ing System Application Programming Interfaces that were designed to query andenumerate them. The resources may include ï¬les, Windows Registry entries,processes, and loaded modules and ï¬les. In this work, we enumerated thesehiding techniques and studied the stealth detection methodologies. We also in-vestigated the eï¬ectiveness of the hiding techniques against popular anti-virusprograms and anti-spyware programs together with publicly available ghostwaredetection and rootkit detection tools. The results show that, anti-virus programsor anti-spyware programs are not eï¬ective for detecting or removing ghostwareapplications. Hidden object detection or rootkit detection tools can be useful,however, these tools can only work after the computer is infected and they donot provide any means for removing the ghostware. As a result, our work showsthe need for understanding the potential dangers and applications of ghostwareand implementing new detection and prevention tools.Keywords: spyware, ghostware, rootkit, stealth, detection.
Botlar tarafından ele geçirilmiş bilgisayarların tespit edilmesi için içerik tabanlı imzaların üretilmesi
A botnet is a network of compromised machines that are remotely controlled andcommanded by an attacker, who is often called the botmaster. Such botnets areoften abused as platforms to launch distributed denial of service attacks, sendspam mails or perform identity theft. In recent years, the basic motivationsfor malicious activity have shifted from script kiddie vandalism in the hackercommunity, to more organized attacks and intrusions for ¯nancial gain. This shiftexplains the reason for the rise of botnets that have capabilities to perform moresophisticated malicious activities. Recently, researchers have tried to developbotnet detection mechanisms. The botnet detection mechanisms proposed to datehave serious limitations, since they either can handle only certain types of botnetsor focus on only speci¯c botnet attributes, such as the spreading mechanism, theattack mechanism, etc., in order to constitute their detection models.We present a system that monitors network tra±c to identify bot-infectedhosts. Our goal is to develop a more general detection model that identi¯essingle infected machines without relying on the bot propagation vector. To thisend, we leverage the insight that all of the bots get a command and perform anaction as a response, since the command and response behavior is the uniquecharacteristic that distinguishes the bots from other malware. Thus, we examinethe network tra±c generated by bots to locate command and response behaviors.Afterwards, we generate signatures from the similar commands that are followedby similar bot responses without any explicit knowledge about the commandand control protocol. The signatures are deployed to an IDS that monitors thenetwork tra±c of a university. Finally, the experiments showed that our systemis capable of detecting bot-infected machines with a low false positive rate.
Genelleştirilmiş kimlik tabanlı ElGamal imzaları ve eklentileri
ID-based cryptography helps us to simplify key management process in traditional public key infrastructures. Any public information such as the e-mail address, name, etc., can be used as a public key and this solves the problem of obtaining the public key of a party and checking that its certificate is valid. ID-based cryptography has been a very active area of research in cryptography since bilinear pairings were introduced as a cryptographic tool. There have been many proposals for ID-based signatures recently. In this thesis, we introduce the concept of generalized ID-based ElGamal signatures and show that most of the proposed ID-based signature schemes in the literature are special instances of this generalized scheme. We also investigate ID-based signatures providing additional properties. Signature schemes with message recovery provide the feature that the message is recoverable from the signature and hence does not need to be transmitted separately. Blind signatures provide the feature that a user is able to get a signature without giving the actual message to the signer. Finally, signcryption schemes fulfill the job of a digital signature and encryption in a single step with a lower computational cost.We generalize the ID-based signatures providing these properties and obtain numerous new signatures which have not been explored before. The generalized ID-based signatures we described provide a unified framework for ID-based El-Gamal signatures and extensions.
Gizli kum bahçesi ile kötücül yazılım analizi
Malware is one of the biggest problems of the world of bits and bytes. Generallymalware does activities a user normally does not do, such as becoming part of avirtual army or submitting confidential data of the user to the malware author.There are publicly available analysis services for unknown binaries. Sandbox analysisis performed by execution of an untrusted binary in an isolated environment.It is a very common technique for malware research. Publicly available sandboxanalysis platforms help users to see traces of the execution without harming theirsystem. Also it helps owners of the sandbox to collect malware and makes thejob of analysts easier. One major problem of the public sandbox testing is thatmalware authors can also benefit from analysis of sandboxes. If they can identifysandbox systems they can hide malicious behavior. This thesis presents the publiclyused Anubis sandbox, detection mechanisms used against Anubis[3], furtherpossible detection mechanisms and our efforts for hiding fingerprint of Anubisfrom malware and decreasing the resulting false negative rates for the malwaredetection.
İkili yürütülebilirlerin dönüşe dayalı programlamaya karşı bağışıklandırılması
Despite the numerous prevention and protection mechanisms that have been introducedinto modern operating systems, the exploitation of memory corruption vulnerabilitiesstill represents a serious threat to the security of software systems and networks. Arecent exploitation technique, called Return-Oriented Programming (ROP), has latelyattracted a considerable attention from academia.ROP attacks utilize short code sequences each ending with a free-branch instruction,i.e. an instruction that allows the attacker to control the execution flow. Identifyingsuch sequences, or gadgets, available in binary executables and chaining themtogether, it is possible to perform arbitrary computations. Past research on the topichas mostly focused on refining the original attack technique, or on proposing partialsolutions that target only particular variants of the attack.In this work, we present a compiler-based approach that represents the first practicalsolution against any possible form of ROP. Our solution is able to protect thealigned free-branch instructions to prevent them from being misused by an attacker,and to eliminate all unaligned free-branch instructions inside a binary executable. Wedeveloped a prototype based on our approach for the x86 architecture, and evaluatedit by compiling GNU libc and a number of real-world applications. The results ofthe experiments demonstrate that our solution is able to prevent any form of return-orientedprogramming attack.
Bazı ideal gizlilik paylaşım şemaları
A secret sharing scheme is a method of assigning shares for a secret to some participants such that only authorized coalitions of these participants can recover the secret.In this work, we study several access structure types: we give an ideal perfect secret sharing scheme for disjunctive multilevel access structures. We introduce joint compartmented access structures, which covers compartmented access structures and conjunctive hierarchical access structures as special cases. We provide an almost surely perfect scheme for those joint compartmented access structures that can be realized by an ideal perfect secret sharing scheme. Lastly, we suggest an alternative threshold secret sharing scheme, and we use this scheme to construct a disjunctive multilevel secret sharing scheme.
Yaygın internet saldırılarının üstesinden gelmede kullanıcı davranışına içgörüler
The Internet?s immense popularity has made it an attractive medium for attackers. Today, criminals often make illegal profits by targeting Internet users. Most common Internet attacks require some form of user interaction such as clicking on an exploit link, or dismissing a security warning dialogue. Hence, the security problem at hand is not only a technical one, but it also has a strong human aspect. Although the security community has proposed many technical solutions to mitigate common Internet attacks, the behavior of users when they face these attacks remains a largely unexplored area.In this work, we describe an online experiment platform we built for testing the behavior of users when they are confronted with common, concrete attack scenarios such as reflected cross-site scripting, session fixation, scareware and file sharing scams. We conducted experiments with more than 160 Internet users with diverse backgrounds. Our findings show that non-technical users can exhibit comparable performance to knowledgeable users at averting relatively simple and well-known threats (e.g., email scams). While doing so, they do not consciously perceive the risk, but solely depend on their intuition and past experience (i.e., there is a training effect). However, in more sophisticated attacks, these non-technical users often rely on misleading cues such as the ?size? and ?length? of artifacts (e.g., URLs), and fail to protect themselves. Our findings also show that trick banners that are common in file sharing websites and shortened URLs have high success rates of deceiving non-technical users, thus posing a severe security risk.
Yayın şifrelemede ve hain takibinde eniyilemeler ve yeni yöntemler
In the last few decades, the use of digital content increased dramatically. Many forms of digital products in the form of CDs, DVDs, TV broadcasts, data over the Internet, entered our life. Classical cryptography, where encryption isdone for only one recipient, was not able to handle this change, since its direct use leads to intolerably expensive transmissions. Moreover, new concerns regarding the commercial aspect arised. Since digital commercial contents aresold to various customers, unauthorized copying by malicious actors became a major concern and it needed to be prevented carefully. Therefore, a new research area called digital rights management (DRM) has emerged. Within the scope of DRM, new cryptographic primitives are proposed. In this thesis, we consider three of these: broadcast encryption (BE), traitor tracing (TT), and trace and revoke (T&R) schemes and propose methods to improve the performances and capabilities of these primitives. Particularly, we ?rst consider pro?ling the recipient set in order to improve transmission size in the most popular BE schemes. We then investigate and solve the optimal free rider assignment problem for one of the most e?cient BE schemes so far. Next, we attempt to close the non-trivial gap between BE and T&R schemes by proposing a generic method for adding traitor tracing capability to BE schemes and hus obtaining a T&R scheme. Finally, we investigate an overlooked problem: privacy of the recipient set in T&R schemes. Right now, most schemes do not keep the recipient set anonymous, and everybody can see who received a particular content. As a generic solution to this problem, we propose a method for obtaining anonymous T&R scheme by using anonymous BE schemes as a primitive.Keywords: Broadcast encryption, traitor tracing, digital rights management.
Akıllı kartta sertifika tabanlı kullanıcı kimlik doğrulamalı openID
From the point of its users, federated identity systems provide great convenience to log in to varied web sites without bothering of registration in advance. Looking from a vantage point, federated identity management gives the opportunity to users of one IT system to access data and sources of another IT system seam-lessly and securely without handling a complete user administration. Single sign-on mechanisms manage user authentication process of these systems prompting log in once and assure access control across those multiple independent systems. OpenID is a widely used federated identity/single sign-on scheme generally implemented with username-password authentication. In this work, we augment the user authentication phase of OpenID with certificate-based authentication using smartcard technology. Our solution provides a secure method to authenticate the user with user's digital certificate written on the smartcard. Keywords: OpenID, digital certi cate, federated identity, single sign-on,certi cate-based user authentication, smartcard, smartcard-based OpenID.
Android rassal sayı üretecinin analizi
Randomness is a crucial resource for cryptography, and random number generators are critical building blocks of almost all cryptographic systems. Therefore, random number generation is one of the key parts of secure communication. Random number generation does not guarantee security. Problematic random number generation process may result in breaking the encrypted communication channel, because encryption keys are obtained by using random numbers. For computers and smart devices, generation of random numbers is done by operating systems. Applications which need random numbers for their operation request them from the operating system they are working on. Due to the importance of random number generation, this process should be analyzed deeply and cryptographically for different operating systems. From this perspective, we studied Android random number generation process by looking at the source codes and found that security of random number generation done by Android relies on the security of random number generation of Linux. Then we analyzed Android random number generator by modifying the kernel source code and applying some tests on its entropy estimator. Finally, we looked for possible weaknesses of random number generator during startup of Android devices. Keywords: SecureRandom, random number generation/generators, Linux RNG,Android RNG, entropy estimator.
Araç tasarsız ağlarında konum güvenliği için rastgele geciktirme teknikleri
VANET is an emerging new communication technology which has attracted a lot of research attention from academic community and industry. It is promising technology to provide safer and efficient traffic conditions. This is realized by letting vehicles to exchange safety messages. This messaging increases the awareness of vehicles about their neighboring vehicles positions and warns drivers about dangerous situations. However, availability of such information facilitates the tracking of vehicles. So, this information must be protected against the potential misuse. In this thesis, we address the problem of achieving location privacy in VANETs with randomly changing identifiers in the presence of a global passive adversary. We suggest adding a random delay to message broadcast period after the vehicle update its pseudonym in mix zones. By this way, we want to mitigate the linkability between pseudonyms. This could help to make tracking more difficult and increase safety and confidence of drivers using VANET. Instead of adding delay to safety messages completely random, one step taken further and delay is added according to the silent vehicle number in mix zone. We also investigated the effects of different number of mix-zone placements in the network to the location privacy of users. Several simulations have been performed to evaluate the performance of the systems. The results of experiments show that adding delay to message broadcast period improves location privacy of drivers in VANET and also provide information about the relationship between the strength of the adversary and the level of privacy achieved by changing pseudonyms. Anahtar s ozc ukler: takma ad, karma b olge, konum gizli gi, ara c tasars z a g .