Archive for May, 2014

SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities

Thursday, May 15th, 2014

Our paper on automated testing of web applications has been accepted to the 2014 USENIX Security Symposium. [Update: the final version of the paper is available here.]

It describes a black-box technique for automatically scanning web sites for vulnerabilties in how they implement Facebook Single Sign-On, and results from our experiments running it on thousands of websites.



You can try the scanner at SSOScan.org.

Yuchen Zhou will present the paper at USENIX Security in San Diego, 20-22 August 2014.

Congratulations Samee Zahur!

Friday, May 2nd, 2014

Samee Zahur passed in PhD Proposal on Abstractions for Data Oblivious Programs. The abstract is:

While many recent papers have demonstrated the feasibility of secure computation for various interesting applications, such techniques have not yet been widely adopted outside of the research community. In the thesis proposed here, we try to reduce one aspect of this entry barrier: software abstractions. We motivate the problem by showing how secure computation necessarily requires redesigning of even simple software abstractions such as language control structures and data structures. First, we propose a new language that can be easily extended by other researchers for purposes of their investigations. Then, we propose new constructions for common data structures that are efficient in this execution model. Finally, we propose to develop new optimizations for ORAM structures to enable faster computations in the RAM model. Our preliminary investigations are already showing promising results. We have implemented a prototype compiler for our new language that provides significantly higher flexibility compared to existing systems. We demonstrate this flexibility by showing that our language allows implementation of various library-based features that have, in the past, always used compiler modifications in other languages. We have also shown constructions of data structures that can provide over 10x speed improvement even on small data sizes.

Congratulations to Samee on successfully presenting his PhD Proposal. Samee will be spending the summer at Microsoft Research (Redmond).