Seongil WiKAIST
Biography
Seongil Wi will be joining UNIST as an Assistant Professor in the Department of Computer Science and Engineering, starting on August 28, 2023. His research interests mainly focus on web and software security, program analysis, automatic vulnerability discovery, and security education. He has contributed to the field through his published works in prestigious venues, including MobiSys, NDSS, and WWW. In recognition of his achievements, he was awarded the NAVER Ph.D Fellowship and Samsung Human Tech. He received his Ph.D. and M.S. degrees from KAIST under the guidance of Prof. Sooel Son and Prof. Sang Kil Cha, respectively. If you would like to learn more about Seongil Wi and his work, you can visit his website at https://seongil-wi.github.io/.
DiffCSP: Finding Browser Bugs in Content Security Policy Enforcement through Differential Testing
The Content Security Policy (CSP) is one of the de facto security mechanisms that mitigate web threats. Many websites have been deploying CSPs mainly to mitigate cross-site scripting (XSS) attacks by instructing client browsers to constrain JavaScript (JS) execution. However, a browser bug in CSP enforcement enables an adversary to bypass a deployed CSP, posing a security threat. As the CSP specification evolves, CSP becomes more complicated in supporting an increasing number of directives, which brings additional complexity to implementing correct enforcement behaviors. Unfortunately, the finding of CSP enforcement bugs in a systematic way has been largely understudied.
In this talk, I will present DiffCSP, the first differential testing framework to find CSP enforcement bugs involving JS execution. DiffCSP generates CSPs and a comprehensive set of HTML instances that exhibit all known ways of executing JS snippets. DiffCSP then executes each HTML instance for each generated policy across different browsers, thereby collecting inconsistent execution results. To analyze a large volume of the execution results, we leverage a decision tree and identify common causes of the observed inconsistencies. We demonstrate the efficacy of DiffCSP by finding 29 security bugs and eight functional bugs. We also show that three bugs are due to unclear descriptions of the CSP specification. We further identify the common root causes of CSP enforcement bugs, such as incorrect CSP inheritance and hash handling. We confirm the risky trend of client browsers deriving completely different interpretations from the same CSPs, which raises security concerns. Our study demonstrates the effectiveness of DiffCSP for identifying CSP enforcement bugs, and our findings have contributed to patching 12 security bugs in major browsers, including Chrome and Safari.
Taeri KimHanyang University
Biography
Taeri Kim is currently pursuing a Ph.D. degree in Computer Science at Hanyang University. Her research interests lie in data mining, graph neural network analysis, and recommender systems. Her work has been featured in major computer science conferences, including CCS, CIKM, and WSDM. In recognition of her exceptional research, she received the Naver Ph.D. Fellowship Award in 2022.
Phishing URL Detection: A Network-based Approach Robust to Evasion
Many cyberattacks start with disseminating phishing URLs. When clicking these phishing URLs, the victim's private information is leaked to the attacker. There have been proposed several machine learning methods to detect phishing URLs. However, it still remains under-explored to detect phishing URLs with evasion, i.e., phishing URLs that pretend to be benign by manipulating patterns. In many cases, the attacker i) reuses prepared phishing web pages because making a completely brand-new set costs non-trivial expenses, ii) prefers hosting companies that do not require private information and are cheaper than others, iii) prefers shared hosting for cost efficiency, and iv) sometimes uses benign domains, IP addresses, and URL string patterns to evade existing detection methods. Inspired by those behavioral characteristics, we present a network-based inference method to accurately detect phishing URLs camouflaged with legitimate patterns, i.e., robust to evasion. In the network approach, a phishing URL will be still identified as phishy even after evasion unless a majority of its neighbors in the network are evaded at the same time. Our method consistently shows better detection performance throughout various experimental tests than state-of-the-art methods, e.g., F-1 of 0.891 for our method vs. 0.840 for the best feature-based method.
Yoochan Lee Seoul National University
Biography
I’m a Ph.D student in Department of Electrical & Computer Engineering at Seoul National University. In general, my research area is System and Software Security. I focus on evolutionizing exploitation techniques, such as combining exploitation techniques and side-channel attacks. I mainly focus on doing research that is of interest to academia and industry.
Pspray: Timing Side-Channel based Linux Kernel Heap Exploitation Technique
The stealthiness of an attack is the most vital consideration for an attacker to reach their goals without being detected. Therefore, attackers put in a great deal of effort to increase the success rate of attacks in order not to expose information on the attacker and attack attempts resulting from failures. Exploitation of the kernel, which is a prime target for the attacker, usually takes advantage of heap-based vulnerabilities, and these exploits' success rates fortunately remain low (e.g., 56.1% on average) due to the operating principle of the default Linux kernel heap allocator, SLUB.
This paper presents Pspray, a timing side-channel attack-based exploitation technique that significantly increases the success probability of exploitation. According to our evaluation, with 10 real-world vulnerabilities, Pspray significantly improves the success rate of all those vulnerabilities (e.g., from 56.1% to 97.92% on average). To prevent this exploitation technique from being abused by the attacker, we further introduce a new defense mechanism to mitigate the threat of Pspray. After applying mitigation, the overall success rate of Pspray becomes similar to that from before using Pspray with negligible performance overhead (0.25%) and memory overhead (0.52%).
Kyungwhoon CheunCorporate President,
Yong Ho HwangCorporate VP,
Kang Geun ShinProfessor,
Insu YunProfessor,
Jun HanProfessor,
