Expert analysis
A General and Flexible Access-Control System for the Web
We describe the design, implementation, and performance of a new system for access control on the web. To achieve greater exibility in forming access-control policies – …
Proprietary Certificates
Certificates play an essential role in public-key cryptography, and are likely to become a cornerstone of commerce-related applications. Traditional certificates, however, are …
OpenSSL Security Vulnerabilities Roundup
OpenSSL Security Advisory issued on 30 July 2002 that points to several security issues within OpenSSL. There are four remotely exploitable buffer overflows in OpenSSL. There …
Hacking the Invisible Network: Insecurities in 802.11x
Wireless local-area networks (WLANs) are becoming increasingly popular but, at the same time, they have introduced new security issues. The convenience of WLANs introduces …
Proxy-Based Security Protocols in Networked Mobile Devices
We describe a resource discovery and communication system designed for security and privacy. All objects in the system, e.g., appliances, wearable gadgets, software agents, …
Security in Plan 9
The security architecture of the Plan 9 operating system has recently been redesigned to address some technical shortcomings. This redesign provided an opportunity also to …
Five Microsoft Security Bulletins Released
Microsoft was pretty active in the past few days – they released five security bulletins dealing with the following products: SQL Server 2000, Windows Media Player, …
Trusted Paths for Browsers: An Open-Source Solution to Web Spoofing
This paper reports the results of our work to systematically defend against Web spoofing, by creating a trusted path from the browser to the user. Starting with the Mozilla …
Secure Execution Via Program Shepherding
We introduce program shepherding, a method for monitoring control flow transfers during program execution to enforce a security policy. Program shepherding provides three …
Setuid Demystified
Access control in Unix systems is mainly based on user IDs, yet the system calls that modify user IDs (uid-setting system calls), such as setuid, are poorly designed, …
More Enforceable Security Policies
We analyze the space of security policies that can be enforced by monitoring programs at runtime. Our program monitors are automata that examine the sequence of program …
Linux Security Modules: General Security Support for the Linux Kernel
The access control mechanisms of existing mainstream operating systems are inadequate to provide strong system security. Enhanced access control mechanisms have failed to win …
Featured news
Resources
Don't miss
- Threat actors are using legitimate Microsoft feature to compromise M365 accounts
- North Korean hackers spotted using ClickFix tactic to deliver malware
- Sandworm APT’s initial access subgroup hits organizations accross the globe
- PAN-OS authentication bypass hole plugged, PoC is public (CVE-2025-0108)
- The UK’s secret iCloud backdoor request: A dangerous step toward Orwellian mass surveillance