I went to visit the DSV SecLab … and got run over by a car.
My recent visits to other universities have been rather interesting … First with UCSB – I went and found nobody there, to talk to. This time though – I was even more successfully whilst trying to visit the DSV SecLab, I got run over by a car just 30 minutes after I arrived in Stockholm. Luckily after one week in a great Swedish hospital I safely returned back to Vienna with my broken leg. 
Tor HTTP usage and Information Leakage
Abstract- This paper analyzes the web browsing behaviour of Tor users. By collecting HTTP requests we show which websites are of interest to Tor users and we determined an upper bound on how vulnerable Tor users are to sophisticated de-anonymization attacks: up to 78 % of the Tor users do not use Tor as suggested by the Tor community, namely to browse the web with TorButton. They could thus fall victim to de-anonymization attacks by merely browsing the web. Around 1 % of the requests could be used by an adversary for exploit piggybacking on vulnerable file formats. Another 7 % of all requests were generated by social networking sites which leak plenty of sensitive and identifying information. Due to the design of HTTP and Tor, we argue that HTTPS is currently the only effective countermeasure against de-anonymization and information leakage for HTTP over Tor.
Get the preprint here: http://torhttp.nysos.net
Happy Birtday Spam!
Apparently 30 years ago the first Spam message was sent. Thus happy birthday dear beloved Spam and hopefully we get rid of these messages clogging up our mailboxes soon.
Facebook: A security and privacy nightmare?
Apparently Facebook decided to open-up profiles to the public yet a little further in future, read more at this blog entry. So whilst a plethora of security research highlights how broken this service really is, Facebook keeps on exposing more private information to third-parties on a sneaky opt-out basis.
Want to catch up how broken Facebook is? Read some interesting (academic) publications regarding Facebook Security:
A Practical Attack to De-Anonymize Social Network Users
All Your Contacts Are Belong to Us
Towards Automating Social Engineering Using Social Networking Sites
What can Facebook users do to protect themselves? So far not that much; at least: adapt your privacy settings, protect your communication with browser extensions such as ForceTLS.
As soon as all review cycles are finished, I plan to publish more information on a new security threat with SNSs that we recently discovered.
(C) Joy of Tech
New publications coming up soon …
Our publications have been accepted at the IFIP CMS’2010 and the SEC 2010 conference. I will publish preprints soon.