Content-based memory deduplication offers potential for saving physical memory by merging identical virtual pages. However, it also opens up a timing side-channel that allows attackers to probe whether an identical copy of one of their pages exists elsewhere on the system. This allows, for example, to find out what exact version of an application is being executed in another VM, and can also facilitate other side-channel attacks, e. g. some Rowhammer-based attacks. This paper presents FakeDD, a modification to Linux KSM, which uses fake deduplication as a countermeasure against such attacks that equalises the write times to duplicate and unique pages. Nevertheless, it still allows to make use of the memory savings offered by deduplication. FakeDD is available as open-source. It is evaluated with regard to its effectiveness and performance overhead. The results indicate that it can effectively prevent side-channel attacks based on the write time differences between duplicate and unique pages and that the additional performance overhead is smaller than that already incurred due to the standard KSM implementation and may thus be an acceptable trade-off for the additional security.

VMs in cloud environments are at threat of attacks from VMs co-located on the same server, e. g. through side-channels. Reducing the ability of attackers to achieve co-location with specific VMs can alleviate the risk of targeted attacks. This paper presents the simulation framework VMPlaceSim, which allows to evaluate resource utilisation and resistance against co-location attacks of VM placement strategies. A new strategy based on the proportion of known users on servers is proposed and evaluated on real-world cloud workload data alongside existing strategies. The evaluation takes attacks into account in which malicious VMs are either launched in regular intervals or their launch is timed around the launch of target VMs. The results indicate that the new known-users strategy is significantly more resistant to co-location attacks than existing strategies aimed at optimising resource utilisation, while retaining a relatively high resource utilisation exceeding that of strategies aimed at thwarting co-location attacks.

Integrity is a key protection objective in the context of system security. This holds for both hardware and software. Since hardware cannot be changed after its manufacturing process, the manufacturer must be trusted to build it properly. However, it is completely different with software. Users of a computer system are free to run arbitrary software on it and even modify BIOS/UEFI, bootloader, or Operating System (OS).

EU data protection laws grant consumers the right to access the personal data that companies hold about them. In a first-of-its-kind longitudinal study, we examine how service providers have complied with subject access requests over four years. In three iterations between 2015 and 2019, we sent subject access requests to vendors of 225 mobile apps popular in Germany. Throughout the iterations, 19 to 26% of the vendors were unreachable or did not reply at all. Our subject access requests were fulfilled in 15 to 53% of the cases, with an unexpected decline between the GDPR enforcement date and the end of our study. The remaining responses exhibit a long list of shortcomings, including severe violations of information security and data protection principles. Some responses even contained deceptive and misleading statements (7 to 13%). Further, 9% of the apps were discontinued and 27% of the user accounts vanished during our study, mostly without proper notification about the consequences for our personal data. While we observe improvements for selected aspects over time, the results indicate that subject access request handling will be unsatisfactory as long as vendors accept such requests via email and process them manually.

Behavior-based tracking is an unobtrusive technique that allows observers on the Internet to monitor user activities over long periods of time - in spite of changing IP addresses. Our technique uses semi-supervised machine learning, which allows observers to track users without the need for multiple labeled training sessions. We present evaluation results obtained on a realistic dataset that contains the DNS traffic of 3,800 users. Given the traffic of one week, our simulated observers can link the sessions of up to 87% of the users with surprisingly little effort. Our results indicate that observers can leverage unlabeled sessions to increase the robustness of existing tracking techniques. This makes it more difficult for users to protect their privacy on the Internet.

Cloud computing is frequently being used to host online services. Abuse of cloud resources poses an important problem for cloud service providers. If third parties are affected by abuse, bad publicity or legal liabilities may ensue for the provider. There is an unsatisfactory level of protection against abuse of cloud offerings at the moment. In this paper, we analyse the current state of abuse detection and prevention in IaaS cloud computing. To establish what constitutes abuse in an IaaS environment, a survey of acceptable use policies of cloud service providers was conducted. We have found that existing intrusion detection and prevention techniques are only of limited use in this environment due to the high level of control that users can exercise over their resources. However, cloud computing opens up different opportunities for intrusion detection. We present possible approaches for abuse detection, which we plan to investigate further in future work.