Biometric authentication is getting increasingly popular because of its appealing usability and improvements in biometric sensors. At the same time, it raises serious privacy concerns since the common deployment involves storing bio-templates in remote servers. Current solutions propose to keep these templates on the client's device, outside the server's reach. This binds the client to the initial device. A more attractive solution is to have the server authenticate the client, thereby decoupling them from the device. Unfortunately, existing biometric template protection schemes either suffer from the practicality or accuracy. The state-of-the-art deep learning (DL) solutions solve the accuracy problem in face- and voice-based verification. However, existing privacy-preserving methods do not accommodate the DL methods, as they are tailored to hand-crafted feature space of specific modalities in general. In this work, we propose a novel pipeline, Justitia, that makes DL-inferences of face and voice biometrics compatible with the standard privacy-preserving primitives, like fuzzy extractors (FE). For this, we first form a bridge between Euclidean (or cosine) space of DL and Hamming space of FE, while maintaining the accuracy and privacy of underlying schemes. We also introduce efficient noise handling methods to keep the FE scheme practically applicable. We implement an end-to-end prototype to evaluate our design, then show how to improve the security for sensitive authentications and usability for non-sensitive, day-to-day, authentications. Justitia achieves the same, 0.33% false rejection at zero false acceptance, errors as the plaintext baseline does on the YouTube Faces benchmark. Moreover, combining face and voice achieves 1.32% false rejection at zero false acceptance. According to our systematical security assessments conducted through prior approaches and our novel black-box method, Justitia achieves ~25 bits and ~33 bits of security guarantees for face- and face&voice-based pipelines, respectively.

This work presents the first findings on the feasibility of using botnets to automate stock market manipulation. Our analysis incorporates data gathered from SEC case files, security surveys of online brokerages, and dark web marketplace data. We address several technical challenges, including how to adapt existing techniques for automation, the cost of hijacking brokerage accounts, avoiding detection, and more. We consolidate our findings into a working proof-of-concept, man-in-the-browser malware, Bot2Stock, capable of controlling victim email and brokerage accounts to commit fraud. We evaluate our bots and protocol using agent-based market simulations, where we find that a 1.5% ratio of bots to benign traders yields a 2.8% return on investment (ROI) per attack. Given the short duration of each attack (< 1 minute), achieving this ratio is trivial, requiring only 4 bots to target stocks like IBM. 1,000 bots, cumulatively gathered over 1 year, can turn $100,000 into $1,022,000, placing Bot2Stock on par with existing botnet scams.

Orphaned file fragment carving is concerned with recovering contents of encoded data in the absence of any coding metadata. Constructing an orphaned file carver requires addressing three challenges: a specialized decoder to interpret partial file data; the ability to discriminate a specific type of encoded data from all other types of data; and comprehensive prior knowledge on possible encoding settings. In this work, we build on the ability to render a partial image contained within a segment of JPEG coded data to introduce a new carving tool that addresses all these challenges. Towards this goal, we first propose a new method that discriminates JPEG file data from among 993 file data types with 97.7% accuracy. We also introduce a method for robustly delimiting entropy coded data segments of JPEG files. This in turn allows us to identify partial JPEG file headers with zero false rejection and 0.1% of false alarm rate. Secondly, we examine a very diverse image set comprising more than 7 million images. This ensures comprehensive coverage of coding parameters used by 3,269 camera models and a wide variety of image editing tools. Further, we assess the potential impact of the developed tool on practice in terms of the amount of new evidence that it can recover. Recovery results on a set of used SD cards purchased online show that our carver is able to recover 24% more image data as compared to existing file carving tools. Evaluations performed on a standard dataset also show that JpgScraper improves the state-of-the-art significantly in carving JPEG file data.

File carving techniques allow for recovery of files from storage devices in the absence of any file system metadata. When data are encoded and compressed, the current paradigm of carving requires the knowledge of the compression and encoding settings to succeed. In this paper, we advance the state of the art in JPEG file carving by introducing the ability to recover fragments of a JPEG file when the associated file header is missing. To realize this, we examined JPEG file headers of a large number of images collected from Flickr photo sharing site to identify their structural characteristics. Our carving approach utilizes this information in a new technique that performs two tasks. First, it decompresses the incomplete file data to obtain a spatial domain representation. Second, it determines the spatial domain parameters to produce a perceptually meaningful image. Recovery results on a variety of JPEG file fragments show that given the knowledge of Huffman code tables, our technique can very reliably identify the remaining decoder settings for all fragments of size 4 KiB or above. Although errors due to detection of image width, placement of image blocks, and color and brightness adjustments can occur, these errors reduce significantly when fragment sizes are >32 KiB.

Transmission power control has paramount importance in the design of energy-efficient wireless sensor networks (WSNs). In this paper, we systematically explore the effects of various transmission power control strategies on WSN lifetime with an emphasis on discretization of power levels and strategies for transmission power assignment. We investigate the effects of the granularity of power levels on energy dissipation characteristics through a linear programming framework by modifying a well known and heavily utilized continuous transmission power model (HCB model). We also investigate various transmission power assignment strategies by using two sets of experimental data on Mica motes. A novel family of mathematical programming models are developed to analyze the performance of these strategies. Bandwidth requirements of the proposed transmission power assignment strategies are also investigated. Numerical analysis of our models are performed to characterize the effects of various design parameters and to comparethe relative performance of transmission power assignment strategies. Our results show that the granularity of discrete energy consumption has a profound impact on WSN lifetime, furthermore, more fine-grained control of transmission power (i.e., link level control) can extend network lifetime up to 20% in comparison to optimally-assigned network-level single transmission power.