Code Pointer Masking (CPM) is a novel countermeasure against code injection attacks on native code. By enforcing the correct semantics of code pointers, CPM thwarts attacks that modify code pointers to divert the application’s control flow. It does not rely on secret values such as stack canaries and protects against attacks that are not addressed by state-of-the-art countermeasures of similar performance. This article reports on two prototype implementations on very distinct processor architectures, showing that the idea behind CPM is portable. The evaluation also shows that the overhead of using our countermeasure is very small and the security benefits are substantial.

External storage devices, such as USB-sticks, SD-cards, or other flash memory devices, are widely used today. These devices may pose a threat if they contain sensitive data and are then lost or forgotten somewhere. Usability of existing encryption solutions for such external storage media is limited because of the need to reenter keys or authentication credentials every time the media is plugged to a different device. We present a solution to the usability problem by caching the key with time delayed deletion. We implemented two variations of this concept. One solution does not require any explicit user interaction, thus limiting the use of the external storage device to short term data transfer, only. The second solution allows multiple encryption keys for different files of the file system to be managed on a trusted host, using the timed key caching to avoid handing out keys or passwords.

Code injections attacks are one of the most powerful and important classes of attacks on software. In such attacks, the attacker sends malicious input to a software application, where it is stored in memory. The malicious input is chosen in such a way that its representation in memory is also a valid representation of a machine code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine code. A typical action of the injected code is to launch a command interpreter shell, and hence the malicious input is often called shellcode.

In ubiquitous computing environments access control decisions have to be adaptable to changes of the situation or state of an entity, in order to properly adjust to these changes without the need of manual interaction. A solution to this challenge is context-aware access control, where the mentioned changes are influencing access control decisions. In this paper we present a security framework for mobile business applications that is capable of performing context-aware access control on message level. There are several components in the framework that together (1) ensure that security requirements defined in policies are enforced in the framework, (2) provide context information and apply plausibility checks to increase the confidence that context information represents the actual situation or state (context) of an entity, and (3) perform the access-control decisions based on a combination of classic access control schemes and context information. In addition, a scenario is described where the introduced features of the framework are applied