Motivated by the transformative impact of deep neural networks (DNNs) in various domains, researchers and anti-virus vendors have proposed DNNs for malware detection from raw bytes that do not require manual feature engineering. In this work, we propose an attack that interweaves binary-diversification techniques and optimization frameworks to mislead such DNNs while preserving the functionality of binaries. Unlike prior attacks, ours manipulates instructions that are a functional part of the binary, which makes it particularly challenging to defend against. We evaluated our attack against three DNNs in white- and black-box settings, and found that it often achieved success rates near 100%. Moreover, we found that our attack can fool some commercial anti-viruses, in certain cases with a success rate of 85%. We explored several defenses, both new and old, and identified some that can foil over 80% of our evasion attempts. However, these defenses may still be susceptible to evasion by attacks, and so we advocate for augmenting malware-detection systems with methods that do not rely on machine learning.

Users struggle to adhere to expert-recommended security and privacy practices. While prior work has studied initial adoption of such practices, little is known about the subsequent implementation and abandonment. We conducted an online survey (n=902) examining the adoption and abandonment of 30 commonly recommended practices. Security practices were more widely adopted than privacy and identity theft protection practices. Manual and fully automatic practices were more widely adopted than practices requiring recurring user interaction. Participants' gender, education, technical background, and prior negative experience are correlated with their levels of adoption. Furthermore, practices were abandoned when they were perceived as low-value, inconvenient, or when users overrode them with subjective judgment. We discuss how security, privacy, and identity theft protection recommendations and tools can be better aligned with user needs.

Private communication detection (PCD) is a traffic-analysis technique whereby an ordinary user of a communication network exploits side channels in end-point devices to observe the busy/idle activity status of targeted users. Correlations of users' activity status allows collection of communication records that reveal private relationships. PCD techniques have been demonstrated for a number of communication technologies, such as Wi-Fi and VoIP, and their effectiveness shown even when the communication network is private; i.e., it provides content confidentiality, flow anonymity, and user pseudonymity. In this paper, we present a mathematical model of PCD that captures the activity status of two targets in a private VoIP network, including the probing process of an attacker that aims to breach their communication anonymity. Using this model, we a) develop fundamental bounds on PCD accuracy; b) measure the anonymity leakage in terms of the amount of call record information obtained in an attack; and c) provide performance guarantees and compare the efficacy of different PCD countermeasures, such as resource randomization and use of firewalls.

We examine the side-channel information leakage in first-come-first-serve (FCFS) packet schedulers. In this setup, an attacker aims to learn the packet arrival pattern of a private user that shares a FCFS packet scheduler with him, using the queuing delay information of his own packets. Under an information-theoretic metric for information leakage, we identify the optimal non-adaptive strategy for a given average probe rate of the attacker and report upto 1000% increase in information leakage compared to the attack strategy analyzed in the literature with the same average probe rate. The search for optimal strategies is reduced to linear programming, implying that the discovery of such strategies is in the domain of a real-world attacker.

We propose a probabilistic key distribution protocol for vehicular network that alleviates the burden of traditional public-key infrastructures. Roadside units act as trusted nodes and are used for secret-sharing among vehicles in their vicinity. Secure communication is immediately possible between these vehicles with high probability. Our performance evaluation, which uses both analysis and simulation, shows that high reliability and short dissemination time can be achieved with low complexity.