{"id":533,"date":"2016-01-22T05:40:27","date_gmt":"2016-01-22T05:40:27","guid":{"rendered":"http:\/\/www.inforsec.org\/wp\/?p=533"},"modified":"2016-01-29T10:04:20","modified_gmt":"2016-01-29T10:04:20","slug":"perplexed-messengers-from-the-cloud-automated-security-analysis-of-push-messaging-integrations","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=533","title":{"rendered":"Perplexed Messengers from the Cloud: Automated Security Analysis of Push-Messaging Integrations"},"content":{"rendered":"\n\n\n
Title: <\/strong>Perplexed Messengers from the Cloud: Automated Security Analysis of Push-Messaging Integrations
\nTime<\/strong>: <\/strong>2016\u5e741\u670827\u65e5(\u5468\u4e09), \u4e0a\u534810:00-11:30
\nSpeaker<\/strong>: <\/strong>\u9648\u607a, \u4e2d\u79d1\u9662\u4fe1\u5de5\u6240
\nVenue: <\/strong>\u4e2d\u79d1\u9662\u8ba1\u7b97\u6240446\u4f1a\u8bae\u5ba4\uff0c\u5317\u4eac\u5e02\u6d77\u6dc0\u533a\u79d1\u5b66\u9662\u5357\u8def6\u53f7
\nOrganizer: <\/b>\u4e2d\u79d1\u9662\u8ba1\u7b97\u6240 \u6b66\u6210\u5c97\u8001\u5e08\uff0cwucg[AT]ict.ac.cn<\/span><\/td>\n		\"Kang\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u62a5\u544a\u6458\u8981<\/strong>\uff1a<\/p>\n

We report a large-scale, systematic study on the security qualities of emerging push-messaging services, focusing on their app-side service integrations. We identified a set of security properties different push messaging services (e.g., Google Cloud Messaging) need to have, and automatically verified them in different integrations using a new tool, called Seminal. Using this tool, we studied 30 leading services around the world, and scanned 35,173 apps. Our findings are astonishing: over 20% apps in Google Play and 50% apps in mainstream Chinese app markets are riddled with security-critical loopholes, putting a huge amount of sensitive user data at risk. Also, our research brought to light new types of security flaws never known before, which can be exploited to cause serious confusions among popular apps and services (e.g., Facebook, Skype, Yelp, Baidu Push). Taking advantage of such confusions, the adversary can post his content to the victim\u2019s apps in the name of trusted parties and intercept her private messages.<\/p>\n

<\/p>\n

\u4e3b\u8bb2\u4eba\u7b80\u4ecb\uff1a<\/p>\n

\u9648\u607a\uff1a2010\u5e74\u4e8e\u4e2d\u56fd\u79d1\u5b66\u9662\u7814\u7a76\u751f\u9662\u83b7\u535a\u58eb\u5b66\u4f4d\uff0c\u7f8e\u56fd\u5bbe\u5dde\u5927\u5b66\u535a\u58eb\u540e\uff0c\u76ee\u524d\u4e3a\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u4fe1\u606f\u5b89\u5168\u56fd\u5bb6\u91cd\u70b9\u5b9e\u9a8c\u5ba4\u526f\u7814\u7a76\u5458\uff0c\u4e3b\u8981\u7814\u7a76\u9886\u57df\u5305\u62ec\u8f6f\u4ef6\u5b89\u5168\u3001\u667a\u80fd\u7ec8\u7aef\u5b89\u5168\u3001\u5b89\u5168\u6d4b\u8bc4\u548c\u9690\u79c1\u4fdd\u62a4\u3002\u66fe\u4e3b\u6301\u548c\u53c2\u52a0\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1\u3001863\u8ba1\u5212\u3001\u4e2d\u79d1\u9662\u6218\u7565\u6027\u5148\u5bfc\u79d1\u6280\u4e13\u9879\u3001\u90e8\u59d4\u9879\u76ee\u7b49\u8bfe\u989820\u4f59\u9879\uff1b\u5728USENIX Security, ACM CCS\u3001ICSE\u3001ASE\u3001IEEE Trans on Reliability\u3001\u300a\u4e2d\u56fd\u79d1\u5b66\u300b\u7b49\u672c\u9886\u57df\u91cd\u8981\u520a\u7269\u548c\u4f1a\u8bae\u4e0a\u53d1\u8868\u8bba\u658740\u4f59\u7bc7\uff0c\u591a\u6b21\u5728\u56fd\u9645\u5b66\u672f\u4f1a\u8bae\u4e0a\u505a\u5927\u4f1a\u62a5\u544a\uff1b\u83b7\u5f97\u4e0e\u7533\u8bf7\u4e13\u522912\u9879\uff1b\u300aIEEE Trans on Dependable and Secure Computing\u300b\u3001\u300aComputers & Security\u300b\u7b49SCI\u671f\u520a\u8bc4\u5ba1\u4e0eAsiaCCS\u7b49\u591a\u4e2a\u56fd\u9645\u4f1a\u8bae\u59d4\u5458\u4f1a\u6210\u5458\u3002\u4e3b\u9875\uff1ahttp:\/\/www.kaichen.org<\/a><\/p>\n

\u8bba\u6587\uff08PDF\uff09<\/a>\uff0c\u6f14\u8bb2Slides<\/a><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Title: Perplexed Messengers from the Cloud: Automa… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-533","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=533"}],"version-history":[{"count":14,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/533\/revisions"}],"predecessor-version":[{"id":566,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/533\/revisions\/566"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=533"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}