Cloud Speicherdienste als Angriffsvektoren.

based on our Usenix Security 2011 Paper (Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space), we will present some recent updates at the Sicherheitskonferenz Krems

We will teach a course in the summer school in Italy…

Manuel found and reported a vulnerability. Excerpt from the changelog (Piwik 1.6): “Security: we would like to thank the following people for their responsible disclosure: [...] Secure Business Austria [...] Thank you to all these people for disclosing security issues to the Piwik team, ensuring a healthy and safe experience for the whole community!“

We present a short overview of security issue in cloud-based storage services at conect’s Webinar series “Security & Risk Management” (more…)

Securing XML archives for Search Based Applications (Talk by John Tait; Oct 19; 10am SBA)

There has been a recent trend to produce what are known as Search Based Applications. One strand of this work is based on the observation that many organisation keep legacy transaction orientated systems up and running in order to allow information contained in those systems to continue to be accessed for audit and security purposes. This is quite different from the high transaction volumes the systems were originally designed for. So for example a credit card might keep an obsolete retailer and customer service applciation up and running purely so security investigators can accessed historic customer transaction patterns via ad hoc SQL queries.

A better solution would be to archive the data in the transaction system to an XML store, and then use enterprise text search systems, like Lucene or Bing/FAST to provide the query facilities. However, this raises the question, does the XML data actually represent the data previously held in the transaction system, or has the data been altered in some way.

The seminar will discuss the security issues search based applications raises and seek to work with the audience to find ways forward with those issues.

Clemens Kolbitsch recently finished his PhD  supervised by Engin Kirda and Chris Kruegel. Tomorrow, he will present his paper “The Power of Procrastination: Detection and Mitigation of Execution-Stalling Malicious Code” at CCS 2011. Clemens will shortly join our partner company TLLOD.

Manuel Leithner presented weaknesses of Facebook, WLANs and Smartphones on ORF (ORF, youtube).

Edgar Weippl presents the Usenix paper at the Conect Event on Security (overview, details, schedule).