CERIAS Blog

The following papers created one-way functions on words for resilient information hiding in text, first one through synonym substitutions, second one through typos: "The hiding virtues of ambiguity: quantifiably resilient watermarking of natural language text through synonym substitutions", U. Topkara et. al. MMSec'06 https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/2006-61.pdf "Information hiding through errors: A confusing approach", M.Topkara et. al. SPIE'07 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.94.1426

There isn't a clear answer to that but here's what Gene Spafford wrote in 2006: > So where did the “change passwords once a month” dictum come from? Back in the days when people were using mainframes without networking, the biggest uncontrolled authentication concern was cracking. Resources, however, were limited. As best as I can find, some DoD contractors did some back-of-the-envelope calculation about how long it would take to run through all the possible passwords using their mainframe, and the result was several months. So, they (somewhat reasonably) set a password change period of 1 month as a means to defeat systematic cracking attempts. This was then enshrined in policy, which got published, and largely accepted by others over the years. As time went on, auditors began to look for this and ended up building it into their “best practice” that they expected. It also got written into several lists of security recommendations. > This is DESPITE the fact that any reasonable analysis shows that a monthly password change has little or no end impact on improving security! It is a “best practice” based on experience 30 years ago with non-networked mainframes in a DoD environment—hardly a match for today’s systems, especially in academia! https://www.cerias.purdue.edu/site/blog/post/password-change-myths/P25… I've heard variations on this idea which all stem back to that same kind of scenario of a DoD facility where things like access were limited and, for…

Sorry, but this is ridiculously bad. So the point here is that they say QUIC doesn't do length hiding. Okay. This is not a secret, but okay, you can point that out. However then they go on that they don't know (because they haven't checked) whether the same is true for TLS. It is. It's been published as the HTTPS Bicycle attack. Writing "we strongly encourage other researchers to study TLS version 1.2 to see if Ring-Road exists" is comical under this circumstances. The university's press release tries to spin this as a google bug: https://www.cerias.purdue.edu/site/blog/post/purdue_cerias_researchers… Which is... quite a stretch, given that QUIC just has the very same behavior as TLS. It almost makes you think they haven't checked TLS to be able to spin this as a "google vuln" story. Then they recommend to disable QUIC. Which will do... nothing to mitigate this vuln, because of course the browser will just fall back to normal HTTPS with TLS - which has the same vuln, but hey, they haven't checked.

A nit: we've known about the flaw since 1993 (see https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/94-05.pdf)

Smart move. That technique was used in the Poly2 project among others: https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/01254339.pdf http://projects.cerias.purdue.edu/poly2/ Ever since I saw eCos OS, I wanted every OS to come with both the ability and a GUI tool to just check off all the features I want, compile kernel with just those features, and create installer for that kernel. Current tech in repos should even let one create that configuration automatically based on what packages they wanted or have already installed in a sample system (eg bare metal or VM). Could also use program analysis where features are dropped if they're not called and/or info from security policies like SELinux for further constraints.

The other link posted here confirms they use the length to select popular passwords of that length. See "step 2": http://www.cerias.purdue.edu/site/blog/post/purdue_cerias_researchers_… It doesn't say how they get the Gmail address to correlate back to the known length password though. I see the "light on details" reasoning, but it doesn't go well with the sensationalist "1 in 10 Gmail users." Surely Google doesn't allow high rate guessing, they must throttle or temporarily disable targeted accounts.

Purdue CERIAS Researchers Find Vulnerability in Google Protocol https://www.cerias.purdue.edu/site/blog/post/purdue_cerias_researchers…

If I read this recent (post-Snowden) blog post of spaf's correctly, he hasn't: https://www.cerias.purdue.edu/site/blog/post/just_sayin/ Though he notes that his armored car quip is approaching 20 years old, dating back to the dark days of Windows 95. Perhaps the better way to think about it is: encryption is necessary but not sufficient. If the NSA has extruded its tentacles into sufficient endpoints (operating systems? firmware? antivirus software?) that's a problem that encryption won't by itself solve. Hey, I'm channeling RMS: free software is the real solution! Unless the NSA's tentacles extend to the compiler you use to compile the free software. :)

Cool! One other fun approach may be to use syntactic transformation (topicalization, middle field ordering, etc.) or lexical variation (e.g. through synonyms): https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/PSI000441.pdf The advantage of such an approach is that you can use coherent text/messages.

That doesn't sound trite. At Purdue CERIAS, the philosophy and linguistics departments are official granters of its Information Security masters degree, along with the technology school. http://www.cerias.purdue.edu/site/education/graduate_program/interdisc…

I've looked into this a bit. There are three programs that I'm aware of: The BitBlaze project at UC Berkeley. http://bitblaze.cs.berkeley.edu/ There's also http://www.cs.kent.ac.uk/people/staff/amk/ which offers a PhD studentship in "Reverse Engineering for Security." CERIAS at Purdue will definitely have some RE related courses, e.g. http://www.cerias.purdue.edu/site/projects/detail/malware_reverse_engi…

This, of course, is a form of digital watermarking in for textual data. Due to unique problems, natural language watermarking and steganography is not advanced or is covered as much as image, video, and audio watermarking. For one thing, it is impossible to make changes to text that are udetectable by consumers, as in images; all changes introduce meaning shifts. If you want to dig deeper, here's one of the rare introductory papers on the subject: https://www.cerias.purdue.edu/tools_and_resources/bibtex_archive/archi…