Export Citations
Save this search
Please login to be able to save your searches and receive alerts for new content matching your search criteria.
- research-articleJuly 2024
How to evade modern web cryptojacking detection tools? A review of practical findings
ARES '24: Proceedings of the 19th International Conference on Availability, Reliability and SecurityJuly 2024, Article No.: 83, Pages 1–10https://doi.org/10.1145/3664476.3670936One of the foundations of cryptocurrencies based on proof-of-work consensus is mining. This is an activity which consumes a lot of computational resources, so malicious actors introduce cryptojacking malware to exploit users computers and in result use ...
- research-articleJuly 2024
What All the PHUZZ Is About: A Coverage-guided Fuzzer for Finding Vulnerabilities in PHP Web Applications
ASIA CCS '24: Proceedings of the 19th ACM Asia Conference on Computer and Communications SecurityJuly 2024, Pages 1523–1538https://doi.org/10.1145/3634737.3661137Coverage-guided fuzz testing has received significant attention from the research community, with a strong focus on binary applications, greatly disregarding other targets, such as web applications. The importance of the World Wide Web in everyone's life ...
- research-articleJuly 2024
FakeX: A Framework for Detecting Fake Reviews of Browser Extensions
ASIA CCS '24: Proceedings of the 19th ACM Asia Conference on Computer and Communications SecurityJuly 2024, Pages 769–784https://doi.org/10.1145/3634737.3656999Browser extensions boost user experience on the web. Similarly to smartphone app stores, browsers like Chrome distribute browser extensions via their Web Store, enabling a thriving market of third-party developed extensions. The Web Store incorporates a ...
- research-articleJuly 2024
RootFree Attacks: Exploiting Mobile Platform's Super Apps From Desktop
ASIA CCS '24: Proceedings of the 19th ACM Asia Conference on Computer and Communications SecurityJuly 2024, Pages 830–842https://doi.org/10.1145/3634737.3645001In recent years, there has been a surge in the popularity of mobile super apps, which consolidate a variety of services, including messaging, ride-hailing, and e-commerce, into a single application, eliminating the need to switch between different apps. ...
- research-articleJune 2024
Web Application Security: A Pragmatic Exposé
Digital Threats: Research and Practice (DTRAP), Volume 5, Issue 2Article No.: 20, Pages 1–9https://doi.org/10.1145/3644394Many individuals, organizations, and industries rely on web applications for the daily operations of their businesses. With the increasing deployment and dependence on these applications, significant attention has been directed toward developing more ...
-
- short-paperJune 2024
WikiPhish: A Diverse Wikipedia-Based Dataset for Phishing Website Detection: Data/Toolset Paper
CODASPY '24: Proceedings of the Fourteenth ACM Conference on Data and Application Security and PrivacyJune 2024, Pages 361–366https://doi.org/10.1145/3626232.3653283Phishing remains a pervasive security threat, necessitating effective and universally comparable detection systems. The use of supervised machine learning models for phishing detection has been generalized in the literature to automate predictions and ...
- research-articleJune 2024
Nothing Personal: Understanding the Spread and Use of Personally Identifiable Information in the Financial Ecosystem
- Mehrnoosh Zaeifi,
- Faezeh Kalantari,
- Adam Oest,
- Zhibo Sun,
- Gail-Joon Ahn,
- Yan Shoshitaishvili,
- Tiffany Bao,
- Ruoyu Wang,
- Adam Doupé
CODASPY '24: Proceedings of the Fourteenth ACM Conference on Data and Application Security and PrivacyJune 2024, Pages 55–65https://doi.org/10.1145/3626232.3653266Online services leverage various authentication methods with differing usability and reliability trade-offs, such as password-based or multi-factor authentication (MFA). However, financial service providers face a unique challenge; authenticating the ...
- research-articleJune 2024
Analysis of Security Mechanisms of Dark Web Markets
EICC '24: Proceedings of the 2024 European Interdisciplinary Cybersecurity ConferenceJune 2024, Pages 120–127https://doi.org/10.1145/3655693.3655700As the name implies, the dark web market – also commonly known as the anonymous market – has put measures for protecting the privacy of its users as a key priority. With the rapid growth of the dark web market, competition between markets has become ...
AdFlush: A Real-World Deployable Machine Learning Solution for Effective Advertisement and Web Tracker Prevention
WWW '24: Proceedings of the ACM Web Conference 2024May 2024, Pages 1902–1913https://doi.org/10.1145/3589334.3645698Conventional ad blocking and tracking prevention tools often fall short in addressing web content manipulation. Machine learning approaches have been proposed to enhance detection accuracy, yet aspects of practical deployment have frequently been ...
The Matter of Captchas: An Analysis of a Brittle Security Feature on the Modern Web
- Behzad Ousat,
- Esteban Schafir,
- Duc C. Hoang,
- Mohammad Ali Tofighi,
- Cuong V. Nguyen,
- Sajjad Arshad,
- Selcuk Uluagac,
- Amin Kharraz
WWW '24: Proceedings of the ACM Web Conference 2024May 2024, Pages 1835–1846https://doi.org/10.1145/3589334.3645619The web ecosystem is a fast-paced environment. In this dynamic landscape, new security features are offered one after another to enhance the security and robustness of web applications and the operations they handle. This paper focuses on a fragile but ...
Unveiling the Invisible: Detection and Evaluation of Prototype Pollution Gadgets with Dynamic Taint Analysis
WWW '24: Proceedings of the ACM Web Conference 2024May 2024, Pages 1800–1811https://doi.org/10.1145/3589334.3645579Prototype-based languages like JavaScript are susceptible to prototype pollution vulnerabilities, enabling an attacker to inject arbitrary properties into an object's prototype. The attacker can subsequently capitalize on the injected properties by ...
- research-articleMay 2024
Phishing Vs. Legit: Comparative Analysis of Client-Side Resources of Phishing and Target Brand Websites
WWW '24: Proceedings of the ACM Web Conference 2024May 2024, Pages 1756–1767https://doi.org/10.1145/3589334.3645535Phishing attacks have persistently remained a prevalent and widespread cybersecurity threat for several years. This leads to numerous endeavors aimed at comprehensively understanding the phishing attack ecosystem, with a specific focus on presenting new ...
- research-articleJuly 2024
Automated Web Security Testing Guide Mapping to Accelerate Process on Penetration Testing
Procedia Computer Science (PROCS), Volume 234, Issue C2024, Pages 1412–1419https://doi.org/10.1016/j.procs.2024.03.140AbstractUsage of website is increasing due to its ease of access. An increase in website users should be accompanied by an increase in website security to prevent unwanted things, such as data breach. Penetration testing is used to reduce risk due to ...
- research-articleJune 2024
Lessons learned from studying third-party data leaks in web services
ICISE '23: Proceedings of the 2023 8th International Conference on Information Systems EngineeringDecember 2023, Pages 125–129https://doi.org/10.1145/3641032.3641043The rise of digitalization has led to a surge in the utilization of web services. Online services offer a convenient way to carry out many everyday tasks. However, third-party web analytics used in many essential web services cause privacy issues as ...
- research-articleNovember 2023
Entangled Clouds: Measuring the Hosting Infrastructure of the Free Contents Web
CCSW '23: Proceedings of the 2023 on Cloud Computing Security WorkshopNovember 2023, Pages 75–87https://doi.org/10.1145/3605763.3625274Free content websites (FCWs) are a critical part of the Internet, and understanding them is essential for their wide use. This study statistically explores the distribution of free content websites globally by analyzing their hosting network scale, ...
- ArticleDecember 2023
- research-articleNovember 2023
You Call This Archaeology? Evaluating Web Archives for Reproducible Web Security Measurements
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications SecurityNovember 2023, Pages 3168–3182https://doi.org/10.1145/3576915.3616688Given the dynamic nature of the Web, security measurements on it suffer from reproducibility issues. In this paper we take a systematic look into the potential of using web archives for web security measurements. We first evaluate an extensive set of web ...
- research-articleNovember 2023
Read Between the Lines: Detecting Tracking JavaScript with Bytecode Classification
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications SecurityNovember 2023, Pages 3475–3489https://doi.org/10.1145/3576915.3616637Browsers and extensions that aim to block online ads and tracking scripts predominantly rely on rules from filter lists for determining which resource requests must be blocked. These filter lists are often manually curated by a community of online users. ...
- research-articleNovember 2023
Finding All Cross-Site Needles in the DOM Stack: A Comprehensive Methodology for the Automatic XS-Leak Detection in Web Browsers
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications SecurityNovember 2023, Pages 2456–2470https://doi.org/10.1145/3576915.3616598Cross-Site Leaks (XS-Leaks) are a class of vulnerabilities that allow a web attacker to infer user state from a target web application cross-origin. Fixing XS-Leaks is a cat-and-mouse game: once a published vulnerability is fixed, a variant is ...
- research-articleNovember 2023
CookieGraph: Understanding and Detecting First-Party Tracking Cookies
CCS '23: Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications SecurityNovember 2023, Pages 3490–3504https://doi.org/10.1145/3576915.3616586As third-party cookie blocking is becoming the norm in mainstream web browsers, advertisers and trackers have started to use first-party cookies for tracking. To understand this phenomenon, we conduct a differential measurement study with versus without ...