Speaker: Zulfikar Ramzan
Date: Wednesday, 25 April
Time: talk 12-1, discussion 1-1:30 (lunch provided)
Place: Maxwell Dworkin 119

Title:
The Current State of Phishing Attacks

Abstract:
Phishing is the act of sending a fake email, to a user, appearing to originate from a legitimate institution with which the user transacts (e.g., their bank, credit card company, etc). The email directs the user to a spoofed web site and asks for sensitive information (e.g., usernames/passwords, credit card numbers, bank account numbers, social security numbers, etc.); in the hands of a malicious party, leaking this sensitive information is very dangerous. While it used to be easy to tell apart a phishing attempt from a legitimate email, phishers have started to using techniques of ever-increasing sophistication. As a result, phishing has catapulted into a major component of the new threat landscape.

This talk will survey the current state of phishing attacks, leveraging real-world data obtained through Symantec’s data collection fabric. We will describe:

- The overall magnitude of the threat, including seasonal & day-of-week effects, geographic distinctions, spoofed brand segmentation, and geographic/population targets;
- The latest trends in attacks that have actually been mounted and how
phishers are trying to circumvent existing countermeasures.

The talk will be self contained and assumes no prior knowledge of the phishing threat.

Speaker: Ben Adida, Harvard CRCS
Date: Wednesday, 18 April
Time: talk 12-1, discussion 1-1:30 (lunch provided)
Place: Maxwell Dworkin 119

Title:
Web (2.0) Security

Abstract:
The emergence of complex collaborative web applications, so-called “web
2.0″, presents a number of fascinating security challenges. In the mad rush
to create ever more useful applications, developers walk a very fine line,
tricking browsers and finding ways around existing security constraints
while attempting to protect users’ private data. The mashup trend, where
different web applications are combined on the fly, is of particular
interest here: mashups provide fascinating new features yet present the most
challenging security problems.

In this talk, we’ll review classic and advanced web security issues and
recent application-level exploits. We’ll then discuss some proposals for
improving the state of secure web application development. Discussion is
strongly encouraged, as this talk will not attempt to provide an
all-encompassing solution.

Speaker: Stephen McCamant, MIT
Date: Wednesday, 11 April
Time: talk 12-1, discussion 1-1:30 (lunch provided)
Place: Maxwell Dworkin 2nd floor lounge

Title: Quantitative Information-Flow Tracking for Type-Unsafe Languages

Abstract:
I’ll describe a new technique for determining how much information about a program’s secret inputs is revealed by its public outputs. The technique tracks programs’ use of data through arbitrary calculations using a fine-grained dynamic bit-tracking analysis, and measures the information revealed during a particular execution. The technique accounts for “implicit flows”, situations in which secret data has an indirect influence via branches or pointer operations. Two kinds of untrusted annotation, which mark independent sub-computations and compact data representations, improve the precision of the analysis. We’ve performed case studies on real C, C++, and Objective C programs of up to half a million lines of code. Our tool checked multiple security policies, including one that was violated by a previously unknown bug. I’ll also outline how a new simulation-based proof technique can be used to check that the technique soundly accounts for all flows in an execution.

CRCS now has a Video Release for people who speak at our luncheons.

Speaker: Gary McGraw, Cigital
Date: Wednesday, 4 April
Time: talk 12-1, discussion 1-1:30 (lunch provided)
Place: Maxwell Dworkin 119

Title: Exploiting Online Games

Abstract:
This talk (based on a book of the same title co-authored by Greg Hoglund) frankly describes controversial security issues surrounding MMORPGs such as World of Warcraft. This no-holds-barred approach is fully loaded with code examples, debuggers, bots, and hacks. If you are a gamer, a game developer, a software security person or an interested bystander, this book exposes the inner workings of online game security for all to see. In the talk, I will cover:
* Why online games are a harbinger of software security issues to come
* How millions of gamers have created billion dollar virtual economies
* How game companies invade your privacy
* Why some gamers cheat
* Techniques for breaking online game security
* How to build a bot to play a game for you
* Methods for total conversion and advanced mods
Ultimately, this talk is mostly about security problems associated with advanced massively distributed software. With hundreds of thousands of interacting users, today’s online games are a bellwether of modern software yet to come. The kinds of attack and defense techniques I describe are tomorrow’s security techniques on display today.

BIO
Gary McGraw is the CTO of Cigital, Inc., a software security and quality consulting firm with headquarters in the Washington, D.C. area. He is a globally recognized authority on software security and the author of six best selling books on this topic. The latest, Software Security: Building Security In was released in 2006, with Exploiting Online Games slated for release this year. His other titles include Java Security, Building Secure Software, and Exploiting Software; and he is editor of the Addison-Wesley Software Security series. Dr. McGraw has also written over 90 peer-reviewed scientific publications, authors a monthly security column for darkreading.com, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Fortify Software and Raven White. His dual PhD is in Cognitive Science and Computer Science from Indiana University where he serves on the Dean’s Advisory Council for the School of Informatics. Gary is an IEEE Computer Society Board of Governors member and produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine