Docsis attacks
17362994
Transferability in Machine Learning: from Phenomena to Black Box Attacks using Adversarial Samples
Many machine learning models are vulnerable to adversarial examples: inputs that are specially crafted to cause a machine learning model to produce an incorrect output. Adversarial examples that affect one model often affect another model, even if the two models have different architectures or were trained on different training sets, so long as both models were trained to perform the same task. An attacker may therefore train their own substitute model, craft adversarial examples against the substitute, and transfer them to a victim model, with very little information about the victim. Recent work has further developed a technique that uses the victim model as an oracle to label a synthetic training set for the substitute, so the attacker need not even collect a training set to mount the attack. We extend these recent techniques using reservoir sampling to greatly enhance the efficiency of the training procedure for the substitute model. We introduce new transferability attacks between previously unexplored (substitute, victim) pairs of machine learning model classes, most notably SVMs and decision trees. We demonstrate our attacks on two commercial machine learning classification systems from Amazon (96.19% misclassification rate) and Google (88.94% using only 800 queries of the victim model, thereby showing that existing machine learning approaches are in general vulnerable to systematic black box attacks regardless of their structure.
ArXiv
Nicolas Papernot Patrick Mcdaniel Ian J Goodfellow
6060248
Ex Machina: Personal Attacks Seen at Scale
The damage personal attacks cause to online discourse motivates many platforms to try to curb the phenomenon. However, understanding the prevalence and impact of personal attacks in online platforms at scale remains surprisingly difficult. The contribution of this paper is to develop and illustrate a method that combines crowdsourcing and machine learning to analyze personal attacks at scale. We show an evaluation method for a classifier in terms of the aggregated number of crowd workers it can approximate. We apply our methodology to English Wikipedia, generating a corpus of over 100k high quality human labeled comments and 63M machine labeled ones from a classifier that is as good as the aggregate of 3 crowd workers, as measured by the area under the ROC curve and Spearman correlation. Using this corpus of machine labeled scores, our methodology allows us to explore some of the open questions about the nature of online personal attacks. This reveals that the majority of personal attacks on Wikipedia are not the result of a few malicious users, nor primarily the consequence of allowing anonymous contributions from unregistered users.
WWW
Ellery Wulczyn Nithum Thain Lucas Dixon
7497070
Malware Guard Extension: Using SGX to Conceal Cache Attacks
In modern computer systems, user processes are isolated from each other by the operating system and the hardware. Additionally, in a cloud scenario it is crucial that the hypervisor isolates tenants from other tenants that are co located on the same physical machine. However, the hypervisor does not protect tenants against the cloud provider and thus the supplied operating system and hardware. Intel SGX provides a mechanism that addresses this scenario. It aims at protecting user level software from attacks from other processes, the operating system, and even physical attackers.
DIMVA
Michael Schwarz Samuel Weiser Daniel Gruss Clementine Maurice Stefan Mangard
14321358
Practical Black Box Attacks against Deep Learning Systems using Adversarial Examples
Advances in deep learning have led to the broad adoption of Deep Neural Networks (DNNs) to a range of important machine learning problems, e.g. guiding autonomous vehicles, speech recognition, malware detection. Yet, machine learning models, including DNNs, were shown to be vulnerable to adversarial samples subtly (and often humanly indistinguishably) modified malicious inputs crafted to compromise the integrity of their outputs. Adversarial examples thus enable adversaries to manipulate system behaviors. Potential attacks include attempts to control the behavior of vehicles, have spam content identified as legitimate content, or have malware identified as legitimate software. Adversarial examples are known to transfer from one model to another, even if the second model has a different architecture or was trained on a different set. We introduce the first practical demonstration that this cross model transfer phenomenon enables attackers to control a remotely hosted DNN with no access to the model, its parameters, or its training data. In our demonstration, we only assume that the adversary can observe outputs from the target DNN given inputs chosen by the adversary. We introduce the attack strategy of fitting a substitute model to the input output pairs in this manner, then crafting adversarial examples based on this auxiliary model. We evaluate the approach on existing DNN datasets and real world settings. In one experiment, we force a DNN supported by MetaMind (one of the online APIs for DNN classifiers) to mis classify inputs at a rate of 84.24% We conclude with experiments exploring why adversarial samples transfer between DNNs, and a discussion on the applicability of our attack when targeting machine learning algorithms distinct from DNNs.
ArXiv
Nicolas Papernot Patrick Mcdaniel Ian J Goodfellow Somesh Jha Z Berkay Celik Ananthram Swami
207241700
Accessorize to a Crime: Real and Stealthy Attacks on State of the Art Face Recognition
Machine learning is enabling a myriad innovations, including new algorithms for cancer diagnosis and self driving cars. The broad use of machine learning makes it important to understand the extent to which machine learning algorithms are subject to attack, particularly when used in applications where physical security or safety is at risk. In this paper, we focus on facial biometric systems, which are widely used in surveillance and access control. We define and investigate a novel class of attacks: attacks that are physically realizable and inconspicuous, and allow an attacker to evade recognition or impersonate another individual. We develop a systematic method to automatically generate such attacks, which are realized through printing a pair of eyeglass frames. When worn by the attacker whose image is supplied to a state of the art face recognition algorithm, the eyeglasses allow her to evade being recognized or to impersonate another individual. Our investigation focuses on white box face recognition systems, but we also demonstrate how similar techniques can be used in black box scenarios, as well as to avoid face detection.
CCS
Mahmood Sharif Sruti Bhagavatula Lujo Bauer Michael K Reiter
4316147
Generating Adversarial Malware Examples for Black Box Attacks Based on GAN
Machine learning has been used to detect new malware in recent years, while malware authors have strong motivation to attack such algorithms. Malware authors usually have no access to the detailed structures and parameters of the machine learning models used by malware detection systems, and therefore they can only perform black box attacks. This paper proposes a generative adversarial network (GAN) based algorithm named MalGAN to generate adversarial malware examples, which are able to bypass black box machine learning based detection models. MalGAN uses a substitute detector to fit the black box malware detection system. A generative network is trained to minimize the generated adversarial examples' malicious probabilities predicted by the substitute detector. The superiority of MalGAN over traditional gradient based adversarial example generation algorithms is that MalGAN is able to decrease the detection rate to nearly zero and make the retraining based defensive method against adversarial examples hard to work.
ArXiv
Weiwei Hu Ying Tan
15494854
A Survey of Attacks on Ethereum Smart Contracts (SoK)
Smart contracts are computer programs that can be correctly executed by a network of mutually distrusting nodes, without the need of an external trusted authority. Since smart contracts handle and transfer assets of considerable value, besides their correct execution it is also crucial that their implementation is secure against attacks which aim at stealing or tampering the assets. We study this problem in Ethereum, the most well known and used framework for smart contracts so far. We analyse the security vulnerabilities of Ethereum smart contracts, providing a taxonomy of common programming pitfalls which may lead to vulnerabilities. We show a series of attacks which exploit these vulnerabilities, allowing an adversary to steal money or cause other damage.
POST
Nicola Atzei Massimo Bartoletti Tiziana Cimoli
35426171
Certified Defenses for Data Poisoning Attacks
Machine learning systems trained on user provided data are susceptible to data poisoning attacks, whereby malicious users inject false training data with the aim of corrupting the learned model. While recent work has proposed a number of attacks and defenses, little is understood about the worst case loss of a defense in the face of a determined attacker. We address this by constructing approximate upper bounds on the loss across a broad family of attacks, for defenders that first perform outlier removal followed by empirical risk minimization. Our approximation relies on two assumptions: (1) that the dataset is large enough for statistical concentration between train and test error to hold, and (2) that outliers within the clean (non poisoned) data do not have a strong effect on the model. Our bound comes paired with a candidate attack that often nearly matches the upper bound, giving us a powerful tool for quickly assessing defenses on a given dataset. Empirically, we find that even under a simple defense, the MNIST 1 7 and Dogfish datasets are resilient to attack, while in contrast the IMDB sentiment dataset can be driven from 12% to 23% test error by adding only 3% poisoned data.
NIPS
Jacob Steinhardt Pang Wei Koh Percy Liang
25552129
Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2
We introduce the key reinstallation attack. This attack abuses design or implementation flaws in cryptographic protocols to reinstall an already in use key. This resets the key's associated parameters such as transmit nonces and receive replay counters. Several types of cryptographic Wi Fi handshakes are affected by the attack. All protected Wi Fi networks use the 4 way handshake to generate a fresh session key. So far, this 14 year old handshake has remained free from attacks, and is even proven secure. However, we show that the 4 way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already in use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value. Our key reinstallation attack also breaks the PeerKey, group key, and Fast BSS Transition (FT) handshake. The impact depends on the handshake being attacked, and the data confidentiality protocol in use. Simplified, against AES CCMP an adversary can replay and decrypt (but not forge) packets. This makes it possible to hijack TCP streams and inject malicious data into them. Against WPA TKIP and GCMP the impact is catastrophic: packets can be replayed, decrypted, and forged. Because GCMP uses the same authentication key in both communication directions, it is especially affected. Finally, we confirmed our findings in practice, and found that every Wi Fi device is vulnerable to some variant of our attacks. Notably, our attack is exceptionally devastating against Android 6.0: it forces the client into using a predictable all zero encryption key.
CCS
M Vanhoef Frank Piessens
24830580
Active Queue Management (AQM) Based on Proportional Integral Controller Enhanced PIE) for Data Over Cable Service Interface Specifications (DOCSIS) Cable Modems
Cable modems based on Data Over Cable Service Interface Specifications (DOCSIS) provide broadband Internet access to over one hundred million users worldwide. In some cases, the cable modem connection is the bottleneck (lowest speed) link between the customer and the Internet. As a result, the impact of buffering and bufferbloat in the cable modem can have a significant effect on user experience. The CableLabs DOCSIS 3.1 specification introduces requirements for cable modems to support an Active Queue Management (AQM) algorithm that is intended to alleviate the impact that buffering has on latency sensitive traffic, while preserving bulk throughput performance. In addition, the CableLabs DOCSIS 3.0 specifications have also been amended to contain similar requirements. This document describes the requirements on AQM that apply to DOCSIS equipment, including a description of the "DOCSIS PIE" algorithm that is required on DOCSIS 3.1 cable modems.
RFC
Greg White Rong Pan