Meet Caesar

Our new dog, Caesar


http://gfycat.com/KindUncommonChital

My PhD Thesis - Client-Centric Identity and Access Management in Cloud Computing

You can find a version of my PhD thesis on the JKU website. My PhD thesis is titled Client-Centric Identity and Access Management in Cloud Computing. I will post both the English and German Abstracts before linking the embedded version of the thesis.

My Master Thesis - New Threats in Cloud Computing

I was unable to publish my master thesis because of a 5-year non diusclosure agreement with the company the sponsored me. Since that agreement expired you can have a look over my master thesis, entitled: New Threats in Cloud Computing - With focus on Cloud Misuse and Cloud Vulnerabilities from the Client Side

Security issue with Joomla 1.6

Joomla is a well-known, widely used open source CMS. According to their website, 2.7 percent of the Web is running on Joomla. Its small download size, easy installation and easy to use interface make it a top choice for a fast development of a website. If you also add the fact that it runs on a PHP/MySQL environment and that it supports a wide variety of plugins, you can see why Joomla is so appreciated.

I have recently used Joomla for a website I was developing these past few months. I must say that if you are thinking of using it for deploying a website fast and easily I would recommend it. However, it is my personal opinion that to get a great look and fell as well as to add some more complex functionalities you would need some basic CSS/HTML/PHP knowledge. For more complex functionalities you will actually need to go in the source code sometimes which entails a good if not excellent understanding of PHP. The good part is that, being open source, there is a detailed documentation as well as a large community which can help you if you run into any problems.

While I was working on the website I discovered a very interesting bug which turned out to be a very big security flaw. Note that this applies if you have more than one user with admin privileges or which can access the global configuration component in the administrator backend. 

Image based authentication

I found a very interesting paper about a very different authentication method as opposed to what is used today. The basic idea is to forget about passwords and rather select a set of images that will be presented to a user when he wants to log in together with a set of decoy images. The user selects the appropriate images and the login is done via selecting only the correct images.

They claim that this system is more useful then traditional username-password mechanisms as it is easier for a person to remember images rather then complicated text. They also claim that "password" recovery would be made easier via this method. It would have been nice to see some well-known services using such a system. However, to my knowledge, no such authentication methods are in use. 

Furthermore, such a system would render password managers obsolete, as, from what I understood in the paper, it would be very hard to store the images used for login. And to prevent the same type of problems that exists in password based systems you would have to choose different images. Maybe for just one account this would be great, but for multiple user accounts it would be hard. 

I would really like some opinions of such an authentication method. Please feel free to comment.

Dropbox drops security

I came across a very interesting piece of news today. For about 4 hours you could log in to a Dropbox account using only  the username and with any password. This, once again, brings back to light the main problem in Cloud Computing: The loss of control. As a user, you are totally dependent on the Cloud Provider (in this case Dropbox) to manage your data. It's a great most of the time, as you don't have to bother with all configurations - including security. But it does have its downside. If the Provider does some bad PooPoo you have no way of protecting the data. 

On a personal note, I think Hussein Fahmy, Amalia Brad and I are especially proud of the fact that we foresaw something like this occurring. In my master thesis, "New Threats in Cloud Computing With focus on Cloud Misuse and Cloud Vulnerabilities from the Client Side", I actually presented a threat called Isolation Failure. The presumption was exactly what happened with Dropbox. An attacker somehow manages to gain access to the data stored on the cloud due to a vulnerability in the Cloud Provider. At that point, it was all based on presumptions as no such case had yet happened. Until now. What happened to Dropbox is exactly the way I described the scenario in my Thesis. I am particularly happy of the solution described in Lifehacker as I gave the same solution to the threat in my thesis. So, in essence Dropbox just gave me a proof of concept for one of my suggested Threats.

I am curious to see what the repercussions of this "accident" will be. Will people actually listen and start to also think of the client-side of Cloud Computing? Will providers also inform clients that their data is not entirely safe? Will they inform them that malware on their machine will still leave to data-loss? 

When I first began my studies in this field I was a bit unsure as to the feasibility and need to provide security on the Client-Side when using Cloud Computing. Now, more than ever, I am convinced that I have chosen the correct path in my studies.

Finally I am eager to find out what just happened? Dropbox says they “ made a code update”. From where I’m standing it’s a code downgrade. Did they just comment the part of the code that checked the credentials of the user? As far as I know, Dropbox is built on top of Amazon S3 so I am also wondering if this vulnerability was propagated there as well. Anyways, I am looking forward to seeing what exactly happened. 

KeePass Password Safe

As promised in a previous post, I am now going to further detail KeePass and give some arguments on why I like using it. For more information please refer to the KeePass website.

So, what is KeePass? KeePass is an open source password manager. This means it's a free application used to store user credentials. However, once you begin using it, you will find it can do much more than just store passwords. The nice thing about KeePass is that you can find a build/implementation for just about any OS out there. The different implementations are available for download here. Note that there is also a portable version if you don't have access rights to install the application, or if you wish to keep the entire application on an USB stick.

How KeePass works

Keep your friends close and your passwords closer

With the continued growth of internet usage more and more people face a challenging problem. The more frequent you visit different websites, the greater the change you will have to create some account for that particular website. Gone are the good all days when you had just one account (email) and one password for your Windows/Linux/Mac. There is a mis-attributed quotation from Bill Gates "640K ought to be enough for anybody". I wonder if it refers to 640K of user credentials. Because honestly, while I'm not quite there, I don't have much to go.

At last…my greatest work…COMPLETED!!!!!

Finally, after months of endless work I finished writing my master thesis. It was not easy, but I fought it on the beaches, I fought it on the landing grounds, in the fields, in the streets and in the hills around Hagenberg. And I never surrendered. All that is left now is the defense of the thesis.

So, let me tell you a little bit about the topic of the thesis. My thesis title is “New Threats in Cloud Computing”. In it, we propose new threats that can arise from a SME (Small and Medium Enterprise) using Cloud Computing. The focus was on Client-Side threats especially pertaining to data leakage. I propose 12 threats in this thesis. I also propose some abstract solutions for mitigating these threats.

The thesis is about 130 pages long and contains a chapter about Cloud Computing, a chapter about Security in Cloud Computing, the problem statement and methodology, the suggested threats and a chapter about certain solution methods.

Unfortunately, it appears that I would not be able to post the thesis online because of legal issues with the company that funded my studies in ISI. 

My Bachelor Thesis – Web Image Processing

I will now post my Bachelor Thesis entitled “Web Image Processing”.

Welcome To My Blog

June 1^st 1996. That’s the first day I ever watched a program in English. I remember it like it was yesterday. That was the day we first had cable. Before that, all I saw was TVR 1. I spent the whole day watching Cartoon Network. Those were the good old days. No money to worry about, no stress with school and most certainly no thesis to finish. After a while my father would watch movies and would see people using remote controls. As we did not have such magical devices, he would often say: “Those lazy capitalists! They can’t be bothered to get up and change the channel”. The funny thing is that nowadays we have so many remote controls in our home that sometimes we still change channels manually, since we can’t find the proper remote.

It was the same thing when we first got Internet. This time it was my mother who did not understand why we need Internet. Now days she spends a lot of time talking to people on Skype and reading newspapers. Thank God she doesn't know how to use Facebook yet !!!

Finally, not to be outdone, I had the same feeling with Facebook. I failed to see the point of it. That’s why, for a long time I had no account. Today, of course, I use Facebook and I must say that I like it. It’s interesting to see what other people are doing and thinking.

The thing is I had the same feeling about blogging. So, coming from the above mentioned family tradition, I decided give it a try. So, what will I post? Well all sorts of things. Starting from study/work related things, to funny images and jokes and of course philosophical discussions.

I really hope that you will have as much fun reading this blog, as I have writing it.