syssec_red_book

Bibliography[108] J. Bonneau, C. Herley, P. C. v. Oorschot, and F. Stajano. The quest to replace passwords: Aframework for comparative evaluation of web authentication schemes. In Proceedings of the2012 IEEE Symposium on Security and Privacy, pages 553–567, 2012.[109] Y. Boshmaf, I. Muslukhov, K. Beznosov, and M. Ripeanu. The socialbot network: when botssocialize for fame and money. In Proceedings of the Annual Computer Security ApplicationsConference. ACM, 2011.[110] E. Bosman, A. Slowinska, and H. Bos. Minemu: The World’s Fastest Taint Tracker. InProceedings of 14th International Symposium on Recent Advances in Intrusion Detection, RAID’11,2011.[111] P. Boykin and V. Roychowdhury. Leveraging social networks to fight spam. Computer,38(4):61–68, Apr. 2005.[112] C. Braz, A. Seffah, and D. MŠRaihi. Designing a trade-off between usability and security:A metrics based-model. Human-Computer Interaction–INTERACT 2007, pages 114–126, 2007.[113] T. Bukowski. ZeuS v3 P2P Network Monitoring, 2012. Technical Report by CERT.pl.[114] Bulba and Kil3r. Bypassing StackGuard and StackShield. Phrack, 10(56), 2001.[115] BullGuard. Security predictions for 2013. Internet. http://blog.bullguard.com/2013/01/bullguards-security-predictions-for-2013.html, 2013.[116] P.-M. Bureau. Same Botnet, Same Guys, New Code: Win32/Kelihos. In VirusBulletin, 2011.[117] J. J. C. Cowan, S. Beattie and P. Wagle. Pointguard: Protecting pointers from buffer overflowvulnerabilities. In Proceedings of the 12 th USENIX Security Symposium, August 2003.[118] C. Cadar, D. Dunbar, and D. Engler. KLEE: Unassisted and automatic generation of highcoveragetests for complex systems programs. In Proceedings of the 8th USENIX Symposiumon Operating Systems Design and Implementation, OSDI’08, 2008.[119] J. Carr. Inside Cyber Warfare. Mapping the Cyber Underworld. O’Reilly Media, Dec. 2011.[120] C. Castillo. Spitmo vs Zitmo: Banking Trojans Target Android, Sept. 2011. http://blogs.mcafee.com/mcafee-labs/spitmo-vs-zitmo-banking-trojans-target-android.[121] L. Cavallaro, P. Saxena, and R. Sekar. On the limits of information flow techniques formalware analysis and containment. In DIMVA, pages 143–163, 2008.[122] D. Chappell. Introducing Windows CardSpace. msdn, April 2006. http://msdn.microsoft.com/en-us/library/aa480189.aspx.[123] S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, S. Savage, K. Koscher,A. Czeskis, F. Roesner, and T. Kohno. Comprehensive experimental analyses of automotiveattack surfaces. In Proceedings of the 20th USENIX Security Symposium, 2011.[124] S. Chen, J. Xu, E. C. Sezer, P. Gauriar, and R. K. Iyer. Non-control-data attacks are realisticthreats. In Proceedings of the 14th USENIX Security Symposium, 2005.[125] W. Cheng, Q. Zhao, B. Yu, and S. Hiroshige. TaintTrace: Efficient Flow Tracing withDynamic Binary Rewriting. In Proc. of ISCC, pages 749–754, 2006.[126] W. Cheswick. Rethinking passwords. Communications of the ACM, 56(2):40–44, 2013.[127] E. Chien, L. OMurchu, and N. Falliere. W32.Duqu: the precursor to the next stuxnet. InUSENIX conference on Large-Scale Exploits and Emergent Threats. USENIX Association, Apr.2012.[128] V. Chipounov, V. Kuznetsov, and G. Candea. S2E: A platform for in vivo multi-path analysisof software systems. In Proceedings of the 16th Intl. Conference on Architectural Support forProgramming Languages and Operating Systems, ASPLOS’11, 2011.[129] L. S. Clair, L. Johansen, W. Enck, M. Pirretti, P. Traynor, P. McDaniel, and T. Jaeger. Passwordexhaustion: Predicting the end of password usefulness. In A. Bagchi and V. Atluri, editors,ICISS, volume 4332 of Lecture Notes in Computer Science, pages 37–55. Springer, 2006.170