activity
20122024
most citedOff-Path Attacking the Web

26 citations · 48 across the 7 of their papers we have counts for

collaborators

7 papers

cs.DC2024★ 10 cited

Practical Rateless Set Reconciliation

Lei Yang, Yossi Gilad, Mohammad Alizadeh

Set reconciliation, where two parties hold fixed-length bit strings and run a protocol to learn the strings they are missing from each other, is a fundamental task in many distribu…

cs.CR2022

Device Tracking via Linux's New TCP Source Port Selection Algorithm (Extended Version)

Moshe Kol, Amit Klein, Yossi Gilad

We describe a tracking technique for Linux devices, exploiting a new TCP source port generation mechanism recently introduced to the Linux kernel. This mechanism is based on an alg…

cs.NI2022★ 3 cited

Coded Transaction Broadcasting for High-throughput Blockchains

Lei Yang, Yossi Gilad, Mohammad Alizadeh

High-throughput blockchains require efficient transaction broadcast mechanisms that can deliver transactions to most network nodes with low bandwidth overhead and latency. Existing…

cs.CR2014★ 7 cited

Securing Smartphones: A Micro-TCB Approach

Yossi Gilad, Amir Herzberg, Ari Trachtenberg

As mobile phones have evolved into `smartphones', with complex operating systems running third- party software, they have become increasingly vulnerable to malicious applications (…

cs.CR2013★ 1 cited

Off-Path Hacking: The Illusion of Challenge-Response Authentication

Yossi Gilad, Amir Herzberg, Haya Shulman

Everyone is concerned about the Internet security, yet most traffic is not cryptographically protected. The usual justification is that most attackers are only off-path and cannot…

cs.CR2012★ 1 cited

TCP Injections for Fun and Clogging

Yossi Gilad, Amir Herzberg

We present a new type of clogging DoS attacks, with the highest amplification factors achieved by off-path attackers, using only puppets, i.e., sandboxed malware on victim machines…

cs.CR2012★ 26 cited

Off-Path Attacking the Web

Yossi Gilad, Amir Herzberg

We show how an off-path (spoofing-only) attacker can perform cross-site scripting (XSS), cross-site request forgery (CSRF) and site spoofing/defacement attacks, without requiring v…