26 citations · 78 across the 11 of their papers we have counts for
10 papers · 1 filter
Automatic Detection of Fake Key Attacks in Secure Messaging
Tarun Kumar Yadav, Devashish Gosain, Amir Herzberg +2
Popular instant messaging applications such as WhatsApp and Signal provide end-to-end encryption for billions of users. They rely on a centralized, application-specific server to d…
Botnets Breaking Transformers: Localization of Power Botnet Attacks Against the Distribution Grid
Lynn Pepin, Lizhi Wang, Jiangwei Wang +5
Traditional botnet attacks leverage large and distributed numbers of compromised internet-connected devices to target and overwhelm other devices with internet packets. With increa…
Securing Smartphones: A Micro-TCB Approach
Yossi Gilad, Amir Herzberg, Ari Trachtenberg
As mobile phones have evolved into `smartphones', with complex operating systems running third- party software, they have become increasingly vulnerable to malicious applications (…
Off-Path Hacking: The Illusion of Challenge-Response Authentication
Yossi Gilad, Amir Herzberg, Haya Shulman
Everyone is concerned about the Internet security, yet most traffic is not cryptographically protected. The usual justification is that most attackers are only off-path and cannot…
Unilateral Antidotes to DNS Cache Poisoning
Amir Herzberg, Haya Shulman
We investigate defenses against DNS cache poisoning focusing on mechanisms that can be readily deployed unilaterally by the resolving organisation, preferably in a single gateway o…
TCP Injections for Fun and Clogging
Yossi Gilad, Amir Herzberg
We present a new type of clogging DoS attacks, with the highest amplification factors achieved by off-path attackers, using only puppets, i.e., sandboxed malware on victim machines…
Security of Patched DNS
Amir Herzberg, Haya Shulman
In spite of the availability of DNSSEC, which protects against cache poisoning even by MitM attackers, many caching DNS resolvers still rely for their security against poisoning on…
Fragmentation Considered Poisonous
Amir Herzberg, Haya Shulman
We present practical poisoning and name-server block- ing attacks on standard DNS resolvers, by off-path, spoofing adversaries. Our attacks exploit large DNS responses that cause I…
Off-Path Attacking the Web
Yossi Gilad, Amir Herzberg
We show how an off-path (spoofing-only) attacker can perform cross-site scripting (XSS), cross-site request forgery (CSRF) and site spoofing/defacement attacks, without requiring v…
Stealth-MITM DoS Attacks on Secure Channels
Amir Herzberg, Haya Shulman
We define stealth Man-in-the-Middle adversaries, and analyse their ability to launch denial and degradation of service (DoS) attacks on secure channels. We show realistic attacks,…