This is the full version of the paper published at IEEE European Symposium on Security and Privacy (Euro S&P) 2018. We have completed reporting to service providers impacted by this novel threat, and several web services and browsers actually improved their security implements. We will shortly release their great efforts
This paper presents a practical side-channel attack that identifies the social web service account of a visitor to an attacker's website. Our attack leverages the widely adopted user-blocking mechanism, abusing its inherent property that certain pages return different web content depending on whether a user is blocked from another user. Our key insight is that an account prepared by an attacker can hold an attacker-controllable binary state of blocking/non-blocking with respect to an arbitrary user on the same service; provided that the user is logged in to the service, this state can be retrieved as one-bit data through the conventional cross-site timing attack when a user visits the attacker's website. We generalize and refer to such a property as visibility control, which we consider as the fundamental assumption of our attack. Building on this primitive, we show that an attacker with a set of controlled accounts can gain a complete and flexible control over the data leaked through the side channel. Using this mechanism, we show that it is possible to design and implement a robust, large-scale user identification attack on a wide variety of social web services. To verify the feasibility of our attack, we perform an extensive empirical study using 16 popular social web services and demonstrate that at least 12 of these are vulnerable to our attack. Vulnerable services include not only popular social networking sites such as Twitter and Facebook, but also other types of web services that provide social features, e.g., eBay and Xbox Live. We also demonstrate that the attack can achieve nearly 100% accuracy and can finish within a sufficiently short time in a practical setting. We discuss the fundamental principles, practical aspects, and limitations of the attack as well as possible defenses.
Scalable Edge Blocking Algorithms for Defending Active Directory Style Attack Graphs
Active Directory（AD）是Windows域网络的默认安全管理系统。AD环境自然地描述了攻击图，其中节点表示计算机/帐户/安全组，并且边表示允许攻击者从一个节点获得对另一个节点的访问的现有访问/已知利用。受实际AD用例的启发，我们研究了一个攻击者和一个防御者之间的Stackelberg游戏。有多个入口节点供攻击者选择，并且有一个目标（域管理员）。每条边都有失败率。攻击者选择成功率最大的攻击路径。防守者可以阻挡有限数量的边（即，撤销访问）。防御者的目标是最小化攻击者的成功率。我们利用实际AD图的树状性来设计可扩展的算法。我们提出了两种新的方法，结合理论的固定参数分析和实际的优化技术。对于树宽度较小的图，我们提出了一个基于树分解的动态规划。然后，我们提出了一个通用的方法转换树分解为基础的动态程序的强化学习环境，这导致了一个随时算法，规模更好，但失去了最优性保证。对于具有少量非分裂路径的图（我们专门为AD图发明的参数），我们提出了一种核化技术，该技术可以显着缩小模型，然后通过混合整数规划来解决。实验上，我们的算法可以扩展到处理具有数万个节点的合成AD图。
Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
Harmless Yet Harmful: Neutral Prompting Attacks for Stealthy Hallucination Steering in Agent Skills
Department of Computer Science（计算机科学系）；National Yang Ming Chiao Tung University（阳明交通大学）；Department of Electronics and Electrical Engineering（电子与电气工程系）；School of Computing（计算学院）；Institute of Science Tokyo（东京科学研究所）
D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting
University of California, Berkeley（加州大学伯克利分校）；International Computer Science Institute（国际计算机科学研究所）；University of California, Riverside（加州大学河滨分校）；Lawrence Berkeley National Laboratory（伯克利国家实验室）
Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；RealAI；Tsinghua University（清华大学）
Strategic Deflection: Defending LLMs from Logit Manipulation
International Artificial Intelligence Center of Morocco（摩洛哥国际人工智能中心）；Mohammed VI Polytechnic University（摩洛哥穆莱·伊斯梅尔理工学院）；AgriEdge；Sorbonne University, LIP6 - UMR 7606 CNRS（索邦大学，LIP6 - UMR 7606 CNRS）
Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection
Beijing Jiaotong University（北京交通大学）；Mohamed bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；INRIA Rennes-Bretagne-Atlantique（法国国家信息与自动化研究所雷恩-布列塔尼-大西洋分所）；Xi’an Jiaotong University（西安交通大学）
