An official website of the United States government
GitGuardian monitored secrets exposure in public GitHub repositories and reported that developers leaked over 12 million secrets (database and other credentials) in 2023, indicating a 113% surge from 2021. Despite the availability of secret detection tools, developers ignore the tools' reported warnings because of false positives (25%−99%). However, each secret protects assets of different values accessible through asset identifiers (a DNS name and a public or private IP address). The asset information for a secret can aid developers in filtering false positives and prioritizing secret removal from the source code. However, existing secret detection tools do not provide the asset information, thus presenting difficulty to developers in filtering secrets only by looking at the secret value or finding the assets manually for each reported secret. The goal of our study is to aid software practitioners in prioritizing secrets removal by providing the assets information protected by the secrets through our novel static analysis tool. We present AssetHarvester, a static analysis tool to detect secret-asset pairs in a repository. Since the location of the asset can be distant from where the secret is defined, we investigated secret-asset co-location patterns and found four patterns. To identify the secret-asset pairs of the four patterns, we utilized three approaches (pattern matching, data flow analysis, and fast-approximation heuristics). We curated a benchmark of 1,791 secret-asset pairs of four database types extracted from 188 public GitHub repositories to evaluate the performance of AssetHarvester. AssetHarvester demonstrates precision of (97%), recall (90 %), and F1-score (94 %) in detecting secret-asset pairs. Our findings indicate that data flow analysis employed in AssetHarvester detects secret-asset pairs with 0 % false positives and aids in improving the recall of secret detection tools. Additionally, AssetHarvester shows 43 % increase in precision for database secret detection compared to existing detection tools through the detection of assets, thus reducing developer's alert fatigue.
more »
« less
Secret messaging with endogenous chemistry
Abstract Data encoded in molecules offers opportunities for secret messaging and extreme information density. Here, we explore how the same chemical and physical dimensions used to encode molecular information can expose molecular messages to detection and manipulation. To address these vulnerabilities, we write data using an object’s pre-existing surface chemistry in ways that are indistinguishable from the original substrate. While it is simple to embed chemical information onto common objects (covers) using routine steganographic permutation, chemically embedded covers are found to be resistant to detection by sophisticated analytical tools. Using Turbo codes for efficient digital error correction, we demonstrate recovery of secret keys hidden in the pre-existing chemistry of American one dollar bills. These demonstrations highlight ways to improve security in other molecular domains, and show how the chemical fingerprints of common objects can be harnessed for data storage and communication.
more »
« less
- Award ID(s):
- 1941344
- PAR ID:
- 10283845
- Date Published:
- Journal Name:
- Scientific Reports
- Volume:
- 11
- Issue:
- 1
- ISSN:
- 2045-2322
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Particle tracking is commonly used to study time-dependent behavior in many different types of physical and chemical systems involving constituents that span many length scales, including atoms, molecules, nanoparticles, granular particles, and even larger objects. Behaviors of interest studied using particle tracking information include disorder-order transitions, thermodynamic phase transitions, struc- tural transitions, protein folding, crystallization, gelation, swarming, avalanches and fracture. A common challenge in studies of these systems involves change detection. Change point detection discerns when a temporal signal undergoes a change in distribution. These changes can be local or global, instantaneous or prolonged, obvious or subtle. Moreover, system-wide changes marking an interesting physical or chemical phenomenon (e.g. crystallization of a liquid) are often preceded by events (e.g. pre-nucleation clusters) that are localized and can occur anywhere at anytime in the system. For these reasons, detecting events in particle trajectories generated by molecular simulation is challenging and typically accomplished via ad hoc solutions unique to the behavior and system under study. Consequently, methods for event detec- tion lack generality, and those used in one field are not easily used by scientists in other fields. Here we present a new Python-based tool, dupin, that allows for universal event detection from particle trajectory data irrespective of the system details. dupin works by creating a signal representing the simulation and partitioning the signal based on events (changes within the trajectory). This approach allows for studies where manual annotating of event boundaries would require a prohibitive amount of time. Furthermore, dupin can serve as a tool in automated and reproducible workflows. We demonstrate the application of dupin using two examples and discuss its applicability to a wider class of problems.more » « less
-
With the rapid growth in the number of IoT devices that have wireless communication capabilities, and sensitive information collection capabilities, it is becoming increasingly necessary to ensure that these devices communicate securely with only authorized devices. A major requirement of this secure communication is to ensure that both the devices share a secret, which can be used for secure pairing and encrypted communication. Manually imparting this secret to these devices becomes an unnecessary overhead, especially when the device interaction is transient. In this paper, we empirically investigate the possibility of using an out-of-band communication channel -- vibration, generated by a custom smart ring, to share a secret with a smart IoT device. This exchanged secret can be used to bootstrap a secure wireless channel over which the devices can communicate. We believe that in future IoT devices can use such a technique to seamlessly connect with authorized devices with minimal user interaction overhead. In this paper, we specifically investigate (a) the feasibility of using vibration generated by a custom wearable for communication, (b) the effect of various parameters on this communication channel, and (c) the possibility of information manipulation by an adversary or information leakage to an adversary. For this investigation, we conducted a controlled study as well as a user study with 12 participants. In the controlled study, we could successfully share messages through vibrations with a bit error rate of less than 2.5%. Additionally, through the user study we demonstrate that it is possible to share messages with various types of objects accurately, quickly and securely as compared to several existing techniques. Overall, we find that in the best case we can exchange 85.9% messages successfully with a smart device.more » « less
-
Abstract Exoplanet and brown dwarf atmospheres commonly show signs of disequilibrium chemistry. In the James Webb Space Telescope (JWST) era, high-resolution spectra of directly imaged exoplanets will allow the characterization of their atmospheres in more detail, and allow systematic tests for the presence of chemical species that deviate from thermochemical equilibrium in these atmospheres. Constraining the presence of disequilibrium chemistry in these atmospheres as a function of parameters such as their effective temperature and surface gravity will allow us to place better constraints on the physics governing these atmospheres. This paper is part of a series of works presenting the Sonora grid of atmosphere models. In this paper, we present a grid of cloud-free, solar metallicity atmospheres for brown dwarfs and wide-separation giant planets with key molecular species such as CH 4 , H 2 O, CO, and NH 3 in disequilibrium. Our grid covers atmospheres with T eff ∈ [500 K, 1300 K], log g ∈ [3.0, 5.5] (cgs) and an eddy diffusion parameter of log K zz = 2 , 4 and 7 (cgs). We study the effect of different parameters within the grid on the temperature and composition profiles of our atmospheres. We discuss their effect on the near-infrared colors of our model atmospheres and the detectability of CH 4 , H 2 O, CO, and NH 3 using the JWST. We compare our models against existing MKO and Spitzer observations of brown dwarfs and verify the importance of disequilibrium chemistry for T dwarf atmospheres. Finally, we discuss how our models can help constrain the vertical structure and chemical composition of these atmospheres.more » « less
-
Lithic Use-Wear Analysis (LUWA) using microscopic images is an underexplored vision-for-science research area. It seeks to distinguish the worked material, which is critical for understanding archaeological artifacts, material interactions, tool functionalities, and dental records. However, this challenging task goes beyond the well-studied image classification problem for common objects. It is affected by many confounders owing to the complex wear mechanism and microscopic imaging, which makes it difficult even for human experts to identify the worked material successfully. In this paper, we investigate the following three questions on this unique vision task for the first time:(i) How well can state-of-the-art pre-trained models (like DINOv2) generalize to the rarely seen domain? (ii) How can few-shot learning be exploited for scarce microscopic images? (iii) How do the ambiguous magnification and sensing modality influence the classification accuracy? To study these, we collaborated with archaeologists and built the first open-source and the largest LUWA dataset containing 23,130 microscopic images with different magnifications and sensing modalities. Extensive experiments show that existing pretrained models notably outperform human experts but still leave a large gap for improvements. Most importantly, the LUWA dataset provides an underexplored opportunity for vision and learning communities and complements existing image classification problems on common objects.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Journal Article:
- https://doi.org/10.1038/s41598-021-92987-2
