Search

In late 2017, a sudden proliferation of malicious JavaScript was reported on the Web: browser-based mining exploited the CPU time of website visitors to mine the cryptocurrency Monero. Several studies measured the deployment of such code and developed defenses. However, previous work did not establish how many users were really exposed to the identified mining sites and whether there was a real risk given common user browsing behavior. In this paper, we present a retroactive analysis to close this research gap. We pool large-scale, longitudinal data from several vantage points, gathered during the prime time of illicit cryptomining, to measure the impact on web users. We leverage data from passive traffic monitoring of university networks and a large European ISP, with suspected mining sites identified in previous active scans. We corroborate our results with data from a browser extension with a large user base that tracks site visits. We also monitor open HTTP proxies and the Tor network for malicious injection of code. We find that the risk for most Web users was always very low, much lower than what deployment scans suggested. Any exposure period was also very brief. However, we also identify a previously unknown and exploited attack vector on mobile devices.

The Einstein Telescope (ET) is a proposed next-generation, underground gravitational-wave (GW) detector to be based in Europe. It will provide about an order of magnitude sensitivity increase with respect to currently operating detectors, and furthermore, extend the observation band towards lower frequencies, i.e., down to about 3Hz. One of the first decisions that needs to be made is about the future ET site following an in-depth site characterization. Site evaluation and selection is a complicated process, which takes into account science, financial, political, and socio-economic criteria. In this paper, we provide an overview of the site-selection criteria for ET, provide a formalism to evaluate the direct impact of environmental noise on ET sensitivity, and outline the necessary elements of a site-characterization campaign., Comment: 22 pages, 3 figures

A new class of quasilinear reaction-diffusion equations is introduced for which the mass flow never reaches the boundary. It is proved that the initial value problem is well-posed in an appropriate weighted Sobolev space setting.

Compact symmetric spaces are probably one of the most prominent class of formal spaces, i.e. of spaces where the rational homotopy type is a formal consequence of the rational cohomology algebra. As a generalisation, it is even known that their isotropy action is equivariantly formal. In this article we show that $(\mathbb{Z}_2\oplus \mathbb{Z}_2)$-symmetric spaces are equivariantly formal and formal in the sense of Sullivan, in particular. Moreover, we give a short alternative proof of equivariant formality in the case of symmetric spaces with our new approach., Comment: to appear in JTA

String obfuscation is an established technique used by proprietary, closed-source applications to protect intellectual property. Furthermore, it is also frequently used to hide spyware or malware in applications. In both cases, the techniques range from bit-manipulation over XOR operations to AES encryption. However, string obfuscation techniques/tools suffer from one shared weakness: They generally have to embed the necessary logic to deobfuscate strings into the app code. In this paper, we show that most of the string obfuscation techniques found in malicious and benign applications for Android can easily be broken in an automated fashion. We developed StringHound, an open-source tool that uses novel techniques that identify obfuscated strings and reconstruct the originals using slicing. We evaluated StringHound on both benign and malicious Android apps. In summary, we deobfuscate almost 30 times more obfuscated strings than other string deobfuscation tools. Additionally, we analyzed 100,000 Google Play Store apps and found multiple obfuscated strings that hide vulnerable cryptographic usages, insecure internet accesses, API keys, hard-coded passwords, and exploitation of privileges without the awareness of the developer. Furthermore, our analysis reveals that not only malware uses string obfuscation but also benign apps make extensive use of string obfuscation., Comment: to appear in ASIA CCS 20, Taipei, Taiwan

We show that a simple piecewise-linear system with time delay and periodic forcing gives rise to a rich bifurcation structure of torus bifurcations and Arnold tongues, as well as multistability across a significant portion of the parameter space. The simplicity of our model enables us to study the dynamical features analytically. Specifically, these features are explained in terms of border-collision bifurcations of an associated Poincar\'e map. Given that time delay and periodic forcing are common ingredients in mathematical models, this analysis provides widely applicable insight., Comment: 13 pages, 7 figures

As an application of the theory of linear parabolic differential equations on noncompact Riemannian manifolds, developed in earlier papers, we prove a maximal regularity theorem for nonuniformly parabolic boundary value problems in Euclidean spaces. The new feature of our result is the fact that, besides of obtaining an optimal solution theory, we consider the `natural' case where the degeneration occurs only in the normal direction., Comment: 21 pages

We give a characterization of those Alexandrov spaces admitting a cohomogeneity one action of a compact connected Lie group $G$ for which the action is Cohen--Macaulay. This generalizes a similar result for manifolds to the singular setting of Alexandrov spaces where, in contrast to the manifold case, we find several actions which are not Cohen--Macaulay. In fact, we present results in a slightly more general context. We extend the methods in this field by a conceptual approach on equivariant cohomology via rational homotopy theory using an explicit rational model for a double mapping cylinder., Comment: Theorem A generalized, examples added to show it is sharp

We provide several results on the existence of metrics of non-negative sectional curvature on vector bundles over certain cohomogeneity one manifolds and homogeneous spaces up to suitable stabilization. Beside explicit constructions of the metrics, this is achieved by identifying equivariant structures upon these vector bundles via a comparison of their equivariant and non-equivariant K-theory. For this, in particular, we transcribe equivariant K-theory to equivariant rational cohomology and investigate surjectivity properties of induced maps in the Borel fibration via rational homotopy theory., Comment: Version accepted for publication in Advances in Mathematics

An action of a compact Lie group is called equivariantly formal, if the Leray--Serre spectral sequence of its Borel fibration degenerates at the E_2-term. This term is as prominent as it is restrictive. In this article, also motivated by the lack of junction between the notion of equivariant formality and the concept of formality of spaces (surging from rational homotopy theory) we suggest two new variations of equivariant formality: "MOD-formal actions" and "actions of formal core". We investigate and characterize these new terms in many different ways involving various tools from rational homotopy theory, Hirsch--Brown models, $A_\infty$-algebras, etc., and, in particular, we provide different applications ranging from actions on symplectic manifolds and rationally elliptic spaces to manifolds of non-negative sectional curvature. A major motivation for the new definitions was that an almost free action of a torus $T^n\curvearrowright X$ possessing any of the two new properties satisfies the toral rank conjecture, i.e. $dim H^*(X;Q)\geq 2^n$. This generalizes and proves the toral rank conjecture for actions with formal orbit spaces., Comment: minor upgrades, references added

TLS 1.3 marks a significant departure from previous versions of the Transport Layer Security protocol (TLS). The new version offers a simplified protocol flow, more secure cryptographic primitives, and new features to improve performance, among other things. In this paper, we conduct the first study of TLS 1.3 deployment and use since its standardization by the IETF. We use active scans to measure deployment across more than 275M domains, including nearly 90M country-code top-level domains. We establish and investigate the critical contribution that hosting services and CDNs make to the fast, initial uptake of the protocol. We use passive monitoring at two positions on the globe to determine the degree to which users profit from the new protocol and establish the usage of its new features. Finally, we exploit data from a widely deployed measurement app in the Android ecosystem to analyze the use of TLS 1.3 in mobile networks and in mobile browsers. Our study shows that TLS 1.3 enjoys enormous support even in its early days, unprecedented for any TLS version. However, this is strongly related to very few global players pushing it into the market and sustaining its growth.

The vast amount of processing power and memory bandwidth provided by modern Graphics Processing Units (GPUs) make them a platform for data-intensive applications. The database community identified GPUs as effective co-processors for data processing. In the past years, there were many approaches to make use of GPUs at different levels of a database system. In this Internal Technical Report, based on the [1] and some other research papers, we identify possible research areas at LIP6 for GPU-accelerated database management systems. We describe some key properties, typical challenges of GPU-aware database architectures, and identify major open challenges., Comment: 7 pages, 4 tables

Digital holographic microscopy is an emerging potentially low-cost alternative to conventional light microscopy for micro-object imaging on earth, underwater and in space. Immediate access to micron-scale objects however requires a well-balanced system design and sophisticated reconstruction algorithms, that are commercially available, however not accessible cost-efficiently. Here, we present an open-source implementation of a lens-less digital inline holographic microscope platform, based on off-the-shelf optical, electronic and mechanical components, costing less than $ 190. It employs a Blu-Ray semiconductor-laser-pickup or a light-emitting-diode, a pinhole, a 3D-printed housing consisting of 3 parts and a single-board portable computer and camera with an open-source implementation of the Fresnel-Kirchhoff routine. We demonstrate 1.55 {\mu}m spatial resolution by laser-pickup and 3.91 {\mu}m by the light-emitting-diode source. The housing and mechanical components are 3D printed. Both printer and reconstruction software source codes are open. The light-weight microscope allows to image label-free micro-spheres of 6.5 {\mu}m diameter, human red-blood-cells of about 8 {\mu}m diameter as well as fast-growing plant Nicotiana-tabacum-BY-2 suspension cells with 50 {\mu}m sizes. The imaging capability is validated by imaging-contrast quantification involving a standardized test target. The presented 3D-printable portable open-source platform represents a fully-open design, low-cost modular and versatile imaging-solution for use in high- and low-resource areas of the world., Comment: 14 pages, 5 figures