Secure Software Updates Disappointments and New Challenges Anthony - - PowerPoint PPT Presentation

▶
secure software updates
SMART_READER_LITE
LIVE PREVIEW

Secure Software Updates Disappointments and New Challenges Anthony - - PowerPoint PPT Presentation

Apr 02, 2023 179 likes •328 views

Secure Software Updates Disappointments and New Challenges Anthony Bellissimo Kevin Fu John Burgess kevinfu@cs.umass.edu Department of Computer Science University of Massachusetts at Amherst, USA http://prisms.cs.umass.edu/ USENIX Hot

slide-1
SLIDE 1

Computer Science

USENIX Hot Topics in Security Workshop

Department of Computer Science University of Massachusetts at Amherst, USA http://prisms.cs.umass.edu/

Kevin Fu

kevinfu@cs.umass.edu

Secure Software Updates

Disappointments and New Challenges Anthony Bellissimo John Burgess

slide-2
SLIDE 2

Secure Software Updates

Computer Science

Observations and Beliefs

  • Software updates are susceptible to MITM
  • Easy to address in centralized scenarios
  • Difficult to deploy in standalone apps
  • Updating embedded devices trickier
  • Unconventional constraints and threats
  • New risks
slide-3
SLIDE 3
slide-4
SLIDE 4

Unsigned updates rampant

slide-5
SLIDE 5

Millions update every day

slide-6
SLIDE 6

Additional info on http://www.cs.umass.edu/~kevinfu/secureupdates/

slide-7
SLIDE 7

http://business.bostonherald.com/technologyNews/view.bg?articleid=148707 http://www.cert.org/kb/vul_disclosure.html

slide-8
SLIDE 8

Secure Software Updates

Computer Science

Survey of Update Security

slide-9
SLIDE 9

Automotive Updates

http://www.soultek.com/clean_energy/hybrid_cars/toyota_prius_hybrid_car_shut_down_or_stall_problems.htm

slide-10
SLIDE 10

Updates in Voting Machines

http://www.nytimes.com/2006/05/12/us/12vote.html?ex=1305086400&en=1b3554af6e2d524a&ei=5088&partner=rssnyt&emc=rss

slide-11
SLIDE 11

Implanted medical devices use updates too

How long until computer viruses can infect humans? “Help! My heart is infected and is launching a DDoS on my pancreas.”

slide-12
SLIDE 12

Software overdose

http://www.fda.gov/cdrh/recalls/recall-082404b-pressrelease.html

slide-13
SLIDE 13

Embedded Medical Software

fda.gov

slide-14
SLIDE 14

Secure Software Updates

Computer Science

What Next?

  • Sign conventional updates
  • Why didn’t the research transfer to reality?
  • Little guys suffer the most
  • Secure updates as an operating system service
  • Updating embedded devices
  • No user interface, but ubiquitous
  • Limited network, power, computation
  • Threat model? Why would anyone attack this?